App settings declarative configuration for Apple devices
Use the App settings configuration to control which apps and binaries a device allows or denies, and to set default privacy permissions for apps. You can allow or deny apps by bundle ID, allow or deny binaries by their signing information, and predefine how apps can access services such as the camera, microphone, and location.
This declaration can be used to deploy the following apps to devices: App Store apps, Custom Apps, unlisted apps, and proprietary in-house apps. The app configuration supports the following:
Minimum supported operating system versions and channels: iOS 27, iPadOS 27, Shared iPad user, macOS 27 device, macOS 27 user, tvOS 27, visionOS 27.
Requires supervision: Yes.
Supported enrollment methods: Automated Device Enrollment.
App settings
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Allowed apps | The dictionary of allowed app settings. See the Allowed apps settings. | No | |||||||||
App privacy | The dictionary of app settings. See the App privacy settings. | No | |||||||||
Allowed apps settings
Setting | Description | Required |
|---|---|---|
Allowed apps | If present, the device only shows or launches apps with bundle IDs in the list. Include the value | No |
Allowed binaries | If present, the device only allows binaries that match the binary identifier properties to run. The device always runs system critical processes. | No |
Always allow managed apps | If turned on, the device implicitly includes managed apps in the effective allow list when Allowed binaries is present. | No |
Denied apps | If present, the device prevents showing or launching apps with bundle IDs in the list. Include the value | No |
Denied binaries | If present, the device doesn’t allow binaries that match the binary identifier properties to run. | No |
App privacy settings
Setting | Description | Required |
|---|---|---|
App privacy permission defaults | The dictionary of app privacy permission defaults. Each key in the dictionary is an app identifier. The dictionary values represent the permission defaults that the device applies for each matching app. In iOS and iPadOS, the app identifier is a bundle ID, for example, “ In macOS, the app identifier is a composed identifier. The format of the composed identifier is “ | No |
App privacy permission default settings
Setting | Description | Required |
|---|---|---|
Accessibility permission | Controls whether an app privacy permission default for accessibility is set. | No |
Bluetooth permission | Controls whether an app privacy permission default for Bluetooth access is set. | No |
Camera permission | Controls whether an app privacy permission default for camera access is set. | No |
Dictation permission | Controls whether an app privacy permission default for dictation is set. | No |
Local network permission | Controls whether an app privacy permission default for local network access is set. | No |
Location accuracy permission | Controls whether an app privacy permission default for location accuracy is set. | No |
Location permission | Controls whether an app privacy permission default for location access is set. | No |
Microphone permission | Controls whether an app privacy permission default for microphone access is set. | No |
Organization justification | Text you provide that clearly explains to the user the reason why the organization requires these app permission defaults. The device includes this text in the permission consent prompt it displays when it launches the app. | Yes |
Note: Not all configurations and their settings are available in all device management services. Each device management service developer implements these settings differently. To learn which settings are available for your devices, consult your developer’s device management service documentation.