Apple Platform Deployment
- Welcome
- Intro to Apple Platform Deployment
- What’s new
-
-
- Declarative status reports
- Declarative app configuration
- Accessibility declarative configuration
- Apple Intelligence declarative configuration
- App settings configuration
- Audio accessory declarative configuration
- Authentication credentials and identity asset declaration
- Background task management declarative
- Calendar declarative configuration
- Certificates declarative configuration
- Contacts declarative configuration
- Content caching declarative configuration
- DNS settings declarative configuration
- DNS proxy declarative configuration
- Exchange declarative configuration
- Extensible SSO declarative configuration
- External intelligence declarative configuration
- Google Accounts declarative configuration
- Keyboard declarative configuration
- LDAP declarative configuration
- Legacy interactive profile declarative configuration
- Legacy profile declarative configuration
- Mail declarative configuration
- Math and Calculator app declarative configuration
- Managed Migration Assistant declarative configuration
- Network relay declarative configuration
- Packages declarative configuration
- Passcode declarative configuration
- Passkey Attestation declarative configuration
- Safari bookmarks declarative configuration
- Safari browsing management declarative configuration
- Safari extensions management declarative configuration
- Screen Sharing declarative configuration
- Service configuration files declarative configuration
- Siri declarative configuration
- Software Update declarative configuration
- Software Update settings declarative configuration
- Storage management declarative configuration
- Subscribed Calendars declarative configuration
- Web content filter plugin declarative configuration
-
-
- Accessibility payload settings
- Active Directory Certificate payload settings
- AirPlay payload settings
- AirPlay Security payload settings
- AirPrint payload settings
- App Lock payload settings
- Associated Domains payload settings
- Automated Certificate Management Environment (ACME) payload settings
- Autonomous Single App Mode payload settings
- Calendar payload settings
- Cellular payload settings
- Cellular Private Network payload settings
- Certificate Preference payload settings
- Certificate Revocation payload settings
- Certificate Transparency payload settings
- Certificates payload settings
- Conference Room Display payload settings
- Contacts payload settings
- Content Caching payload settings
- Directory Service payload settings
- DNS Proxy payload settings
- DNS Settings payload settings
- Dock payload settings
- Domains payload settings
- Energy Saver payload settings
- Exchange ActiveSync (EAS) payload settings
- Exchange Web Services (EWS) payload settings
- Extensible Single Sign-on payload settings
- Extensible Single Sign-on Kerberos payload settings
- Extensions payload settings
- FileVault payload settings
- Finder payload settings
- Firewall payload settings
- Fonts payload settings
- Global HTTP Proxy payload settings
- Google Accounts payload settings
- Home Screen Layout payload settings
- Identification payload settings
- Identity Preference payload settings
- Kernel Extension Policy payload settings
- LDAP payload settings
- Lights Out Management payload settings
- Lock Screen Message payload settings
- Login Window payload settings
- Managed Login Items payload settings
- Mail payload settings
- Network Usage Rules payload settings
- Notifications payload settings
- Parental Controls payload settings
- Passcode payload settings
- Printing payload settings
- Privacy Preferences Policy Control payload settings
- Relay payload settings
- SCEP payload settings
- Security payload settings
- Setup Assistant payload settings
- Single Sign-on payload settings
- Smart Card payload settings
- Subscribed Calendars payload settings
- System Extensions payload settings
- System Migration payload settings
- Time Machine payload settings
- TV Remote payload settings
- Web Clips payload settings
- Web Content Filter payload settings
- Xsan payload settings
-
- Glossary
- Document revision history
- Copyright and trademarks
Lights Out Management device management payload settings for Apple devices
You can configure Lights Out Management settings to remotely start, shut down, and restart the following after they enroll in a device management service:
Mac mini (M6 2026) with a 2.5Gbps or 10Gbps Ethernet card
Mac mini (M5 Pro 2026) with a 2.5Gbps or 10Gbps Ethernet card
Mac Pro (2023)
Mac Pro (Rack, 2023)
Mac Studio (2022) or later models
Mac mini (2020) with a 10Gbps Ethernet card or later models
Mac Pro (2019)
Mac Pro (Rack, 2019)
The device management service sends the Lights Out Management command to the Mac (acting as the Controller). The Mac acting as a Controller in turn sends the command to another configured Mac (acting as the Device), as specified in the payload, using a secured and proprietary protocol. All Mac computers acting as Controllers or Devices:
Need to have macOS 11 or later
Need to be on the same local subnet and use Ethernet (communication is over IPv6)
Need to have the CA Certificate Trusts for a Device (If configured as a Controller)
Need to have the CA Certificate Trusts for Controller (If configured as a Device)
Need to be enrolled in the same device management service
Need to have the Lights Out Management payload installed
Don’t require a static IP address for communication
Communication between the device management service and the Controller uses Apple Push Notification service (APNs). Communication between the Controller and the Device computers uses TCP/IP (IPv6) and TLS. The certificates in the Lights Out Management payloads on each device encrypt this communication, and evaluate the communication using a proprietary protocol and mTLS.
Certificates
Certificates configured on Controllers or Devices for LOM communication can be included as PKCS #12 or issued using an SCEP payload. Each needs to include the following certificate specific configurations:
x509 Key Usage: Digital Signature, Key Encipherment and Data Encipherment
x509 Extended Key Usage: Server Authentication, Client Authentication
x509 Subject CN
x509 SubjectAltName, dNSName
If a Mac supports Lights Out Management, it can be both a Controller and a Device. You configure it by including the UUID of the device certificate payload for both ControllerCertificateUUID and DeviceCertificateUUID keys within the com.apple.lom payload.
The Lights Out Management payload supports the following. For more information, see Payload information.
Supported installation method: Requires a device management service to install.
Supported payload identifier: com.apple.lom
Supported operating systems and channels: macOS device.
Supported enrollment methods: Device Enrollment, Automated Device Enrollment.
Duplicates allowed: False—only one Lights Out Management payload can be delivered to a device.
You can use the settings in the table below with the Lights Out Management payload.
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Configures a device for LOM. | Yes | |||||||||
Controller certificate | The certificate for the LOM controller. | If the Mac is being used as a Controller. | |||||||||
Device certificate | The certificate for the LOM device. | If the Mac is being used as a Device. | |||||||||
Controller CA certificate | The CA certificate for the controller. | If the Mac is being used as a Device. | |||||||||
Device CA certificate | The CA certificate for the device. | If the Mac is being used as a Controller. | |||||||||
Note: Each device management service developer implements these settings differently. To learn how various Lights Out Management settings are applied to your devices, consult your developer’s device management service documentation.