Apple Platform Deployment
- Welcome
- Intro to Apple Platform Deployment
- Whats New for IT at WWDC26
-
Plan the deployment
-
Intro to device management
- Declarative device management
- Device management
- About device supervision
- Choose a deployment model
- Device enrolment methods
- Deploy Apple TV
- Deploy Apple Vision Pro
- Deploy Apple Watch
- Deploy shared devices
- Choose a device management service
- Device management migration
- Back up and restore managed devices
- Use standards-based services
-
Intro to device management
-
Prepare your environment
- Deploy devices with Apple School Manager or Apple Business
- Use Apple Configurator
- Configure your network for device management
- Configure devices to work with APNs
- Configure devices with mobile data connections
- Prepare your Wi-Fi networks
- Speed up downloads
-
Use identity services
- Intro to Apple identity services
- Extensible Single Sign-on on Apple devices
- Integrate Apple devices with Microsoft services
- About Managed Apple Accounts
- Review the setup process
- Device management configuration options
- Manage software updates
- Distribute content
- Integrate with networks
-
Ensure device security
- Intro to device management security
- Background Security Improvements
- Lock and locate devices
- Erase devices
- Activation Lock
- Manage accessory access
- Enforce password policies
- Use persistent tokens
- Use built-in network security features
- Managed Device Attestation
- Manage certificates
-
Smart card integration
- Intro to smart card integration
- Smart card support on iPhone and iPad
- Smart card support on Mac
- macOS system security
-
Device management settings
-
Declarative configurations and status reports
- Declarative status reports
- Declarative app configuration
- Authentication credentials and identity asset declaration
- Background task management declarative
- Calendar declarative configuration
- Certificates declarative configuration
- Contacts declarative configuration
- Exchange declarative configuration
- Google Accounts declarative configuration
- LDAP declarative configuration
- Legacy interactive profile declarative configuration
- Legacy profile declarative configuration
- Mail declarative configuration
- Maths and Calculator app declarative configuration
- Managed Migration Assistant declarative configuration
- Passcode declarative configuration
- Passkey Attestation declarative configuration
- Safari browsing management declarative configuration
- Safari extensions management declarative configuration
- Screen Sharing declarative configuration
- Service configuration files declarative configuration
- Software Update declarative configuration
- Software Update settings declarative configuration
- Storage management declarative configuration
- Subscribed Calendars declarative configuration
-
Device management lists
- Device management service enrolment information
- Device management payload lists
- Device management restriction lists
- Device management command lists
- Device management query lists
-
Device management payload settings
- Accessibility payload settings
- Active Directory Certificate payload settings
- AirPlay payload settings
- AirPlay Security payload settings
- AirPrint payload settings
- App Lock payload settings
- Associated Domains payload settings
- Automated Certificate Management Environment (ACME) payload settings
- Autonomous Single App Mode payload settings
- Calendar payload settings
- Mobile payload settings
- Mobile Private Network payload settings
- Certificate Preference payload settings
- Certificate Revocation payload settings
- Certificate Transparency payload settings
- Certificates payload settings
- Conference Room Display payload settings
- Contacts payload settings
- Content Caching payload settings
- Directory Service payload settings
- DNS Proxy payload settings
- DNS Settings payload settings
- Fonts payload settings
- Domains payload settings
- Energy Saver payload settings
- Exchange ActiveSync (EAS) payload settings
- Exchange Web Services (EWS) payload settings
- Extensible Single Sign-on payload settings
- Extensible Single Sign-on Kerberos payload settings
- Extensions payload settings
- FileVault payload settings
- Finder payload settings
- Firewall payload settings
- Fonts payload settings
- Global HTTP Proxy payload settings
- Google Accounts payload settings
- Home Screen Layout payload settings
- Identification payload settings
- Identity Preference payload settings
- Kernel Extension Policy payload settings
- LDAP payload settings
- Lights Out Management payload settings
- Lock Screen Message payload settings
- Login Window payload settings
- Managed Login Items payload settings
- Mail payload settings
- Network settings
- Network Usage Rules payload settings
- Notifications payload settings
- Parental Controls payload settings
- Passcode payload settings
- Printing payload settings
- Privacy Preferences Policy Control payload settings
- Relay payload settings
- SCEP payload settings
- Security payload settings
- Setup Assistant payload settings
- Single Sign-on payload settings
- Smart Card payload settings
- Subscribed Calendars payload settings
- System Extensions payload settings
- System Migration payload settings
- Time Machine payload specifics
- TV Remote payload settings
- VPN device management settings
- Web Clips payload settings
- Web Content Filter payload settings
- LDAP payload settings
-
Declarative configurations and status reports
- Additional resources
- Glossary
- Document revision history
- Copyright and trademarks
[]![[]](https://help.apple.com/assets/6A0B5225AE238D20F4001D7E/6A0B522FA0E25B8C7409A3FE/en_GB/312766e3df7f57c1f549da2dab216b36.png){kind=link}
System Extensions device management payload settings for Apple devices
You can configure System Extensions settings for users of a Mac that enrols in a device management service. Installing or removing this payload can change the state of system extensions on the Mac. If a containing app activates a system extension, and the system extension is in a pending state, installing a payload that allows the extension completes the activation process. If a system extension is active, removing a payload that allows the extension deactivates that extension.
The System Extensions payload supports the following. For more information, see Payload information.
Supported approval method: Requires user approval.
Supported installation method: Requires a device management service to install.
Supported payload identifier: com.apple.system-extension-policy
Supported operating systems and channels: macOS device.
Supported enrolment methods: Device Enrolment, Automated Device Enrolment.
Duplicates allowed: True more than one System Extensions payload can be delivered to a device.
You can use the settings in the table below with the System Extensions payload.
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Allowed system extensions | The list of system extensions approved for the Mac. | Yes | |||||||||
Allowed system extension types | A dictionary that maps a team identifier to an array of strings, where each string is a type of system extension you can install for that team identifier. If there is no entry for a specified team identifier in the dictionary, the system allows all extension types. | No | |||||||||
Allowed team identifiers | An array of team identifiers that defines valid, signed system extensions that are allowable to load. Approved system extensions are those signed with any of the specified team identifiers. | No | |||||||||
Allow user overrides | Restricts users from approving additional system extensions that configuration profiles dont explicitly allow. | No | |||||||||
Note: Each device management service developer implements these settings differently. To learn how System Extensions settings are applied to your devices, consult your developers device management service documentation.