Restrictions configuration (iOS device policy)

If you clear the checkbox, users can’t install alternative app marketplaces, and any alternative app marketplace already installed is disabled.

Note that alternative app marketplaces are only available in the European Union. The following requirements must be met:

• The country associated with the user’s Apple ID belongs to the European Union.
• The device is physically located in the European Union.

For details, see About alternative app marketplaces in the European Union.

Users can add App Clips.

If you clear the checkbox, any existing App Clips are removed.

Users can place or receive FaceTime video calls.

This setting only applies to supervised devices.

If the checkbox is cleared, users cannot dial by using voice commands when the device is locked by a password.

If the user has not configured a device password, voice dialing is always allowed.

Users must enter their Apple ID password to make any purchase.

If the checkbox is cleared, there is a brief grace period during which users can make subsequent purchases without having to enter their password again.

Users can add friends in Game Center.

This setting only applies to supervised devices.

Users can find people in the Find My app.

If you turn off both Allow Find My Device and Allow Find My Friends, the Find My app becomes unavailable.

Users can find devices in the Find My app.

If you turn off both Allow Find My Device and Allow Find My Friends, the Find My app becomes unavailable.

Allow restarting the device in recovery mode via USB from an unpaired host.

Warning: When you select this option, an unauthorized user can reset the iPhone or iPad to its factory settings without directly interacting with the device. All they need is a USB connection from the device to their computer.

Users can access Shared iPad without a password by tapping Guest on the sign-in page. This starts a temporary session.

When users sign out of a temporary session, all their data is deleted.

In a temporary session, users can’t edit account settings or sign in to Apple services.

The number of days that an update of iOS or iPadOS is delayed after its release date.

Enter a value from 0 (no delay) to 90.

This restricts the opening of documents with apps or accounts managed by Sophos Mobile, for example a corporate email account.

If users have an email account managed by Sophos Mobile and apps managed by Sophos Mobile on their devices, attachments from the managed email account can only be opened with managed apps.

In this way you can prevent corporate documents from being opened in unmanaged apps.

If you turn this setting off, the next two settings are disabled. Contacts from managed accounts can be shared with unmanaged apps.

This restricts the opening of documents with apps/accounts not managed by Sophos Mobile, for example a private email account.

If users have an email account and apps not managed by Sophos Mobile on their devices, attachments from the unmanaged email account can only be opened with unmanaged apps.

In this way you can prevent personal documents from being opened in managed apps.

This setting restricts sharing of clipboard content between managed and unmanaged apps and accounts, based on what you configured for sharing documents with the Allow documents to be shared only within managed apps/accounts and Allow documents to be shared only within unmanaged apps/accounts settings.

For example, when you turn on Allow documents to be shared only within managed apps/accounts, turning on this setting prevents users from pasting clipboard content from managed into unmanaged apps.

When you turn off both of the Allow documents ... settings, this setting has no effect.

If the checkbox is cleared, the iTunes Store is unavailable and its icon is removed from the Home screen. Users cannot preview, purchase or download content.

This setting only applies to supervised devices.

If the checkbox is cleared, the Safari web browser is unavailable and its icon is removed from the Home screen. This also prevents users from opening Web Clips.

This setting only applies to supervised devices.

If the checkbox is cleared, Safari does not auto-fill web forms with previously entered information.

This setting only applies to supervised devices.

In this field, you specify if Safari accepts cookies.

When you allow cookies, you can specify if only cookies from the current site, from previously visited sites, or from all sites are accepted.

Users can change settings related to their cellular plan.

This setting only applies to supervised devices.

Users can modify Personal Hotspot settings.

As an administrator, you can turn on Personal Hotspot with the Roaming/Hotspot configuration. See Roaming/Hotspot configuration (iOS device policy).

This setting only applies to supervised devices.

When you turn this setting off, users can’t use widgets from their iPhone apps on their Mac.

This setting only applies to supervised devices.

Users can back up their devices to iCloud.

This setting only applies to supervised devices.

Users can store documents and app configuration data in iCloud.

This setting only applies to supervised devices.

Users can upload photos to My Photo Stream.

Warning If you clear the checkbox to forbid My Photo Stream, this also removes existing photos shared via My Photo Stream from all devices. If there are no other copies of these photos, they are lost.

Users can use iCloud Keychain to synchronize passwords across their iPhones, iPads, and Macs.

If the checkbox is cleared, iCloud Keychain data is only stored locally on the device.

Users can use iCloud Private Relay.

iCloud Private Relay is an Apple service to hide IP addresses and browsing activities in Safari. iCloud Private Relay requires an iCloud+ subscription.

This setting only applies to supervised devices.

If the checkbox is cleared, users are not asked if they want to trust certificates that cannot be verified.

This setting applies to Safari and to Mail contacts and Calendar accounts.

The device uses iBeacon to discover AirPrint devices.

Warning If you allow this, malicious AirPrint devices can perform phishing attacks on network traffic.

Users can turn on the AutoFill Passwords setting, which lets them use saved password or credit card information in Safari or other apps.

If this checkbox is cleared, automatic suggestion of strong passwords is disabled as well.

Users must authenticate when using auto-fill.

This setting is only enforced on devices that support Face ID or Touch ID.

Apple-delivered advertising uses user information to serve ads that are more relevant to the user.

Users can turn off personalized ads with the Personalized Ads setting under Settings > Privacy > Apple Advertising.

If the checkbox is cleared, explicit music or video content is hidden in the iTunes Store. Explicit content is flagged by content providers, for example record labels, when listed on the iTunes Store.

This setting only applies to supervised devices.