AppSettings

Discussion

Specify com.apple.configuration.app.settings as the declaration type.

Binary identifier rules

The following combinations of binary identifiers are supported for each key:

• AllowedBinaries:

  • Either CDHash or TeamID needs to be present.

  • SigningID, PathPrefix, or SigningState may be present.

• DeniedBinaries:

  • Either CDHash or TeamID or SigningID needs to be present.

  • PathPrefix or SigningState may be present.

Privacy permission defaults

Privacy permission defaults allow an organization to suggest a set of privacy permissions for use with an app. When set, the app displays a consent prompt listing all the configured defaults. If the user accepts, the device applies those defaults for the app. If the user declines, no defaults are set and the device prompts the user in the normal way when the app requires permission.

The consent prompt only shows permissions that the user hasn’t previously seen, and won’t appear if the user has seen all permissions. The user can choose from one of two options in the prompt:

• Allow: this option sets the app privacy permissions for the specified sub-systems (camera, microphone, and so on) to “Allow”. The device doesn’t prompt the user when the app uses the sub-system.

• Not Now: this option ignores the app privacy permission defaults for the specified sub-systems (camera, microphone, and so on). The device prompts the user in the normal way when the app uses the sub-system.

The user can change the app permission privacy settings in Settings.app if they choose.

Only AppKit-based apps on macOS support this feature.

Configuration availability

App privacy examples

{
    "Type": "com.apple.configuration.app.settings",
    "Identifier": "AF389B6F-5784-4DB6-BEFF-EA6D689BD4B0",
    "ServerToken": "A5CA3371-559E-44B4-B9ED-A0A7DFEC193A",
    "Payload": {
        "Privacy": {
            "PermissionDefaults": {
                "com.example.scanner": {
                    "OrganizationJustification": "This app is used for scanning work documents.",
                    "Camera": "Allow"
                },
                "com.example.on-site": {
                    "OrganizationJustification": "This app is used for video conferences while on-site with customers.",
                    "Camera": "Allow",
                    "Microphone": "Allow",
                    "Location": "WhileUsing",
                    "LocationAccuracy": "Precise"
                }
            }
        }
    }
}

{
    "Type": "com.apple.configuration.app.settings",
    "Identifier": "245E4CBC-021B-4DB0-9B30-25F581119A2A",
    "ServerToken": "D6472788-7568-4268-99CE-AD8AE114B28C",
    "Payload": {
        "Privacy": {
            "PermissionDefaults": {
                "com.example.scanner (ABCD1234)": {
                    "OrganizationJustification": "This app is used for scanning work documents.",
                    "Camera": "Allow"
                },
                "com.example.on-site {anchor apple generic}": {
                    "OrganizationJustification": "This app is used for video conferences while on-site with customers.",
                    "Camera": "Allow",
                    "Microphone": "Allow",
                    "Location": "WhileUsing",
                    "LocationAccuracy": "Precise"
                }
            }
        }
    }
}