NinjaOne Apple MDM: Custom Payload Examples

Topic

This article shows examples of custom payloads for NinjaOne Mobile Device Management (MDM) devices that can be used to add a mobile configuration to a NinjaOne policy and configure settings not available directly in NinjaOne.

Environment

NinjaOne Mobile Device Management (MDM)
Apple iOS
Apple iPadOS
Apple macOS

Description

Technicians with the appropriate MDM permissions can use custom payloads for Apple MDM devices to add a mobile configuration to a NinjaOne policy and configure settings not available directly in the NinjaOne UI.

Select a category to learn more:

Standard Format for Mobile Configuration Files
Payloads for iOS, iPadOS, & macOS
Certificates
- PKCS1 Certificate
- PKCS12 Certificate
Payloads for iOS and iPadOS
Additional Resources

Standard Format for Mobile Configuration Files

You will use mobile configuration files to create custom payloads, and Apple documentation defines the required top-level keys for these file types. Refer to TopLevel | Apple Developer Documentation (external link) for more information.

The following example shows the required keys and format for each Apple MDM mobileconfig file:

<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
…
</array>
<key>PayloadDisplayName</key>
<string>Profile Name</string>
<key>PayloadIdentifier</key>
<string>Profile.2DE4CC74-A880-402D-A9CF-6665C87FE12E</string>
<key>PayloadUUID</key>
<string>2DE4CC74-A880-402D-A9CF-6665C87FE12E</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>

This structure contains several required fields:

Field	Description
PayloadContent	This array of dictionaries defines each configuration payload sent to the device. Each `mobileconfig` must have a minimum of one payload dictionary defined within the `PayloadContent` array.
PayloadDisplayName	This is the name of the payload.
PayloadIdentifier	This identifier is unique among all MDM payloads sent to each device. A common practice is to use the format `[Name].[UUID]`. If you attempt to install two payloads with the same identifier on a device, the second payload will typically fail to install.
PayloadUUID	Use a unique Globally Unique Identifier (GUID) format string among all MDM payloads sent to each device. On a macOS, you can use the following command in Terminal to generate a random Universally Unique Identifier (UUID). `uuidgen`
PayloadType	This is a string that matches the payload's type. This field should always use the value Configuration or must match one of Apple’s defined payload types.
PayloadVersion	This is the payload version. You can update a payload without incrementing this field.

After you define the custom payload in a policy, you cannot change the PayloadIdentifier and PayloadUUID values. If you need to modify these values, you must first define a new custom payload and delete the old one.

The dictionaries within the PayloadContent array also have a very specific structure. You must include certain standard keys in each dictionary and keys unique to each PayloadType. Refer to Apple developer documentation (external link) for more information. Refer to the following code block to use the standard keys:

<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         … {keys specific to the PayloadType} …
         <key>PayloadDisplayName</key>
         <string>Restriction</string>
         <key>PayloadIdentifier</key>
         <string>Restriction.63FBE224-B91A-4030-8D19-0D8D8883C4B7</string>
         <key>PayloadUUID</key>
         <string>63FBE224-B91A-4030-8D19-0D8D8883C4B7</string>
         <key>PayloadType</key>
         <string>com.apple.applicationaccess</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
      </dict>
   </array>
   <key>PayloadDisplayName</key>
   <string>Profile Name</string>
   <key>PayloadIdentifier</key>
   <string>Profile.2DE4CC74-A880-402D-A9CF-6665C87FE12E</string>
   <key>PayloadUUID</key>
   <string>2DE4CC74-A880-402D-A9CF-6665C87FE12E</string>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
</dict>
</plist>

You must include the following fields for each dictionary within the PayloadContent array:

Field	Description
PayloadDisplayName	This is the human-readable name for the profile payload.
PayloadIdentifier	This identifier is unique among all MDM payloads sent to each device. A common practice is to use the format `[Name].[UUID]`. If you attempt to install two payloads with the same identifier on a device, the second payload will typically fail to install.
PayloadUUID	This GUID format string should be unique among all MDM payloads sent to each device. On a macOS, you can use the following command in Terminal to generate a random UUID. `uuidgen`
PayloadType	This is a string that matches the payload's type. It should always have the value Configuration or must match one of Apple’s defined payload types. Refer to Profile-Specific Payload Keys \| Apple Developer Documentation (external link) for more information about the defined payload types.
PayloadVersion	This is the payload version. You can update a payload without incrementing this field.

NinjaOne supports the following variables for custom payloads. NinjaOne will automatically replace the variable with the corresponding information from the device or assigned user:

Variable	Description
${device.location.name}	This is the device's assigned location name value.
${device.location.id}	This is the device's assigned location ID value.
${device.organization.name}	This is the device's organization's name value.
${device.organization.id}	This is the device's organization ID value.
${device.serialNumber}	This is the device's serial number value.
${device.id}	This is the device's GUID value (unique identifier).
${device.owner.email}	This is the device's assigned user email address value.
${device.owner.firstName}	This is the device's assigned user's first name value.
${device.owner.lastName}	This is the device's assigned user's last name value.
${device.owner.displayName}	This is the device's assigned user's display name value.

Payloads for iOS, iPadOS, and macOS

Notifications

You can use the Notifications payload to define the notification settings for one or more apps. Users cannot override these settings. Refer to Notifications | Apple Developer Documentation (external link) for more information.

You can modify the following keys to achieve your desired behavior:

Key	Description
NotificationSettings	This is an array of dictionaries, each defining the notification settings of an individual app. It contains all keys outside the top level. You can add more dictionaries to this key as needed to manage all desired apps. This field is required.
BundleIdentifier	This is the bundle ID of an individual app whose notification settings you manage. This field is required.
NotificationsEnabled	This Boolean field specifies whether notifications are turned on or off for this app. This field is required.
AlertType	Set to 0 for None, 1 for Temporary Banner, and 2 for Persistent Banner.
BadgesEnabled	Set whether badges are active.
CriticalAlertEnabled	Set whether to allow critical alerts to override Do Not Disturb and ringer settings.
GroupingType	Set to 0 for automatic grouping, 1 for grouping notifications from this app into a single group, and 2 for don’t group notifications.
PreviewType	Set to 0 for Always show previews, 1 for only show previews when a device is unlocked, and 2 for never show previews.
ShowInCarPlay	Set whether notifications show in CarPlay.
ShowInLockScreen	Set whether to show notifications on the lock screen.
ShowInNotificationCenter	Show notifications in the notification center.
SoundsEnabled	Activate sounds for notifications.

<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>NotificationSettings</key>
         <array>
            <dict>
               <key>BundleIdentifier</key>
               <string>com.ninjaone.assist</string>
               <key>NotificationsEnabled</key>
               <true/>
               <key>AlertType</key>
               <integer>2</integer>
               <key>BadgesEnabled</key>
               <true/>
               <key>CriticalAlertEnabled</key>
               <true/>
               <key>GroupingType</key>
               <integer>2</integer>
               <key>PreviewType</key>
               <integer>2</integer>
               <key>ShowInCarPlay</key>
               <true/>
               <key>ShowInLockScreen</key>
               <true/>
               <key>ShowInNotificationCenter</key>
               <true/>
               <key>SoundsEnabled</key>
               <true/>
           </dict>
           <dict>
               <key>BundleIdentifier</key>
               <string>com.apple.tips</string>
               <key>NotificationsEnabled</key>
               <false/>
           </dict>
        </array>
        <key>PayloadDisplayName</key>
        <string>Notifications</string>
        <key>PayloadIdentifier</key>
        <string>Notifications.8E87A542-1AF1-4DBF-B1FE-645044C84C64</string>
        <key>PayloadUUID</key>
        <string>8E87A542-1AF1-4DBF-B1FE-645044C84C64</string>
        <key>PayloadType</key>
        <string>com.apple.notificationsettings</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
      </dict>
   </array>
   <key>PayloadDisplayName</key>
   <string>Notifications</string>
   <key>PayloadIdentifier</key>
   <string>Notifications.C10A32DE-C782-4374-8D67-968EC168DD7A</string>
   <key>PayloadUUID</key>
   <string>C10A32DE-C782-4374-8D67-968EC168DD7A</string>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
</dict>
</plist>

Certificates

There are a few payloads you can use to transfer certificates to a device, such as the CertificatePKCS12 or the CertificatePKCS1 payload.

Generally speaking, you will use the PKCS12 payload for certificates that also contain a private key (you will specify the password used to access the private key within the payload) and the PKCS1 payload for certificates without a private key, primarily to ensure the device trusts the specified certificates.

We provide examples of each payload in this section.

PKCS1 Certificate

Use for certificates that do not contain the private key. Note the following key:

Key	Description
PayloadContent	This key contains the certificate file converted to base64. You can generate this key on a macOS with the command `base64 -i {path_to_cert_file}`.

<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>PayloadContent</key>
         <data>
         LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFakNDQWZxZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBREFuTVJnd0ZnWURWUVFEREE5VVpYTjAKUTJWeWRHbG1hV05oZEdVeEN6QUpCZ05WQkFZVEFsVlRNQjRYRFRJMU1ESXlNREU1TkRVd05Wb1hEVEkyTURJeQpNREU1TkRVd05Wb3dKekVZTUJZR0ExVUVBd3dQVkdWemRFTmxjblJwWm1sallYUmxNUXN3Q1FZRFZRUUdFd0pWClV6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU1KNHdJS1BBVXlWVXgyandtZUoKU0lSa0VCOUFLQXN3c2VhMnFMWUNTQlhlcmRxZE5SdDArdmdaQnN5T1lwUEY4TXQ0SEdXVVF3OVNEQ2pLQUl3MQovaFl5MDFrZDgrTUsvdnlXcExSNnhxTDZRQTBKajhnVlVid0JxbDBVanlCb3BabW1wMlZWbTlyYTNtRGpnNEFiCkttQkFIZjhldkJPRFBEZ3RaTm01Snk3MVBBelM3N3B3YjFINU4rUURJQy9uV1NLcTBSUjlNbXZZaTMzZUlJcngKT0hiZEN5dlBGMzEwd2Z1WUM1cGhxcU5oOGRLTUw3SnR2RXZVNHlzSzJoa0loTXYxQUhiM1ZIQisybEFWdjNnOQpoQ3FPbjVNd1VKMzNWNEZHWDN4OXhlVnZCSWlTK3F5MXFKSEdvZVJFbmVVZmN1Z2xUU2pNb1lwVUVSRU84QTMwCjJ3a0NBd0VBQWFOSk1FY3dEZ1lEVlIwUEFRSC9CQVFEQWdXZ01CWUdBMVVkSlFFQi93UU1NQW9HQ0NzR0FRVUYKQndNQk1CMEdBMVVkRGdRV0JCUWh3M3JDVTg2SmhPWWwrdDFrNlF6eXlFcmFDVEFOQmdrcWhraUc5dzBCQVFzRgpBQU9DQVFFQVNRM1dwVTdnZHZhMW05cXk4TFZOUlIralMzdHFBOE02T24rYXBNeTVkT0ZNQ3pjTWNhV2J2c2lSCmNCYVQxdXhxeFJMRmRBTUNtTWs1dW1vTGp1c3FJYjVCcVJlUzJFUVRmYm5MeThSV0lsSjM1K0VuUWNDRW9JWUcKWUhIWDY5ZWh2bFlITExaQ01BK21hTVhVYTlVNURMcy9WNG9UdWllVGZMeE0xOXlOT0dIS0VTbWl0QWNseFl3YgpMTUJoTGY1dmVXOW12ak9jc2lKblc0eWU3MVBtWG5oK2RhWFhoZzFJU0lHeEsyTkFvZFRzWFpRNm5iN200ZHNpCjdGVDRwcFFRcTllQWNJS1dSN3pTSVJMenZ6Wm8rSkRPeTltbVYyZVpYTjhIOFA2UVdlUTRoZmM0QW5RWGsxR1IKZmRGYzhKeUtSVktFcUM4UlE0WGR5UXE3RC9jZ2tBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
         </data>
         <key>PayloadDisplayName</key>
         <string>CertificateP1</string>
         <key>PayloadIdentifier</key>
         <string>CertificateP1.95B82EE6-B86D-4F00-A152-7CE20F2E2CD4</string>
         <key>PayloadUUID</key>
         <string>95B82EE6-B86D-4F00-A152-7CE20F2E2CD4</string>
         <key>PayloadType</key>
         <string>com.apple.security.pkcs1</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
      </dict>
   </array>
   <key>PayloadDisplayName</key>
   <string>CertificateP1</string>
   <key>PayloadIdentifier</key>
   <string>CertificateP1.33A95849-29DE-4F61-BBD5-D5D588B5D698</string>
   <key>PayloadUUID</key>
   <string>33A95849-29DE-4F61-BBD5-D5D588B5D698</string>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
</dict>
</plist>

PKCS12 Certificate

Use this payload for certificates that contain a private key and require a specified password to access it. Note the following keys:

Key	Description
AllowAllAppsAccess	If true, the system allows apps to access the private key.
KeyIsExtractable	If true, the user can extract the private key from the keychain.
Password	This is the password you use to access the certificate's private key.
PayloadContent	This key contains the certificate file converted to base64. Generate this on a macOS with the command `base64 -i {path_to_cert_file}`.

<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>AllowAllAppsAccess</key>
         <true />
         <key>KeyIsExtractable</key>
         <false />
         <key>Password</key>
         <string>ninjaone</string>
         <key>PayloadContent</key>
         <data>
         MIIJrwIBAzCCCXYGCSqGSIb3DQEHAaCCCWcEggljMIIJXzCCA+cGCSqGSIb3DQEHBqCCA9gwggPUAgEAMIIDzQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIsW3A0TlifRsCAggAgIIDoIXbmvjObzrxfQHvCTGlvRfjbsp2QozlINd/odcMfquKiFLFovXoYrNVbwhu9JGbAdRMAPrXAdCoSlLc7ocJjp0h1BCrQ067uQD5zQSJDZFORwMKPzPTThdM2/LzTXRWTRXDj0H5BA2IB9OkWimojLw6ufEPGmqRsxnosWUKYlxtRqv28IqEi11fySoGtKqrsMhmJkVH/c0rwM/35mxDTcLTMrp3tQ7O+DUjnpVosrJ5gHkyS2ZAFL1e4JAn6qC34YJVQ0+2MyRAJ85AEbOM5OO54oMZLB9C3QopkLHk1RkY0pwQ28wFRw3LEEDmnq2DBHelTZmIGje43E8Aea+FxZQOPgp9YbmD1p9MoXGsI5J5vNMPiyZfV32MrQHTKY5yutRd29lgGpJ6rt9fd4z0VOPkmbTLPT7qnWyGOuWS8tL023UaR5pNfsLQTB1EoP+PRw3aFL/HjEs6lnanbOEtLSx/jX06kK6LGrHihDbXs+RSvZzVoJDRCYBAhNSSSGPw5H4naI2nk+m4LHiDlFzigqZwfR836qrI/0nXEB6QmgT5aXBQjsN/y2Jjnv+fl4mBDDKrLJg4ucgXEELtlG8oOqViFYq4ESrvCijOwp775a3m+KBtAlMGMnK7I0X/KW/GvAwCh15Rj9u16vgLT+X0qyxPOgCrtmsxoo4xX/kKxqXwYAgh96tmnRNFsAsXtBVPo1XFHMEb6DzKfbyLztCfSb+IXk4HAx/4nvj2llMqmoePq3rhtRAHQmAYtM/pu7AgVqF5RpR7lJ8Q/0B6Sw7sNzOHnQFxCU60Ow/CA5Xhd4h8VQXvLvJYtGTnjmbx1dQ6VZmRkuMjT0thoq4IH6k6K1EBymucW8uSeJI3ahNXASsJw6sQZ8vp3HlzeQxlMBVSHF2vU1R4Z1ecbDN2sOWx/XUyYj8zE73RC4UYb/lUWDOoz2HrN7Ps10wJSSM/X2vkZbgqi9Xt53yb7r9m7bPsITBtJJnARZ0CcQCVhG4a1LhA1wASAzgbnoZKL1PuWEKKZ0yGqGPsE+tfi/J91T0wFecb6uiRBEMcsqlxN9Ev3axB6NkUtBpgY0T9dIrv1LoJOLTJNxxVk5/ek6JaP4gw6jZ9OT6uv1g5wXvo1Htvnc6tvGJ6ivWP2yU3Kfy7213dezUPTpKoEF5SUJtXwt9YONgkU7jEbeanrexbIX8mIpQCMbApY2GIjcIUSt0jvHdWTYxxhSU5b5w/nJGL9Pc6tygwggVwBgkqhkiG9w0BBwGgggVhBIIFXTCCBVkwggVVBgsqhkiG9w0BDAoBAqCCBO4wggTqMBwGCiqGSIb3DQEMAQMwDgQI5jsdKBP2aYcCAggABIIEyAD2wf+tWIu3BYMTihY1yHYoAfPjDzY1i2AAij4yQRcBgwvJHYw5+y+Lv7XSsBnCYM4RovycGRRI1jBb15nwcuZm+BK3Gco1syK84m2tN27PYapfezIKfAiRC/2V5jPs5vsAuRJLt8gz9i0JdUM0rk9gfHuf9TqPESXpJ9ux9WRBzYJivjdNceeC5PCXXv0wnpfoKc4xZZOEwZrUvHHmrX0aIQJqXuqTXBx0NWmrJVNkAixH0AzhJygMaGQfIqu9/svVaFUMd0+idJPc5re0TZssRIu/OcRyOyDo6JrjXr7PXd0n/KEltaFN4AIJP9MIpQxms8quCgfFfGWrr9laIaDD36lEDpt6liS6jTHXR4Y3pK0j4in1pOWCVA1ROhIhzNRBGxdUaJhlvxTTaHvZ2zYZlu4KnNdXkCwQKvGFcjmy3YhQsf/Eh/mEbu+5OtOCb1Wj9lBWuEsc80B+2koyZkAsGcF2pLbZYmvkWiEWd/4Ku63SkOt2kDeVVsHsPqdfJNH5J3rPFQYNrqm2ePbyOYRHOx6F76VMeH/y3At3dwMOtbqkd2Mi5JQ2i4ks4ZUCEfQuI2qKs+qUM7lj07YtXRHO/VcelIfjn511Q1t1Cvwn3MgM5VgwGuyWUZ6Kbyu+GHNz3GR2N42aIqcxgsArUpV8rOztuNucfVhwRIDtKUZ8DY8WQp0PtLyb/6syBfXuS4kuD397ZrG4GvLvoIrgqBNQourHLC9Rfm+Xy2V2wIth+KfGFaohkY1PqlUyqgELelcRUgybqNsTDK/78GgJjEk0c4HNVOd+635dvRuDNP0BCX9aqk1dbjCSlpsvZ7nlL9Qx1nEF+opWAHoot2Ft7Gb46S6TLr5XyOk4gG6y6mFsmaoM4ee8UOX10pWgvep8PxnuZG0mZJibfCT12NNlv5vKUeiF31fWEs34OR8J26WOAzAp/OmxwVxcX/MxyRoukO07TRW9AUAwwqXv6fDFpazSYAnbeh2ONin0eo2OUSyvBXZXkBmpiMhxN8VugBgcrcyYFq6nZKWR9ZwqpHQgd/zd8vcCGawU6gK2g6oHD3uIDQQ4BFC9JpltDZPRNey2Q+mzXeRrnuStp4YlrM54aef4E8ry1O6Ei/TYeESmhynAL1ekUvhwNP+eoO51a0bhXvKO8FQPlJKNWsurau+a2uGEkg2gTcilT8Ut7tmaE5OelMAes2W0xs/qzI2rQCFs84Bw26IBsNQeAXDZ3IkLjU6QFrllC6ahTAm2rtBDUo/OpLzu1FMW6kSMdRBb1flvWv1FhYWKqe2FR1ITQfuSYUeH1UwZ4DA9b02K40xP3r9WfXiSGIQ0wVHGuitTLQtD4obKNUpaHjt26yBtTX8lXhBPqhoEBIRLhXVty0+WIUNMNQJadP+4taWQci1RNaEcJ9VtmTM67D3yCkmFlMvJEUT8yeVwqujf1zKkjSf0G/rZu4FpsrH1+oHemCSnfal7zMuCuEmywr+Rr7eJMPaqqAzn6lba5PjdZ5MBmUq7vHbORTtZxGIbtztkfwz2nlJKegrwcjMER5sLoO4jS5nY4kToLM2Kvhwv/ljQtVLIlD1FWJYLoanO+jp2RIi8UxPpdD84zz/pmZOM6UwyRI3EgrncDH5/6MgQ+TFUMC0GCSqGSIb3DQEJFDEgHh4AVABlAHMAdABDAGUAcgB0AGkAZgBpAGMAYQB0AGUwIwYJKoZIhvcNAQkVMRYEFCHDesJTzomE5iX63WTpDPLIStoJMDAwITAJBgUrDgMCGgUABBQZO4cE2Hvkufizr9Qj7mzqz2iY2AQIRYe4ys20e4QCAQE=
         </data>
         <key>PayloadDisplayName</key>
         <string>CertificateP12</string>
         <key>PayloadIdentifier</key>
         <string>CertificateP12.D1351A32-C4B8-4B6E-B225-51E1CCB2AB8A</string>
         <key>PayloadUUID</key>
         <string>D1351A32-C4B8-4B6E-B225-51E1CCB2AB8A</string>
         <key>PayloadType</key>
         <string>com.apple.security.pkcs12</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
      </dict>
   </array>
   <key>PayloadDisplayName</key>
   <string>CertificateP12</string>
   <key>PayloadIdentifier</key>
   <string>CertificateP12.5530D661-D71D-4D04-8A79-4CB0F516D8EE</string>
   <key>PayloadUUID</key>
   <string>5530D661-D71D-4D04-8A79-4CB0F516D8EE</string>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
</dict>
</plist>

Payloads for iOS and iPadOS

Read the following subsections to learn about different custom payloads for iOS and iPadOS devices.

Kiosk mode (AppLock payload)

Use the AppLock payload to lock a device into a single app. Make sure to also deploy the app to the device in the NinjaOne policy, or else the device could be stuck in an unusable state until the AppLock payload is removed. Refer to AppLock | Apple Developer Documentation (external link) to learn more.

Note the following keys, which can be modified to achieve your desired behavior:

Key	Description
Identifier	This is the `bundleID` of the app you want to lock the device into. Make sure the app is deployed to the device.
Options	This is a dictionary of options that allow you to activate or deactivate various hardware behaviors or accessibility options.
UserEnabledOptions	By using the Accessibility Shortcut on your device (press the lock button three times), you can allow the user to modify certain accessibility settings.

<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>App</key>
         <dict>
            <key>Identifier</key>
            <string>com.ninjaone.assist</string>
            <key>Options</key>
            <dict>
               <key>DisableAutoLock</key>
               <false />
               <key>DisableDeviceRotation</key>
               <false />
               <key>DisableRingerSwitch</key>
               <false />
               <key>DisableSleepWakeButton</key>
               <false />
               <key>DisableTouch</key>
               <false />
               <key>DisableVolumeButtons</key>
               <false />
               <key>EnableAssistiveTouch</key>
               <false />
               <key>EnableInvertColors</key>
               <false />
               <key>EnableMonoAudio</key>
               <false />
               <key>EnableSpeakSelection</key>
               <false />
               <key>EnableVoiceOver</key>
               <false />
               <key>EnableZoom</key>
               <false />
               <key>EnableVoiceControl</key>
               <false />
            </dict>
            <key>UserEnabledOptions</key>
            <dict>
               <key>AssistiveTouch</key>
               <false />
               <key>InvertColors</key>
               <false />
               <key>VoiceOver</key>
               <false />
               <key>Zoom</key>
               <false />
               <key>VoiceControl</key>
               <false />
            </dict>
         </dict>
         <key>PayloadIdentifier</key>
         <string>com.apple.app.lock.0EB94448-30BA-4CDC-BB8D-6321F60F608E</string>
         <key>PayloadUUID</key>
         <string>0EB94448-30BA-4CDC-BB8D-6321F60F608E</string>
         <key>PayloadType</key>
         <string>com.apple.app.lock</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
      </dict>
   </array>
   <key>PayloadDisplayName</key>
   <string>Kiosk</string>
   <key>PayloadIdentifier</key>
   <string>Kiosk.3E0C188E-AC9E-4AAF-AF4B-943F980B6480</string>
   <key>PayloadUUID</key>
   <string>3E0C188E-AC9E-4AAF-AF4B-943F980B6480</string>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
</dict>
</plist>

Web Clips

You can use the WebClip payload to add icons to the device home screen that link directly to a specified webpage. Refer to WebClip | Apple Developer Documentation (external link) to learn more.

Each dictionary within the PayloadContent array will configure an individual web clip, but you can define multiple dictionaries to configure multiple web clips. Note the following keys, which you can modify to achieve your desired behavior:

Key	Description
Label	This is the label for the icon that will appear on the device.
URL	This is the exact URL that the user will navigate to when they tap the icon.
IsRemovable	This key allows you to determine whether the user can remove the icon from the home screen.
FullScreen	This key allows you to determine whether the webpage should appear in full screen or the browser navigation menu should be visible.
TargetApplicationBundleIdentifier	This optional key lets you specify the `bundleID` of a browser to use to launch the web clip. If not included, the device will use the default browser.
Icon	This is a base64-encoded string containing the contents of an image file to use as the icon. The device will use a default “blank” icon if it is not included. On a macOS, you can generate this string using the following command in Terminal: `base64 -i {path_to_icon}`

<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>Label</key>
         <string>N1</string>
         <key>URL</key>
         <string>https://www.ninjaone.com</string>
         <key>IsRemovable</key>
         <false />
         <key>FullScreen</key>
         <true />
         <key>Icon</key>
         <data>
         iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAACXBIWXMAACxKAAAsSgF3enRNAAARPklEQVR4nO3dv2tdZ57H8e8ZZTQoXGExAmOBF4ddZFiYxqqmknurmi3GaXabpErlNDNNXLnabSbNTJU0W8XNbuX08R8gN4EBmyxjJiAj8ODgy5iIEWeLE41/jOxYV1f3nHs/rxeI2EpiPxLYz/s8z3nOaX76y1+3BQBE+UnfAwAAZk8AAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAwNvYWO57BABT9U7fA4BB216r9v3zVVXVfHS/58EATI8AgOPsrFf74UbVhR+u/O+N+x0PwJQJADgyWuom/vfPP5/4ARaUAIDRUjfpXz/fRQBAAAFAro3laq+fr9pZN/H/mK3V5z/eXKl29ZXv18Zy1cbPjv9/976v2jt46VPN08OqB8+ef2L36ZQGCrwtAUCejeVuf//aet8jGY7NlarVd6rdGnUxdPnd7p+bK6f/ta+M/uFT7ev+2wfPqsaHVff/WjU+rGZ3XPX0by/HAjAVAoAcW6vV7vzcxL+12l3FX16p2nx3OpP8tByN5YdoaD944d/dG1ftfV/N/WfdioEogFMRACy+rdXuiv+YK9GFN1rqvv6tUXdVP8/fgyujqiujaq+98Ll746rdp91KgW0EOBEBwOLaWe/2+Id0hTsLmyvVXl2r2l5b/K/9KAo+qG7rYHdczd0nXQy8ct8B8DIBwOJ59Qx/gu21aq+e6yb91BsaR0tV2+eq3T7X/fzBs2ruPK66+0QMwDEEAIvh6CjfznrOxH90T0PypP8mmyvV3rhYdeNiFwO396u+etKtFADV/PSXv37tDbkweLM6w39vPIxHAW8sV7uznhU60/bl42ru/MU9A8SzAsB8SjvKt7Xa3c9wtLzN5K6tV3tt/fmqwJ3HfY8IeiEAmC9pE3/i/QyzsrlS7SeXqj7cqOaLH0LA9gBBBADzIekon0cTz9aF5e5egQ83qm7vdzEgBAggABg2Ez+zMlqq+mCj2p31aj7bszXAwhMADFPa0vf1893Xa+Lv34Xl51sDtx66WZCFJQAYjtFS1dW1rIl/e63ajy/mfL3z5MJytb/frLr7XTWf/tmzBFg4AoD+JS59b65U+/E/ZWxtzLvtc9Vujbptgdv7fY8GpkYA0J+jM+1JE/9R7Hyw0fdIOInRUnej4M56Nbf+5EVELAQBwOylHeU7srVa7c1Llvvn2eZKtf/9r9V8+q3VAOaeAGB2Ul/HO1rqguf6+b5HwpS0Ny5WXV2r5jffODLI3BIAnL2ko3yv2lyp9r/+xVX/IroyqvZ/f1HNb//PSQHmkgDg7Oysd3v8iRN/VXe078bFvkfBWRotVfv7TVsCzCUBwPSlneF/1Wip2pvveW5/kPbGxarLK9X87ltbAswNAcB0jJa6if/987kTf1W35H/zvarNlb5HwqxdW692893urZEigDkgADidxDP8r7O1Wu1//rPvQ7LNle6+gI/uOyrI4AkAJnN0lG97zYRX1a1+fHKp71EwBKOlav9wWQQweAKAk0k9w/8G7Y2LjvjxsqMIuPWw6u6TvkcDx/pJ3wNgjuysV/s/vzD5v6C9ecnkz/FGS92W0I4/LwyTAOCttRvBN/cdo715SQzxo9pPLokABkkAwARM/pyECGCIBACckMmfSbSfXHI8lEERAHACJn9Oo/3DZRHAYAgAeEsmf05ttNS9G8LRWQZAAMDb2Fwx+TMdF5a7lQDomQCAt+GKjWnaXPGiKHonAAD6cP189yRN6IkAAOhJe/NSledr0BMBANCXo1dHQw8EAECfrow8TppeCACAnrUfbtgKYOYEAEDfbAXQAwEAMARXRk4FMFMCAGAg2o8veuYEMyMAAIbiwnK177shkNkQAABDcv28VQBmQgAADMloqdsKgDMmAACG5tq6Y4GcOQEAMEDthxt9D4EFJwAAhsgqAGdMAAAMlFUAzpIAABiq7TUnAjgzAgBgqEZLngvAmREAAEO2s973CFhQAgBgyC4siwDOhAAAGLhWAHAGBADA0F0ZORLI1AkAgDlgFYBpEwAA80AAMGUCAGAeXFiu2lrtexQsEAEAMCfanZ/3PQQWiAAAmBfba32PgAUiAICq8WHVvXH38eBZ36PhdUZLIoCpeafvAQBn6NFB1d5B1e7Tap4ePp/cd5+e7NfZXKlafadqY7najR/2ojeWu31pZqq9eq6au0/6HgYLQADAIrk37ib73fHJJ/k3eWFVoKmqqr3uJ6Olqq3VardGXRRsrkzv9+R4bgRkSgQAzLNHB1VfPekm/D6uCseHVXefPL8i3Viu2l7rzqyLgbNxYbn73tqq4ZQEAMyjLx9X89V3/Uz6b7J3UHV7v5rb+912wfXz3fl1r7SdqvbqWjUCgFMSADAvHh1U3XlczRf73ZX30O0dVPPpt1Wf7XWvtL1+XghMy/Za1Wd7fY+COScAYOgeHVTz2V7Vncd9j2Qy48Nu/F/sdyHwwUbfI5p/mytdTM1DCDJYjgHCUI0Pqz7fq+ZXX8/v5P+iH0Kg+bevu5sVOR03A3JKAgCG6MvH1fzq6+7KedHsHVTz0f1ue8AV7MTaq+f6HgJzzhYADMmjg2puPZzuEb6hur1fze7Tam++58TAJKwAcEpWAGAo7n5Xzb//MWPyP/LgWTUf3bclMIkLy26q5FQEAAxA8+m31fz2m8wl8fFhFwFfLsB9DrNmFYBTEADQp/FhNf/xx6rb+32PpHfNrYci4ITarVHfQ2COCQDoy9Hytwe6/J0IOKHL7/Y9AuaYAIA+mPxfq7n10PflbV2xAsDkBADM2tHkn7jf/5aaj+53Tz7kxzlBwYQEAMySyf/tjA+r+c03fY9iPtgGYEICAGbl6G53k//befCse1gQb9RaAWBCAgBmweQ/mdv7nhHwY6wAMCEBADPQfPqtG9sm1Nz6U99DGDYrAExIAMBZu72/GC/z6cveQdXnC/hOhGkZLVVtLPc9CuaQAICzZB97Kpov9m2fvMnGz/oeAXNIAMAZsnw9JeNDIfUmtgGYgACAs/L5nn3/abrz2CrAa7S2AJiAAICz8Oigms/sW0+ddyYcz0kAJiAA4Aw0tx72PYSF1HwhAI5lBYAJCACYtnvjqt2nfY9iMY0PvSzoOBcEACcnAGDKLP2frebOX/oewjBZBeCEBABMk6v/s7f71IuCjuMoICckAGCKXP3PyFdP+h7B8IyW+h4Bc0YAwLQ8eObqf0YaT1b8B+1lzwLgZAQATEnjiNrsPHhmGwBOSQDANIwPPe9/1qy2vGxrte8RMGcEAEzDXXvSs9bsek0wnIYAgCnwgJoeWAGAUxEAcFqPDjzzvw97B+4DeNGVUd8jYM4IADgtR9L6YxUAJiYA4JSau9/1PYRYzX0rLzApAQCnMT50FdonWy8v8zhgTkAAwGm4E71f9//a9wiGxeOAOQEBAKfQuPrv1/iw+wBOTADAaQiA/tkGgIkIAJjU+NDkMwR73/c9AphLAgAmZfIfhj3PAvg7bwTkBAQATMry/yA0T90DcMQbATkJAQATcgZ9IKzEwEQEAEzK3jMwxwQATMqV5zB4FgBMRADAJEz+w+E5ADARAQCTMOkAc04AwCQsOwNzTgDAJKwADMsjzwKAkxIAMAFHAAfGw4DgxAQATMIKADDnBAAABBIAMAmPAQbmnAAAgEACAAACCQAACCQA4KQ8BhhYAAIATsoRQGABCAAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAg0Dt9D4D50dx5XLU77nsY/Xv6t75HwCua3/25atVfZ7X3fd8jYI74E8Pb2zvoPmBoHjzrewQwd2wBAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAECg/wdsqOIF108fkQAAAABJRU5ErkJggg==
         </data>
         <key>PayloadDisplayName</key>
         <string>N1</string>
         <key>PayloadIdentifier</key>
         <string>N1.E935A83C-30E0-4F4F-A04B-6CF1B900714D</string>
         <key>PayloadUUID</key>
         <string>E935A83C-30E0-4F4F-A04B-6CF1B900714D</string>
         <key>PayloadType</key>
         <string>com.apple.webClip.managed</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
      </dict>
      <dict>
         <key>Label</key>
         <string>Apple</string>
         <key>URL</key>
         <string>https://www.apple.com</string>
         <key>IsRemovable</key>
         <false />
         <key>FullScreen</key>
         <true />
         <key>TargetApplicationBundleIdentifier</key>
         <string>com.apple.mobilesafari</string>
         <key>Icon</key>
         <data>
         iVBORw0KGgoAAAANSUhEUgAAAOEAAADhCAMAAAAJbSJIAAAAflBMVEX///8AAAD39/f6+vrw8PBKSkoqKirz8/MdHR3p6elVVVUUFBT5+flhYWGxsbHb29uqqqri4uIwMDB8fHyZmZlNTU3FxcXJyclpaWk5OTkkJCS8vLyenp6CgoLV1dU+Pj6Kiopvb2+Hh4ekpKQWFhZ0dHQLCwuSkpJERERbW1vBTkBRAAAJiklEQVR4nO2dh5qqMBBGI6AIKogNEcVl7e//gteyxV2ZSSZEMu53/wcAj6RMpkW0WGrfHbXn41PPwKOEgWeYVnYaR7E4yxsYeBo7wk45SR1xkzM38EBmhO1D7okv/T3C4zLuC/F3CTubxBU/5P8twoPzi++PrTRh/BvvrCQ08GQehOvhw/e7qDgaeDYLwl1RxSfELDPwcA6EE68aUEQLA0+3T9iJKkfoRRsTz7dOOE0hPiEOJl5gm/BUtYZ+yBubeINlwspN4lOxic3CMiH2Bc9LadfEO6wSol9QiKGRl9gkHAHboNFpaJUwRwFFPDLyFouESxxQ5GZeY49w7OOAjplBao9wmkg+YbI38yJbhD3JJDRksrXsEa4kY1T0O4beZInwiG8Uwtg6Y4twK1tHhTBx+L3KDuE0aOwTWiKUfsK+EaP7KiuEHdkyIzYmIhY3WSGUfsJkau5lNgj3MkD3zeDbbBC+yQiN+Ng+ZYMQPxUKEZhw5n/JAuG8jwO6S6Ovs0Aos0hTI86LLzVP2JUMUs+EG/hOzRPuIA/3TX0zJ/tvNU84RAF9c8bMhxon7CI+btPL6FWNE06xaRgY8lzcq3FCbBoGY0Oei3s1TjiBAWMTQe0HNU64AQFTk7batxonBJfS6EkvbJpwH1XzJeWz3tg04baS0IueM0IvappwUWGVuunqCWvop5om7DwSFof1M9/YNOFo9nuLeGs/941NE65/GG1OXj5vAn6oacJ7Z3cxHj1x/n2qacJ26vi+lxT5swfnlxrfD3vbnjlfqIps59M8XwwJ14Pd+2Fy1uF9XA6mo5qf3AhhNlhNNlF+UTRcvpVHXV9S7/Q2TIsk8K+pbq7jBUlcpPlmXCMSVZuwfUjj80/qf6bfuf3z74qLCd0v3x3nceCICrnnJ+Y7zb+tHuEpCh5zl28/ykmGJMj5zAdzFD8w01LnN+oT9trDyj/8Tv7wuFV40n4xyHG6L0VT8qzUJczK3+ZXtYrVVDK6RuFElpZxr9mOaAXpEa5XqMfsh4LhDrast+H7TOLkf1C6IrlUdQi3q1RxUN3kpMt55eDKVpEsSlMld0ZxyWkQhjPca12lZHb4baXtB1FBf9BNXqRu89EJSbPmW06SHu5mULgppNkKmOL3ZxEeaQP0h/p+PAnPi+tiHgWSrUEuN1dMKSIS7mr98VcBGyhdihU1JMKFPNGnUa1ME2bSbLumdVCINRIIscoIWxrKt0Z1woE02c6C3EiKqEw419mbny83ki2pqoQDnoBCniCmSIjGNS1LkkClRthmDCgEbqUqEWYMV9F7oUdtJUJ2++AvxVjgQ4UQCUwzEWbcKBBK0+qta4Md++WEod5pqUG9ofuFlLCr5o+xp0CSwSEl5D4JU1l4VUZ44j1G3byuXVoRlOYkuVUqJdzZZsA1VPD044Rdjiembw1VHOA44dg2A6pIKVaDE8oCE1alMAelhAfbEJhMeBP39V2Hz1OqGjTFCFemPJtPUKKci4oRMl5ICYXeCGGpGzdpQISyGoQQyATloJgQCYYJM8aDlFKUARO+8z34kkr1QUIoXZmBElIkHySc8h2ktApTkHDM1mIj9qmDCPfMQoXfcokdwCDCh2xlNiqIiakQYcjWJqV2j4IIS9sgkNQNUpywx3YazoiAEOGCayzGITcjAAhHXK3ugFy9ABC2bZNASqmAECHbhYbeDhMg5LrQuPQqDYCQ60LjkwEhQq77PX0aQoRcfVAaTUEAQtskkEpThFvbJJA0ajGrCUe2SSBpVAhVE2a2SSDRAQHCo20SSMYIp7ZJAHnGCE+2UQAl/wmVCee2UQD9J3x9wuDPEzp/ntDcfvif0Jo0GkRXEw5sk0DSaDVRTRjaJoGk0c/ttexSnSsvXuxsUZgiZHsC1jhcVBN2bZNAcukNMl7ME2XO520bBJSxuAXX0JNIyD14AUK2tWo+eUcECPmm6JMvTQAI+WYHo3VqBEK2prfoU1fTV4sBCzEjni8AwoxvYiL1sjKAsMN2MVVP0scJu3wXU+pNzwDhnnNRXkra9SHPB+uSLtJMhAhPfJea8wmD0pwOIlzzTREWNMMGIlzwTfO+SLlLFJIFzdduu8g71Sfkm+d9lbTAWU7IvMRZtfoQIeSb6H2Tu1TssgxHAvDbUhhIMZcWJlyx9WR8SqmZGULIu+vOVTX7te2ZT8SzXJVtEYnILamNRZuXM5GngSGEA65JpndyavVr6zHfEW/KZcn7WNyY8Sn4TnX608iu8eOiDXqYQmP/LzARryrmyKkfJeR9grqTE8FnDZSQbbD7UckSWnFeuLfJT7nFTofwZYbpRU51lT5OyDbrpFLVyTaSLkr8re9vARVDkkyxN9s/myAg10ZCOGV/SPwW0CxDQsjcqXivAnDcyPIZmbvc7gSdFWWEa66ViL8F9qCX5qTCt2ryEth+T0rI3W/6Ia+EAOR5xa+x1sCBYTnhKzgzsEYECrnh/H1u560C9mUoEM75bxjOBP75Kvn9/DeMBPG4qRByrWT7Ftb8S6lGg/uG4WGuKCVC7h8RTXVTq7PhvZzi9V5qhAPWyymerahG2OVs2MR4vFuxGoyzYSPJkFIk7PGNec8k0Sflm3S47hjwoYJI2Jowbegi7fSpTNjhabvF0mat6nWnJcdsRUee106orOW4Yygk0xIIO/x2DEehiSKlOppfEzeVklJS/Tc381Sp3pJEmDEbp0pNr2k1/GNWm6Ja2TONsMNpPVWs8SL2YWB0S6APRLVrErbGbMJtKrfo6BDuh0ymYqzaQILcLWTLY5yqV7DR+6HwKNxTbx+h0fGFg2lD6B6h09PG/pYRELq46BAurFtvajns+oTWd0VSDxctwlZp1UCllcnqEbYOFl3ExMsRNAlbG2sbP/XqAF1CawtqQG2MoU1oKc/doyyjNQmt1NTQr0aoQWjljlI6YB3C1oiM6HpJkaazs9IiCcjrscYXrEdIPPLHy13YXmejm7L1MZwfZpSSDsKFeaYI1aMZ/dmuU1WEte+GkepZhXzDjBFCJevGifE/f5768j/KlUXRINUlbI1S/Nf58VBug2STQuIdCZCcIFy1CVutJWKHJ/m72l/fHecx/Ff5KeU+wJ8yQNiabqrDp366pEyd8JBXD3knX231f50JwlbvNHn4jk6xLKn3+ozOi+vDaE2GO80ZeJMRwvOaeNzld78tiFanTLFe/qdG4W5YfG2UXjopj5RGJhUyRHhWr9Mu3y8aD9YLjVsavrTvdrJwUM4H06xTk+6if3Lbr+mVsm1KAAAAAElFTkSuQmCC
         </data>
         <key>PayloadDisplayName</key>
         <string>Apple</string>
         <key>PayloadIdentifier</key>
         <string>Apple.D06CCEE5-DD8A-4E00-B6C4-D8F8C64F54E2</string>
         <key>PayloadUUID</key>
         <string>D06CCEE5-DD8A-4E00-B6C4-D8F8C64F54E2</string>
         <key>PayloadType</key>
         <string>com.apple.webClip.managed</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
      </dict>
   </array>
   <key>PayloadDisplayName</key>
   <string>WebClips</string>
   <key>PayloadIdentifier</key>
   <string>WebClips.013CE3FD-8844-4334-9506-2EF8693E6C56</string>
   <key>PayloadUUID</key>
   <string>013CE3FD-8844-4334-9506-2EF8693E6C56</string>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
</dict>
</plist>

Browser Allowlist

You can use the WebContentFilter payload to define an allowlist that contains all the websites accessible via an Internet browser. In the native Safari browser, these websites will also appear in Favorites. If you allow a domain, the subdomains and subpages are accessible by default. Refer to WebContentFilter | Apple Developer Documentation (external link) to learn more.

Note the following keys, which you can modify to achieve your desired behavior:

Key	Description
FilterType	Always set this key to BuiltIn.
AllowList	This is an array of dictionaries, each specifying a webpage that the device can access through the Internet browser. Each dictionary contains a title (used for the Favorite tab in Safari) and the actual URL. You can specify subdomains for the URL, but you are not required to do so. You can add dictionaries as needed.

<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>FilterType</key>
         <string>BuiltIn</string>
         <key>AllowListBookmarks</key>
         <array>
            <dict>
               <key>Title</key>
               <string>NinjaOne</string>
               <key>URL</key>
               <string>ninjaone.com</string>
            </dict>
            <dict>
               <key>Title</key>
               <string>Apple</string>
               <key>URL</key>
               <string>apple.com</string>
            </dict>
         </array>
         <key>PayloadDisplayName</key>
         <string>Allowlist</string>
         <key>PayloadIdentifier</key>
         <string>Allowlist.8ADB4E90-A490-4C8E-BBFE-0DE3BD923923</string>
         <key>PayloadUUID</key>
         <string>8ADB4E90-A490-4C8E-BBFE-0DE3BD923923</string>
         <key>PayloadType</key>
         <string>com.apple.webcontent-filter</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
      </dict>
   </array>
   <key>PayloadDisplayName</key>
   <string>Allowlist</string>
   <key>PayloadIdentifier</key>
   <string>Allowlist.129BBAA6-40E8-46E2-92BF-0CDABAD54BA6</string>
   <key>PayloadUUID</key>
   <string>129BBAA6-40E8-46E2-92BF-0CDABAD54BA6</string>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
</dict>
</plist>

Browser Blocklist

You can use the WebContentFilter payload to define a denylist that contains all websites that are inaccessible via a browser. If you block a domain, the subdomains will also be denied. Refer to WebContentFilter | Apple Developer Documentation (external link) to learn more.

Key	Description
FilterType	Always set this key to BuiltIn.
DenyListURLs	This is an array of strings, each specifying a webpage that the device cannot access through the browser. Optionally, you can specify subdomains for the URL. Add strings as needed.

<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>FilterType</key>
         <string>BuiltIn</string>
         <key>DenyListURLs</key>
         <array>
            <string>facebook.com</string>
            <string>reddit.com</string>
         </array>
         <key>PayloadDisplayName</key>
         <string>Denylist</string>
         <key>PayloadIdentifier</key>
         <string>DenyList.3CF8F060-E776-4950-8B64-2A6080BBB694</string>
         <key>PayloadUUID</key>
         <string>3CF8F060-E776-4950-8B64-2A6080BBB694</string>
         <key>PayloadType</key>
         <string>com.apple.webcontent-filter</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
      </dict>
   </array>
   <key>PayloadDisplayName</key>
   <string>Denylist</string>
   <key>PayloadIdentifier</key>
   <string>Denylist.C72D246D-F2D6-4D41-B83D-592D195B7A79</string>
   <key>PayloadUUID</key>
   <string>C72D246D-F2D6-4D41-B83D-592D195B7A79</string>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
</dict>
</plist>

Mail Configuration

You can use the ExchangeActiveSync payload to configure the native mailing app on a device to connect to an Exchange ActiveSync (EAS) account for email. The user must first authenticate to the EAS account before data will sync. Refer to ExchangeActiveSync | Apple Developer Documentation (external link) to learn more.

There are several configurable options for this payload, but note the following keys in particular:

Key	Description
PayloadDisplayName	This is the account name that will appear on the device.
Host	This is the Exchange server hostname or IP address. For Office365, use outlook.office365.com.
EmailAddress	This is the user's email address. When you use the variable `${device.owner.email}`, NinjaOne will automatically populate this field with the email address of the device owner specified in NinjaOne. If you use this, ensure a user is assigned to the device. To learn how to assign a device to a user, refer to NinjaOne Endpoint Management: Assigned User.
UserName	This is the device owner's username. When you use the variable `${device.owner.email}` NinjaOne will automatically populate this field with the email address of the device owner specified in NinjaOne. If you use this, ensure the device has an assigned user.
OAuth	This key allows you to determine whether the configuration uses OAuth for federated authentication.
MailNumberOfPastDaysToSync	This key allows you to determine how many days of mail to sync upon first setup of the account.
SSL	Enforce Secure Socket Layer (SSL) for the connection.
PreventMove	This key allows you to determine whether users can move messages from this account to another account.
PreventAppSheet	This key allows you to determine whether device owners can use an app other than the Apple Mail to send emails.
EnableCalendars	Determine whether to sync calendars.
EnableCalendarsUserOverridable	This key allows you to determine whether the user can modify the `EnableCalendars` setting.
EnableContacts	Determine whether to sync contacts.
EnableContactsUserOverridable	This key allows you to determine whether the user can modify the `EnableCalendars` setting.
EnableMail	Determine whether mail is synced.
EnableMailUserOverridable	This key allows you to determine whether the user can modify the `EnableMail` setting.
EnableNotes	Determine whether to sync the Notes app.
EnableNotesUserOverridable	This key allows you to determine whether the user can modify the `EnableNotes` setting.
EnableReminders	Determine whether to sync the Reminders app.
EnableRemindersUserOverridable	This key allows you to determine whether the user can modify the `EnableReminders` setting.

<plist version="1.0">
<dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>PayloadDisplayName</key>
         <string>Corporate Email</string>
         <key>Host</key>
         <string>outlook.office365.com</string>
         <key>EmailAddress</key>
         <string>${device.owner.email}</string>
         <key>UserName</key>
         <string>${device.owner.email}</string>
         <key>OAuth</key>
         <true/>
         <key>MailNumberOfPastDaysToSync</key>
         <integer>7</integer>
         <key>SSL</key>
         <true/>
         <key>PreventMove</key>
         <true />
         <key>PreventAppSheet</key>
         <true />
         <key>EnableCalendars</key>
         <true/>
         <key>EnableCalendarsUserOverridable</key>
         <false/>
         <key>EnableContacts</key>
         <true/>
         <key>EnableContactsUserOverridable</key>
         <false/>
         <key>EnableMail</key>
         <true/>
         <key>EnableMailUserOverridable</key>
         <false/>
         <key>EnableNotes</key>
         <true/>
         <key>EnableNotesUserOverridable</key>
         <false/>
         <key>EnableReminders</key>
         <true/>
         <key>EnableRemindersUserOverridable</key>
         <false/>
         <key>PayloadIdentifier</key>
         <string>com.apple.eas.account.9B232C94-3E0A-4E4B-BF88-64370E3BA105</string>
         <key>PayloadUUID</key>
         <string>9B232C94-3E0A-4E4B-BF88-64370E3BA105</string>
         <key>PayloadType</key>
         <string>com.apple.eas.account</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
      </dict>
   </array>
   <key>PayloadDisplayName</key>
   <string>Corporate Email</string>
   <key>PayloadIdentifier</key>
   <string>Corporate Email.158FBE77-8888-4578-A443-DBF46AD4C937</string>
   <key>PayloadType</key>
   <string>Configuration</string>
   <key>PayloadUUID</key>
   <string>158FBE77-8888-4578-A443-DBF46AD4C937</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
</dict>
</plist>

Additional Resources

Refer to NinjaOne MDM: Resource Catalog to learn more about Apple MDM in NinjaOne.