Enterprise MDM APIs Introduced in iOS 12

Apple’s release of iOS 12 expanded the Mobile Device Management (MDM) framework, granting enterprise administrators and developers deeper control over device security, communication protocols, and hardware configurations. This release introduced specific payload keys, restrictions, and query capabilities designed to improve data privacy, streamline identity workflows, and secure managed devices in corporate and educational environments.

Authentication and Identity APIs

iOS 12 brought improvements to identity verification and directory service integrations:

  • OAuth 2.0 Support for Exchange: MDM solutions gained the ability to configure Exchange ActiveSync accounts using OAuth 2.0 authentication. This allowed organizations to deploy modern, token-based authentication workflows directly through the standard Exchange payload.
  • S/MIME Enhancements: Apple introduced APIs that allow administrators to mandate specific S/MIME signing and encryption certificates per user account, with granular control over whether users can toggle S/MIME on or off.

Hardware and Cellular Management

With the hardware release of the iPhone XS and XR alongside iOS 12 updates, Apple added controls specifically tailored for dual-SIM architecture:

  • eSIM and Cellular Plan Restrictions: The allowESIMModification restriction key was introduced to prevent end-users from adding, removing, or switching eSIM profiles without administrative authorization.
  • Cellular Query APIs: The MDM command set was expanded to query the status of both SIM slots, reporting back ICCID, carrier names, and network information for both the physical nano-SIM and the digital eSIM.

Security and Restriction Payloads

Several new restrictions were added to the standard profile configuration service to tighten data leakage points:

  • Password Sharing Restrictions: The allowPasswordSharing key enabled MDMs to block the automated AirDrop password-sharing feature between Apple devices.
  • Password Autofill Control: The allowAutoFillPasswords restriction permitted enterprise administrators to disable native password autofill from iCloud Keychain on supervised devices, mitigating risks around shared or loaner equipment.
  • Proximity-Based Setup Prevention: Administrators gained the ability to block the proximity-based device setup prompt via allowProximitySetupToNewDevice, ensuring that new corporate devices could not transfer unapproved data or configurations from personal devices.
  • USB Restricted Mode Management: New management profiles allowed enterprises to regulate the behavior of USB accessories when an iOS device is locked, giving control over whether the Lightning port communicates with external accessories after one hour of inactivity.

Supervised Device and App Controls

iOS 12 refined administrative controls over the operating system environment and application lifecycles:

  • Software Update Deferrals: While initially introduced in minor revisions of iOS 11, iOS 12 fully stabilized the enforcedSoftwareUpdateDelay key, allowing administrators to defer over-the-air system updates for up to 90 days from public release.
  • Autonomous Single App Mode (ASAM): The framework expanded ASAM accessibility permissions, allowing developers of custom enterprise apps to programmatically enable specific accessibility features—such as VoiceOver or Zoom—directly while their app is locked into dedicated operational modes.