Restrict macOS 13 Settings with Configuration Profiles

Managing system configurations on macOS 13 Ventura requires Mobile Device Management (MDM) configuration profiles to maintain fleet security and administrative control. With Apple's transition from System Preferences to the SwiftUI-based System Settings in macOS 13, administrators must deploy targeted .mobileconfig payloads to hide, disable, or enforce specific setting panels. This article outlines the primary configuration profile payloads used to restrict and manage settings on macOS 13 devices.

System Settings Visibility Payload (com.apple.systemsettings.managed)

Starting in macOS 13, Apple introduced a dedicated payload specifically designed to manage the visibility of items in the redesigned System Settings interface. Administrators can use this payload to create an allowlist or a blocklist of specific settings panes.

  • Restricted Panes: You can completely hide specific sections, such as Network, Displays, Battery, Touch ID & Password, or Startup Disk, preventing end users from altering hardware and security configurations.
  • Granular Control: Instead of disabling the entire application, this payload targets individual pane identifiers (e.g., com.apple.Network-Settings.extension or com.apple.Passwords-Settings.extension), keeping essential productivity panes visible while locking sensitive administrative controls.

Restrictions Payload (com.apple.applicationaccess)

The standard restrictions payload remains one of the most effective tools for locking down functionality across the operating system, impacting several core settings within macOS 13:

  • Apple ID and iCloud: Disables the ability to sign in to an Apple ID, modify iCloud settings, or use iCloud Keychain and iCloud Drive.
  • AirDrop and Sharing: Blocks AirDrop, Bluetooth file sharing, and remote screen sharing.
  • Touch ID: Restricts users from enrolling new fingerprints or using Touch ID to unlock the device.
  • Siri and Dictation: Disables Siri entirely, removing its configuration options from System Settings.
  • Account Modification: Prevents standard or administrative users from adding, deleting, or modifying local user accounts.

Security and Privacy Payloads

To ensure devices comply with organizational standards, several dedicated security payloads enforce settings that users cannot override.

  • FileVault (com.apple.MCX.FileVault2): Enforces full-disk encryption, configures institutional recovery keys or personal recovery key escrow, and locks down the FileVault pane in System Settings to prevent users from decrypting their drives.
  • Firewall (com.apple.security.firewall): Turns on the built-in macOS packet-filtering firewall, enables stealth mode, and prevents users from disabling firewall rules or allowing unauthorized inbound applications.
  • Gatekeeper (com.apple.systempolicy.control): Restricts application execution strictly to the Mac App Store or identified developers, graying out the option for users to bypass security warnings for unsigned software.

Software Update Payload (com.apple.SoftwareUpdate)

Controlling the upgrade lifecycle is essential for macOS 13 stability. The Software Update payload controls how and when updates appear in System Settings:

  • Deferred Updates: Delays major OS upgrades or minor software updates by up to 90 days, hiding them from the user interface.
  • Automatic Installation: Forces the automatic checking, downloading, and installation of critical security responses and system files without user intervention.
  • Admin Enforcement: Restricts standard users from triggering manual updates, ensuring system updates are initiated only by administrative schedules.

Passcode Policy Payload (com.apple.mobiledevice.passwordpolicy)

This payload establishes constraints on system authentication and locks down the Lock Screen and Password panes in System Settings:

  • Complexity Requirements: Mandates minimum password lengths, special character requirements, and maximum password age.
  • Lock Screen Timeout: Defines the maximum period of inactivity before the display goes to sleep and enforces an immediate password requirement upon waking, preventing users from extending screen lock intervals.