Contents

LegacyProfile

The declaration to configure a legacy profile.

Declaration

object LegacyProfile

Properties

NameTypeDescription
ProfileAssetReferencestring

The identifier of an asset declaration containing a reference to the profile data. The corresponding asset needs to be of type com.apple.asset.data. The referenced data needs to be a property list file, and the asset’s “ContentType” value set to match the data type.

One of ProfileURL or ProfileAssetReference needs to be present.

Available: iOS 27+ | iPadOS 27+ | macOS 27+ | tvOS 27+ | visionOS 27+ | watchOS 27+

ProfileURLstring

The URL of the profile to download and install, which needs to start with https://. The request uses MDM semantics, which includes the device-identity certificate, and any user authentication. This is equivalent to an MDM request made to the CheckInURL or ServerURL.

One of ProfileURL or ProfileAssetReference needs to be present.

Discussion

Specify com.apple.configuration.legacy as the declaration type.

This declaration specifies an MDMv1 profile for the device to download and install.

The profile may contain any payload type other than the following:

  • com.apple.mdm

  • com.apple.declarations

If a user enrollment triggers this configuration: in macOS the system silently ignores any MDMv1 payloads in macOS where the User Enrollment Mode setting is forbidden; in iOS, tvOS, watchOS and visionOS, the system rejects the entire profile if any MDMv1 payload has its User Enrollment Mode setting set to forbidden.

Transition profiles from MDM

A declarative device management (DDM) legacy profile can take control of profiles installed via MDM. This avoids the need to first remove the MDM profile, before installing the DDM equivalent. DDM cannot take over control of non-MDM-installed profiles.

The rules for transitioning profiles are:

  1. An existing MDM-installed profile is present (installed by MDM using the Install Profile).

  2. DDM is enabled on the device.

  3. The server sends a legacy profile configuration to the device and ensures it is “activated”.

    1. The DDM profile that the configuration applies needs to conform to the following requirements:

      1. The DDM profile’s PayloadIdentifier and PayloadUUID need to match that of the MDM profile.

      2. The DDM profile needs to have the same number of payloads as the MDM profile.

      3. The DDM profile payloads needs to have the same PayloadType, PayloadIdentifier, and PayloadUUID, in the same order as the profile payloads in the MDM profile.

    2. If the DDM profile doesn’t conform to the above requirements, the configuration isn’t applied and its valid status is set to invalid.

    3. The Profile List can be used to determine the “structure” of existing MDM profiles to satisfy the above requirements.

When DDM takes control of the MDM profile, the following occurs:

  1. The system doesn’t reinstall the profile. Instead, the MDM profile’s existing system state remains unchanged. Thus system state won’t include any differences between the MDM and DDM profiles (other than the structural items outlined above that must match).

  2. Any attempt to install, update, or remove the profile using MDM commands fails (using the usual identifier and UUID matching rules). This holds true while the DDM profile is active.

  3. Updates to the DDM configuration result in the system reapplying the profile which updates the system state with any new or changed settings.

Configuration availability

Allowed in supervised enrollment

iOS, macOS, Shared iPad, tvOS, visionOS, watchOS

Allowed in device enrollment

iOS, Shared iPad, tvOS, visionOS

Allowed in user enrollment

iOS, macOS, Shared iPad, visionOS

Allowed in local enrollment

iOS, macOS, Shared iPad, tvOS, visionOS, watchOS

Allowed in system scope

iOS, macOS, Shared iPad, tvOS, visionOS, watchOS

Allowed in user scope

macOS, Shared iPad

Apply

Multiple configurations are applied separately

Configuration examples

See Also

Configurations