Restrictions and Network
The Restrictions and Network settings manage various functions that are available to supervised devices.
iOS uses advanced Mobile Device Management (MDM) configurations for devices that are configured with a Supervised profile. The administrator can tether a device to a macOS computer and use Apple Configurator 2 to supervise a device or supervise the device over-the-air as part of the Apple Device Enrollment Program (DEP).
Restrictions and Network settings
Policy setting | Description | Supported devices |
---|---|---|
Allow Apple Intelligence reports | If this setting is disabled, the system disables Apple Intelligence reports. | iOS 18.4+ iPadOS 18.4+ |
Allow video conferencing remote control | If this setting is disabled, the system disables the ability for a remote FaceTime session to request control of the device. | iOS 18.4+ iPadOS 18.4+ |
Allow signing in to external intelligence integrations | Disabling this setting forces external intelligence providers into an anonymous mode. If a user is already signed in to an external intelligence provider, applying this restriction signs them out. | iOS 18.2 to 18.3 iPadOS 18.2 to 18.3 |
Allow personalised handwriting results | If this setting is disabled, the system disables iOS and iPadOS from generating text in the user’s handwriting. | iOS 18.0+ iPadOS 18.0+ |
Allow app installation from an alternative marketplace (in eligible regions) | If this setting is disabled, the system disables the installation of new alternative app marketplaces and apps that are hosted on those marketplaces. | iOS 17.4+ |
Allow putting an iPhone or iPad into Recovery Mode from an unpaired host | Previously, any external host computer was allowed to restart a connected iPhone or iPad into
recoveryOS (also known as Recovery Mode ). This meant that the host computer could
completely erase the device and restore iOS or iPadOS over a USB connection without any other
physical interaction with the device. iOS 14.5 and iPadOS 14.5, or later, prevent this behavior by
default.Default is |
iOS 14.5+ iPadOS 14.5+ |
Allow Shared iPad Temporary Session | The shared iPad does not allow a Temporary Session. | iPadOS 13.4+ |
Allow accessory connections | The device can always connect to specific accessories while locked. |
iOS 13.0+ iPadOS 13.1+ |
Playback of explicit music, video and podcast content | Explicit music or video content that is purchased from the iTunes Store or downloaded from the Podcasts app is hidden. Explicit content is flagged by content providers, such as record labels, when sold through the iTunes Store. |
iOS 13.0+ iPadOS 13.1+ |
iCloud Documents and Data | Documents and data are not added to iCloud. |
iOS 13.0+ iPadOS 13.1+ |
AirPlay, View Screen by Classroom and screen sharing | Teachers who use Classroom can’t use AirPlay with students’ screens, view students’ screens or share students’ screens. |
iOS 12.0+ iPadOS 13.1+ |
Proximity AutoFill | Users’ devices do not advertise themselves to nearby devices for passwords by use of Proximity AutoFill. For devices with iOS, iPadOS, and macOS, this feature restricts only wifi password requests. |
iOS 12.0+ iPadOS 13.1+ |
Turn on “Set Automatically” in Date and Time settings | Set Automatically is turned on and users can’t turn it off. |
iOS 12.0+ iPadOS 13.1+ |
Allow connected accessories while locked |
Users can always connect accessories when the iPhone or iPad is locked. For more information, see Activating data connections securely in Apple Platform Security. |
iOS 11.4.1+ iPadOS 13.1+ |
Defer software updates |
For more information, see Test and defer software updates. Default is
|
iOS 11.3+ iPadOS 13.1+ |
Set up a nearby Apple device | Users cannot use their Apple devices to set up and configure other Apple devices. |
iOS 11.0+ iPadOS 13.1+ |
Modify data plan settings | Users cannot change any settings for the data plan. |
iOS 11.0+ iPadOS 13.1+ |
Join only Wi-Fi networks installed by a Wi-Fi payload |
When enabled, devices that have this restriction can join only the wifi networks that are added
to the Wi-Fi payload. Default is
off .Important: If the Wi-Fi network is
not available, the device cannot be managed.
|
iOS 10.3+ iPadOS 13.1+ |
Restrict app usage | Any apps other than Settings or Phone (on iPhone) can be placed on either an approved list or an unapproved one. |
iOS 9.3+ iPadOS 13.1+ |
Modify restrictions or Screen Time settings |
Users cannot set their own Screen Time settings on their device for iOS 12 or later. Users cannot set their own restrictions on their device for iOS 11.4.1 or earlier. |
iOS 8.0+ (Restrictions) iOS 12.0+ (Screen Time) iPadOS 13.1+ (Screen Time) |
Autonomous Single App Mode | Users can use selected apps in Single App Mode. |
iOS 7.0+ iPadOS 13.1+ |
Pair with non-Apple Configurator hosts | Users can pair their iPhone or iPad only with the Mac that first supervised the device and that has Apple Configurator installed. |
iOS 5.0+ iPadOS 13.1+ |
Game Center | The Game Center app and its icon are removed. | iOS 6.0+ iPadOS 13.1+ |
Apple Books | Apple Books is disabled, and users cannot access it from the Books app. | iOS 6.0+ iPadOS 13.1+ |
Install a configuration profile | Users cannot manually install configuration profiles in Settings on a supervised device. If this setting is disabled, users cannot add profiles or certificates to the device, but profiles and certificates can be pushed to the device through MDM. | iOS 6.0+ iPadOS 13.1+ |
iMessage | For Wi-Fi–only devices, the Messages app is hidden. For devices with wifi and mobile, the
Messages app is still available but only the SMS or MMS service can be used. If this setting is disabled, the device can still use the cellular network to send text messages. |
iOS 6.0+ iPadOS 13.1+ |
Siri profanity filter |
The profanity filter in Siri can be disabled. Default is |
iOS 5.0+ iPadOS 13.1+ |
User-generated content in Siri | Siri cannot access content from sources that allow user-generated content, such as Wikipedia. | iOS 7.0+ iPadOS 13.1+ |
Modify account settings | Users cannot create new accounts or change their username, password, or other settings associated with their account on a supervised device. | iOS 7.0+ iPadOS 13.1+ |
Allow activation lock | The supervised device is locked to the Apple ID that is used for the iCloud account. To manually override the activation lock setting, see Manually clearing the activation lock on supervised iOS devices. |
iOS 7.0+ |
Allow removing apps | Users can remove any app from supervised devices. | iOS 4.2+ |
Allow cellular data usage modification | Users can specify which apps on the supervised device can use the cellular network. | iOS 7.0+ |
Modify mobile data app settings | Users cannot change any settings for apps that use mobile data. | iOS 7.0+ iPadOS 13.1+ |
Allow Find My Friends modification | Users can access and modify Find My Friends on a supervised device to use GPS to locate friends with Apple devices. | iOS 7.0+ |
AirDrop | Users cannot use AirDrop on a supervised device to share content with other Apple devices.
If this setting is disabled, the AirDrop function is removed from the supervised device. |
iOS 7.0+ iPadOS 13.1+ |
Erase All Content and Settings | Users cannot erase their device and reset it to factory defaults from a supervised device. | iOS 8.0+ iPadOS 13.1+ |
Allow user enabled restrictions |
Provides permission to the user to enable device restrictions in the Restrictions UI in the device settings. Disabling this policy setting on devices that runs iOS 12 or later, disables the Enable ScreenTime option in the ScreenTime UI in the device settings, and also disables the ScreenTime feature if it is already enabled. |
iOS 8 - 11 (Restrictions) iOS 12+ (ScreenTime) iPadOS 13.1+ (ScreenTime) |
Podcasts | Users cannot download podcasts on a supervised device. | iOS 8.0+ iPadOS 13.1+ |
Predictive keyboard | Users cannot see the predictive keyboard (where the device provides suggestions as you type words or phrases) on a supervised device. | iOS 8.1.3+ iPadOS 13.1+ |
Auto correction | Users cannot see any word correction suggestions on a supervised device. | iOS 8.1.3+ iPadOS 13.1+ |
Spell check | Users cannot see potentially misspelt words that are underlined in red. If this setting is restricted, the user cannot use spell check on the device. However, the user can still use the built-in app level spell check on the device. |
iOS 8.1.3+ iPadOS 13.1+ |
Define and Look Up | Users cannot tap and hold a selection and look up a dictionary definition about the selection. | iOS 8.1.3+ iPadOS 13.1+ |
Allow modifying Touch ID fingerprints | Users can modify the Touch ID fingerprint identity sensor setting on a supervised device. Users cannot use Touch ID if this setting is not set up on the device. | iOS 8.3+ |
Modify Touch ID fingerprints and Face ID faces | Users cannot add or remove existing biometric information. |
iOS 8.3+ (Touch ID) iOS 11.0+ (Face ID) iPadOS 13.1+ (Touch ID or Face ID) |
Allow usage of app store | If this setting is disabled, users cannot download apps from the app store to a supervised device. MDM can still push apps to the device or the user can access Apple Configurator or iTunes on a computer to add apps to the device. However, access to the system-level app store is hidden from the user. | iOS 9.0+ |
Keyboard shortcuts | Users cannot use any keyboard shortcuts on a supervised device. | iOS 9.0+ iPadOS 13.1+ |
Pair with Apple Watch | Users cannot pair a supervised device with an Apple Watch. If this setting is disabled, the paired devices are removed from each other and shared content is erased. |
iOS 9.0+ |
Modify passcode | Users cannot change the passcode that is set on a supervised device. | iOS 9.0+ iPadOS 13.1+ |
Modify device name | Users cannot change the name of a supervised device as shown in
Note:
This setting also blocks the MDM profile from changing the name of the supervised device. If this
setting is disabled, an administrator cannot remotely set or automatically name a supervised device.
|
.iOS 9.0+ iPadOS 13.1+ |
Modify Wallpaper | Users cannot change the wallpaper for the Lock Screen or Home
Screen on a supervised device. Note: This setting also blocks MDM actions. Do not
disable this setting until MaaS360 successfully pushes the
settings to the device.
|
iOS 9.0+ iPadOS 13.1+ |
Automatic app downloads | The App Store does not automatically download apps. | iOS 9.0+ iPadOS 13.1+ |
Allow trust of enterprise apps | (Deprecated) The supervised device can receive trusted enterprise apps that are pushed through MDM. | iOS 9.0+ |
News | Users cannot use the News app on a supervised device. | iOS 9.0+ iPadOS 13.1+ |
Allow iTunes Radio | Users can still access iTunes Radio if the Music app is disabled on the supervised device. | iOS 9.3+ |
Radio | Users cannot listen to the radio with Apple Music. | iOS 9.3+ iPadOS 13.1+ |
Apple Music | Users cannot access the Apple Music app on a supervised device. | iOS 9.3+ iPadOS 13.1+ |
Modify Bluetooth settings | Users cannot change Bluetooth settings on a supervised device. | iOS 11.0+ iPadOS 13.1+ |
Allow diagnostic log submission modification | Users can change settings for the diagnostic log submission and app analytics on a supervised device. | iOS 9.3.2+ |
Modify diagnostic settings | Modifying diagnostic data settings is not permitted. |
iOS 9.3.2+ iPadOS 13.1+ |
Modify Notifications settings | Users cannot change the configuration of any Notifications settings on a supervised device. | iOS 9.3+ iPadOS 13.1+ |
Modify dictation | Users cannot use dictation on a supervised device. | iOS 10.3+ iPadOS 13.1+ |
Enforce usage of only MDM configured wifi | If this setting is enabled, the device can connect only to wifi profiles that are deployed
and configured on a supervised device. This setting prevents connections to wifi networks that are
not configured by MDM. Note: This restriction is enforced when at least one wifi network is
configured on a supervised device.
|
iOS 10.3+ |
AirPrint | Users cannot use AirPrint. | iOS 11.0+ iPadOS 13.1+ |
Store AirPrint credentials in Keychain | Users cannot save their AirPrint credentials to the iCloud keychain. | iOS 11.0+ iPadOS 13.1+ |
Discover AirPrint printers using iBeacon | Users cannot discover AirPrint printers by using nearby iBeacon-compatible hardware transmitters. | iOS 11.0+ iPadOS 13.1+ |
AirPrint to destinations with untrusted certificates | Users can’t use AirPrint to print to printers with untrusted certificates. Default is
|
iOS 11.0+ iPadOS 13.1+ |
Add VPN configurations | A user cannot create or add VPN configurations on a supervised device. | iOS 11.0+ iPadOS 13.1+ |
Remove apps | A user cannot remove installed apps from a supervised device. |
iOS 4.2.1+ iOS 11.0+ iPadOS 13.1+ |
Require biometric authentication for AutoFill | Users must authenticate with biometric authentication or with a passcode to automatically
fill password and credit card information. Default is |
iOS 11.0+ iPadOS 13.1+ |
Allow host pairing | Allows administrator control on supervised devices that pair with an iOS device. If this setting is disabled, host pairing is not allowed except for the supervision host. |
iOS 7.0+ |
Allow date and time modification | Users are allowed to change the date and time on a supervised device. To restrict a user from editing the date and time on an iOS device, disable this setting and publish the policy to the device. |
iOS 12.0+ |
Allow USB accessories while locked | The supervised device can connect to USB accessories even if the device is locked. | iOS 11.3+ |
Allow proximity setup to new devices | Users can transfer data, settings, and content from an old device to a new device by using
the same Apple ID. The old device with the published policy allows automatic setup of new devices
that are within the proximity of the old device. You can also take the following action from the Device Inventory page: . |
iOS 11.0+ |
Password AutoFill | Users cannot use AutoFill Passwords for saved passwords and no prompt is shown to pick a saved password from iCloud Keychain or third-party password managers. | iOS 12.0+ iPadOS 13.1+ |
Allow password proximity requests | Users can request their device password by using proximity setup from nearby devices. | iOS 12.0+ |
Share passwords over AirDrop | Users cannot share their passwords over AirDrop. | iOS 12.0+ iPadOS 13.1+ |
Modify eSIM settings | Users cannot add or remove an eSIM plan. | iOS 12.1+ iPadOS 13.1+ |
Allow cellular plan modification | Users can share the cellular password with the AirDrop password feature and also modify the cellular plan on a supervised device. | iOS 11.0+ |
Modify Personal Hotspot settings | Users can modify personal Hotspot settings on a supervised device. | iOS 12.2+ iPadOS 13.1+ |
Allow use of iTunes for media download | Users can download apps, music, or videos from the iTunes store on a supervised device. | iOS 13.0+ |
iTunes Store | The iTunes Store is disabled and its icon is removed from the Home Screen. Users can’t preview, purchase, or download content. | iOS 13.0+ iPadOS 13.1+ |
Install apps |
App Store is disabled and its icon is removed from the Home Screen. Users can’t install or update apps from the App Store by using the Finder (macOS 10.15 or later) or iTunes (macOS 10.14 or earlier). For devices with iOS 10 or later, MDM can override this restriction. Proprietary in-house apps can still be installed and updated.
Note: If native iOS and iPadOS
system apps are removed, they can be reinstalled.
|
iOS 5.0+ iOS 13.0+ iPadOS 13.1+ |
Use Safari | Users can use the Safari web browser on a supervised device. This setting also prevents users
from opening Web Clips. Enable autofill in Safari: Uses the autofill feature for the Safari browser on a supervised device. |
iOS 13.0+ iPadOS 13.1+ |
Safari AutoFill | Safari does not track what users enter in web forms. | iOS 13.0+ iPadOS 13.1+ |
Allow use of camera | Users can use the camera app on a supervised device. If this setting is disabled, the camera
app is hidden from the user, and the user cannot access the camera app from other
apps. Allow use of FaceTime: Allows the FaceTime app on the device to make audio and video calls from the device. |
iOS 13.0+ |
Allow Cloud backup | Users can back up the contents of a supervised device onto iCloud. | iOS 13.0+ |
Allow documents sync | Users can synchronize documents that are uploaded to iCloud. | iOS 13.0+ |
Allow cloud keychain sync | Users can synchronize information such as a Safari username and password, credit card details, or wifi settings onto iCloud. | iOS 13.0+ |
Allow explicit music and podcasts purchased from iTunes | Users can download explicit material on a supervised device. | iOS 13.0+ |
Add Game Center friends | Disabling this setting disables users from adding contacts from the Game Center social network on a supervised device. | iOS 13.0+ iPadOS 13.1+ |
Multiplayer gaming | Users cannot play games online over wifi or cellular data on a supervised device. | iOS 13.0+ iPadOS 13.1+ |
Allow Find My Device | Users cannot use the Find My app on a supervised device. | iOS 13.0+ iPadOS 13.1+ |
Modify Find My settings | Users cannot change any settings in the Find My app. |
iOS 7.0+ iPadOS 13.1+ |
Allow Find My Friends | Users cannot use the Find My Friends app on a supervised device. Note: For iOS 13.0+ devices,
the Find My Friends and Find My iPhone settings are
combined with Find My app. These settings function as follows.
|
iOS 13.0+ iPadOS 13.1+ |
Force Wi-Fi on | Users cannot disable wifi on a supervised device from Settings or the Control Center even during Airplane Mode. This setting does not prevent the user from selecting which wifi network to use on the device. | iOS 13.0+ iPadOS 13.1+ |
Allow QuickPath keyboard | Users cannot use the QuickPath keyboard on a supervised device. | iOS 13.0+ iPadOS 13.1+ |
Allow network drive connections | If this is disabled, the users cannot connect to network drives in the Files app. | iOS 13.0+ iPadOS 13.1+ |
Allow USB drive access files app | Users can connect to any USB devices that are present in the Files app. | iOS 13.0+ |
Allow shared device guest session | Allows guest login sessions on a shared iPad device. For more information about shared iPad temporary sessions, see https://support.apple.com/en-in/guide/deployment/dep9a34c2ba2/web. | iOS 13.4+ |
Allow App Clips | Users can use App Clips on a supervised device. App Clips are a small part of an app that
allows the user to do a task quickly. App Clips are available in Safari, Maps, and Messages, or through NFC tags, QR codes, and App Clip codes (unique markers that take you to specific App Clips). |
iOS 14.0+ iPadOS 14.0+ |
Allow near-field communications (NFC) | If this setting is disabled, it disables users from using built-in NFC hardware in compatible devices that use iOS 14.2 or later. | iOS 14.2+ |
Allow unpaired external boot to recovery | If this setting is enabled, it allows users to boot iOS or iPad OS devices into Recovery Mode from an external host computer (unpaired host). By default, an external host computer cannot start a device in Recovery Mode. | iOS 14.5+ |
Force on device only dictation | If this setting is enabled, this setting prevents the use of Siri for dictation on a supervised device. By default, users can use dictation to enter text with many apps and features that use the keyboard on devices. | iOS 14.5+ |
iCloud Private Relay | If this setting is disabled, the system disables the user from turning on iCloud Private Relay. | iOS 15.0+ iPadOS 15.0+ |
Allow mail privacy protection | If this setting is disabled, the device cannot use Mail Privacy Protection. Path on the device: |
iOS 15.2+ |
Allow rapid security response installation | If this setting is disabled, Apple does not automatically push security patches to supervised
devices. If this setting is enabled, Apple automatically pushes security patches by default. iPhone
users do not need to restart the phone for these updates to take effect. Path on the device: |
iOS 16.0+ |
Allow rapid security response removal | If this setting is disabled, users cannot remove the rapid security response from supervised devices. | iOS 16.0+ |
Allow iPhone Widgets On Mac | This setting is turned on by default. When this setting is turned on, MaaS360 allows iPhone widgets on a Mac that has signed in the same Apple ID for iCloud. | iOS 17.0+ |
Allow Live Voicemail | If this setting is disabled, the system disables live voicemail on the device. | iOS 17.2+ |
Force Preservation of eSIM on erase | If this setting is enabled, the system disables the eSIM from being erased when a device is
set to wipe after entering an incorrect passcode too many times. Note: The operating system doesn’t
preserve an eSIM if Find My initiates erasing the device.
|
iOS 17.2+ iPadOS 17.2+ |
Allow Marketplace App Installation | Disabling this setting prevents the users from installing apps from alternative app marketplaces. | iOS 17.4+ |
Allow auto-dim | Disabling this setting disables auto dim on devices and prevents the device from dimming. |
iPadOS 17.4+ |
Allow app installation from a website (in eligible regions) | Disabling this setting prohibits the device from installing apps directly from the web. | iOS 17.5+ |
Allow eSIM outgoing transfers | Disabling this setting prevents the transfer of an eSIM from the device on which the restriction is installed to a different device. | iOS 18.0+ iPadOS 18.0+ |
Allow Genmoji | Disabling this setting prohibits creating new Genmoji. | iOS 18.0+ iPadOS 18.0+ |
Allow Image Playground | Disabling this setting prohibits the use of image generation. | iOS 18.0+ iPadOS 18.0+ |
Allow Image Wand | Disabling this setting prohibits the use of Image Wand. | iOS 18.0+ iPadOS 18.0+ |
Allow iPhone mirroring | Disabling this setting prohibits the use of iPhone Mirroring that prevents the iPhone from mirroring to Mac devices. | iOS 18.0+ |
Allow Personalized Handwriting Results | Disabling this setting prevents the system from generating text in the user's handwriting. | iOS 18.0+ |
Allow writing tools | Disabling this setting disables the Apple Intelligence writing tools. | iOS 18.0+ iPadOS 18.0+ |
Allow apps to be locked | Disabling this setting prevents the apps from being locked. | iOS 18.0+ iPadOS 18.0+ |
Allow apps to be hidden | Disabling this setting prevents the apps from being hidden. | iOS 18.0+ iPadOS 18.0+ |
Allow call recording | Disabling this setting prevents the calls from being recorded. | iOS 18.1+ |
Allow Mail summary | Disabling this setting prevents emails from being summarized. | iOS 18.1+ iPadOS 18.1+ |
Allow RCS messaging | Disabling this setting prevents RCS messaging services. | iOS 18.1+ iPadOS 18.1+ |
Allow default browser modification | Disabling this setting disables the default browser preference modification. The MDM settings command to set the default browser preference still works when this setting is enabled. | iOS 18.2+ iPadOS 18.2+ |
Allow Safari summary | If this setting is disabled, the system disables the ability to summarize content in Safari. | iOS 18.4+ iPadOS 18.4+ |
Allow satellite connection | If this setting is disabled, the system prohibits the connection to and use of satellite services. | iOS 18.2+ |
Allow Mail smart replies | If this setting is disabled, the system disables smart replies in Mail. | iOS 18.4+ iPadOS 18.4+ |
Allow Notes transcription | If this setting is disabled, the system disables transcription in Notes. | iOS 18.4+ iPadOS 18.4+ |
Allow external intelligence workspace IDs | Currently, only a single workspace ID is supported. If this setting is enabled, Apple Intelligence allows only the given external integration workspace ID to be used, and requires a sign-in to make requests. The user is required to sign in to integrations that support signing in. Multiple payloads combine by using an intersect operation. This means the allowed set of workspace IDs can become the empty set if conflicting values are specified in multiple payloads. |
iOS 18.3+ iPadOS 18.3+ |
Allow visual intelligence summary | If the setting is disabled, the system disables visual intelligence summarization. | iOS 18.3+ iPadOS 18.3+ |
Allow Notes transcription summary | If this setting is disabled, the system disables the transcription summarization in Notes. | iOS 18.3+ iPadOS 18.3+ |
Allow default calling app modification | If this setting is disabled, the system prevents the default calling app preference modification. | iOS 18.4+ iPadOS 18.4+ |
Allow default messaging app modification | If this setting is disabled, the system prevents the default messaging app preference modification. | iOS 18.4+ iPadOS 18.4+ |
Classroom Restrictions | ||
Automatic joining of Classroom classes without prompting | A student is automatically joined to the class without being prompted. Default is
off . |
iOS 11.0+ iPadOS 13.1+ |
Require teacher permission to leave Classroom teacher-created classes | A student must request permission before they can leave a teacher-created class. Default is
off . |
iOS 11.3+ |
Allow app and device lock without prompt | The teacher can lock the student device in the Classroom app on a student's iPad to prevent the student from closing the app or opening another app without being prompted. | iOS 11.0+ |
Allow screen observation without prompt | The teacher can view a student's iPad screen without being prompted. | iOS 11.0+ |
Classroom to perform AirPlay and View Screen without prompting |
Students in managed classes aren’t prompted when the teacher uses AirPlay or View Screen. Default
is |
iOS 11.0+ iPadOS 13.1+ |
Classroom can focus students on a single app and lock the device without prompting |
Teachers can lock an app open or lock the device without first prompting the user. Default is
|
iOS 11.0+ iPadOS 13.1+ |
Configure global proxy settings | The administrator can configure proxy settings for network traffic on a supervised device. |
iPadOS 13.1+ |
Configure AirPlay settings | The administrator can configure which supervised devices can connect to AirPlay to share content with other iOS devices. | iOS 7.0+ |
Configure delay for software updates | Number of days to delay (1-90) days: Updates on devices are delayed and hidden from the user based on the number of days (1 - 90 days) specified by the administrator. | iOS 11.3+ |