Configuration profiles
A configuration profile pushes Wi-Fi, restrictions, VPN, a web icon, and similar settings to an Enrolled iPhone or iPad.
Settings → Apple → Configuration profiles. A screen passcode is not created here — use Device policies.
Create and assign
Click New profile. Fill in Name. Status defaults to Draft — a draft is not installed on devices. Change it to Active when you want devices to receive it. Choose Payload type, fill in the fields for that type, then Save profile.
The SSID box shows the hint Office-WiFi. That is not a saved network. Status must be Active before a device receives the profile after you assign it. Assign the profile to the whole organization (Entire customer), one Device group, or one User group. You can assign it on Defaults if every Apple device in the organization needs it.
An Enrolled device that has a network receives the profile on its own. The Profiles tab on the device page updates after the device reports its profile list.
To remove it: unassign it. The device receives a command to remove the profile. The profile row stays in the catalog until you delete it.
Types often used on iPhone and iPad
| Type | What the device does |
|---|---|
| Wi-Fi | Adds a Wi-Fi network. |
| Web Clip | An icon that opens a web page on the Home Screen. iPhone and iPad only. Do not assign it to a group that contains a Mac. |
| Restrictions | Turns off the camera, AirDrop, screenshots, and other restrictions. Split them into separate profiles so they are easier to remove. |
| Certificate (PEM) | Installs a certificate. A device that is not supervised may have to trust it by hand in Settings. |
| VPN | Adds a VPN configuration. A VPN row does not mean the tunnel is connected. |
| Email (IMAP/POP), Exchange ActiveSync | Adds a mail account. It needs a real account. |
| Content Filter | Blocks pages in Safari. Prefer this on a supervised device. |
| Single App Mode | Locks the device inside one app. Supervised devices only. Remove it right after a test — the user cannot get back to the Home Screen. |
| Home Screen Layout | Arranges icons. Supervised devices only. |
| Global HTTP Proxy | Forces traffic through a proxy. Supervised devices only. A wrong proxy can cut the network, and the device will not receive the command to remove it. Do not try a fake proxy on a device that is in use. |
FileVault, Firewall, Gatekeeper, Login Window, Privacy Preferences, and System Extensions are for Mac. They are not installed on an iPhone.
Common questions
- I assigned it, but the device still has no profile?
- The profile must be Active, not Draft. The device must be Enrolled, online, and inside the target you assigned. The Profiles tab can stay empty until the device is asked for its profile list.
- How is an ADE profile different from this one?
- An ADE profile runs only during the device’s first setup. A configuration profile is a setting after the device is already managed.