profilecreator / profilemanifests

Manifest repository for the ProfilePayloads framework

Download

See the latest download in Releases

Contribute

If you want to contribute to the payloads available in this project, please go to the ProfileManifests repo:

ProfileManifests

There is a getting started guite to describe the basics on how to create your own manifest:

ProfileManifests - Getting Started

ProfileCreator

macOS application to create configuration profiles.

System Requirements

ProfileCreator requires macOS 10.12 or newer.

Development

Getting started

In order to develop for ProfileCreator, the following pieces of software are required

• Xcode 14 or higher
• macOS 12.0 or higher

In addition to those pieces of software you will also need to clone ProfilePayloads alongside the ProfileCreator repository (The repositories must be adjacent to each other).

Compiling

In order to compile ProfileCreator, please navigate to where the Xcode Project file is located and run the following command

xcodebuild -project ProfileCreator.xcodeproj -scheme ProfileCreator -configuration Debug

This will compile the application and output the result in the DerivedData path as set by your Xcode preferences. The default DerivedData location will be ~/Library/Developer/Xcode/DerivedData/.

In addition, please take a look at the ProfileManifests project which supplies ProfileCreator with its payloads is very much active!

Have Questions?

Consult the wiki. Join the conversion over in the #profilecreator channel in the MacAdmins Slack.

Acknowledgements

Icon is created by Katherine M. Ahern:

• kateahern.com

UI Icons have been taken from the following sites:

• icons8.com

Open Source code included in this project:

• WFColorCode
• Highlightr

profilemanifests's Issues

Update com.microsoft.autoupdate2 for new force install keys

Posting as a reminder to add these new deadline keys for MAU:

https://docs.microsoft.com/en-us/deployoffice/mac/mau-deadline

Add Notifications iOS Payload (com.apple.notificationsettings)

Per https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf

Add What's New with Mac (com.apple.touristd)

Lot of different gists out there for suppressing the "What's New with Mac" prompts. Would be great if we could make this the one-stop-shop instead.

Add VPN Payload (com.apple.vpn.managed)

Per https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf

Add Per-App VPN Payload (com.apple.vpn.managed.applayer)

Per https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf macOS & iOS

Update Restrictions - Add pfm_range_min for delayed software updates

Preference key for delaying updates by X days is currently listed as ManagedDeferredInstallDelay, but Apple Documentation lists this key as enforcedSoftwareUpdateDelay. I confirmed this in Apple Configurator 2 as well.

Additionally, preference has a max delay of 90 days, so pfm_range_max should be added.

Got myself confused looking at Software Update rather than Restrictions ... oops

Update Microsoft Office (com.microsoft.office)

Add Non-UI Security control preferences per https://youtu.be/Xb3jLxjfDkI?t=3059

Preferences here: https://docs.google.com/spreadsheets/d/1ESX5td0y0OP3jdzZ-C2SItm-TUi-iA_bcHCBvaoCumw

DisableVisualBasicExternalDylibs
AllowVisualBasicToBindToSystem
DisableVisualBasicToBindToPopen
DisableVisualBasicMacScript < already in manifest

Add IsKeyExtractable key to the SCEP Profile

As per Apple's Configuration Profile Reference the SCEP profile does support a boolean key called "IsKeyExtractable" since 10.14.4.

Update Finder preferences (com.apple.finder)

Missing preferences (basing this off 10.14.3 machine)

Keep folders on top in windows when sorting by name - _FXSortFoldersFirst - boolean
Keep folders on top on desktop _FXSortFoldersFirstOnDesktop - boolean
Remove items from the Trash after 30 days FXRemoveOldTrashItems - boolean
etc.

Add Game Center payload for macOS (com.apple.gamed)

While iOS Game Center settings are handled in Restrictions payload, this is separate on macOS, but mirror the purpose of the iOS preferences exactly.

GKFeatureAccountModificationAllowed
GKFeatureAddingGameCenterFriendsAllowed
GKFeatureGameCenterAllowed
GKFeatureMultiplayerGamingAllowed

Add macOS 10.14.4 Restrictions Payload preferences

Don't know where else this is documented, but found here (https://docs.jamf.com/10.11.0/jamf-pro/release-notes/What's_New.html)

allowRemoteScreenObservation
allowScreenShot
forceClassroomUnpromptedScreenObservation
forceClassroomUnpromptedAppAndDeviceLock
forceClassroomAutomaticallyJoinClasses
forceClassroomRequestPermissionToLeaveClasses

Add Manifest for NoMAD Login+

Docs here:
https://files.nomad.menu/NoMADLoginPlusAdminGuide.pdf

I can pick this up at some point.

Add iOS 12 Restrictions Payload preferences

Don't know where else this is documented, but found here (https://docs.jamf.com/10.11.0/jamf-pro/release-notes/What's_New.html)

allowManagedToWriteUnmanagedContacts
allowUnmanagedToReadManagedContacts
allowESIMModification
allowPersonalHotspotModification
allowSiriServerLogging
forceAutomaticDateAndTime
forceDelayedSoftwareUpdates

Update Skype payload with new keys and titles.

The keys for the Skype payload can be confusing. Consider adding an inverted boolean and a proper title to make them work the same. Or just make it more clear what true or false actually is setting.

After a quick googling, the following keys have also been mentioned for com.skype.skype. But I have no idea if they work in this version or if they are for older versions:

• SKDisableWelcomeTour
• SKShowSilentUpgradeNotice
• SKShowWelcomeTour
• SKShowWelcomeOnLogin
• SKSilentUpgradeNoticeScreen
• SKShowSplash
• DialpadOpen

Update com.microsoft.Office365ServiceV2 to note is no longer applies after 16.24

The entire preference domain com.microsoft.Office365ServiceV2 was removed as of Office 16.24 back in April. There is no reason to manage it for newer releases.

Per conversation with @pbowden-msft in Slack: https://macadmins.slack.com/archives/C07UZ1X7B/p1565795925296800

Loginwindow ChangePasswordDisabled not working?

Recently for demo tried adding the ChangePasswordDisabled preference from the Login Window payload to a profile and it wasn't showing up under the Profiles pref pane when deployed via MDM. Tried to confirm the existence of this preference in our MDM within the Login Window payload there, but didn't see it.

Know there's the ability to restrict access the the "Change Password" button in System Preferences, but my memory is failing me if this one-in-the-same, or different ...

Either way, despite exporting the profile and confirming it's presence in the created profile, the preference did not appear when deployed through MDM.

Fix Skype for Business autoDetectAutoDicoveryURLs key spelling

Currently is autoDetectAutoDiscoveryURLs ... but Microsoft developers done goofed and it's actually autoDetectAutoDicoveryURLs

https://techcommunity.microsoft.com/t5/Skype-for-Business-IT-Pro/Skype-for-Business-Mac-client-Preference-Settings/td-p/66530

Update Microsoft Office Manifest

As of this writing, there have been about 50+ preference keys added for Office-related apps. The Google Sheet containing these preference keys are located here: https://docs.google.com/spreadsheets/d/1ESX5td0y0OP3jdzZ-C2SItm-TUi-iA_bcHCBvaoCumw/edit#gid=0

I've intentionally left the preference keys at the bottom of the sheet starting at line 114 (at the time of this writing) so that it would be easier to see the new keys that have been added. You'll know because there's an empty white line between the sorted entries and the new entries that haven't been sorted. It's possible there may be even a few additional keys I've missed related to MAU and other Office apps that aren't part of the main suite. In any case, feel free to let me know if you've got any questions. Probably easiest to reach out to me on Slack: @bp

Also, let me know if you think it'd make sense to add a column specifically for ProfileCreator so we can mark off which keys have been added to the manifests.

com.microsoft.office: add new privacy keys for 16.28

There are new keys for Office from version 16.28 and up. These are mentioned here: https://macadmins.software/docs/16.28-Privacy-Consent.key
More info here: https://docs.microsoft.com/nl-nl/deployoffice/privacy/mac-privacy-preferences
At time of writing the sheet with all the keys is not updated yet: https://goo.gl/UC04oZ

Add manifest for MunkiAdmin

Add App-to-Per-App VPN Mapping Payload (com.apple.vpn.managed.appmapping)

Per https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf

com.microsoft.Edge

Now that Microsoft Edge has consolidated on the com.microsoft.Edge preference domain for all versions (Canary, Developer and Beta) we should work on adding a manifest for it.

https://docs.microsoft.com/en-us/deployedge/configure-microsoft-edge#configure-microsoft-edge-on-mac

https://docs.microsoft.com/en-us/deployedge/microsoft-edge-policies

Since Edge is Chromium based it looks like most, if not all, of the keys are the same as Chrome. So we might be able to re-use that profile as a base to get started.

Update com.microsoft.autoupdate.fba to note it no longer applies after Office 16.27

The SendAllTelemetryEnabled key no longer applies in Office versions after 16.27. There is nothing left to manage in that domain going forward.

Per conversation with @pbowden-msft in Slack: https://macadmins.slack.com/archives/C07UZ1X7B/p1565795925296800

Update Microsoft Office (com.microsoft.autoupdate2)

Change Application ID from MSau03 to MSau04 as of version 4.7.1 of Microsoft AutoUpdate.

MSau03 for all versions prior to 4.7.1.

Getting Username/Password in a profile

Hi there,

I love this app but maybe I have missed something. How do I use the Username and Password for example in Mail? It needs to read {{username}}@domain.com.

Thanks!

Add Santa manifest (com.google.santa)

Just started looking at this again myself. Working on this

https://santa.readthedocs.io/en/latest/deployment/configuration/#local-configuration-profile

Add Education Configuration Payload (com.apple.education)

Per https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf

Allow Firefox Prompt For Download Location

Hello !
Can you add Prompt For Download Location in Firefox Profile ?

<dict>
  <key>PromptForDownloadLocation</key>
  <true/> | <false/>
</dict>

Thanks !

Update Firefox manifests for v68 changes

Changes are documented here: https://github.com/mozilla/policy-templates/releases/tag/v1.8

This release provides support for the following new policies on Firefox 68 and Firefox ESR 68:

DefaultDownloadDirectory
DownloadDirectory
ExtensionSettings
FirefoxHome
LocalFileLinks
NewTabPage
Preferences
PromptForDownloadLocation
SearchSuggestEnabled

It also makes the following changes to existing policies:

RequestedLocales can now use a string so the value can be blank to use the system locale.
SanitizeOnShutdown has been updated to provide more granular configuration.
SearchEngines has been updated to support POST search engines.

Also the README has been completely updated to provide more detailed information about each policy.

Date and Time Prefs

Looking for profile settings for date & time: time zone, time server, clock settings. macOS

Wrong Config level for NoMAD-LoginAD

If I am reading the code manifests correctly the menu.nomad.login.ad.plist file needs the following target set so ProfileCreator will make the profile using the right System-level configuration.

		<key>pfm_targets</key>
		<array>
			<string>system</string>
		</array>

Since I'm not 100% sure how to go about testing this after the code change I'm just going to leave this issue here 😅

Core Services UI Agent key misspelling

Was testing a Mojave machine today and setting CSUIDisable32BitWarning to true, but prompts persisted.

Checked on rtrouton blog and found this same preference, with an added s: rtrouton/profiles@d436ea1

Since pushing this via MCX profile in MDM haven't seen prompt, so I think it's safe to say it's supposed to be CSUIDisable32BitWarnings

Add AirDrop payload for macOS (com.apple.NetworkBrowser)

While AirDrop for iOS is handled in Restrictions payload, this is handled by separate domain.

Add TV Remote iOS Payload (com.apple.tvremote)

Per https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf

Add com.jamf.connect.shares.plist

https://docs.jamf.com/jamf-connect/1.0.0/sync/administrator-guide/File_Shares.html

All information is located within the Jamf guide provided.

All mappings are the same as the menu.nomad.shares.plist which already exists in ProfileCreator.

System Preferences Enabled/Disabled/Hidden Preference Panes

In the main System Preferences payload, it's currently possible to configure any preference pane to be simultaneously enabled, disabled, and hidden, which I'm guessing would cause problems if done in a profile.

It would be helpful once one of these preference panes was configured in one of these areas that it became greyed out and inaccessible from the others to avoid unintended duplicates.

Unsure at the moment about how this could be accomplished ...

Add iOS Single Sign-On Account Payload

Per https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf

Update iOS Restrictions w/ Screen Time preference

https://support.apple.com/guide/mdm/supervised-restrictions-mdm54960f92a/1/web/1

allowEnablingRestrictions

Was previously named "Allow modifying Restrictions (supervised only)" --> "Allow Screen Time (supervised only)"

Add OfficeAutoSignIn to com.microsoft.office

Per https://macadmins.slack.com/archives/C2N7MED7G/p1562834771272700

Update Smart Card payload w/ FieldTokenRemovalAction

"Enable Screen Saver on Smart Card removal" - FieldTokenRemovalAction

from https://docs.jamf.com/10.12.0/jamf-pro/release-notes/What's_New.html

Fix pfm_title for ShowWhatsNewOnLaunch in com.microsoft.office manifest

Currently, the pfm_title for ShowWhatsNewOnLaunch is "Hide what's new message after update". However, when set to true this actually shows what's new on launch messages, rather than hiding them as the pfm_title suggests.

Instead, the pfm_title should be "Show what's new message after update".

Add new Certificate Transparency Payload (com.apple.security.certificatetransparency)

https://support.apple.com/guide/mdm/certificate-transparency-mdmbafaa79ff/1/web/1

https://support.apple.com/en-us/HT205280

https://support.apple.com/guide/mdm/certificate-transparency-custom-payload-mdmd0d176513/1/web/1

Add RelaunchNotification + RelaunchNotificationPeriod to com.google.Chrome.plist

https://www.chromium.org/administrators/policy-list-3#RelaunchNotification

As of Chromium 66 + 67, Google Chrome has the ability to mandate a browser restart and a time period to set this by.

Update Skype for Business Manifest

AutoDetectAutoDicoveryURLs needs to be set to autoDetectAutoDicoveryURLs. The app will ignore the setting otherwise.

Add jamJAR manifest (uk.co.dataJAR.jamJAR)

Github: https://github.com/dataJAR/jamJAR
Wiki: https://github.com/dataJAR/jamJAR/wiki
Preferences documentation: https://github.com/dataJAR/jamJAR/wiki/jamJAR-Preferences

Add Safari Payload (com.apple.Safari)

Have managed a number of Safari settings via MCX profile

ManagedInstalls LicenseInfoURL

Please add a field for LicenseInfoURL in ManagedInstalls (Munki) as described here:
https://github.com/munki/munki/wiki/License-Seat-Tracking

FR: Add manifest organization to allow manifests with same name for differing platforms

Because all related manifests live together, separated and organized only by whether they are a part of Apple's documented payloads, third-party apps, etc., there's not an opportunity to have multiple manifests that have the same filename / domain but deal with different platforms.

As a result, while a Restrictions manifest exists for macOS (com.apple.applicationaccess.plist), it's not possible to have one for iOS since the domains are the same.

Would like to be able to create this manifest for iOS prefs per https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf

Update Firefox manifest

According to this release page, Mozilla added a few new policies/preferences. According to the page, it looks like everything after Dec 14, 2018 (which I'm specifically highlighting below):
https://github.com/mozilla/policy-templates/releases

This release provides support for the following new policies on Firefox 67 and Firefox ESR 60.7:
CaptivePortal
ExtensionUpdate
NetworkPrediction

This release provides support for the following new policies on Firefox 66 and Firefox ESR 60.6:
SSLVersionMin
SSLVersionMax

There were no new policies for Firefox 65/Firefox 60.5 ESR

MunkiReport

Could you add a manifest for MunkiReport. Documentation is below

https://github.com/munkireport/munkireport-php/wiki/Client-Configuration