Profiles are the primary means to manage devices. Configure profiles so your visionOS devices remain secure and configured to your preferred settings. You can think of profiles as the settings and rules that, when combined with compliance policies, help you enforce corporate rules and procedures. They contain the settings, configurations, and restrictions that you want to enforce on devices.
A profile consists of the general profile settings and a specific payload. Profiles work best when they contain only a single payload.
visionOS profiles apply to a device at either the user level or the device level. When creating visionOS profiles, you select the level the profile applies to. Some profiles can only be applied to the user level or device level.
Supervised Mode Requirement for Profiles
You can deploy some or all your visionOS devices in Supervised mode. Supervised mode is a device-level setting that provides administrators with advanced management capabilities and restrictions.
Certain profile settings are available only to supervised devices. A supervised setting is tagged using an icon displayed to the right, which indicates the minimum visionOS requirement needed for enforcement.
For example, prevent end users from using FaceTime, by deselecting the toggle next to Allow FaceTime in the Restrictions Profile. The visionOS 2.0 + Supervised icon means only devices that are running visionOS 2.0 and set up in Supervised mode using Automated Device Enrollment are affected by this restriction.
Configure a visionOS Profile
Using the following basic steps you can configure any visionOS profile in the Omnissa Workspace ONE UEM. Explore the available settings for each profile in the following sections.
-
Navigate to Resources > Profiles & Baselines > Profiles and select Add > Apple visionOS > Device Profile.
-
Configure the profile’s Name setting.
-
Select the payload from the list.
-
Configure the profile settings.
-
Select Save and Publish.
Custom Settings Profile
The Custom Settings payload can be used when Apple releases new visionOS functionality or features that Omnissa Workspace ONE UEM does not currently support through its native payloads. If you do not want to wait for the newest release of Workspace ONE UEM to control these settings, you can use the Custom Settings payload and XML code to enable or deactivate certain settings manually.
You might want to copy your profile and save it under a “test” organization group to avoid affecting users before you are ready to Save and Publish. Do not assign a profile to any smart group as it might give an encrypted value when viewing XML.
-
Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > visionOS.
-
Configure the profile’s General settings.
-
Configure the appropriate payload (for example, Restrictions or Passcode).
-
Select Save and Publish.
Note: Ensure that the profile created in Steps 1–4 is not assigned to any smart group. Otherwise, the data might be encrypted when viewing xml.
-
Navigate back to the Profiles page and select a profile using the radio button next to the profile name. Menu options appear above the list.
-
Select <!–--> XML from the menu choices. A View Profile XML window appears.
-
Look for the PayloadContent key and copy the single dictionary nested inside. Copy the entire dictionary content from
<dict>…</dict>. See below for sample XML for the Restrictions payload.
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>safariAcceptCookies</key>
<real>2</real>
<key>safariAllowAutoFill</key>
<true />
<key>PayloadDisplayName</key>
<string>Restrictions</string>
<key>PayloadDescription</key>
<string>RestrictionSettings</string>
<key>PayloadIdentifier</key>
<string>745714ad-e006-463d-8bc1-495fc99809d5.Restrictions</string>
<key>PayloadOrganization</key>
<string></string>
<key>PayloadType</key>
<string>com.apple.applicationaccess</string>
<key>PayloadUUID</key>
<string>9dd56416-dc94-4904-b60a-5518ae05ccde</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDescription</key>
<string></string>
<key>PayloadDisplayName</key>
<string>Block Camera/V_1</string>
<key>PayloadIdentifier</key>
<string>745714ad-e006-463d-8bc1-495fc99809d5</string>
<key>PayloadOrganization</key>
<string></string>
<key>PayloadRemovalDisallowed</key>
<false />
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>86a02489-58ff-44ff-8cd0-faad7942f64a</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>
For more examples and information on the XML code, refer to the KB article
-
If you see encrypted text between dict tags in the XML window, you can generate the decrypted text by modifying the settings in the profiles page. To do this:
-
Navigate to Groups & Settings > All Settings > Devices > Users > Apple > Profiles.
-
Override the custom settings option.
-
Deactivate Encrypt Profiles option and then Save.
-
-
Navigate back to Custom Settings profile and paste the XML you copied in the text box. The XML code you paste should contain the complete block of code, from
to . -
Remove the original payload you configured by selecting the base payload section, for example, Restrictions, Passcode and selecting the minus [-] button. You can now enhance the profile by adding custom XML code for the new functionality.
-
Select Save and Publish.
Configure a Restrictions Profile
You can configure device restrictions,application level restrictions, iCloud restrictions etc on your visionOS devices.
Configure the restrictions profile settings including:
| Setting | Description |
|---|---|
| Device Functionality | Device-level restrictions can deactivate the core device functionality such as the camera, FaceTime, Siri, and in-app purchases to help improve productivity and security. |
| Applications | Application-level restrictions deactivates certain applications such as YouTube, iTunes, and Safari, or some of their features, to enforce corporate use policies. |
| iCloud | Omnissa Workspace ONE UEM provides restrictions for visionOS 1.1 and later devices that can deactivated iCloud or iCloud functionality if needed. |
| Security & Privacy | Security and privacy-based restrictions prohibit end users from performing certain actions that might violate corporate policy or otherwise compromise their device. |
| Data Loss Prevention | Data loss prevention restrictions prevent end users from using AirDrop to share files with other macOS computers and visionOS devices, Allow managed apps to write contacts to unmanaged contacts accounts etc. |
For more details on specific restrictions for visionOS, refer to Apple documentation.
Wi-Fi Profile
Configuring a Wi-Fi profile allows devices to connect to corporate networks, even if they are hidden, encrypted, or password protected. This payload is useful to end users who travel and use their own unique wireless network or to end users in an office setting where they are able to automatically connect their devices to a wireless network on-site.
- Configure the wi-fi settings including:
| Setting | Description |
|---|---|
| Service Set Identifier | Enter the name of the network where the device connects. |
| Hidden network | Enter a connection to a network that is not open or broadcasting. |
| Auto-Join | Determine whether the device automatically connects to the network when starting the device. The device keeps an active connection until the device is restarted or a different connection is chosen manually. |
| Enable IPv6 | Deselect this option to disable IPv6 |
| Security Type | Select the type of access protocol to be used. Enter the Password or select the Protocols that apply to your Wi-Fi network. |
| Protocols | Choose protocols for network access. This option appears when WiFi and Security Type is any of the Enterprise choices. This option also appears when Ethernet is selected. |
| Wi-Fi Hotspot 2.0 | Enable Wi-Fi Hotspot 2.0 functionality and is only available for visionOS 1.1 and higher devices. Hotspot 2.0 is a type of public-access Wi-Fi that allows devices to identify and connect seamlessly to the best match access point. Carrier plans must support Hotspot 2.0 for it to function correctly. |
| HESSID | The HESSID used for Wi-Fi Hotspot 2.0 negotiation |
| Domain Name | Enter the domain name of the Passpoint service provider. |
| Allow connecting to roaming partner Passpoint networks | Enable roaming to partner Passpoint networks. |
| Displayed Operator Name | Enter the name of the Wi-Fi hotspot service provider. |
| Roaming Consortium Organization ID | Enter the roaming consortium organization identifiers. |
| Network Access ID | Enter the Network Access ID realm names. |
| MCC/MNC | Enter the Mobile Country Code/Mobile Network Configuration formatted as a 6-digit number. |
| Authentication | Configure Authentication settings that vary by protocol. |
| User name | Enter the username for the account. |
| User Per-Connection Password | Request the password during the connection and send with authentication. |
| Password | Enter the password for the connection. |
| Identity Certificate | Select the certificate for authentication. |
| Outer Identity | Select the external authentication method. |
| TLS Certificate Required | Enable to allow for two-factor authentication for EAP-TTLS, PEAP, or EAP-FAST. Select disabled to allow for zero-factor authentication for EAP-TLS. |
| TLS Minimum Version | Select the minimum TLS version 1.0, 1.1, and 1.2. If no value is selected, the minimum TLS version defaults to 1.0. Note: and Maximum TLS versions can be configured only for TLS, TTLS, EAP-Fast, and PEAP protocol types. |
| TLS Maximum Version | Select the maximum TLS version 1.0, 1.1, and 1.2. If no value is selected, the maximum TLS version defaults to 1.2. |
| Trusted Certificates | These are the trusted server certificates for your Wi-Fi network. |
| Trusted Server Certificate Names | Enter the trusted server certificate names. |
| Allow Trust Exceptions | Allow end users to make trust decisions. |
- Configure Proxy settings for either Manual or Auto proxy types.
- If you use a Cisco infrastructure, configure the QoS Marking Policy (visionOS 1.1 and higher).
| Setting | Description |
|---|---|
| Fastlane QoS Marking | Select the marking setup that you require. |
| Enable QoS Marking | Select this option to choose apps for prioritized data allocations. |
| Allow Apple Calling | Select Allow Apple Calling to add Apple Wifi Calling to your QoS allowlist. |
| Allow Apps for QoS Marking | Search for and add Apps to allocate prioritized data. |
- Configure Captivate Portal to bypass the portal.
- Select Save & Publish when you are finished to push the profile to devices.
Credentials Profile
Even if you protect your corporate email, Wi-Fi and VPN with strong passcodes and other restrictions, your infrastructure may remain vulnerable to brute force and dictionary attacks, in addition to employee error. For greater security, you can implement digital certificates to protect corporate assets.
To assign certificates, you must first define a certificate authority. Then, configure a Credentials payload alongside your Wi-Fi payload. Each of these payloads has settings for associating the certificate authority defined in the Credentials payload.
To push down certificates to devices, you must configure a Credentials payload as part of the profiles you created for Wi-Fi settings. Use the following instructions to create a certificate-enabled profile:
-
Navigate to Resources > Profiles & Baselines > Profiles > Add and select visionOS from the platform list.
-
Configure the profile’s Name settings.
-
Select either the Wi-Fi payload to configure. Fill out the necessary information, depending on the payload you selected.
-
Select the Credentials payload.
-
Choose one option from the Credentials Source menu:
-
Choose to Upload a certificate and enter the Certificate Name.
-
Choose Defined Certificate Authority and select the appropriate Certificate Authority and Certificate Template.
-
Choose User Certificate and the use for the S/MIME certificate.
-
Choose Derived Credentials and select the appropriate Key Usage based on how the certificate is used. Key Usage options are Authentication, Signing, and Encryption.
-
-
Navigate back to the previous payload for Wi-Fi.
-
Specify the Identity Certificate in the payload:
- Wi-Fi - Select a compatible Security Type (WEP Enterprise, WPA/WPA2 Enterprise or Any (Enterprise)) and select the Identity Certificate under Authentication.
-
Navigate back to Credentials payload.
-
Select Save & Publish after configuring any remaining settings.
Was this page helpful?