Managing Apple Devices through Blueprints and Settings

After provisioning an Apple device, you can manage it via the console through a blueprint or its device or group settings. Make the most out of your multi-OS fleets by understanding how blueprints and settings affect devices. 

This article applies to supported versions of iPhones (iOS) and iPads (iOS/iPadOS). See Managing tvOS for a guide on Apple TV management.

In this article: 

• Managing iOS Settings in a Blueprint
  • Understanding blueprint terms
• Apps & Configuration
• Device Mode

  • Multi-app Mode

  • Kiosk Mode

• Application Management
  • Managing preloaded apps 
  • Applying managed configs to iOS apps
• Connectivity

  • Edit Bluetooth

  • Allow Near-Field Communication (NFC)

  • Wi-Fi Access Points

• Device Security
• Display & Branding

  • Screenshot

• Esper Settings

  • Enable PList

• Files
• Hardware Settings

  • Hotspot & USB Tethering

  • Camera

• Platform Services

  • Allow Siri® Assistant

• Sound
• System Updates
• Time & Date

  • Force Automatic Time & Date

• Managing iOS Devices & Groups Settings
  • For Individual Devices
  • For Devices in Groups

Managing iOS Settings in a Blueprint

Blueprints control a device’s look and behavior. They’re designed to manage fleets, including multi-OS ones. 

To create a blueprint, go to Blueprints Manager > Create Blueprint. 

Click on the iOS tab to manage the iOS settings for that section.

Understanding blueprint terms

Version Number: This blueprint’s version. Whenever you make a change, a new version will be saved in the Blueprint Manager. 

Published Status: Indicates if the changes are published or not. Blueprints must be saved before they can be published. 

Sections: The sections that control device configurations such as Wi-Fi connectivity, App Installations, and other software and hardware settings. 

How to Apply

Blueprints determine which configurations are applied and at what point they should be applied. 

Always Apply: The strictest provisioning method. Every time the device interacts with the console, the setting in the blueprint will be applied even if the end-user makes changes, those changes will reset.

For the device user, this means that they are free to change the volume. However, the console user will need to explicitly set the device back to the way it is described in the blueprint to reach its desired state. 

For a console user with permission to make changes to the device, even if they change the device’s volume from the console, the blueprint will revert these changes when it reaches the device. 

The blueprint creator will be able to change the volume if they make a change to the volume setting in the 

Provision Only: The setting will apply once–at the time of provisioning. Some features make sense to set as Provision Only, such as time zone settings if you are provisioning devices that will be shipped to different regions. 

Ignore: The setting will be ignored. At the time of provisioning, it will have whichever settings the device had by default or before provisioning. Changes can be made to this setting at any point. 

In some cases, it makes sense to ignore a device’s brightness settings and let the user control it. Console users with the ability to interact with that device or group will also be able to make changes to these settings.

You can quickly change these settings by using the top dropdown menu of each section. 

Apps & Configuration

Device Mode

Device Mode determines how users will interact with the device. There are two modes: multi-app mode and kiosk mode.

Multi-app Mode

The device mode function lets you switch a device between multi-app mode and kiosk mode. The end user can see and use all the approved apps when a device is in multi-app mode.

Kiosk Mode

When a device is in kiosk mode, the device acts as a kiosk, and end users can only interact with the kiosk app, similar to a pinned app. However, this mode doesn't prevent other apps from running in the background. Other apps can also be accessed from the kiosk app. 

To change a device to kiosk mode, choose kiosk mode in a blueprint.  Then, select the kiosk app from the App Management section of the blueprint. 

You may notice an error when you select this mode.

To resolve it, select the kiosk app from the Application Management section. Scroll down in the Apps & Configuration section to view the Application Management section. 

Application Management 

Add apps from Apple’s®  Volume Purchase Program (via Apple Business Manager) or locally via an IPA upload. 

To add an application, click on Add Application. 

You’ll have the options to: 

• upload an IPA.
• choose from an uploaded application and version.
• add an application from the App Store® (if enrolled in VPP).

Managing preloaded apps

Need granular control over your preloaded apps on the device's homescreen? Set the state for preloaded apps through a blueprint. 

Set Hide Preloaded Apps to Ignore. 

Then, select the app and its state from the Select preloaded apps and set state menu. You can set these apps to Show or Disable. 

All other preloaded apps will be hidden (except the Camera, App Store, Esper Settings, and System Settings). 

Automatic VPP app updates

By default, VPP apps update when a device converges. With automatic VPP app updates enabled, the app updates as soon as a new version is available in the App Store — no converge commands required.

You can enable or disable this per app. In the App Management section of the blueprint, click the Actions menu (...) for the app you want to configure. Under App auto update, select On or Off.

This setting is available for VPP apps on devices in both Kiosk and Multi-app mode. Loading Esper help center style skill

A check for VPP updates occurs every 24 hours. When an update is found, it's automatically pushed to all devices that have automatic updates enabled.

Locking device orientation for Kiosk Mode apps

You can lock the screen orientation for iOS/iPadOS/tvOS apps running in Kiosk Mode, preventing the device from rotating based on its physical position.

In the App Management section of the blueprint, click the Actions menu (...) for the app you want to configure. Under Device Rotation, select Lock to fix the orientation or Allow to permit rotation.

This setting is available for both Enterprise and VPP apps in Kiosk Mode.

Applying managed configs to iOS apps 

To add a managed config to an iOS app, click on that app in the Apps & Configuration section of a blueprint. Learn more about adding dynamic placeholders to iOS applications.

Then enter the keys and values in XML-format. Refer to the app’s documentation for managed configuration information.

When done, apply the changes.Managed configurations will apply only if they are supported by the app. 

<dict> 
   <key>key</key>
   <string>value</string>
</dict>

Connectivity 

Edit Bluetooth®

Once enabled, the user will be able to change the device’s bluetooth settings (from on to off, or from off to on). If disabled, the user will not be able to change the bluetooth settings (i.e., they won’t be able to turn it on if it’s off, or won’t be able to turn it off if it’s on). 

Allow Near-Field Communication (NFC) 

If you want device users to use Near-Field Communication (NFC) on their devices when supported, enable NFC if you don’t, disable it. If any applications require NFC, make sure this setting is enabled. Only available for iOS 14.2+. 

Strict Wi-Fi Synchronization 

When enabled, only the access points listed in the blueprint can be joined. We recommend having a fallback network to mitigate connectivity issues.

Wi-Fi Access Points

Add Wi-Fi access points to connect devices to your network. Once added successfully, the network will appear under your list of networks. 

If you added a network from the Android tab, you’ll need to add the network to the iOS tab as well, even when adding devices to the same network. 

Determine how you want Wi-Fi endpoints to be added to the device. Always Apply applies after every converge. Provision Only will only apply to the device at the time of provisioning. Ignore will ignore the settings and the settings will not be applied.
If you have devices already deployed in the field that should not receive newly added Wi-Fi networks, set Wi-Fi endpoints to Provision Only. This ensures the configuration is applied during provisioning for new devices, while existing devices remain unchanged.

Device Security

Factory Reset

If enabled, device users will be able to perform a factory reset and wipe the device. If disabled, the device user will not be able to factory reset and wipe the device. On the device, this action is called "Erase all content and settings." 

Display & Branding

Screenshot

If enabled, allows device users to take screenshots. If disabled, prevents users from taking a screenshot. 
You will need to enable screenshots to conduct a remote reviewer session. 

Home Screen Wallpaper 

Upload a wallpaper for your home and lock screens. These images should be in portrait format. See Apple’s documentation for suggested resolutions. 

Lock Screen Wallpaper 

Select home screen to set the lockscreen or upload a different screen wallpaper.

Esper Settings

Unlike Android devices, iOS devices do not currently have access to the Esper Settings app. 

Enable plist

Use a plist to customize device behavior beyond its available blueprint settings.

When enabled, allows you to paste a plist. The settings defined in the plist will take precedence over the settings defined in the blueprint.  For example, if you enabled screenshots in the blueprint and disabled screenshots in the plist, the device user would not be able to take screenshots. 

plist restrictions for the Camera app and App Store won't work, but these can be disabled from their respective toggles. 

See Apple’s documentation for a list of Device Management Profile Restrictions. 

Files 

There are currently no File management features available for iOS devices. 

Hardware Settings 

Hotspot & USB Tethering 

Enable or disable the device user from sharing a mobile connection with other devices via USB or Wi-Fi. Only available for iOS 12.2+. 

Camera

Enable or disable the device user from using the camera. 

Platform Services 

Allow Siri® Assistant 

Allow or disable Siri voice commands on the device. 

Enable web content filtering

Create a list of websites to allow or deny when users browse the internet. Limit: 100 URLs. Duplicate URLs will be overwritten. 

Only one type of list may be enabled at a time. To add multiple URLs, separate each URL by a comma.
You can bulk upload a list of URLs through a CSV by clicking on the Bulk Upload button. Download the sample file for an example. 

Sound 

There are currently no Sound management features available for iOS devices. 

System Updates

Defer iOS system updates for up to 90 days after the software release date. For example, if a software update was released 30 days ago, the device user will receive a notification to update after 60 days (even when setting the defer period to 90 days). Only available for iOS 12+ devices.

Time & Date 

Force Automatic Time & Date

Enable automatic syncs based on location. Only available for iOS 12+. 

Managing iOS Devices & Groups Settings

For individual devices

Perform actions on an iOS device from Devices & Groups. Click on the device and then go to the Settings tab. 

Ping Device 

Pings the device and checks if the device is reachable. 

Device Mode

Switch the device experience to Kiosk or Multi-app mode. 

• Kiosk Mode Limits device interaction to a single designated app. Use this action to lock down a device without updating its blueprint. Not supported: webclips or preloaded apps.
• Multi-app Mode Restores access to all apps configured in the device's blueprint. Use this action to exit Kiosk mode without updating its blueprint.

Screen Lock 

Locks the device’s screen. iOS devices return to the home screen. 

Shutdown 

Shut down the iOS device. 

Reboot 

Reboots (restarts) the device. 

Reset or Remove the Device 

Removes Esper and factory resets the device. Learn more about factory resets. 

Clear Passcode 

Removes the passcode. Passcodes can interfere with the device’s ability to receive a blueprint or converge command. We recommend disabling passcodes. The Clear Passcode command will remove a passcode for devices with a passcode enabled. 

For Devices in Groups 

To manage devices as a group, click on the group in Devices & Groups and click on the Actions button. 

App Management 

Install or uninstall the group’s applications. See the Managing iOS Applications article for more information. 

Ping

Pings the device and checks if the device is reachable. 

Screen Lock

Lock the device’s screen. iOS devices return to the home screen. 

Reboot 

Reboots (restarts) the device. 

Send Message 

Sends a broadcast message to devices. Only for Android devices.

Delete Devices

Remove the devices from Esper and/or Factory Reset them. Learn more about removing iOS devices or Android devices.