Profile: Binary Restriction

The Binary Restriction profile allows admins to control which apps and binaries can run on managed devices. On macOS, rules match binaries by code signing properties, so a rule keeps matching the targeted software even if it is moved or renamed. On iOS, iPadOS, tvOS, and visionOS, rules match apps by Bundle ID. The profile is delivered using Declarative Device Management (DDM).

Apple documentation for this configuration can be found here:

Requirements

  • macOS 27+, iOS/iPadOS 27+, tvOS 27+, or visionOS 27+
  • Supervised devices
  • Declarative Device Management enabled on the device

Note: This profile is delivered only as a declaration, so it is not installed on devices that do not meet the requirements above. Multiple Binary Restriction profiles can be assigned to the same device, and the device combines their rules.

Binary Restriction vs. App Restrictions

The Binary Restriction profile is separate from the existing App Restrictions profile (which is iOS/tvOS only). App Restrictions continues to work as before. Existing App Restrictions profiles are not converted, and the two profiles are configured independently. Binary Restriction is the best option for macOS.

To create a Binary Restriction profile:

  1. In SimpleMDM, go to Configs > Profiles.
  2. Click "Create Profile" and select Binary Restriction.
  3. Enter a name for the profile.
  4. Under Restriction Mode, choose Denied Binaries or Allowed Binaries.
  5. Under Binary Rules, add one or more rules. See Binary rules explained below.
  6. Choose the profile's scope settings, then save the profile.
  7. Assign the profile to a device, group, or assignment group.

Restriction Mode

Each profile uses one mode. The default is Denied Binaries.

  • Denied Binaries: Blocks any binary or app matching a rule. Everything else runs normally. On macOS, a denied binary that is already running is also stopped. This is the recommended mode.
  • Allowed Binaries: Only binaries or apps matching a rule can launch. System-critical processes always run. Use this mode with care, as an incomplete allow list can prevent essential apps from running and lock users out of their devices. Test on a small group of devices before deploying widely.
    • This mode extremely aggressive - use it with caution and test thoroughly! It will restrict even critical system processes.

A profile in Allowed Binaries mode must include at least one rule or have an automatic allowance enabled (see below).

Binary rules explained

Each rule identifies software by one required Identify by value, plus optional additional conditions. A binary only matches a rule when all of the rule's conditions match. Rules can also be given an optional Label for your own reference. The label is not sent to the device.

Identify by

For iOS:

  • Bundle ID: The bundle identifier of the app to match, such as com.example.app. A Bundle ID rule cannot be combined with any other condition, and has no effect on macOS.

For macOS:

  • Code Directory Hash: The exact code directory hash of a specific binary, as a 40-character hexadecimal value. Because the hash changes with every build of the app, this matches a single version of a binary. No additional conditions can be added.
  • Team ID: The 10-character Team ID of the developer that signed the binary. This matches all binaries signed by that developer. Apple system binaries that have no Team ID can be matched with *APPLE*.
  • Signing ID (Denied Binaries mode only): The code signing identifier of the binary, such as com.example.app. In Allowed Binaries mode, Signing ID can be added only as an additional condition to a Team ID.

Additional conditions (macOS)

When a rule is identified by Team ID or Signing ID, click "Add condition" to narrow the rule. Conditions are combined, so the binary must match all of them.

  • Team ID: Limits the rule to binaries signed by this Team ID.
  • Signing ID: Limits the rule to binaries with this signing identifier.
  • Path Prefix: Limits the rule to binaries located under this path, such as /Applications/.

Signing State

For macOS rules, select which kinds of code signature the rule applies to. Selecting more than one applies the rule to each selected state.

  • All: Applies to every signing state. Selecting All clears the other options. This is the same as making no selection.
  • TestFlight: Apps distributed through TestFlight.
  • DeveloperID: Apps signed with a Developer ID certificate.
  • Enterprise: Apps signed with an enterprise certificate.
  • AppStore: Apps distributed through the Mac App Store.
  • Apple: Software signed by Apple.

Rule requirements

  • In Denied Binaries mode, macOS rules must include a Code Directory Hash, Team ID, or Signing ID.
  • In Allowed Binaries mode, macOS rules must include a Code Directory Hash or Team ID.
  • A rule cannot combine a Bundle ID with any macOS code signing condition.
  • Duplicate rules are not allowed.

Tip: On a Mac, run codesign -dvvv <path_to_binary> in Terminal to display the Team ID, Signing ID, and other values for a binary. All values are entered manually. You can drag and drop a file from Finder into Terminal to quickly get the full file path.

If you change the Restriction Mode after adding rules, an identifier that is no longer valid for the new mode is kept as an additional condition rather than removed. Review your rules after switching modes.

Allowed Binaries options

When Allowed Binaries is selected, the following options are available. These help avoid blocking software that devices and SimpleMDM need in order to work.

  • Always allow managed apps (macOS): Automatically allows apps installed through MDM. This is off by default. Apps and packages deployed through the SimpleMDM Munki integration or the prestage installer are not treated as managed apps, so they must be added as rules.
  • Always allow Apple system apps (macOS): Allows Apple system apps that do not have a Team ID. This is on by default. Disabling it can block critical macOS processes and severely disrupt the device. Keep this enabled unless you have explicitly allowed the required system software.
  • Allow SimpleMDM iOS app (iOS): Allows the SimpleMDM app. This is on by default. Disabling it prevents some SimpleMDM iOS features, such as location tracking and push messaging, from working.
  • Allow SimpleMDM Munki agent (macOS): Allows the SimpleMDM agent. This is on by default. Disabling it prevents some SimpleMDM macOS features, such as software installation through the Munki integration, from working.
  • Allow SimpleMDM & Microsoft apps for Device Compliance integration (macOS, iOS): Allows the SimpleMDM and Microsoft apps used by the Device Compliance integration. This is on by default. Disabling it prevents some device compliance features from working.

These options are not available in Denied Binaries mode, where nothing is blocked unless a rule matches it.

Notes

  • Rules apply per platform. Code signing rules apply only to macOS devices, and Bundle ID rules apply only to iOS, iPadOS, tvOS, and visionOS devices. A profile that has no rules applicable to the platforms it is scoped to cannot be saved. Add rules for the relevant platform or adjust the profile's allowed platforms.
  • When a profile is assigned to a mix of platforms, each device receives only the rules that apply to it.
  • Because a rule's code signing values must be entered manually, test rules on a single device before assigning them widely.
  • The profile is applied to the device as a declaration, so there is no profile to view in the device's installed profiles list.
  • Multiple profiles configured using the "Denied Binaries" mode can be applied per device; however, only one profile in "Allowed Binaries" mode can be applied per device.
Eric McCann
Updated
Was this article helpful?

Related articles