I make several Restrictions Configuration Profiles based on our needs. I set up smart groups to funnel devices in to the correct Restrictions. Generally I have Three, Low, Medium, and High (default). By and large all devices will fall in to High unless something tells JAMF to do otherwise. There are a few one offs for custom restrictions when needed by a specific business unit.
I do everything for restrictions in the JAMF Pro GUI.
The Restrictions Configuration Profiles I use.
- Low - Used only for environment and business unit testing, highly restricted in terms of how can get it
- iCloud not restricted, AppleID's allowed
- Only Apple Pay is blocked in System Preferences to confirm that function is working
- Erase all contents and settings allowed
- Software updates no deferral
- Medium - Used only for troubleshooting, and all users have a SS policy that will drop them to this configuration for 1hr.
- iCloud restricted, AppleID's allowed
- Very few System Preference panes are blocked
- Erase all contents and settings blocked so people cant wipe their devices
- Software updates Defer 7 days and upgrades 30 days
- High - The Production Environment as a whole
- iCloud totally restricted, No Apples ID's nothing
- Many System Preference panes blocked that we don't want people in
- Erase all contents and settings blocked so people cant wipe their devices
- Software updates Defer 30 days and upgrades 90 days
- There are of course a few one off special restrictions for special use cases.
Beyond what I mentioned there are general restriction differences, but they are not really noteworthy.
How I scope everything.
- Every device is targeted by the High Restriction. Unless one of the following are met
- If a device has a specific flag which a policy sets by creating a file and an EA sees it will be targeted by the Medium restriction
- There is a follow up policy that checks for the existence of the flag and removes it, which will retarget the device for High
- Due to the nature of Low, I have that setup with an Extension Attribute and a Smart group so it must be set within JAMF.
- The one offs are setup with usually off department and excluded from the other restriction's.
- Devices targeted by one set of restrictions are excluded from all other restrictions so there are not any conflicts
Once all this is setup its really no maintenance. Let smart groups do all the scoping and everything happens automatically.
Every one of these exemptions would funnel you in to the scope of a different restriction.
