Safari extensions management declarative configuration for Apple devices

Use the Safari extensions configuration to provide management of Safari extensions on iPhone, iPad, and Mac devices that enroll in a device management service.

Safari extensions enhance and customize the web browsing experience on iPhone, iPad, and Mac. In iOS 18, iPadOS 18, macOS 15, or later, organizations can use a device management service to manage how they use Safari extensions on supervised devices. For example, a business may want to install and turn on specific extensions to provide access to internal services, or an educational institution may want to prevent students from using extensions that provide information that goes against school policy. These extension management features work for standard browsing and Private Browsing, and include:

Defining which extensions are allowed
Controlling which extensions are always on or always off
Configuring an extension to access websites by specific domains and subdomains

The Service configuration files configuration supports the following:

Minimum supported operating system versions and channels: iOS 18, iPadOS 18, Shared iPad device, Shared iPad user, macOS 15 user.
Requires supervision: Yes.
Supported enrollment methods: Device Enrollment (macOS), Automated Device Enrollment (iOS, iPadOS, macOS).

Setting	Description	Required
Any	The composed identifier of the managed extension, or “*” for all extensions. In order for the extension to be managed, its host app needs to be present on the device. To generate this string use `codesign -dv <path_to_appex>`. The browser extension is located in the PlugIns folder inside the app bundle. The expected format is `Identifier` (`TeamIdentifier`). For extensions that aren’t also available on macOS the app developer needs to provide this information.	No
State	Controls whether an extension is allowed. Options are: Allowed Always On Always Off	No
Private Browsing	Controls whether an extension is allowed in Private Browsing. Options are: Allowed Always On Always Off	No
Allowed domains	Controls the domains and sub-domains the extension is granted access to. Any non-prefixed domains take precedence over prefixed domains, and `DeniedDomains` takes precedence over `AllowedDomains`. Any domains not specified in `AllowedDomains` or `DeniedDomains` are configurable by the user.	No
Denied domains	Controls the domains and sub-domains the extension isn’t allowed to access. Any non-prefixed domains take precedence over prefixed domains, and `DeniedDomains` takes precedence over `AllowedDomains`. Any domains not specified in `AllowedDomains` or `DeniedDomains` are configurable by the user.	No

Note: Each device management service developer implements these settings differently. To learn how various Safari extensions management settings are applied to your devices and users, consult your developer’s device management service documentation.

Helpful?

Apple Platform Deployment

Safari extensions management declarative configuration for Apple devices