System Extensions

com.apple.system-extension-policy

The payload that configures system extensions.

macOS 10.15+

Not available with User Enrollment · macOS: device channel only

Configuration Keys (7)

Key	Type	Title	Description	Default	Range
`AllowUserOverrides` If 'false', restricts users from approving additional system extensions that configuration profiles don't explicitly allow. Default: true	boolean	Allow users to approve system extensions	If 'false', restricts users from approving additional system extensions that configuration profiles don't explicitly allow.	true	—
`AllowedTeamIdentifiers` An array of team identifiers that defines valid, signed system extensions that are allowable to load. Approved system extensions are those signed with any of the specified team identifiers. To avoid requiring an administrator to authorize the operation, you can activate system extensions that this key specifies using 'OSSystemExtensionActivationRequest API'. It's an error for the same team identifier to appear in both this array and as a key in the 'AllowedSystemExtensions' dictionary.	array	Allowed Team Identifiers	An array of team identifiers that defines valid, signed system extensions that are allowable to load. Approved system extensions are those signed with any of the specified team identifiers. To avoid requiring an administrator to authorize the operation, you can activate system extensions that this key specifies using 'OSSystemExtensionActivationRequest API'. It's an error for the same team identifier to appear in both this array and as a key in the 'AllowedSystemExtensions' dictionary.	—	—
`AllowedTeamIdentifiersItem`	string	Team Identifier	—	—	—
`AllowedSystemExtensions` A dictionary of approved system extensions on the computer. The dictionary maps the team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension to install. To avoid requiring an administrator to authorize the operation, you can activate system extensions that this key specifies using 'OSSystemExtensionActivationRequest API'. It's an error for the same team identifier to appear in both the 'AllowedTeamIdentifiers' array and as a key in this dictionary.	dict	Allowed System Extensions	A dictionary of approved system extensions on the computer. The dictionary maps the team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension to install. To avoid requiring an administrator to authorize the operation, you can activate system extensions that this key specifies using 'OSSystemExtensionActivationRequest API'. It's an error for the same team identifier to appear in both the 'AllowedTeamIdentifiers' array and as a key in this dictionary.	—	—
`{{key}}`	string	Team Identifier	—	—	—
`{{value}}` The mapping of team identifiers to arrays of bundle identifiers, where the bundle identifier defines the system extension to install.	array	Bundle Identifier	The mapping of team identifiers to arrays of bundle identifiers, where the bundle identifier defines the system extension to install.	—	—
`AllowedSystemExtensionsItems`required Allowed system extension bundle ID	string	Bundle Identifier	Allowed system extension bundle ID	—	—
`ANY` The mapping of team identifiers to arrays of bundle identifiers, where the bundle identifier defines the system extension to install.	array	—	The mapping of team identifiers to arrays of bundle identifiers, where the bundle identifier defines the system extension to install.	—	—
`AllowedSystemExtensionsItems`required Allowed system extension bundle ID	string	—	Allowed system extension bundle ID	—	—
`AllowedSystemExtensionTypes` A dictionary that maps a team identifier to an array of strings, where each string is a type of system extension that you can install for that team identifier. The allowed extension types are 'DriverExtension', 'NetworkExtension', and 'EndpointSecurityExtension'. If there's no entry for a specified team identifier in the dictionary, the system allows all extension types.	dict	Allowed System Extension Types	A dictionary that maps a team identifier to an array of strings, where each string is a type of system extension that you can install for that team identifier. The allowed extension types are 'DriverExtension', 'NetworkExtension', and 'EndpointSecurityExtension'. If there's no entry for a specified team identifier in the dictionary, the system allows all extension types.	—	—
`{{key}}`	string	Team Identifier	—	—	—
`{{value}}` The mapping of team identifier to an array of strings, where each string is a type of system extension that you can install for that team identifier.	array	System Extension Types	The mapping of team identifier to an array of strings, where each string is a type of system extension that you can install for that team identifier.	—	—
`AllowedSystemExtensionTypesItems`required Permitted System Extension Type Range: Driver (DriverExtension), Network (NetworkExtension), Endpoint Security (EndpointSecurityExtension)	string	System Extension Type	Permitted System Extension Type	—
`ANY` The mapping of team identifier to an array of strings, where each string is a type of system extension that you can install for that team identifier.	array	—	The mapping of team identifier to an array of strings, where each string is a type of system extension that you can install for that team identifier.	—	—
`AllowedSystemExtensionTypesItems`required Permitted System Extension Type	string	—	Permitted System Extension Type	—	—
`RemovableSystemExtensions` macOS 12.0+ A dictionary of system extensions that are allowed to remove themselves from the machine. The dictionary maps team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension. An application using the 'OSSystemExtensionDeactivationRequest' API can deactivate the specified system extensions without requiring an administrator to authorize the operation.	dict	Removable System Extensions	A dictionary of system extensions that are allowed to remove themselves from the machine. The dictionary maps team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension. An application using the 'OSSystemExtensionDeactivationRequest' API can deactivate the specified system extensions without requiring an administrator to authorize the operation.	—	—
`{{key}}`	string	Team Identifier	—	—	—
`{{value}}` The dictionary maps team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension.	array	Bundle Identifier	The dictionary maps team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension.	—	—
`RemovableSystemExtensionsItems`required Removed system extension bundle ID	string	Bundle Identifier	Removed system extension bundle ID	—	—
`ANY` The dictionary maps team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension.	array	—	The dictionary maps team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension.	—	—
`RemovableSystemExtensionsItems`required Removed system extension bundle ID	string	—	Removed system extension bundle ID	—	—
`NonRemovableSystemExtensions` macOS 15.0+ A dictionary of system extensions on the computer. The dictionary maps the team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension which can't be disabled or uninstalled when SIP is enabled. It's an error for the same mapping to appear in the dictionary values corresponding to 'RemovableSystemExtensions' and 'NonRemovableSystemExtensions' keys.	dict	—	A dictionary of system extensions on the computer. The dictionary maps the team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension which can't be disabled or uninstalled when SIP is enabled. It's an error for the same mapping to appear in the dictionary values corresponding to 'RemovableSystemExtensions' and 'NonRemovableSystemExtensions' keys.	—	—
`{{key}}`	string	—	—	—	—
`{{value}}` System extension bundle identifiers	array	—	System extension bundle identifiers	—	—
`NonRemovableSystemExtensionsItems`required Non Removable system extension bundle ID	string	—	Non Removable system extension bundle ID	—	—
`ANY` System extension bundle identifiers	array	—	System extension bundle identifiers	—	—
`NonRemovableSystemExtensionsItems`required Non Removable system extension bundle ID	string	—	Non Removable system extension bundle ID	—	—
`NonRemovableFromUISystemExtensions` macOS 15.0+ A dictionary of system extensions on the computer. The dictionary maps the team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension which can't be disabled or uninstalled from System Settings or Finder. The set of system extensions between 'RemovableSystemExtensions' and 'NonRemovableFromUISystemExtensions' can't overlap.	dict	—	A dictionary of system extensions on the computer. The dictionary maps the team identifiers (keys) to arrays of bundle identifiers, where the bundle identifier defines the system extension which can't be disabled or uninstalled from System Settings or Finder. The set of system extensions between 'RemovableSystemExtensions' and 'NonRemovableFromUISystemExtensions' can't overlap.	—	—
`{{key}}`	string	—	—	—	—
`{{value}}` System extension bundle identifiers	array	—	System extension bundle identifiers	—	—
`NonRemovableFromUISystemExtensionsItems`required Non Removable from UI system extension bundle ID	string	—	Non Removable from UI system extension bundle ID	—	—
`ANY` System extension bundle identifiers	array	—	System extension bundle identifiers	—	—
`NonRemovableFromUISystemExtensionsItems`required Non Removable from UI system extension bundle ID	string	—	Non Removable from UI system extension bundle ID	—	—