Managing Safari Settings with Enterprise MDM Profiles

This article provides a comprehensive guide for enterprise IT administrators on how to configure and secure the Safari web browser across corporate Apple devices using Mobile Device Management (MDM) configuration profiles. It covers the exact payloads, property list (plist) keys, and restriction settings required to standardize the browser homepage, deploy essential corporate bookmarks, and enforce stringent web security policies on both macOS and iOS/iPadOS.

Understanding Safari MDM Payloads

To manage Safari, administrators deploy .mobileconfig profiles via an MDM solution. Because macOS and iOS/iPadOS handle browser management differently, configurations are split into two main methods:

  • macOS: Uses a Custom Settings payload targeting the com.apple.Safari preference domain.
  • iOS/iPadOS: Uses the standard Restrictions payload (com.apple.applicationaccess) and the Web Content Filter payload (com.apple.webcontent-filter), requiring the devices to be Supervised.

Setting the Safari Homepage

Setting a default homepage is natively supported on macOS. While iOS does not have a traditional "homepage" setting in Safari, administrators can achieve a similar result using Web Clips.

macOS Configuration

Deploy a plist file targeting the com.apple.Safari domain with the following keys to set and lock the homepage:

  • Set the URL: Use the HomePage key (String) and set the value to your desired URL (e.g., https://intranet.company.com).
  • Enforce on New Windows: Use the NewWindowBehavior key (Integer) and set the value to 0. This forces new Safari windows to open the specified homepage.
  • Enforce on New Tabs: Use the NewTabBehavior key (Integer) and set the value to 0. This forces new tabs to open the homepage rather than the start page or an empty page.

Deploying Corporate Bookmarks

Administrators cannot easily edit a user's local bookmark file without overwriting personal data. Instead, MDM provides non-destructive ways to push corporate links.

iOS/iPadOS Managed Bookmarks

You can inject a read-only folder of corporate bookmarks directly into the iOS Safari Bookmarks menu using the Web Content Filter payload (com.apple.webcontent-filter):

  1. Set the FilterType to BuiltIn.
  2. Add the PermittedURLs or configure the WhitelistedBookmarks array.
  3. For each bookmark in the array, define the URL (String), Title (String), and BookmarkPath (String) to organize them into folders.

Web Clips (iOS/iPadOS and macOS)

As an alternative to in-browser bookmarks, use the Web Clips payload (com.apple.webClip.managed). This places a direct link icon on the iOS Home Screen or in the macOS Dock.

  • URL: The target web address.
  • Label: The name displayed under the icon.
  • IsRemovable: Set to false to prevent users from deleting the shortcut.

Enforcing Security and Privacy Policies

Securing the browser is critical for preventing data leakage and phishing attacks. Below are the essential security policies and the corresponding keys for macOS (com.apple.Safari) and iOS (com.apple.applicationaccess).

1. Disable AutoFill

Preventing Safari from saving passwords and credit cards ensures sensitive data is stored only in approved enterprise password managers.

  • macOS Keys: Set AutoFillPasswords, AutoFillCreditCardData, and AutoFillFromAddressBook to false.
  • iOS Key: Set safariAllowAutoFill to false.

2. Enforce Fraudulent Website Warnings

This setting forces Safari to check visited URLs against known lists of phishing and malware sites.

  • macOS Key: Set WarnAboutFraudulentWebsites to true.
  • iOS Key: Set safariForceFraudWarning to true.

3. Block Pop-Up Windows

Blocking pop-ups mitigates the risk of malicious redirects, adware, and scareware.

  • macOS Key: Set WebKitJavaScriptCanOpenWindowsAutomatically and com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptCanOpenWindowsAutomatically to false.
  • iOS Key: Set safariAllowPopups to false.

4. Prevent Cross-Site Tracking and Manage Cookies

Restricting cookies and tracking protects corporate network traffic from third-party profiling.

  • macOS Key: Set BlockStoragePolicy (Integer) to configure cookie blocking, and set WebKitPreferences.storageBlockingPolicy to 1 to block third-party cookies.
  • iOS Key: Set safariAcceptCookies (Integer) to 0 (Never), 1 (From visited sites), or 2 (Always). Set OneTimePasscodeAutoFill to false if you wish to stop SMS code interception.

5. Manage JavaScript

While most modern web apps require JavaScript, high-security environments may require disabling it entirely.

  • macOS Key: Set WebKitJavaScriptEnabled and com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptEnabled to false.
  • iOS Key: Set safariAllowJavaScript to false.

Deployment Best Practices

  • Scope Appropriately: On macOS, deploy the com.apple.Safari payload at the Device/Computer level rather than the User level to ensure consistency across shared machines.
  • Validate Plist Syntax: Before uploading a custom plist to your MDM, run plutil -lint filename.plist in the macOS Terminal to ensure there are no syntax errors.
  • Test in Staging: Blocking JavaScript or cookies can break Single Sign-On (SSO) workflows. Always test your Safari security profile on a pilot group of IT devices before a company-wide rollout.