Overview
The Apple Sharing Restrictions Policy controls how managed Apple devices share content and services. You can:
lock the Mac's Sharing settings, such as File Sharing, Printer Sharing, Internet Sharing, and Remote Management
turn off Remote Login (SSH), guest access to shared folders, and the Mac's built-in web and NFS servers
turn off content caching and file transfers with Finder
block screenshots and screen recording
stop iPhones and iPads from helping set up nearby new devices
All settings are on by default. A new policy with no changes doesn't restrict anything.
Important: The "Modification" settings lock the current state. They don't turn sharing off. Settings such as Allow File Sharing Modification stop users from changing that setting in System Settings. If File Sharing is already on, it stays on, and users can't turn it off. To make sure a service is off, turn it off on the Mac before the policy applies.
The four Mac services settings work differently: they actually turn their service off. See Mac services below.
Supported platforms and requirements
Item | Details |
Platforms | macOS, iOS, iPadOS |
Minimum OS | macOS 10.14, iOS 13.0, iPadOS 13.0 (most Mac settings need macOS 14; see the table) |
Device ownership | Company-owned devices; BYOD Macs, iPhones, and iPads |
Supervision | Required only for Allow Setting Up New Nearby Devices |
Swif agent | Required for the four Mac services settings |
BYOD devices. On devices enrolled with Apple User Enrollment, Apple allows only Allow Screenshot. All other settings require device enrollment. See BYOD Limitation (Apple, Windows).
Settings reference
Mac Sharing settings
These settings correspond to the services in System Settings > General > Sharing. When a setting is off, users can't change that service. Whatever state it's in stays as it is.
Setting | What it does when turned off | Default | Minimum OS |
Allow File Sharing Modification | Users can't change File Sharing. | On | macOS 14 |
Allow Printer Sharing Modification | Users can't change Printer Sharing. | On | macOS 14 |
Allow Internet Sharing Modification | Users can't change Internet Sharing. | On | macOS 14 |
Allow Remote Management Modification | Users can't change Remote Management (Apple Remote Desktop). | On | macOS 14 |
Allow Remote Apple Events Modification | Users can't change Remote Apple Events. | On | macOS 14 |
Allow Bluetooth Sharing Modification | Users can't change Bluetooth settings in System Settings. | On | macOS 14 |
Allow Media Sharing Modification | Users can't change Media Sharing. | On | macOS 15.1 |
Turn off a setting to lock that service in its current state.
Other Mac settings
Setting | What it does when turned off | Default | Minimum OS |
Allow Content Caching | Turns off content caching on the Mac. | On | macOS 10.13 |
Allow File Transfer Using Finder or iTunes | Turns off iTunes file sharing services, which transfer files between the Mac and connected devices. Finder handles these transfers on macOS 10.15 and later; test the effect on your macOS versions. | On | macOS 10.13 |
Unlike the Mac Sharing settings, Allow Content Caching turns caching off; it doesn't just lock the setting. Keep it on for Macs that serve as content caches for your network.
Mac services
These settings use the Swif agent instead of a configuration profile. Unlike the Mac Sharing settings above, they turn the service off, and the agent keeps it off.
Setting | What it does when turned off | Default | Minimum OS |
Allow Guests to Connect to Shared Folders | Turns off guest access to shared folders (SMB). | On | macOS 12 |
Allow Remote Login (SSH) | Turns off Remote Login. SSH sessions that are already open aren't ended. | On | macOS 12 |
Allow HTTP Server | Turns off the Mac's built-in web server (Apache). | On | macOS 12 |
Allow NFS Server | Turns off the Mac's NFS server. The exports file ( | On | macOS 12 |
Turning a setting back on doesn't turn the service back on. When a setting is on, Swif leaves the service as it is. It never turns a service on. To use the service again, turn on the setting, then turn the service on manually on the Mac.
These settings require the Swif agent to be installed and running on the Mac.
All platforms
Setting | What it does | Default | Platforms and minimum OS | Supervision |
Allow Screenshot | When off, users can't take screenshots or record the screen. The Classroom app also can't observe the screen. | On | macOS 10.14.4, iOS 3.1, iPadOS 13.0 | Not required |
Allow Setting Up New Nearby Devices | When off, the device doesn't offer to help set up a nearby new device (Quick Start). Starting with iOS 26.3, it also can't export data to set up a new Android device. Ignored on Shared iPad. | On | iOS 11.0, iPadOS 13.0 | Required |
Before you start
Decide which sharing services should be on or off on your Macs.
Set each service to the state you want before the policy locks it.
Install the Swif agent on Macs where you want to turn off Remote Login, guest access, or the web or NFS servers.
Identify Macs that are content caches. Leave Allow Content Caching on for them, or exclude them from a policy that turns it off.
Check supervision for iPhones and iPads that need Allow Setting Up New Nearby Devices.
Create the policy
In Swif, go to Device Management > Policies, then select Create new policy > Configure a Policy.
Select Apple Sharing Restrictions Policy.
Enter a clear name, such as
Mac Sharing – Locked.Turn off each Mac Sharing setting you want to lock, and each Mac service you want turned off.
Set Allow Content Caching, Allow File Transfer Using Finder or iTunes, Allow Screenshot, and Allow Setting Up New Nearby Devices.
Save the policy.
Assign it to a device group.
Test on a few devices before a wider rollout.
Example configurations
Example 1: Company Macs with sharing locked
Sharing services are already off on these Macs, and users shouldn't turn them on.
Setting | Value |
All Mac Sharing settings | Off |
Allow Remote Login (SSH) | Off |
Allow Guests to Connect to Shared Folders | Off |
Allow HTTP Server | Off |
Allow NFS Server | Off |
Allow Content Caching | Off |
Allow File Transfer Using Finder or iTunes | Off |
Allow Screenshot | On |
Example 2: Office Macs that share a printer and cache content
Setting | Value |
Allow Printer Sharing Modification | On |
Allow Content Caching | On |
Other Mac Sharing settings | Off |
Allow Screenshot | On |
Example 3: Supervised iPhones handling sensitive data
Setting | Value |
Allow Screenshot | Off |
Allow Setting Up New Nearby Devices | Off |
Users can't capture the screen or move data to a new device with Quick Start.
Verify the policy
Mac
Open System Settings > General > Device Management and open the Swif profile. Confirm that it includes the restrictions.
Open System Settings > General > Sharing. Locked services should be grayed out, and their on/off state shouldn't be changeable.
If Allow Content Caching is off, confirm that Content Caching is off.
If Allow Remote Login (SSH) is off, confirm that Remote Login is off in System Settings > General > Sharing, and that a new SSH connection to the Mac is refused.
If Allow Screenshot is off, press Shift-Command-3 and confirm that no screenshot is saved.
iPhone or iPad
Go to Settings > General > VPN & Device Management, open the Swif profile, and confirm that it lists Restrictions.
If Allow Screenshot is off, try taking a screenshot.
If Allow Setting Up New Nearby Devices is off, bring a new device nearby and confirm that no setup prompt appears.
In Swif, open the device and confirm that the policy shows as applied.
Troubleshooting
A sharing service is still on, and users can't turn it off
The policy locks the current state. Temporarily turn on that service's Modification setting, turn the service off on the Mac, then turn the setting off again.
Remote Login, the web server, or the NFS server is still on
Check that the Swif agent is installed and running on the Mac.
Check that the Mac runs macOS 12 or later.
Wait for the agent to check in, then check again.
An SSH session still works after Remote Login was turned off
This is expected. Swif turns off Remote Login for new connections but doesn't end sessions that are already open. Ask the user to disconnect, or restart the Mac.
Remote Login didn't come back after the setting was turned on
This is expected. Swif never turns a service on. Turn on Remote Login manually in System Settings > General > Sharing.
Mac Sharing settings aren't locked
Check that the Mac runs macOS 14 or later (15.1 for Media Sharing).
Content caching stopped working on a Mac
Allow Content Caching is off in a policy assigned to that Mac. Turn it on, or remove that Mac from the policy.
The Classroom app can't observe screens
Allow Screenshot is off, which also blocks Classroom screen observation.
Quick Start still appears on an iPhone
Check that the device is supervised.
Check that it isn't a Shared iPad, which ignores this setting.
Only screenshots are restricted on a BYOD device
Apple User Enrollment supports only Allow Screenshot.
Related resources
Swif
Apple