Overview

The Apple Application and Service Control Policy controls Continuity, network discovery, and Terminal security on managed Apple devices. You can:

turn off Handoff, which continues an activity from one Apple device on another
turn off Universal Control, which lets one keyboard and pointer work across a nearby Mac and iPad
turn off AirPlay Receiver, so other devices can't AirPlay to the Mac
turn off Siri
turn off Bonjour advertising, so the Mac doesn't announce its services on the local network
turn on Secure Keyboard Entry in Terminal, so other apps can't read what users type there

A new policy with no changes doesn't restrict anything.

Supported platforms and requirements

Item	Details
Platforms	macOS, iOS, iPadOS
Minimum OS	macOS 10.12, iOS 5, iPadOS 5 (each setting has its own minimum; see the table)
Device ownership	Company-owned devices
Supervision	Not required
User Enrollment (BYOD)	Not supported for Handoff, Universal Control, AirPlay Receiver, or Siri on macOS.

Settings reference

Setting	What it does when turned off	Default	Platforms and minimum OS
Allow Handoff	Turns off Handoff, so users can't continue activities between their Apple devices.	Not set	macOS 10.15, iOS/iPadOS 8.0
Allow Universal Control	Turns off Universal Control.	On	macOS 13
Allow AirPlay Receiver	Other devices can't use the Mac as an AirPlay Receiver.	On	macOS 12.3
Allow Siri	Turns off Siri.	Not set	macOS 14, iOS/iPadOS 5.0

Not set means Swif doesn't send the setting, so the feature stays available.

Setting	What it does when turned on	Default	Platforms and minimum OS
Disable Bonjour Advertising	Stops the Mac from advertising its own Bonjour services, such as shared folders, screens, and printers, on the local network. Takes effect after the Mac restarts.	Not set	macOS 12
Turn On Secure Keyboard Entry in Terminal	Turns on Secure Keyboard Entry in Terminal as a managed setting, so other apps can't read what users type there. When off or not set, users choose.	Not set	macOS 11

About Handoff

Apple has deprecated the Handoff restriction on unsupervised devices and for Managed Apple Accounts. Apple says it will eventually require supervision and apply only to personal Apple Accounts. It still works on unsupervised devices for now.

About Siri

Apple deprecated the Siri restriction in OS 26.4 and recommends declarative Siri settings instead. Allow Siri still works on OS 26.4 and later, but Apple may remove it in a future release.

For supervised devices running 26.4 or later, you can also use the Apple Siri Settings Policy (Declarative). If both policies apply to a device, the more restrictive setting wins.

About Bonjour advertising

Disable Bonjour Advertising stops the Mac from announcing its services. It doesn't stop the Mac from finding other devices, so users can still discover and use network printers and AirPlay displays.

It does mean other devices can't automatically discover services the Mac offers, such as a shared printer, File Sharing, or Screen Sharing. Users would have to connect by address instead. Apple says the change takes effect after a restart.

About Secure Keyboard Entry

Secure Keyboard Entry stops other apps from reading what users type in Terminal, such as passwords and commands. That protects against keyloggers. This meets CIS macOS Benchmark recommendation 6.4.1.

Swif applies it as a managed preference in the profile, which sets SecureKeyboardEntry to true in com.apple.Terminal. Users can't turn it off. Secure Keyboard Entry stays checked in the Terminal menu, and choosing it doesn't change it.

Terminal only. It applies to Apple's Terminal app, not to third-party terminal apps such as iTerm2. Those have their own Secure Keyboard Entry setting.
Some apps may stop working with Terminal. Apps that read keystrokes, such as text expanders or some accessibility tools, can't see what's typed in Terminal while it's on.

Using this policy with other Swif policies

Siri: the Apple Siri Settings Policy (Declarative) also controls Siri on supervised devices running 26.4 or later. If both policies apply, the more restrictive setting wins.
AirPlay: to control which AirPlay destinations a device can send to, use the Apple AirPlay Policy. This policy only controls whether a Mac can receive AirPlay.

Before you start

Decide which features users need. Handoff and Universal Control are common productivity features.
Check whether any Mac shares services on the network before you turn on Disable Bonjour Advertising.
Plan a restart for Macs that get Disable Bonjour Advertising.
Check for overlapping policies that set the same restrictions.

Create the policy

In Swif, go to Device Management > Policies, then select Create new policy > Configure a Policy.
Select Application and Service Control Policy.
Enter a clear name, such as Continuity & Services – Restricted.
Set the features you want to control.
Save the policy.
Assign it to a device group.
Restart Macs that receive Disable Bonjour Advertising.
Test on a few devices before a wider rollout.

Example configurations

Example 1: Company Macs on shared office networks

Setting	Value
Allow AirPlay Receiver	Off
Disable Bonjour Advertising	On
All other settings	Defaults

Other people on the network can't AirPlay to these Macs or see their services advertised.

Example 2: Macs handling regulated data

Setting	Value
Allow Handoff	Off
Allow Universal Control	Off
Allow AirPlay Receiver	Off
Allow Siri	Off
Turn On Secure Keyboard Entry in Terminal	On

Content can't move to personal devices through Continuity, Siri is unavailable, and other apps can't read what's typed in Terminal.

Example 3: Developer Macs (CIS)

Setting	Value
Turn On Secure Keyboard Entry in Terminal	On
Disable Bonjour Advertising	On
All other settings	Defaults

Developers keep Handoff and Universal Control, while Terminal input is protected and the Mac doesn't advertise its services.

Example 4: Company iPhones without Siri

Setting	Value
Allow Siri	Off
All other settings	Defaults

Verify the policy

Mac

Open System Settings > General > Device Management and open the Swif profile. Confirm that it includes the restrictions.
Check each restricted feature:
- Handoff and AirPlay Receiver: in System Settings > General > AirDrop & Handoff, the options should be unavailable.
- Siri: Siri should be unavailable in System Settings.
If Turn On Secure Keyboard Entry in Terminal is on, open Terminal and check the Terminal menu. Secure Keyboard Entry should have a checkmark, and choosing it shouldn't turn it off. You can also check in Terminal. It should return 1:
```
defaults read "/Library/Managed Preferences/com.apple.Terminal" SecureKeyboardEntry
```
If Disable Bonjour Advertising is on, restart the Mac. From another Mac on the same network, confirm that this Mac's shared services, such as File Sharing, no longer appear automatically in the Finder sidebar.

iPhone or iPad

Go to Settings > General > VPN & Device Management, open the Swif profile, and confirm that it lists Restrictions.
If Allow Siri is off, confirm that Siri is unavailable in Settings.

In Swif, open the device and confirm that the policy shows as applied.

Troubleshooting

Handoff still works on an iPhone

Check that the device runs iOS 8 or later.
Check that no other policy turns Handoff on.

Universal Control or AirPlay Receiver still works on a Mac

Check that the Mac runs macOS 13 or later for Universal Control, or macOS 12.3 or later for AirPlay Receiver.

Siri is still available on a Mac

Check that the Mac runs macOS 14 or later.

Bonjour advertising hasn't stopped

Restart the Mac. The setting takes effect only after a restart.

Other devices can't find a printer or folder shared by the Mac

This is expected when Disable Bonjour Advertising is on. Connect to the Mac by its IP address or host name, or turn Disable Bonjour Advertising off for that Mac.

Secure Keyboard Entry isn't on in iTerm2 or another terminal app

This is expected. The setting applies only to Apple's Terminal app. Turn on Secure Keyboard Entry in the other app's own settings.

Users can't turn off Secure Keyboard Entry in Terminal

This is expected when Turn On Secure Keyboard Entry in Terminal is on. The menu item stays checked. If it isn't checked, run the defaults read command in Verify the policy. If it doesn't return 1, the profile hasn't applied.

A text expander or other tool stopped working in Terminal

This is expected while Secure Keyboard Entry is on, because other apps can't read what's typed in Terminal. Use the tool in other apps, or turn off the setting for that Mac.

The Mac can't find network printers

Disable Bonjour Advertising doesn't stop the Mac from finding other devices. Check the printer and network instead.

Related resources

Swif

Apple