Overview

Upload any .mobileconfig profile or paste your own XML/PList payload—no waiting for Swif’s pre-built policy catalogue.

Why use a custom profile (policy)?

Add Apple settings that aren’t yet exposed in Swif’s built-in policy list.
Re-use a vendor-supplied .mobileconfig (for DNS-filtering, 802.1X, kernel extensions, etc.).
Prototype a setting quickly, then roll it out fleet-wide with Swif’s smart-targeting, versioning, and rollback.

Create a custom profile policy

1) Start the wizard

Device Management → Policies → New Policy.
You’ll land on Basic configurations (step 1 of 4).

2) Fill Basic configurations

Field	What to enter	Tips
Policy Name	Friendly title (e.g. “Zoom PPPC profile”).	Shown in the Swif console & reports.
Policy Description	Optional notes for other admins.	Markdown supported.
Type	`Mac/iOS/iPadOS`.	Switch to Windows to deliver a .json CSP or script instead.
Config Method	• Upload .mobileconfig – drag-and-drop a signed or unsigned profile • Write Policy Script – paste raw XML/PList	Use Write Policy Script for small tweaks or to build from scratch.
Identifier	Reverse-DNS string unique in your org (e.g. `com.acme.dnsfilter`).	Required only for Write Policy Script; Swif auto-reads it from uploaded files.
Payload Content (Write Policy Script)	Your `<array>…</array>` of payload dictionaries.	No outer `<plist>` wrapper—Swif adds it. Press Copy to reuse later.

Heads-up: Keep the overall profile ≤ 300 KB and < 64 payloads to stay within Apple MDM limits.

Click Continue.

3) Select devices

Target individual Macs or device groups. (Mix-and-match: you can push one profile to all Finance laptops and a different version to Dev laptops.)

4) Select device groups

Optional second filter—handy if you first chose “All devices” but need to exclude, say, lab Macs.

5) Review & create

Swif shows a diff-style summary:

Policy metadata
Payload hash & size
Target scope

Hit Create and Swif immediately queues a InstallProfile MDM command. Online Macs apply the profile within seconds; offline devices receive it on next check-in.

Updating or removing the custom policy

Policies → open the policy → Edit to upload a new .mobileconfig or update XML.
Swif auto-increments the version, pushes a RemoveProfile followed by an InstallProfile, and keeps previous versions for rollback.
To retire a profile, set Status → Disabled. Swif removes it on next device sync.

Frequently asked questions

Question	Answer
Do I need to sign the .mobileconfig?	No—Swif signs the final profile with its MDM certificate before delivery. If you do sign it, Swif preserves your signature.
Can a bad payload brick Macs?	Swif validates XML syntax and checks for Apple-reserved keys. Malformed profiles are rejected pre-flight.
What about profile conflicts?	Apple applies the most recent payload with the same PayloadUUID. Use unique IDs (or let Swif generate them) to layer settings safely.
Can I mix iOS and macOS payloads?	Yes—choose Mac/iOS/iPadOS and include both payload dictionaries; each device installs only what it supports.

Examples

Example minimal PPPC payload (paste into Payload Content)

<array>
    <dict>
        <key>PayloadType</key>
        <string>com.apple.TCC.configuration-profile-policy</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadIdentifier</key>
        <string>com.acme.camera-deny</string>
        <key>PayloadUUID</key>
        <string>{{uuid}}</string>
        <key>PayloadEnabled</key>
        <true/>
        <key>Services</key>
        <dict>
            <key>Camera</key>
            <dict>
                <key>Authorization</key>
                <string>Deny</string>
            </dict>
        </dict>
    </dict>
</array>

Paste, set Identifier =com.acme.camera-deny.profile, deploy to your target Macs—done.

Example: Configure Cloudflare DNS over HTTPS

This example configures managed Macs to use Cloudflare’s public 1.1.1.1 resolver through DNS over HTTPS (DoH).

DoH encrypts DNS queries between the Mac and Cloudflare by sending them over HTTPS. This helps prevent network operators and other parties on the local network from reading or modifying DNS requests in transit.

This example uses Cloudflare’s unfiltered public resolver:

https://cloudflare-dns.com/dns-query

Requirements

macOS 11 or later
The Mac must be enrolled in Swif
The Swif MDM profile must be installed
HTTPS access to cloudflare-dns.com over TCP port 443
A managed Wi-Fi network when the profile is delivered through MDM

Important: Apple states that when the DNS Settings payload is installed through MDM, it applies only to managed Wi-Fi networks. Configure the Wi-Fi network through an Apple Wi-Fi policy before relying on this profile. Do not assume that the profile covers manually joined Wi-Fi networks, Ethernet, VPN tunnels, or applications that use their own DNS resolver.

For device-wide DNS protection across different network interfaces, consider Cloudflare WARP or another endpoint DNS-filtering client.

Create the Custom Policy

In the Swif Admin Dashboard, go to Device Management > Policies > New Policy.
Complete the basic configuration:

Field	Value
Policy Name	`Cloudflare DNS over HTTPS`
Policy Description	`Routes DNS queries from managed Wi-Fi networks to Cloudflare using encrypted DNS over HTTPS.`
Type	`Mac/iOS/iPadOS`
Config Method	`Write Policy Script`
Identifier	`com.yourcompany.cloudflare-doh.profile`

Replace yourcompany with a value unique to your organization.
Paste the following XML into Payload Content.

Do not include an outer <plist> wrapper because Swif adds it automatically.

<array>
    <dict>
        <key>DNSSettings</key>
        <dict>
            <key>DNSProtocol</key>
            <string>HTTPS</string>

            <key>ServerAddresses</key>
            <array>
                <string>1.1.1.1</string>
                <string>1.0.0.1</string>
                <string>2606:4700:4700::1111</string>
                <string>2606:4700:4700::1001</string>
            </array>

            <key>ServerURL</key>
            <string>https://cloudflare-dns.com/dns-query</string>
        </dict>

        <key>PayloadDescription</key>
        <string>Configures Cloudflare 1.1.1.1 using DNS over HTTPS.</string>

        <key>PayloadDisplayName</key>
        <string>Cloudflare DNS over HTTPS</string>

        <key>PayloadEnabled</key>
        <true/>

        <key>PayloadIdentifier</key>
        <string>com.yourcompany.cloudflare-doh</string>

        <key>PayloadType</key>
        <string>com.apple.dnsSettings.managed</string>

        <key>PayloadUUID</key>
        <string>{{uuid}}</string>

        <key>PayloadVersion</key>
        <integer>1</integer>
    </dict>
</array>

Select the test Macs or device groups that should receive the policy.
Review the policy and select Create.
Allow the devices to check in and install the profile.
Review the policy’s Report tab for installation errors.

Because SupplementalMatchDomains is not included, the payload instructs macOS to use the encrypted resolver for all eligible DNS queries on the applicable managed network.

Payload Settings

Key	Purpose
`DNSProtocol`	Selects the encrypted DNS protocol. `HTTPS` enables DoH.
`ServerURL`	Specifies Cloudflare’s RFC 8484 DoH endpoint and hostname used for TLS certificate validation.
`ServerAddresses`	Supplies Cloudflare’s IPv4 and IPv6 resolver addresses.
`PayloadType`	Identifies Apple’s managed DNS Settings payload.
`PayloadUUID`	Uniquely identifies the payload.
`PayloadIdentifier`	Provides a stable reverse-domain identifier for profile management.

The ServerAddresses entries are Cloudflare resolver addresses. DNS messages sent to the configured DoH service remain protected by HTTPS.

Cloudflare Resolver Options

Cloudflare provides multiple public resolver variants.

Resolver	DoH URL	Behavior
Standard `1.1.1.1`	`https://cloudflare-dns.com/dns-query`	Unfiltered DNS resolution
Malware blocking	`https://security.cloudflare-dns.com/dns-query`	Blocks domains associated with malware and phishing
Malware and adult-content blocking	`https://family.cloudflare-dns.com/dns-query`	Blocks malware, phishing, and adult content

If you use a Cloudflare for Families endpoint, replace both the URL and server addresses with the matching values.

Malware Blocking

<key>ServerAddresses</key>
<array>
    <string>1.1.1.2</string>
    <string>1.0.0.2</string>
    <string>2606:4700:4700::1112</string>
    <string>2606:4700:4700::1002</string>
</array>
<key>ServerURL</key>
<string>https://security.cloudflare-dns.com/dns-query</string>

Malware and Adult-Content Blocking

<key>ServerAddresses</key>
<array>
    <string>1.1.1.3</string>
    <string>1.0.0.3</string>
    <string>2606:4700:4700::1113</string>
    <string>2606:4700:4700::1003</string>
</array>
<key>ServerURL</key>
<string>https://family.cloudflare-dns.com/dns-query</string>

Do not combine the addresses from one resolver variant with the URL from another.

Cloudflare’s public resolvers do not provide organization-specific policies, identity attribution, or administrative DNS reporting. Use Cloudflare Zero Trust Gateway or another enterprise DNS service when those capabilities are required.

Prevent Users From Disabling DoH

On supervised devices, Apple supports the optional ProhibitDisablement key.

To prevent users from disabling the DNS configuration, add the following immediately after the closing </dict> for DNSSettings:

<key>ProhibitDisablement</key> 
<true/>

Deploy this option only to supervised Macs. Test it before broad deployment because users may be unable to restore DNS connectivity themselves if the configured resolver becomes unavailable.

Verify the Profile

After installation:

Confirm that the policy reports as installed in Swif.
On the Mac, open System Settings > General > Device Management.
Locate Cloudflare DNS over HTTPS.
Confirm that the Mac is connected to a Wi-Fi network configured through MDM.
Open Cloudflare’s connection verification page.
Confirm that the page reports a connection to 1.1.1.1 and that DNS over HTTPS is active.

You can also confirm that the DoH endpoint is reachable:

curl --fail --silent --show-error \
  --header 'accept: application/dns-json' \
  'https://cloudflare-dns.com/dns-query?name=example.com&type=A'

A successful JSON response confirms that the Mac can reach Cloudflare’s DoH endpoint. It does not by itself prove that macOS system DNS is using the installed profile.

To list installed configuration profiles:

sudo profiles show -type configuration

Review Execution Report

If there is an error in the custom policy, the error information is an async process. The policy installation process does not give Swif the error directly. After a custom policy is installed on a device, it returns an error message to Swif. For example, if a requested field is missing in a profile, it will not be installed on the device.

You can view such custom policy execution reports on the Policy > Report tab.

Next steps

Need inspiration? Apple’s sample .mobileconfig library → developer.apple.com.
Scripting large profiles? Check out profilebuddy or mcxToProfile.

With Swif’s Custom macOS Policy workflow, you can ship any Apple profile across your fleet in minutes—no Jamf-only hacks, no Terminal gymnastics.

Swif Policy glossary – see All Apple policies article instead of creating a custom one.

Creating a Custom macOS profile policy