MDM profiles and Apple Configurator for parental control

Forums and parent communities sometimes recommend the “hard way”: install a mobile device management profile on the child’s iPhone, or use Apple Configurator to supervise the device directly [source: apple-mdm-profiles] [source: apple-configurator-restrictions].

This is a different class of control. It was designed for organisations issuing devices to employees or students, not for a parent’s iPhone at home [source: apple-deployment-restrictions].

This article describes what the path offers, what it costs, and why it is usually the wrong tool for the family setting.

Editorial scope. This article explains the path. It does not walk through it. The configuration of an MDM profile or an Apple Configurator supervised device is documented by Apple and by the relevant third-party MDM vendor. This wiki does not publish that walkthrough.

Definition

Two Apple-published mechanisms are involved:

• MDM profiles. A Mobile Device Management profile is a configuration payload that a device receives from a server. The server can push settings, restrictions, and apps. The profile is installed on the device and persists until it is removed [source: apple-mdm-profiles].
• Apple Configurator. A macOS application from Apple used by administrators to supervise and configure iOS, iPadOS, and tvOS devices. Supervised devices accept a wider set of restrictions than non-supervised devices [source: apple-configurator-restrictions].

The key word is supervision. A supervised device is one where the management profile can apply a set of restrictions that a non-supervised device cannot accept, including restrictions the user cannot override from the device [source: apple-deployment-restrictions].

Both mechanisms are part of Apple’s device-management stack. They are designed for organisations: schools issuing iPads, companies issuing iPhones, hospitals issuing shared iPads [source: apple-deployment-restrictions].

Scope

This article covers three questions:

• What the path offers. The restrictions that supervision adds on top of what Screen Time already does.
• What the path costs. The trade-offs the parent takes on when choosing supervision over Screen Time.
• Why it is usually wrong for the family setting. The conditions under which the trade-off fails.

It does not cover:

• How to set up a specific MDM vendor. Vendor documentation is the place for that. Jamf, Mosyle, Kandji, Hexnode, and Apple Business Manager each have their own setup flow.
• How to use Apple Configurator. Apple’s user guide for Apple Configurator documents the workflow. This wiki does not duplicate it.
• MDM for company-owned devices. The organisation case is not the family case. The article cites the organisational documentation as the source of what supervision does, not as a recommendation for the family setting [source: apple-deployment-restrictions].
• School-managed devices. A school-issued device comes under the school’s MDM, not the parent’s. The parent’s configuration on a school-managed device is constrained by what the school’s MDM allows [source: apple-screen-time].

What supervision adds on top of Screen Time

The Screen Time configuration covered in the Set up Screen Time on iPhone article is what Apple publishes for the family setting. Supervised devices accept additional restrictions that Screen Time alone cannot apply [source: apple-deployment-restrictions] [source: apple-configurator-restrictions].

Apple’s published list of restrictions available on supervised devices includes:

• Disabling the App Store entirely. Not just restricting installs through Family Sharing; turning the App Store off at the system level [source: apple-configurator-restrictions].
• Disabling the camera, Safari, Siri, or the iMessage store at the system level. Each can be restricted independently [source: apple-deployment-restrictions].
• Restricting the date and time independently of the user’s clock. The published Date and Time restriction on supervised devices can require a fixed date — used by some parents who also want to control when the device believes it is [source: apple-configurator-restrictions].
• Forcing a single app or a small set of apps at the lock screen. Single-app mode and kiosk mode are supervised-only restrictions [source: apple-configurator-restrictions].
• Locking the Find My setting. A supervised device can be set so the Find My toggle cannot be disabled by the user [source: apple-deployment-restrictions].
• Forcing the device to install or remove apps silently. A supervised device can have apps installed or removed by the management server without the user approving each action [source: apple-mdm-profiles].

The list above is what Apple publishes. The exact set of restrictions, and the ones a particular MDM vendor exposes, depends on the vendor’s product [source: apple-deployment-restrictions].

What the path costs

The trade-off has four components, each of which is a separate cost.

• Supervision is a property of the device, not of the Apple Account. A supervised iPhone stays supervised for as long as the profile remains on it. Removing the profile from a supervised device is either impossible from the device itself or requires the original Apple Configurator connection that supervised it [source: apple-mdm-profiles]. The child does not have an off-switch.
• A supervised device cannot be a personal device in the usual sense. Apps and settings that are not in the supervised configuration are harder to install or change. The Apple Account on the device is the family’s, but the device itself is locked to the configuration [source: apple-deployment-restrictions].
• The MDM vendor sees the device. A configuration pushed through an MDM profile is, by definition, visible to the MDM server. For an organisational deployment this is the design. For a family, it means a third-party server holds the configuration data [source: apple-mdm-profiles].
• The child’s Apple ID may need to be a Managed Apple ID. Apple’s deployment path includes Managed Apple IDs for organisational issuance. A family Apple Account is a separate class, and not all supervised configurations support both [source: apple-region-rules].

The four points are not edge cases. They are the design.

Why it is usually wrong for the family setting

The conditions under which the trade-off fails are common. Three cases cover most of the family situations that forums warn about.

Case 1: the parent is using the tool to fix a Screen Time configuration gap. A limit that is not sticking, a request that bypasses Ask to Buy, an alternative marketplace that should not be open — these are Screen Time configuration gaps, not supervision gaps [source: apple-screen-time] [source: apple-parental-controls]. The Making Screen Time settings stick article walks through the configuration fixes. Supervision adds capability without addressing the underlying configuration [source: apple-deployment-restrictions].

Case 2: the parent is buying the MDM as a peace-of-mind upgrade. Forums often present MDM as a “stronger” version of Screen Time. It is not stronger in the sense of “more secure”; it is stronger in the sense of “more constraints” [source: apple-mdm-profiles]. A parent who does not need the additional constraints is paying the trade-off for capability they do not use.

Case 3: the child is older and the conversation matters more than the configuration. A teenager whose device is supervised has lost the normal friction of an un-supervised device. The configuration is the entire relationship. The relationship a teenager has with a supervised device is not the relationship a teenager has with a configured-but-personal device [source: consumer-ftc-parental-controls]. The editorial stance this wiki takes (ADR-0005) is that proportionate, openly-communicated safeguards work better for this age band.

The third case is the one that breaks the trade-off most often. A parent who supervises a 14-year-old’s iPhone is not “more protective” than a parent who configures Screen Time and asks the child to use Ask to Buy. They have replaced a conversation with a configuration.

When the path is the right tool

A short list of conditions where the path is the right answer. The list is short on purpose.

• The device is shared, not personal. A family iPad used by three children, where each child’s configuration needs to be reset after each use, is a supervised-device use case. Apple’s shared-iPad deployment path is designed for this [source: apple-deployment-restrictions].
• The device is intended for a single narrow purpose. A device dedicated to a single educational app, or to a specific streaming service, is a kiosk-mode use case. Single-app mode on supervised devices is the supported path [source: apple-configurator-restrictions].
• The child has a documented configuration history of bypassing Screen Time. For a child who has demonstrated a pattern of bypassing Screen Time despite a configuration that is otherwise correct, supervision adds the constraints Screen Time cannot. The configuration walk should be the first response, not supervision [source: apple-parental-controls].

The third case is the most common reason a parent reaches for MDM in the family setting. The right ordering is: configuration first, conversation second, supervision as a last resort. The forum-recommended order is often reversed.

What the configuration does not do

A short list to set expectations about the path even when it is chosen:

• It does not solve the configuration gaps that let limits stop sticking. Those gaps are Screen Time configuration gaps, not supervision gaps [source: apple-screen-time].
• It does not extend Screen Time reports. The Screen Time report still shows what apps were used, not what was viewed inside them. Communication Safety still does not notify the parent [source: apple-communication-safety].
• It does not transfer ownership back to the child. A supervised device does not become a personal device by being taken off the supervision profile. The profile removal requires the original connection [source: apple-mdm-profiles].
• It does not survive a forgotten Apple ID. The MDM profile is bound to the configuration. A forgotten Apple ID or a wiped device without re-enrolment ends the supervision [source: apple-mdm-profiles].

The single sentence version: supervision is the right tool for an organisation and the wrong tool for a family unless the family is buying a property the family setting does not actually need.

Talking about it

A device that the child experiences as supervised is a device the child experiences as not theirs [source: consumer-ftc-parental-controls].

A few short habits make the decision land as a configuration event rather than as a relationship event:

• Decide before installing. A device that is supervised and a device that is personal are different categories. The decision belongs at the device-issue moment, not after the fact.
• Be specific about what the supervision adds. “Stronger” is not a property. The list of additional restrictions is. The list above is the list to discuss [source: apple-deployment-restrictions].
• Re-decide at each major life event. A new school, a new device, a child’s transition to a more autonomous device — these are the moments when the trade-off should be re-evaluated.

The point of the path is not to be the strongest tool. It is to be the right tool for the situation. For most family situations, the right tool is Screen Time plus the conversation.

Sources

• apple-mdm-profiles — Apple Deployment Guide, “Review MDM restrictions for Apple devices” (EN). The MDM profile removal and supervision semantics.
• apple-configurator-restrictions — Apple Deployment Guide, “Restrictions for Apple devices” (EN). The supervised restrictions list, including the Date and Time restriction.
• apple-deployment-restrictions — Apple Deployment Guide, “Device management restrictions for iPhone and iPad devices” (EN, retrieved 2025-12-17). The organisation-managed-device context.
• apple-screen-time — Apple Support, “Use Screen Time to manage your child’s iPhone or iPad” (EN, retrieved 2026-07-01). The Screen Time family-side configuration.
• apple-parental-controls — Apple Support, “Use parental controls to manage your child’s iPhone or iPad” (EN, retrieved 2026-04-21). The container structure and post-update re-check requirement.
• apple-region-rules — Apple Support, “Region-specific rules for managing an Apple Account” (EN, retrieved 2026-08-16). The Managed Apple ID and personal Apple Account distinction.
• consumer-ftc-parental-controls — U.S. Federal Trade Commission, parental-controls consumer guidance. The one-layer-of-protection framing.

[source: apple-mdm-profiles] [source: apple-configurator-restrictions] [source: apple-deployment-restrictions] [source: apple-screen-time] [source: apple-parental-controls] [source: apple-region-rules] [source: apple-communication-safety] [source: consumer-ftc-parental-controls]