Device Supervision vs Device Management
Comparing Supervised & Managed Restrictions on an Adult's Personal iPhone
Restriction capabilities that are unlocked by enabling different modes on an Adult's own iPhone.
One of the most important things to consider if you are trying to set up content filtering on a personal iPhone or iPad is: "how can I prevent these restrictions from being bypassed?". Answering this question was the primary motivation for starting Tech Lockdown. For Apple devices that are used to access the internet, you will usually need some way to enforce or block apps and control network and VPN settings. This article will compare the Supervised and Managed Apple device capabilities that can give access to elevated restrictions on an adult's iPhone.
An iOS device can be configured in 3 different ways:
- Standard (most common): this is a typical iPhone purchased from a retail location.
- Supervised: an iPhone is supervised by connecting to a computer to enable the mode.
- Managed: an iPhone configured by a Mobile Device Manager where it is remotely configured and controlled. Businesses uses MDMs to manage corporate devices. The iPhone is controlled remotely via the MDM tool (usually in a web browser).
Restriction Approaches on a Standard iOS device
Apple's built-in parental controls is the primary way to enforce restrictions on a child's iPhone or iPad, but it tends to not be a good fit for adults. Furthermore, any website or app blockers downloaded from the App Store all encounter the same limitations when restricting an iPhone and cannot provide more restrictions that what Screen Time allows.
For a third-party app to be effective, the iPhone/iPad must be set up as a child's device (a child's Apple account with an age below 18) or have Supervised Mode enabled. This unlocks new restrictive capabilities. Learn more about unlocking elevated permissions on a child's iPhone . Otherwise, the rest of this blog post will showcase Supervised and Managed modes that will work for an adult's iPhone if you need to unlock more restrictions.
New Restriction Capabilities on Supervised Devices
A supervised iPhone or iPad can install Apple config files that protect and enforce settings.
In order to enable supervised mode , the personal iPhone or iPad must be connected to a computer and "prepared" using the Apple configurator tool with supervised mode opted in to.
Config files can then be installed on to the supervised iOS device. These files can be prevented from being removed so that restrictions are reliably enforced. You can use an Apple Config Generator to create the config files with your desired restrictions.
Here are some notable use cases for device supervision:
Restrict Apps
With Supervised mode, it's possible to completely block iPhone apps and control what can be installed from the app store.
You can use Allowlist blocking to restrict usage of apps to an approved list while blocking all others automatically. Even if the App Store is enabled, the user won't be able to install any unapproved apps. Existing apps can be updated as normal.
If a Blocklist approach is used instead, you can create an app blocklist and optionally block apps based on age rating.
Protect Network Settings
When blocking adult content on an iPhone , a common bypass technique involves downloading a conflicting VPN to circumvent filtering and monitoring or changing DNS settings.
For example, a VPN app can add a conflicting VPN configuration or the user can manually specify it in settings.
With Supervised mode, an Apple Config Generator can be used to add a configuration that disallows adding new VPNs.
When VPN creation is disallowed, the existing VPN profiles will stay installed, but an app can't request permission to add a new VPN configuration.
Furthermore, you can install protected DNS settings that can be changed.
When both VPN and DNS protection are combined, you can reliably prevent an adult from circumventing a content filtering service.
Managed Screen Time Settings
Supervised mode can be used to enforce certain Screen Time settings. When configured using an Apple Config Generator , the Screen Time settings can't be modified using the Screen Time section in iPhone settings. This handles a common loophole on an adult's iPhone: Screen Time is normally easily bypassed, even if the screen time settings are locked with a pin.
Here are some notable Screen Time settings that can be completely protected:
- Disable the iPhone App Store (though this is not needed if Allowlist supervised app restrictions are used)
- Enforce Screen Time's built in web content filtering, including the automatic built-in adult content filter and your own list of URLs to block.
- Prevent apps from being deleted , which is useful if your content filter has a companion app that is installed on the device. Deleting the app would usually remove the associated content filtering VPN connection.
Using Mobile Device Management to Sync Restrictions Remotely
Mobile Device Management (MDM) is a step above device Supervision in that these same restrictions can be managed remotely. Changing restrictions does not require you to manually install the updated config files on the managed iPhone - they can be synced automatically. Enabling device management on a personal iPhone may not be possible for everyone since it requires you to have an Apple Business Manager account. An ABM account must be applied for and can take several weeks to be approved.
It's also possible to completely prevent the removal of Apple config files that have been installed by the Mobile Device Manager, even if the user is highly technical. This is the main reason some adults choose to set up full device management on their own personal iPhone or iPad.
Frequently Asked Questions
Are there any iOS apps that can enforce restrictions on a standard iPhone?
The short answer is no.
On an iPhone, it is difficult to take full control of the device using an app that you can download from the AppStore. Apple imposes this limitation to protect their users from malicious apps and to encourage people to configure a supervised or managed device instead.
Making an app that can fully lock down an iPhone's settings and prevent bypass is not possible without Supervised Mode being enabled and combined with the App. However, you can convert an iPhone into either a supervised device or managed device to access additional bypass prevention features.
Both Device Supervision and Management allow you to enforce settings using Apple config files (called profiles). Some settings, such as DNS settings, or App enforcement, now become possible. This is perfect if you are trying to set up device to enforce content restrictions for either yourself, an accountability partner, or for a family.
If you are using a DNS Filtering service to block adult content , Supervised Mode can be used to protect the DNS and VPN settings on an iPhone to ensure it isn't bypassed.