Release_iOS-16-4_macOS-13-3

apple · Apr 6, 2023 · 5a8fb0d · 5a8fb0d
1 parent eb51fb0
commit 5a8fb0d
Show file tree

Hide file tree

Showing 23 changed files with 386 additions and 62 deletions.
diff --git a/README.md b/README.md
@@ -8,10 +8,10 @@ This release corresponds to the following OS versions
 
 | OS      | Version |
 |---------|---------|
-| iOS     | 16.2    |
-| macOS   | 13.1    |
-| tvOS    | 16.2    |
-| watchOS |  9.2    |
+| iOS     | 16.4    |
+| macOS   | 13.3    |
+| tvOS    | 16.4    |
+| watchOS |  9.4    |
 
 ## What's Available
 

diff --git a/declarative/declarations/configurations/account.caldav.yaml b/declarative/declarations/configurations/account.caldav.yaml
@@ -48,4 +48,4 @@ payloadkeys:
   type: <string>
   presence: optional
   content: The identifier of an asset declaration that contains the credentials for
-    this account. The corresponding asset must be of type UserNameAndPasswordCredentials.
+    this account. The corresponding asset must be of type CredentialUserNameAndPassword.
diff --git a/declarative/declarations/configurations/account.carddav.yaml b/declarative/declarations/configurations/account.carddav.yaml
@@ -47,4 +47,4 @@ payloadkeys:
   type: <string>
   presence: optional
   content: The identifier of an asset declaration that contains the credentials for
-    this account. The corresponding asset must be of type UserNameAndPasswordCredentials.
+    this account. The corresponding asset must be of type CredentialUserNameAndPassword.
diff --git a/declarative/declarations/configurations/account.ldap.yaml b/declarative/declarations/configurations/account.ldap.yaml
@@ -42,7 +42,7 @@ payloadkeys:
   type: <string>
   presence: optional
   content: The identifier of an asset declaration that contains the credentials for
-    this account. The corresponding asset must be of type UserNameAndPasswordCredentials.
+    this account. The corresponding asset must be of type CredentialUserNameAndPassword.
 - key: SearchSettings
   title: Search Settings
   type: <array>

diff --git a/declarative/status/device.operating-system.supplemental.build-version.yaml b/declarative/status/device.operating-system.supplemental.build-version.yaml
@@ -14,4 +14,5 @@ payloadkeys:
   title: Status item value.
   type: <string>
   presence: required
-  content: Status value.
+  content: Identifies the operating system's build and rapid security response versions
+    in use on the device (for example, '20A123a', or '20B27c').
diff --git a/declarative/status/device.operating-system.supplemental.extra-version.yaml b/declarative/status/device.operating-system.supplemental.extra-version.yaml
@@ -14,4 +14,5 @@ payloadkeys:
   title: Status item value.
   type: <string>
   presence: required
-  content: Status value.
+  content: Identifies the operating system's rapid security response version in use
+    on the device (for example, 'a').
diff --git a/mdm/checkin/declarativemanagement.yaml b/mdm/checkin/declarativemanagement.yaml
@@ -33,10 +33,6 @@ payloadkeys:
   rangelist:
   - DeclarativeManagement
   content: The message type, which must have a value of 'DeclarativeManagement'.
-- key: EnrollmentID
-  type: <string>
-  presence: required
-  content: The per-enrollment identifier for the device.
 - key: Endpoint
   type: <string>
   presence: required
@@ -50,3 +46,79 @@ payloadkeys:
   type: <data>
   presence: optional
   content: A Base64-encoded JSON object using the SynchronizationTokens schema.
+- key: UDID
+  supportedOS:
+    iOS:
+      userenrollment:
+        mode: forbidden
+    macOS:
+      userenrollment:
+        mode: forbidden
+  type: <string>
+  presence: required
+  content: The device's UDID.
+- key: EnrollmentID
+  supportedOS:
+    iOS:
+      userenrollment:
+        mode: required
+    macOS:
+      userenrollment:
+        mode: required
+    tvOS:
+      introduced: n/a
+  type: <string>
+  presence: required
+  content: The per-enrollment identifier for the device.
+- key: EnrollmentUserID
+  supportedOS:
+    iOS:
+      introduced: n/a
+    macOS:
+      devicechannel: false
+      userenrollment:
+        mode: required
+    tvOS:
+      introduced: n/a
+  type: <string>
+  presence: required
+  content: A per-enrollment identifier that identifies the user for user enrollments.
+- key: UserShortName
+  supportedOS:
+    iOS:
+      sharedipad:
+        mode: required
+    macOS:
+      devicechannel: false
+    tvOS:
+      introduced: n/a
+  type: <string>
+  presence: optional
+  content: On Shared iPad, this value returns the Managed Apple ID of the user. When
+    present indicates that the token is for the user channel. On macOS, this value
+    always returns the short name of the user.
+- key: UserID
+  supportedOS:
+    iOS:
+      sharedipad:
+        mode: required
+    macOS:
+      devicechannel: false
+    tvOS:
+      introduced: n/a
+  type: <string>
+  presence: optional
+  content: On macOS, this value always returns the ID of the user. On Shared iPad,
+    this value is always set to FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF to indicate that
+    no authentication will occur.
+- key: UserLongName
+  supportedOS:
+    iOS:
+      introduced: n/a
+    macOS:
+      devicechannel: false
+    tvOS:
+      introduced: n/a
+  type: <string>
+  presence: required
+  content: The full name of the user.
diff --git a/mdm/commands/application.install.yaml b/mdm/commands/application.install.yaml
@@ -178,6 +178,21 @@ payloadkeys:
     default: true
     content: If 'false', this app isn't removable while it's a managed app. This value
       is available in iOS 14 and later, and tvOS 14 and later.
+  - key: TapToPayScreenLock
+    supportedOS:
+      iOS:
+        introduced: '16.4'
+      macOS:
+        introduced: n/a
+      tvOS:
+        introduced: n/a
+    type: <boolean>
+    presence: optional
+    default: false
+    content: Enabling this setting will require Tap to Pay on iPhone users to use
+      Face ID or a passcode to unlock their device after every transaction that requires
+      a customer’s card PIN. Disabling this setting will allow users to configure
+      this setting on their device based on personal preference.
 - key: ChangeManagementState
   supportedOS:
     iOS:

diff --git a/mdm/commands/application.managed.list.yaml b/mdm/commands/application.managed.list.yaml
@@ -60,6 +60,7 @@ responsekeys:
       type: <string>
       presence: required
       rangelist:
+      - Queued
       - NeedsRedemption
       - Redeeming
       - Prompting
@@ -81,6 +82,7 @@ responsekeys:
       - Failed
       content: |-
         The status of the managed app, which is one of the following values:
+        * 'Queued': The app is scheduled for installation.
         * 'NeedsRedemption': The app needs a redemption code to complete installation.
         * 'Redeeming': The device is redeeming the redemption code for the app.
         * 'Prompting': The app installation is prompting the user.

diff --git a/mdm/commands/information.device.yaml b/mdm/commands/information.device.yaml
@@ -242,6 +242,20 @@ payloadkeys:
       type: <string>
       content: The key to get the model. This value requires the Device Information
         access right.
+    - key: ModelNumber
+      supportedOS:
+        iOS:
+          introduced: '16.4'
+          accessrights: AllowQueryDeviceInformation
+        macOS:
+          introduced: '13.3'
+          accessrights: AllowQueryDeviceInformation
+        tvOS:
+          introduced: '16.4'
+          accessrights: AllowQueryDeviceInformation
+      type: <string>
+      content: The device's hardware model number, including region info, e.g. "MK1A3LL/A".
+        Requires Device Information right. Requires Apple silicon on macOS.
     - key: IsAppleSilicon
       supportedOS:
         iOS:
@@ -365,12 +379,24 @@ payloadkeys:
           introduced: '5.0'
           accessrights: AllowQueryDeviceInformation
         macOS:
-          introduced: n/a
+          introduced: '13.3'
+          accessrights: AllowQueryDeviceInformation
         tvOS:
           introduced: n/a
       type: <string>
       content: The key to get the battery level. This value requires the Device Information
         access right, and is available in iOS 5 and later.
+    - key: HasBattery
+      supportedOS:
+        iOS:
+          introduced: n/a
+        macOS:
+          introduced: '13.3'
+          accessrights: AllowQueryDeviceInformation
+        tvOS:
+          introduced: n/a
+      type: <string>
+      content: Whether the device has an internal battery.
     - key: IsSupervised
       supportedOS:
         iOS:
@@ -1180,6 +1206,21 @@ payloadkeys:
       content: |-
         The key to get an attestation of the device's properties.
         Available in iOS 16 and later and tvOS 16 and later.
+    - key: EACSPreflight
+      supportedOS:
+        iOS:
+          introduced: n/a
+        macOS:
+          introduced: '13.3'
+          accessrights: AllowQueryDeviceInformation
+          userchannel: false
+          userenrollment:
+            mode: forbidden
+        tvOS:
+          introduced: n/a
+      type: <string>
+      content: Determines whether the device could perform an EraseDevice using Erase
+        All Content and Settings.
 - key: DeviceAttestationNonce
   supportedOS:
     iOS:
@@ -1380,6 +1421,17 @@ responsekeys:
   - key: Model
     type: <string>
     content: The model. This value requires the Device Information access right.
+  - key: ModelNumber
+    supportedOS:
+      iOS:
+        introduced: '16.4'
+      macOS:
+        introduced: '13.3'
+      tvOS:
+        introduced: '16.4'
+    type: <string>
+    content: The device's hardware model number, including region info, e.g. "MK1A3LL/A".
+      Requires Device Information right. Requires Apple silicon on macOS.
   - key: IsAppleSilicon
     supportedOS:
       iOS:
@@ -1474,13 +1526,23 @@ responsekeys:
       iOS:
         introduced: '5.0'
       macOS:
-        introduced: n/a
+        introduced: '13.3'
       tvOS:
         introduced: n/a
     type: <real>
     content: The battery level, between '0.0' and '1.0', or '-1.0' if MDM can't determine
       the battery level. This value requires the Device Information access right,
       and is available in iOS 5 and later.
+  - key: HasBattery
+    supportedOS:
+      iOS:
+        introduced: n/a
+      macOS:
+        introduced: '13.3'
+      tvOS:
+        introduced: n/a
+    type: <boolean>
+    content: Whether the device has an internal battery.
   - key: IsSupervised
     supportedOS:
       iOS:
@@ -1648,7 +1710,7 @@ responsekeys:
       type: <boolean>
       content: If 'true', start a new scan. This value is available in macOS 10.11
         and later.
-    - key: AutomaticCheckEnabled
+    - key: AutoCheckEnabled
       type: <boolean>
       content: The preference to automatically check for app updates. This value is
         available in macOS 10.11 and later.
@@ -2268,9 +2330,12 @@ responsekeys:
     subkeys:
     - key: RecommendationsCadence
       type: <integer>
-      content: Which software updates are presented to the user. 0 (the default) allows
-        all updates, 1 allows only older updates. 2 allows only newer updates. No
-        effect if only a single update would be offered to the user for this device.
+      content: |-
+        Which software updates to present to the user.
+        * '0' (the default) allows all updates.
+        * '1' allows only older updates.
+        * '2' allows only newer updates.
+        No effect if the device qualifies for only a single update.
   - key: AccessibilitySettings
     supportedOS:
       iOS:
@@ -2318,8 +2383,9 @@ responsekeys:
       - 9
       - 10
       - 11
-      content: The accessibility text size apps that support dynamic text use. 0 is
-        the smallest value, and 11 is the largest available.
+      content: |-
+        The accessibility text size apps that support dynamic text use. 0 is the smallest value, and 11 is the largest available.
+        '-1' indicates that the current size is unknown or hasn't been explicitly set.
     - key: TouchAccommodationsEnabled
       type: <boolean>
       content: If 'true', device has enabled touch accommodations.
@@ -2347,3 +2413,21 @@ responsekeys:
     subkeys:
     - key: AttestationCertificate
       type: <data>
+  - key: EACSPreflight
+    supportedOS:
+      iOS:
+        introduced: n/a
+      macOS:
+        introduced: '13.3'
+        userenrollment:
+          mode: forbidden
+      tvOS:
+        introduced: n/a
+    type: <string>
+    content: |-
+      Determines whether the device could perform an EraseDevice using Erase All Content and Settings.
+      Responses can include:
+        "success" -> device supports EACS and everything looks OK
+        "not supported" -> device is too old to support EACS (does not contain T2 or AppleSilicon)
+        "unknown failure" -> something went wrong for which we don't have a better error message
+        (other string) -> reason why EACS cannot be performed at the current time (e.g. "System is not sealed")
diff --git a/mdm/commands/settings.yaml b/mdm/commands/settings.yaml
@@ -344,6 +344,21 @@ payloadkeys:
         default: true
         content: If 'false', this app isn't removable while it's managed. This value
           is available in iOS 14 and later, and tvOS 14 and later.
+      - key: TapToPayScreenLock
+        supportedOS:
+          iOS:
+            introduced: '16.4'
+          macOS:
+            introduced: n/a
+          tvOS:
+            introduced: n/a
+        type: <boolean>
+        presence: optional
+        default: false
+        content: Enabling this setting will require Tap to Pay on iPhone users to
+          use Face ID or a passcode to unlock their device after every transaction
+          that requires a customer’s card PIN. Disabling this setting will allow users
+          to configure this setting on their device based on personal preference.
   - key: DeviceName
     supportedOS:
       iOS:
@@ -853,6 +868,8 @@ payloadkeys:
         introduced: n/a
     type: <dictionary>
     presence: optional
+    content: A dictionary that contains accessibility settings. Available in iOS 16
+      and later.
     subkeys:
     - key: Item
       type: <string>