# Restrictions

MDM lets you configure various restrictions on the managed Apple devices, as per the requirements of your organization. You can allow or restrict users to access various features of the devices, like profile settings, application settings, iCloud settings, security, and privacy settings.

**Note:** To view a detailed comparison of various policies supported with respect to specific OS version, click [here](https://www.manageengine.com/mobile-device-management/mdm-ios-feature-comparison.html).

The status of restrictions imposed using MDM for a **particular device**, is shown under **Inventory->Restrictions**. When no restrictions are imposed by MDM, by default the status is displayed as **Allowed**.

## Profile Creation

To create a Restriction Profile follow the given steps:

1. On the Mobile Device Manager Plus console, navigate to Device Management->Profiles->+create Profile->Choose iOS/iPadOS Profile.
   ![Create ios Profile](https://www.manageengine.com/mobile-device-management/help/images/iosres_1.png)
2. Provide the Profile Name and provide a description and continue.
   ![Create ios Profile description](https://www.manageengine.com/mobile-device-management/help/images/iosres_2.png)
3. Select the Restrictions Tab and configure the restrictions as required. Save and Publish the Restriction. Associate the restriction profile to the desired groups or devices.

**Note:** When a restriction is applied through MDM, the corresponding setting on the user's device is disabled (grayed out) and cannot be modified by the user until the restriction is removed.

## FAQ

**How can users install App Store apps without admin approval?**

**Answer:**

This can be enabled by configuring and associating an iOS/iPadOS restriction profile.

**Steps:**

1. Create a restriction profile that allows Add/modify iCloud, Mail and other accounts.
2. Also configure a restriction profile that allows users installing unapproved apps.
3. Associate the profile with the required devices.

Once applied, users can sign in with their Apple ID and install apps directly from the App Store without admin approval.