When you apply several different payloads to a device, the settings interact in a variety of ways.
Combined payloads
Combined payload items aren’t mutually exclusive. These payload items are concatenated together, keeping all the payload items. Combined payloads are usually things like mail or LDAP accounts, where the existence of one doesn’t preclude additional accounts.
Multiple payloads of the same kind can be applied to a device. If payloads contain account, certificate, or network configurations, each of the payloads’ configurations are applied simultaneously. Some network payloads may conflict with others. If two payloads define different network settings for the same SSID, for example, the result is undefined. However, iOS payloads containing restrictions don’t conflict. Instead, the most restrictive value of each restriction is applied. In OS X, most combined payload’s restrictions settings (versus account settings) are undefined if more than one value exists in multiple payloads.
You can use combined payloads to add usage restrictions together to form a restrictive environment where the user has very limited options on what can be used on the device.
Exclusive payloads
Exclusive payloads can only be applied once. These payloads have only one version of the setting possible, like device names, password policies, or specific network settings. For example, a device can’t simultaneously have more than one global HTTP proxy. Any duplicate payload settings overwrite previous settings.
If payloads contradict each other, the more restrictive setting is normally used. In some cases, the result is undefined.
Note: On iOS, if combined payloads have the same account description (or display name), they’re treated as exclusive payloads.
Payload categories and interaction
The following table shows the available payloads, how they can be applied, and whether they’re exclusive, combined, or other.
Payload | OS X and iOS | iOS only | OS X only |
|---|---|---|---|
General | Exclusive |
|
|
Certificate | Combined |
|
|
Font | Combined |
|
|
Network | Combined |
|
|
Passcode | Combined |
|
|
SCEP | Combined |
|
|
Security & Privacy | Varies |
|
|
VPN | Combined |
|
|
AirPlay |
| Combined |
|
AirPrint |
| Combined |
|
APN |
| Exclusive |
|
Calendar | Combined (user) | Combined (device) |
|
Contacts | Combined (user) | Combined (device) |
|
Exchange | Combined (user) | Combined (device) |
|
Global HTTP Proxy |
| Exclusive |
|
LDAP | Combined (user) | Combined (device) |
|
Combined (user) | Combined (device) |
| |
Restrictions (iOS) |
| Exclusive |
|
Single App Mode |
| Exclusive |
|
Single Sign-on |
| Exclusive |
|
Subscribed Calendars |
| Combined |
|
Web Clips | Combined (user) | Combined (device) |
|
Content Filter |
| Combined |
|
Domains |
| Combined |
|
Accessibility |
|
| Combined |
AD Certificate |
|
| Exclusive |
Custom Settings |
|
| Combined |
Directory |
|
| Exclusive |
Dock |
|
| Combined |
Energy Saver |
|
| Combined |
Finder |
|
| Combined |
Identification |
|
| Exclusive |
Login Items |
|
| Combined |
Login Window |
|
| Combined |
Messages |
|
| Combined |
Mobility |
|
| Combined |
Parental Controls |
|
| Combined |
Printing |
|
| Combined |
Restrictions (OS X) |
|
| Exclusive |
Software Update |
|
| Combined |
Time Machine |
|
| Combined |
Xsan |
|
| Exclusive |
Interaction with Open Directory
OS X payloads may behave differently when they interact with Open Directory settings:
Managed device-applied user profiles take priority over Open Directory-stored user settings.
Open Directory-stored user settings take priority over managed device-applied device profiles.
Managed device-applied device profiles take priority over Open Directory-stored computer settings.