Every Apple Intelligence control is allowed by default on managed iPhones, iPads and Macs, and the features can send corporate text, documents and images either to Apple's Private Cloud Compute or, through the ChatGPT extension, to OpenAI. Security teams need to decide which features are acceptable, which data paths are acceptable, and then enforce that with device management rather than policy documents. This guide explains the three processing paths, the MDM restriction keys and the newer declarative configurations that control each feature, how to restrict the ChatGPT extension to a corporate workspace, what you can and cannot log, and a hardening baseline. It assumes the enrolment and supervision basics in our iOS and iPadOS Enterprise Security Guide and does not repeat them. Facts come from Apple's deployment documentation, Apple's published device management schema, Apple's Private Cloud Compute security write-up and Apple's ChatGPT extension privacy notice, checked on 8 November 2026.
This is an independent guide from NHI Mgmt Group, based on Apple's public documentation as of November 2026. It is not sponsored or reviewed by Apple. Product features change, so confirm settings against Apple's current documentation.
Key takeaways
- Every control defaults to allow. Each Apple Intelligence restriction and declarative key defaults to true, so nothing is blocked until you push a configuration.
- The control surface moved in 26.4. Apple's schema marks the Restrictions payload keys for Apple Intelligence deprecated in iOS, iPadOS and macOS 26.4 in favour of the declarative configurations com.apple.configuration.intelligence.settings and com.apple.configuration.external-intelligence.settings.
- Supervision is the dividing line. The declarative configurations require supervised devices, and most legacy keys require supervision on iOS; BYOD user enrolments get only the external intelligence on/off and sign-in keys, and only temporarily.
- ChatGPT has two privacy modes. Without an account, Apple's notice says OpenAI must not store requests or train on them; signed in, OpenAI's policies and the account's settings apply. Pinning a corporate workspace ID forces sign-in to that workspace.
- Private Cloud Compute is designed to be verifiable, not just trusted. Apple publishes PCC software measurements in a transparency log; your residual decisions are about the on-device and ChatGPT paths, not PCC internals.
How identity and access work in Apple Intelligence
Apple Intelligence has no separate admin console or tenant. Access is decided by three things: the device and its enrolment type, the person's Apple Account or Managed Apple Account signed in on it, and any external provider account used through the ChatGPT extension. Requests take one of three paths:
| Path | Where data goes | Identity used | Enterprise control |
|---|---|---|---|
| On-device models | Stays on the device | None beyond the device user | Per-feature allow keys; Force On-Device Only Dictation and Translation |
| Private Cloud Compute | Apple silicon servers via a third-party OHTTP relay that hides the source IP | Source IP hidden by the relay; non-targetability is a stated design requirement | Per-feature allow keys (no separate PCC switch in the schema) |
| ChatGPT extension | OpenAI, with IP hidden and approximate location shared | Anonymous, or the user's ChatGPT account | External intelligence Enabled, AllowSignIn and AllowedWorkspaceIDs |
Apple's Private Cloud Compute write-up sets five core requirements: stateless computation (personal data used only for the request and not retained, including in logs), enforceable guarantees, no privileged runtime access (no remote shells or admin tools that bypass the guarantees), non-targetability (an attacker cannot single out one user without a broad, likely detected compromise) and verifiable transparency. Nodes use the Secure Enclave to protect request decryption keys and Secure Boot to run only signed code; data volume keys are randomised on reboot, and only pre-specified, audited logs and metrics can leave a node. Apple publishes measurements of PCC software in an append-only transparency log, devices send data only to nodes whose attested software matches a logged release, and a Virtual Research Environment lets researchers inspect it. For most risk assessments this makes PCC comparable to on-device processing; the material third-party flow is ChatGPT. See the On-Device AI Security Guide.
Admin roles and privileged access
The privileged role here is whoever can publish configurations in your MDM service, plus whoever can assign devices to that MDM in Apple Business Manager. Both can switch Apple Intelligence controls on or off for the entire fleet, so treat them like any change to a security baseline.
- Separate authoring from assignment: configuration changes affecting Apple Intelligence should go through change control, with one administrator authoring and another approving the assignment to production groups. See the Change Management Security guide.
- Protect the MDM console: phishing-resistant MFA and a small admin group, because one compromised MDM admin account can issue wipe or configuration commands to the whole fleet.
- Supervision is set at enrolment: the declarative configurations require supervision, which comes from Automated Device Enrollment (and, for the Apple Intelligence configuration on Mac, Device Enrollment). Devices enrolled any other way cannot receive them, so device assignment in Apple Business Manager is part of the control. See the Apple Business Manager Security guide.
- Vendor variation: Apple's deployment pages state not every setting is available in every device management service and each implements them differently; confirm your MDM exposes the key before relying on it, and fall back to a custom profile or declaration where it does not.
Integrations, API tokens and service accounts
The only external integration Apple documents for enterprise control is external intelligence, used by the ChatGPT extension. Apple's ChatGPT extension privacy notice states:
- Off by default: the extension must be enabled before anything is sent, and users are asked before information is shared. For Siri, the confirmation prompt can be turned off by the user; for Writing Tools and visual intelligence, users choose per feature.
- What is sent: the request, attachments and related content (such as documents or photos), plus time zone, country, device type, language and feature used. The IP address is hidden; an approximate location is shared for fraud prevention and legal compliance.
- Without a ChatGPT account: OpenAI must use the data only to fulfil the request, must not store it unless required by law, and must not use it to train or improve models.
- With a ChatGPT account: OpenAI's privacy policies and the account's settings apply, and OpenAI may log requests, attachments and session history and may use them for training.
That creates a real decision. Anonymous use has strong contractual limits but no corporate visibility. Signed-in use with a personal account is the worst case: data lands under consumer terms you do not control. Signed-in use with a corporate workspace gives you that workspace's data terms and admin controls.
| Setting (declarative, 26.4) | Legacy Restrictions key | Effect | Enrolment |
|---|---|---|---|
| Enabled | allowExternalIntelligenceIntegrations | false turns off external intelligence integrations | Legacy key works on iOS user enrolment and unsupervised devices, temporarily per Apple |
| AllowSignIn | allowExternalIntelligenceIntegrationsSignIn | false forces anonymous mode and signs out an already signed-in user on their next request | As above |
| AllowedWorkspaceIDs | allowedExternalIntelligenceWorkspaceIDs | Only the listed workspace ID (currently one value) is allowed, and sign-in is required | Supervised on iOS; profile cannot be manually installed |
Apple's schema notes that multiple workspace ID payloads combine by intersection, so two conflicting values produce an empty set and block the integration; manage the value in one place. Choose one of three postures: disable (Enabled false), anonymous only (AllowSignIn false), or corporate workspace only (AllowedWorkspaceIDs set to your organisation's workspace). See the Shadow AI Discovery Guide.
Feature controls reference
All keys below default to true (allowed). Version numbers are the introduced versions in Apple's schema. Legacy keys are deprecated from 26.4 but remain the only option for devices on earlier releases.
| Feature | Legacy key (iOS / macOS introduced) | Declarative key (intelligence.settings) | Data risk to weigh |
|---|---|---|---|
| Writing Tools | allowWritingTools (18.0 / 15.0) | AllowWritingTools | Rewrites any selected text, including in third-party apps; can hand off to ChatGPT |
| Mail summaries and Smart Replies | allowMailSummary (18.1 / 15.1), allowMailSmartReplies (18.4 / 15.4) | Apps, Mail: AllowSummary, AllowSmartReplies | Processes message bodies |
| Notes transcription | allowNotesTranscription (18.4 / 15.4), allowNotesTranscriptionSummary (18.3 / 15.3) | Apps, Notes: AllowTranscription, AllowTranscriptionSummary | Records and summarises meetings; consent obligations |
| Safari summaries | allowSafariSummary (18.4 / 15.4) | Apps, Safari: AllowSummary | Processes page content including intranet pages |
| Image Playground, Genmoji, Image Wand | allowImagePlayground, allowGenmoji (18.0 / 15.0), allowImageWand (iOS 18.0) | AllowImagePlayground, AllowGenmoji, AllowImageWand | Generated imagery in corporate communications |
| Visual intelligence | allowVisualIntelligenceSummary (iOS 18.3) | AllowVisualIntelligence (27.0); AllowVisualIntelligenceSummary deprecated | Camera and screen content; can hand off to ChatGPT |
| Apple Intelligence Report | allowAppleIntelligenceReport (18.4 / 15.4) | AllowAppleIntelligenceReport | Decide whether users and investigators may generate it |
| Dictation and translation | None | ForceOnDeviceOnlyDictation, ForceOnDeviceOnlyTranslation (default false) | Keeps speech and translated text on device |
| Siri integration | allowSiriAI (iOS 27.0, already deprecated) | Use com.apple.configuration.siri.settings | Siri requests that may reach PCC or ChatGPT |
The intelligence declaration uses a boolean AND combine type: if any assigned declaration sets a key to false, the feature is off. That makes layering safe (a stricter group policy always wins) but means a forgotten test declaration can silently disable features for a pilot group. On Mac, the declaration can be applied at system and user scope.
Logging and detection
There is no per-request enterprise audit log for Apple Intelligence. What you can measure is configuration state and data flow:
- Configuration compliance: use declarative status reports from your MDM to confirm each device has the intelligence and external intelligence declarations applied and active, and report devices below 26.4 still relying on legacy keys.
- OS version coverage: devices below the version in which a key was introduced ignore it; track the fleet by OS version against the table above.
- Network and workspace logs: if you pin a corporate ChatGPT workspace, that workspace's own audit and compliance logs become the record of what was sent through it.
- Shadow AI signals: devices with external intelligence enabled but no workspace pin, discovered through configuration reports, are the population most likely to send data under personal terms.
Metrics: percentage of supervised devices with both declarations active; percentage of fleet on 26.4 or later; devices with external intelligence enabled and no workspace pin (target zero for corporate-owned); count of user enrolments where only legacy external intelligence keys apply; time from policy change to 95 percent compliance.
Hardening baseline
- Classify features: agree with legal and privacy which features are allowed per data classification; on-device and PCC features are usually acceptable for most roles, ChatGPT handoff and Notes transcription need explicit decisions.
- Pilot in audit fashion: because there is no report-only mode, apply the declarations to an IT pilot group first and confirm the expected features disappear, then widen by ring.
- Corporate-owned, supervised: deploy com.apple.configuration.external-intelligence.settings with either Enabled false or AllowedWorkspaceIDs set to your workspace; deploy com.apple.configuration.intelligence.settings with Mail, Notes and Safari settings matched to your classification and on-device-only dictation and translation for sensitive roles.
- Older OS versions: keep an equivalent Restrictions payload for devices below 26.4 until they are upgraded.
- BYOD user enrolment: apply allowExternalIntelligenceIntegrations or allowExternalIntelligenceIntegrationsSignIn where your policy requires, knowing Apple states these will require supervision in a future release; protect corporate data with managed apps and data separation rather than device-wide AI controls.
- High-risk users: combine with the Apple Lockdown Mode Guide where appropriate.
- Roll back: removing a declaration restores the default (allowed) behaviour; keep versioned copies so a rollback is a reassignment rather than a rebuild.
Decision guidance by organisation size: a small organisation without supervised devices cannot use the declarative configurations at all, so its realistic options are the legacy external intelligence keys on user-enrolled devices and a written rule against personal ChatGPT sign-in; the priority there is moving corporate-owned devices into Automated Device Enrollment. A mid-sized organisation with supervised fleets should standardise on the two declarations and one workspace pin. A large or regulated organisation will usually want per-group declarations, for example on-device-only dictation and no Notes transcription for legal, HR and executives, with the boolean AND combine type guaranteeing the stricter group wins where memberships overlap. In every case, tell users which features are allowed and why: blocking without explanation pushes the same data into unmanaged apps.
| Control area | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ATT&CK addressed |
|---|---|---|---|
| Feature restrictions and declarations | CM-6, CM-7 | PR.PS-01 | |
| External intelligence workspace pinning | SA-9, AC-3 | GV.SC-07 | T1567 Exfiltration Over Web Service |
| On-device-only dictation and translation | SC-28 | PR.DS-02 | |
| MDM admin access | AC-6, IA-2 | PR.AA-05 | T1078.004 |
| Status reports and compliance | AU-6 | DE.CM-03 |
Common misconfigurations
- Relying on deprecated keys only: continuing to push Restrictions payload keys to 26.4 devices without the matching declarations, then losing control when Apple stops honouring them.
- Assuming BYOD is covered: the declarative configurations need supervision, so user enrolments and unsupervised devices are outside them.
- Allowing sign-in without a workspace pin: users sign in with personal ChatGPT accounts and corporate content falls under consumer terms.
- Conflicting workspace ID payloads: two values intersect to an empty set and block the integration for everyone in both groups.
- Blanket disablement without need: switching off on-device and PCC features that carry little third-party risk pushes users towards unmanaged AI tools.
- Forgetting Notes transcription: recording meetings raises consent and retention issues separate from AI processing.
Practitioner checklist
- Decide per feature and data class which Apple Intelligence features are allowed.
- Choose a ChatGPT posture: disabled, anonymous only, or corporate workspace only.
- Deploy both declarative configurations to supervised devices on 26.4 or later.
- Keep equivalent Restrictions payload keys for devices on earlier versions.
- Set ForceOnDeviceOnlyDictation and ForceOnDeviceOnlyTranslation for sensitive roles.
- Manage the workspace ID in a single configuration to avoid empty intersections.
- Confirm your MDM exposes each key; use custom declarations where it does not.
- Monitor declarative status reports and OS version coverage monthly.
- Restrict who can publish MDM configurations and require approval for changes.
Standards and references
- Apple Platform Deployment: Apple Intelligence declarative configuration
- Apple Platform Deployment: External intelligence declarative configuration
- Apple: Device management schema, Restrictions payload
- Apple: Device management schema, Intelligence settings declaration
- Apple Security Research: Private Cloud Compute
- Apple: ChatGPT extension and privacy
Related NHI Mgmt Group resources: iOS and iPadOS Enterprise Security Guide · Apple Declarative Device Management and Managed Device Attestation Guide · macOS Security Guide for Enterprises · Mobile Device Management Security Guide