<!--
{
  "documentType" : "article",
  "framework" : "DeviceManagement",
  "identifier" : "/documentation/DeviceManagement/commands-and-queries",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Commands and queries"
}
-->

# Commands and queries

Remotely execute management commands and queries on managed devices.

## Discussion

The Mobile Device Management (MDM) protocol provides a way to tell a device to remotely execute certain management commands or queries. When a device registers with the device management service, the service sends push notifications to the device when there are commands to process on the device.

When the device receives the notification, it polls the device management service for the command, processes the command, and reports the command results to the service. The device then checks for other commands to process.

> Important:
> Device management is for enterprise use only. To use it in your app, the Account Holder of your app’s development team must request the Mobile Device Management capability. For more information, see [Request a Mobile Device Management Capability](https://developer.apple.com/contact/request/mdm-capability).

## Topics

### Declarative management

[`Declarative Management`](/documentation/DeviceManagement/Declarative-Management-Command)

Enable your server to support declarative management or trigger a declarative management synchronization operation on the device.

### Profile management

[`Install Profile`](/documentation/DeviceManagement/Install-Profile-Command)

Install a configuration profile on a device.

[`Profile List`](/documentation/DeviceManagement/Profile-List-Command)

Get a list of installed profiles on a device.

[`Remove Profile`](/documentation/DeviceManagement/Remove-Profile-Command)

Remove a previously installed profile from the device.

[`Install Provisioning Profile`](/documentation/DeviceManagement/Install-Provisioning-Profile-Command)

Install a provisioning profile on a device.

[`Provisioning Profile List`](/documentation/DeviceManagement/Provisioning-Profile-List-Command)

Get a list of installed provisioning profiles on a device.

[`Remove Provisioning Profile`](/documentation/DeviceManagement/Remove-Provisioning-Profile-Command)

Remove a previously installed provisioning profile from a device.

### Device details

[`Device Information`](/documentation/DeviceManagement/Device-Information-Command)

Get detailed information about a device.

[`Device Configured`](/documentation/DeviceManagement/Device-Configured-Command)

Inform the device that it can allow the user to continue in Setup Assistant.

[`User Configured`](/documentation/DeviceManagement/User-Configured-Command)

Inform the device that it can continue past Setup Assistant and finish login.

[`Restrictions`](/documentation/DeviceManagement/Restrictions-Command)

Get a list of restrictions on the device.

### Device state

[`Erase Device`](/documentation/DeviceManagement/Erase-Device-Command)

Remotely and immediately erase a device.

[`Device Lock`](/documentation/DeviceManagement/Device-Lock-Command)

Remotely and immediately lock a device.

[`Restart Device`](/documentation/DeviceManagement/Restart-Device-Command)

Remotely and immediately restart a device.

[`Shut Down Device`](/documentation/DeviceManagement/Shut-Down-Device-Command)

Remotely and immediately shut down a device.

### Managed apps

[`Install Application`](/documentation/DeviceManagement/Install-Application-Command)

Install a third-party app on a device.

[`Install Enterprise Application`](/documentation/DeviceManagement/Install-Enterprise-Application-Command)

Install an enterprise app on a device.

[`Installed Application List`](/documentation/DeviceManagement/Installed-Application-List-Command)

Get a list of the installed apps on a device.

[`Managed Application List`](/documentation/DeviceManagement/Managed-Application-List-Command)

Get the status of all managed apps on a device.

[`Remove Application`](/documentation/DeviceManagement/Remove-Application-Command)

Remove an app.

[`Apply Redemption Code`](/documentation/DeviceManagement/Apply-Redemption-Code-Command)

Complete the installation of an app using a redemption code.

[`Validate Applications`](/documentation/DeviceManagement/Validate-Applications-Command)

Force validation of developer and universal provisioning profiles for enterprise apps.

[`Managed Application Attributes`](/documentation/DeviceManagement/Managed-Application-Attributes-Command)

Query attributes in managed apps on a device.

[`Managed Application Configuration`](/documentation/DeviceManagement/Managed-Application-Configuration-Command)

Get app configurations from managed apps on a device.

[`Managed Application Feedback`](/documentation/DeviceManagement/Managed-Application-Feedback-Command)

Get app feedback from a managed app on the device.

### Managed media

[`Install Media`](/documentation/DeviceManagement/Install-Media-Command)

Install a book on a device.

[`Managed Media List`](/documentation/DeviceManagement/Managed-Media-List-Command)

Get a list of the managed books on a device.

[`Remove Media`](/documentation/DeviceManagement/Remove-Media-Command)

Remove a previously installed book from a device.

### Accounts

[`Account Configuration`](/documentation/DeviceManagement/Account-Configuration-Command)

Create and configure a local administrator account on a device.

[`Invite To Program`](/documentation/DeviceManagement/Invite-To-Program-Command)

Invite a user to join the Volume Purchase Program (VPP).

### Passwords

[`Clear Passcode`](/documentation/DeviceManagement/Clear-Passcode-Command)

Remove the passcode from a device.

[`Clear Restrictions Password`](/documentation/DeviceManagement/Clear-Restrictions-Password-Command)

Clear the Screen Time password and the restrictions on a device.

[`Unlock User Account`](/documentation/DeviceManagement/Unlock-User-Account-Command)

Unlock a user account that the system locked because of too many failed password attempts.

[`Set Auto Admin Password`](/documentation/DeviceManagement/Set-Auto-Admin-Password-Command)

Update the local administrator account password.

[`Set Firmware Password`](/documentation/DeviceManagement/Set-Firmware-Password-Command)

Change or clear the firmware password on a device.

[`Verify Firmware Password`](/documentation/DeviceManagement/Verify-Firmware-Password-Command)

Verify the firmware password on a device.

### Lost device

[`Enable Lost Mode`](/documentation/DeviceManagement/Enable-Lost-Mode-Command)

Enable Lost Mode on a device, which provides a message and phone number on the Lock Screen.

[`Device Location`](/documentation/DeviceManagement/Device-Location-Command)

Request the location of a device when in Lost Mode.

[`Play Lost Mode Sound`](/documentation/DeviceManagement/Play-Lost-Mode-Sound-Command)

Play the Lost Mode sound on a device that’s in Lost Mode.

[`Disable Lost Mode`](/documentation/DeviceManagement/Disable-Lost-Mode-Command)

Take the device out of Lost Mode.

### Recovery Lock

[`Set Recovery Lock`](/documentation/DeviceManagement/Set-Recovery-Lock-Command)

Set or clear the Recovery Lock password.

[`Verify Recovery Lock`](/documentation/DeviceManagement/Verify-Recovery-Lock-Command)

Verify the device’s Recovery Lock password.

### Content caching

[`Content Caching Information`](/documentation/DeviceManagement/Content-Caching-Information-Command)

Get the status of the content caches on a device.

### AirPlay mirroring

[`Request Mirroring`](/documentation/DeviceManagement/Request-Mirroring-Command)

Prompt the user to share their screen using AirPlay Mirroring.

[`Stop Mirroring`](/documentation/DeviceManagement/Stop-Mirroring-Command)

Stop mirroring the display to another device.

### eSIM management

[`Refresh Cellular Plans`](/documentation/DeviceManagement/Refresh-Cellular-Plans-Command)

Query a carrier URL for active eSIM cellular-plan profiles on a device.

### Managed settings

[`Disable Remote Desktop`](/documentation/DeviceManagement/Disable-Remote-Desktop-Command)

Disable Remote Desktop on a device.

[`Enable Remote Desktop`](/documentation/DeviceManagement/Enable-Remote-Desktop-Command)

Enable Remote Desktop on a device.

[`Settings`](/documentation/DeviceManagement/Settings-Command)

Configure settings on a device.

### Lights-out management

[`LOM Device Request`](/documentation/DeviceManagement/LOM-Device-Request-Command)

Send requests to a device using lights-out management (LOM).

[`LOM Setup Request`](/documentation/DeviceManagement/LOM-Setup-Request-Command)

Get information from a device to set up lights-out management (LOM).

### Security

[`Security Info`](/documentation/DeviceManagement/Security-Info-Command)

Get security-related information about a device.

[`Certificate List`](/documentation/DeviceManagement/Certificate-List-Command)

Get a list of installed certificates on a device.

[`Activation Lock Bypass Code`](/documentation/DeviceManagement/Activation-Lock-Bypass-Code-Command)

Get the code to bypass Activation Lock on a device.

[`Clear Activation Lock Bypass Code`](/documentation/DeviceManagement/Clear-Activation-Lock-Bypass-Code-Command)

Clear the Activation Lock bypass code on a device.

[`Rotate FileVault Key`](/documentation/DeviceManagement/Rotate-FileVault-Key-Command)

Change the FileVault primary password on a device.

### Extensions

[`Active NSExtensions`](/documentation/DeviceManagement/Active-NSExtensions-Command)

Get a list of active extensions for a user on a device.

[`NSExtension Mappings`](/documentation/DeviceManagement/NSExtension-Mappings-Command)

Get a list of the installed extensions for a user on a device.

### Enhanced logging

[`Trigger Enhanced Log Collection`](/documentation/DeviceManagement/Trigger-Enhanced-Log-Collection-Command)

Trigger enhanced log collection on the device.

[`Cancel Enhanced Log Collection`](/documentation/DeviceManagement/Cancel-Enhanced-Log-Collection-Command)

Cancel enhanced log collection on the device.

### User management

[`User List`](/documentation/DeviceManagement/User-List-Command)

Get a list of users with active accounts on a device.

[`Log Out User`](/documentation/DeviceManagement/Log-Out-User-Command)

Force the current user to log out of a device.

[`Delete User`](/documentation/DeviceManagement/Delete-User-Command)

Delete a user’s account from a device.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)