<!--
{
  "availability" : [
    "iOS: 18.0.0 -",
    "iPadOS: 18.0.0 -",
    "macCatalyst: 18.0.0 -",
    "macOS: 15.0.0 -",
    "visionOS: 26.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "DeviceManagement",
  "identifier" : "/documentation/DeviceManagement/SafariExtensionSettings",
  "metadataVersion" : "0.1.0",
  "role" : "Object",
  "symbol" : {
    "kind" : "Object",
    "modules" : [
      "Device Management"
    ],
    "preciseIdentifier" : "rmdm-declarations:SafariExtensionSettings"
  },
  "title" : "SafariExtensionSettings"
}
-->

# SafariExtensionSettings

The declaration to configure Safari Extensions.

```
object SafariExtensionSettings
```

## Discussion

Specify `com.apple.configuration.safari.extensions.settings` as the declaration type.

Safari supports the following values for `AllowedDomains` and `DeniedDomains`:

- A specific domain such as “example.com” or “www.example.com”.
- A wildcard domain that uses a single “*” character as a prefix for the domain, such as “*example.com”. This matches both the exact domain “example.com”, and any sub-domains such as “www.example.com”. It won’t match other domains with a similar string suffix such as “myexample.com”.
- A global wildcard specified as a single “*” character that matches any domain.

Safari determines whether a domain is allowed or denied using the following precedence rules:

1. A specific domain takes precedence over the global wildcard or a wildcard domain.
2. A wildcard domain takes precedence over the global wildcard.

If the same value appears in both `AllowedDomains` and `DeniedDomains`, Safari denies use of a matching domain.

The user can configure any domains not matched by the values in `AllowedDomains` or `DeniedDomains`.

### Examples

Give an extension access to only “example.com” and its sub-domains, and deny access to everywhere else.

```json
"AllowedDomains": ["*example.com"],
"DeniedDomains": ["*"]
```

Give an extension access to “example.com” and its sub-domains, without deny anywhere else. The user can make their own choice for other domains.

```json
"AllowedDomains": ["*example.com"]
```

Give an extension access to “example.com” and its sub-domains, but deny access to “private.example.com” or anywhere else.

```json
"AllowedDomains": ["*example.com"],
"DeniedDomains": ["private.example.com", "*"]
```

Give an extension access to “public.example.com”, but deny access to “example.com” or any other of its sub-domains. The user can make their own choice for other domains.

```json
"AllowedDomains": ["public.example.com"],
"DeniedDomains": ["*example.com"]
```

### Configuration availability

|||
|--------------------------------|------------------------------------------------------------------------------------|
|Allowed in supervised enrollment|iOS, macOS, Shared iPad, visionOS                                                   |
|Allowed in device enrollment    |N/A                                                                                 |
|Allowed in user enrollment      |N/A                                                                                 |
|Allowed in local enrollment     |N/A                                                                                 |
|Allowed in system scope         |iOS, visionOS                                                                       |
|Allowed in user scope           |macOS, Shared iPad                                                                  |
|Apply                           |Multiple configurations are combined and applied as a single effective configuration|

### Configuration examples

**Disallow all:**

This configuration disables all Safari extensions.

```json
{
    "Type": "com.apple.configuration.safari.extensions.settings",
    "Identifier": "EB13EE2B-5D63-4EBA-810F-5B81D07F5017",
    "ServerToken": "E180CA9A-F089-4FA3-BBDF-94CC159C4AE8",
    "Payload": {
        "ManagedExtensions": {
            "*": {
                "State": "AlwaysOff"
            }
        }
    }
}
```

**Allow one:**

This configuration disables all Safari extensions, except for one that it requires.

```json
{
    "Type": "com.apple.configuration.safari.extensions.settings",
    "Identifier": "EB13EE2B-5D63-4EBA-810F-5B81D07F5017",
    "ServerToken": "E180CA9A-F089-4FA3-BBDF-94CC159C4AE8",
    "Payload": {
        "ManagedExtensions": {
            "*": {
                "State": "AlwaysOff"
            },
            "com.example.WebExtension (ABCDE12345)": {
                "State": "AlwaysOn"
            }
        }
    }
}
```

**Disallow private browsing:**

This configuration allows all Safari extensions, but one isn’t allowed in private browsing.

```json
{
    "Type": "com.apple.configuration.safari.extensions.settings",
    "Identifier": "EB13EE2B-5D63-4EBA-810F-5B81D07F5017",
    "ServerToken": "E180CA9A-F089-4FA3-BBDF-94CC159C4AE8",
    "Payload": {
        "ManagedExtensions": {
            "com.example.WebExtension (ABCDE12345)": {
                "State": "AlwaysOn",
                "PrivateBrowsing": "AlwaysOff"
            }
        }
    }
}
```

**Disallow domain:**

This configuration allows all Safari extensions, but one isn’t allowed for use with a domain and its sub-domains.

```json
{
    "Type": "com.apple.configuration.safari.extensions.settings",
    "Identifier": "EB13EE2B-5D63-4EBA-810F-5B81D07F5017",
    "ServerToken": "E180CA9A-F089-4FA3-BBDF-94CC159C4AE8",
    "Payload": {
        "ManagedExtensions": {
            "com.example.WebExtension (ABCDE12345)": {
                "DeniedDomains": [
                    "*example.org"
                ]
            }
        }
    }
}
```

## Topics

### Objects

[`SafariExtensionSettingsManagedExtensionsObject`](/documentation/DeviceManagement/SafariExtensionSettingsManagedExtensionsObject)

The dictionary of managed extensions settings. Each key in the dictionary represents a composed identifier for a specific managed extension, or you can specify a single “*” character to match any extension. The dictionary values represent the settings that Safari applies to each extension that matches the key. In order for the extension to be managed, its host app needs to be present on the device.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)