Setting unique restrictions for signed-out devices

The Signed-Out label enables you to specify more stringent restrictions for multi-user devices when a user signs out. This is a dynamic label that applies automatically to any multi-user iOS device that does not have a signed-in user.

Specifying restrictions involves the following main steps:

  1. Create the restrictions that you want applied when a user signs out.

    For example, you might want to disable access to YouTube when an authorized user is not signed in.

  2. Apply each policy and configuration to the Signed-Out label.

Suppose you want iPad devices to be restricted to basic web use when an authorized user is not signed in. You would need to create a Restrictions configuration to lock down the camera, inappropriate content, screen captures, app installation, and so on.


  1. Go to Policies & Configs > Configurations.
  2. Select Add New > Apple > iOS / tvOS > Restrictions. The New Restrictions Setting dialog box opens.
  3. Assign a Name to the configuration.
  4. Clear the check boxes for the items you want to restrict.
  5. Select Save.
  6. Select the new configuration.
  7. Select Actions > Apply To Label.
  8. Select Signed-Out.
  9. Select Apply.

    Ivanti EPMM sends the new restriction settings to multi-user devices upon sign-out.