Apple Intelligence: frame MDM and Xcode restrictions in enterprise
Apple now specifies how MDM can govern external intelligence integrations: allow or block them, control sign-in and limit Apple Intelligence to a single workspace. For an Apple enterprise organization, that granularity turns a general AI policy into a deployable and verifiable control.
1. Update: three controls for external intelligence
The com.apple.configuration.external-intelligence.settings declarative configuration, documented by Apple on September 17, 2026, applies to supervised devices enrolled through Automated Device Enrollment on iOS 26.4, iPadOS 26.4, macOS 26.4 and visionOS 26.4 or later. Apple separates three decisions: allowing external integrations, allowing people to sign in, and supplying a list of allowed workspace IDs, currently limited to one value.
When that ID is present, Apple Intelligence allows only that workspace and requires sign-in for integrations that support it. Apple also notes that each MDM vendor chooses how to implement these settings, so their presence in Apple documentation does not guarantee immediate availability in Jamf or another service.
2. What Apple officially documents
In WWDC26 device management updates, Apple states that legacy Restrictions payload keys used to manage Apple Intelligence, Siri and keyboard settings were deprecated in iOS 26.4, iPadOS 26.4, macOS 26.4, visionOS 26.4 and watchOS 26.4. Apple points administrators to declarative configurations such as com.apple.configuration.intelligence.settings, com.apple.configuration.external-intelligence.settings, com.apple.configuration.siri.settings and com.apple.configuration.keyboard.settings.
The same documentation lists controls for Genmoji, Image Playground, Writing Tools, Image Wand, app-specific Apple Intelligence capabilities in Mail, Notes and Safari, Apple Intelligence Report, visual summaries, and on-device-only processing for dictation and translation on iPhone and iPad. Apple also says iOS 27, iPadOS 27, macOS 27 and visionOS 27 introduce a key to prevent Calendar events from being created using natural language input.
3. Why Xcode belongs in the same discussion
Apple's Review device management restrictions for Apple devices page also lists CodingAssistantAllowExternalIntegrations for macOS 26. On a supervised Mac, this restriction can turn off external integrations for the coding assistant in Xcode 26 through a com.apple.dt.Xcode profile. Apple also lists IDEProhibitOnDeviceModelInteraction, which can prevent Xcode Predictive Code Completion.
For development teams, the question is therefore not only whether Apple Intelligence is allowed. IT must distinguish local assistance, external integrations, code data, client constraints, intellectual property and logging. A developer Mac does not have the same risk profile as a field iPad or an administrative Mac.
4. What does this change for a Belgian or French organization?
For an SMB, this update means moving beyond a binary "AI allowed or blocked" rule. The useful question is which capabilities are needed, on which devices, through which MDM or Jamf controls, and which data must never be sent to an external service. For mid-market organizations, large enterprises and public bodies, the impact is broader: AI policy, profiles by population, business exceptions, software development, DPO, security, audit and support need a shared operating model.
In Belgium and France, the topic naturally connects to GDPR, contractual duties, document confidentiality, professional secrecy and sovereignty constraints. Workspace filtering can separate an approved environment from personal accounts, but it does not document data location or supplier commitments; those questions still belong in the legal and security assessment.
5. Underside analysis: govern AI by profile, not slogan
Our reading is that organizations should turn Apple Intelligence into a usage matrix. A support group may need Safari and Mail summaries; a legal group may require tighter restrictions; developers may need Xcode while external integrations remain restricted; a shared-device fleet may need a different policy again.
The Apple Business Partner role is to connect Apple Business, Automated Device Enrollment, Jamf or MDM, dynamic groups, compliance, user communication and support. Without that connection, Apple Intelligence settings become a pile of technical keys that are difficult to explain during an incident or an audit.
6. Recommended control points
- Inventory which Apple Intelligence features are actually useful by population: leadership, support, field teams, developers and sensitive business roles.
- Move legacy settings to Apple's declarative configurations as soon as the MDM supports them correctly.
- Confirm that the MDM implements all three settings, then test blocking, sign-in and single-workspace targeting on a supervised pilot group.
- Document Apple Intelligence, external integrations, Siri, keyboard and Xcode 26 separately instead of treating them as one AI block.
- Test profiles on supervised Mac, iPhone, iPad and Apple Vision Pro devices before broad rollout, with user and support validation.
- Align policy with GDPR, security, intellectual property, customer contracts and sector requirements.
- Keep readable MDM or Jamf evidence for audit: applied profiles, targeted groups, exceptions and validation date.
Goal: turn Apple Intelligence, Siri, keyboard and Xcode controls into an MDM policy that IT, security and business teams can actually operate.
Frame your Apple Intelligence governanceApple sources: External intelligence declarative configuration, WWDC26 device management updates, and Review device management restrictions for Apple devices.