Recently one of our customers had the business requirement to restrict AirPlay capabilities on Supervised iPad’s.

This requirement came about because staff were using AirPlay to get around sharing and screen recording restrictions set on devices.

Officially, Apple does not provide an MDM command to disable AirPlay directly, so I had to get a bit creative here.

What we can do “Officially”

If we take a look at Apple’s “Device management restrictions for iPhone and iPad devices” page here, we can see that there are only 3 AirPlay related options officially available.

The first option almost reads like a global AirPlay on/off toggle (in addition to the classroom features) but during testing with Intune it sadly did not disable AirPlay on any of my test devices.

A workaround

During research, I came across this lovely post from Bryan Garmon in the Workspace One forums.

To quote Bryan:

Apple does not provide an MDM command to disable AirPlay directly; but you can effectively disable AirPlay by providing a null list of available AirPlay targets to the device.

He also provided a payload for Workspace One that does just that.

I reworked his payload code into a .mobileconfig file for use with Intune, and this was the result I ended up with.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" 
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>Disable AirPlay</string>
<key>PayloadIdentifier</key>
<string>com.company.disableairplay.payload</string>
<key>PayloadType</key>
<string>com.apple.airplay</string>
<key>PayloadUUID</key>
<string>3F2A61E2-67D5-4B18-A34F-9B27C7D87111</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>AllowList</key>
<array>
<dict>
<key>DeviceName</key>
<string>FAKE-AIRPLAY-TARGET</string>
</dict>
</array>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Disable AirPlay</string>
<key>PayloadIdentifier</key>
<string>com.company.disableairplay</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>AE3D4E92-44F7-4A6A-B671-0C27D8A2F222</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" 
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDisplayName</key>
            <string>Disable AirPlay</string>
            <key>PayloadIdentifier</key>
            <string>com.company.disableairplay.payload</string>
            <key>PayloadType</key>
            <string>com.apple.airplay</string>
            <key>PayloadUUID</key>
            <string>3F2A61E2-67D5-4B18-A34F-9B27C7D87111</string>
            <key>PayloadVersion</key>
            <integer>1</integer>

            <key>AllowList</key>
            <array>
                <dict>
                    <key>DeviceName</key>
                    <string>FAKE-AIRPLAY-TARGET</string>
                </dict>
            </array>
        </dict>
    </array>

    <key>PayloadDisplayName</key>
    <string>Disable AirPlay</string>
    <key>PayloadIdentifier</key>
    <string>com.company.disableairplay</string>
    <key>PayloadRemovalDisallowed</key>
    <false/>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>AE3D4E92-44F7-4A6A-B671-0C27D8A2F222</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

I uploaded this to Intune as a custom config profile, and victory!

No more AirPlay 🙂

As you can see the AirPlay menu does appear, however no devices will show up.

This is perfect.

Building off of this…

After having luck with that, I then discovered that this setting was actually recently added to Intune via settings catalogs, even better!

This also includes another config option, for passwords, which can actually make our policy even stronger here.

With the Allow List only, nobody would be able to use AirPlay to any device unless it is named “FAKE-AIRPLAY-TARGET”.

However, by adding a password for this device name (and not telling anyone what it is) we are able to prevent connections entirely, even if someone manages to rename an AirPlay target.

For context, our setup used ADE enrolled iPad’s without user affinity, on iPad OS version 26.4.1.

Everything worked perfectly in the end!

Cheers!

I hope this helped, leave a comment below if you have anything you’d like to add, or if you just want to say hi!