Quick Links
Configuration profiles on an iPhone or iPad are sort of like Group Policy or the registry editor on Windows. They allow you to quickly distribute groups of settings and access powerful management features that aren't normally available. Configuration profiles are really designed for organizations, but can be used by anyone.
You'll need a Mac to create configuration profiles for your iPhone or iPad. This requires Apple Configurator, and modern versions of Apple Configurator are only available for Mac OS X. Apple once offered a version of Apple Configurator that works on Windows, but no longer does.
How to Create a Configuration Profile
To create a configuration profile, you'll need to install the free Apple Configurator app from the App Store on a Mac.
Launch Apple Configurator and click File > New Profile.
The new profile screen will appear, with the General tab selected. You'll have to type a name for your profile into the "Name" box here. The name will appear on any devices you install the configuration profile on, so give it a descriptive name.
Other fields here are optional. The Identifier is a unique identifier for the profile. Each profile should have a different identifier. If you want to replace an existing profile, give a new profile the same identifier as the old one. When someone installs the new profile on their device, it will replace the existing profile with that identifier.
The organization and description name allow you to provide further information about the profile. People with the profile installed on their device can view this information. The "consent message" appears when someone installs the profile on their device.
The "Security" and "Automatically Remove Profile" options allow you to define when the profile can be removed. By default, the profile can be removed by anyone. You can configure the profile so that it can never be removed or require a password to be removed, or have it automatically expire on a certain date or after a limited time period. These settings are intended for larger organizations to lock down their devices, but they can be used by anyone.
The rest of the screens listed in the sidebar are entirely optional. They're all set to "Not configured" by default, which means they're not part of the current configuration profile.
To define a setting, click a group of settings, then click the "Configure" button to see the settings included in that group.
You'll see a wide variety of settings you can configure, depending on the category you choose. Some of these settings are marked "supervised only," which means they'll only take effect on a device in Supervised Mode. You can define these settings in a configuration profile and then install it on a device anyway--but these particular settings will only function on a supervised device. They'll be silently ignored on a non-supervised device.
For example, the option to hide preinstalled apps under Restrictions > Apps only works on supervised devices.
Not all of these settings are for locking down a device. Others allow you to simply pre-configure a device in various ways. For example, click over to the Wi-Fi tab and you can add wireless network details. Users who install the configuration profile can automatically be connected to the Wi-Fi network with the appropriate network settings without configuring it themselves. For some sections, you can add additional settings using the + button in the top-right corner of the screen. For example, you could pre-configure multiple Wi-Fi networks.
You can also pre-configure VPNs, certificates, proxies, and other types of accounts. These settings can be part of a single configuration profile users can install to configure everything all at once.
When you're done, click File > Save to save the configuration profile to a file on your Mac. Configuration profiles have the .mobileconfig file extension, although it's hidden by default on Mac OS X.
How to Install a Configuration Profile
You can now install the configuration profile to one or more devices. You could email the configuration profile to someone--including yourself--or offer it for download on a website. When someone taps the email attachment in the Mail app or downloads the configuration profile file from a website, they'll be prompted to install it on their iPhone or iPad.
You'll see information about the settings the profile contains when you install it, and you can tap the categories for more details.
Only install configuration profiles you trust. A configuration profile could include malicious VPN or proxy settings that force your Internet traffic through a malicious server, for example.
You can also deploy the configuration profile to a device--either a supervised or unsupervised one--through Apple Configurator. To do so, connect the iPhone or iPad to your Mac using a USB cable--the cable you use to charge it works fine. You'll see a prompt asking you to trust the Mac on the iPhone or iPad. After you do, it will appear in the Apple Configurator app.
Double-click the device in Apple Configurator and click over to the "Profiles" category. Click the "Add Profiles" button and browse to the configuration profiles you'd like to add. Apple Configurator will immediately sync them to your connected iPhone or iPad.
How to Remove a Configuration Profile
To remove a configuration profile, head to Settings > General > Profile on your iPhone or iPad. You can then tap the name of the profile and tap "Delete Profile" to delete it from your device.
This is also how you can check to see if you have a configuration profile installed on your device. Just head to Settings > General > Profile and see if a profile is listed here. Tap the profile and then tap the categories to see more information about the settings it contains.
To remove a configuration profile via Apple Configurator, connect the device to your Mac and launch Apple Configurator. Double-click your device and select the "Profiles" category. Select the configuration profile and click Edit > Delete.
Organizations can also deploy and update configuration profiles through a mobile device management (MDM) server.