`pymobiledevice3 profile`¶

Install and remove configuration profiles, supervise the device, and other MDM-style management.

`list`¶

Print the installed configuration profiles.

pymobiledevice3 profile list [OPTIONS]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`install`¶

Install configuration profiles (.mobileconfig).

Without --keybag the device asks the user to approve each profile; with a supervision identity (supervised devices) it is installed silently.

pymobiledevice3 profile install [OPTIONS] {profiles}...

Arguments:

Argument	Description
`profiles...`	Configuration profile files (.mobileconfig). [required]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

--keybag <file> Supervision identity (PEM with the supervisor certificate and private key) to install silently; without it the user must approve the profile on the device.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`cloud-configuration`¶

Print the device's cloud (supervision/DEP) configuration, or apply one from a plist.

pymobiledevice3 profile cloud-configuration [OPTIONS] [config]

Arguments:

Argument	Description
`config`	Cloud configuration plist to apply; omit to print the current one.

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`download-cloud-configuration`¶

Ask the device to download and apply its DEP cloud configuration (needs Internet on the device).

pymobiledevice3 profile download-cloud-configuration [OPTIONS]

Options:

Option	Description
`--native`	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own `remoted` tunnel via the `remotepairingd` service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: `remoted` and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until `remoted` reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
`--username <str>`	MDM enrollment username.
`--password <str>`	MDM enrollment password.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`store`¶

Store profiles on the device for installation after setup, without installing them now.

pymobiledevice3 profile store [OPTIONS] {profiles}...

Arguments:

Argument	Description
`profiles...`	Configuration profile files (.mobileconfig). [required]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`remove`¶

Remove an installed configuration profile by its identifier.

pymobiledevice3 profile remove [OPTIONS] {name}

Arguments:

Argument	Description
`name`	Profile identifier, as listed under ProfileMetadata by `profile list`. [required]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`set-wifi-power`¶

Turn the device's Wi-Fi radio on or off (defaults to off).

pymobiledevice3 profile set-wifi-power [OPTIONS] [state]:<on|off>

Arguments:

Argument	Description
`state:<on\\|off>`	Turn Wi-Fi on or off. [default: off]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`erase-device`¶

Erase all content and settings from the device. DESTRUCTIVE.

Wipes the device back to factory state (like Settings > General > Transfer or Reset > Erase All Content and Settings). There is no confirmation.

pymobiledevice3 profile erase-device [OPTIONS]

Options:

Option	Description
`--native`	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own `remoted` tunnel via the `remotepairingd` service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: `remoted` and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until `remoted` reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
`--preserve-data-plan / --no-preserve-data-plan`	Keep the eSIM / cellular data plan across the erase. [default: preserve-data-plan]
`--disallow-proximity-setup / --no-disallow-proximity-setup`	Prevent setting up the erased device from a nearby device (Quick Start). [default: no-disallow-proximity-setup]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`create-keybag`¶

Create a supervision identity (keybag) for supervise and silent profile installs.

Runs locally; no device needed.

pymobiledevice3 profile create-keybag [OPTIONS] {keybag} {organization}

Arguments:

Argument	Description
`keybag`	File to write the new identity (PEM private key + certificate) to. [required]
`organization`	Organization name for the certificate's Common Name. [required]

`supervise`¶

Supervise the device under your organization.

Activates the device first if it is not activated yet, then writes a supervised cloud configuration that registers the supervision identity.

pymobiledevice3 profile supervise [OPTIONS] {organization}

Arguments:

Argument	Description
`organization`	Organization name shown on the device as the supervisor. [required]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

--keybag <file> Supervision identity to register (see create-keybag). If omitted, a throwaway one is generated, so later supervised-only commands cannot be used.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`install-wifi-profile`¶

Install a Wi-Fi profile so the device joins the given network automatically.

pymobiledevice3 profile install-wifi-profile [OPTIONS] {encryption_type} {ssid} {password}

Arguments:

Argument	Description
`encryption_type`	Network security type (e.g. WPA, WEP, None). [required]
`ssid`	Network name (SSID). [required]
`password`	Network password. [required]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

--keybag <file> Supervision identity (PEM with the supervisor certificate and private key) to install silently; without it the user must approve the profile on the device.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`install-http-proxy`¶

Install a profile that routes the device's HTTP traffic through a global proxy.

pymobiledevice3 profile install-http-proxy [OPTIONS] {server} {port}

Arguments:

Argument	Description
`server`	Proxy server host name or address. [required]
`port`	Proxy server port. [required]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

--keybag <file> Supervision identity (PEM with the supervisor certificate and private key) to install silently; without it the user must approve the profile on the device.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`remove-http-proxy`¶

Remove the HTTP proxy profile installed by install-http-proxy.

pymobiledevice3 profile remove-http-proxy [OPTIONS]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`install-restrictions-profile`¶

Install a restrictions profile, e.g. to delay software (OTA) updates.

pymobiledevice3 profile install-restrictions-profile [OPTIONS]

Options:

Option	Description
`--native`	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own `remoted` tunnel via the `remotepairingd` service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: `remoted` and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until `remoted` reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
`--keybag <file>`	Supervision identity (PEM with the supervisor certificate and private key) to install silently; without it the user must approve the profile on the device.
`--enforced-software-update-delay <int range>`	Days to delay software updates from showing up (0-90). [default: 0; 0<=x<=90]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`request-unlock-token`¶

Save the passcode unlock token (supervised devices only).

The device must have no passcode set. The token can later be passed to clear-passcode.

pymobiledevice3 profile request-unlock-token [OPTIONS] {output}

Arguments:

Argument	Description
`output`	File to write the raw unlock token to. [required]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

--keybag <file> Supervision identity (PEM with the supervisor certificate and private key). [required]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`clear-passcode`¶

Remove the device passcode using a saved unlock token (supervised devices only).

The device then drops this host's pairing; re-pair without a prompt using lockdown pair-supervised.

pymobiledevice3 profile clear-passcode [OPTIONS] {token}

Arguments:

Argument	Description
`token`	Unlock token saved by request-unlock-token. [required]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

--keybag <file> Supervision identity (PEM with the supervisor certificate and private key). [required]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`clear-restrictions-password`¶

Clear the Screen Time passcode (supervised devices only).

iOS 27.2 rejects it device-side (its sandbox blocks the Screen Time agent lookup).

pymobiledevice3 profile clear-restrictions-password [OPTIONS]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

--keybag <file> Supervision identity (PEM with the supervisor certificate and private key). [required]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`security-info`¶

Show the device's security status (supervised devices only).

PasscodePresent reliably tells whether a passcode is set, unlike lockdown's PasswordProtected.

pymobiledevice3 profile security-info [OPTIONS]

Options:

Option Description

--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

--keybag <file> Supervision identity (PEM with the supervisor certificate and private key). [required]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

`set-wallpaper`¶

Set the wallpaper (supervised devices only).

pymobiledevice3 profile set-wallpaper [OPTIONS] {image}

Arguments:

Argument	Description
`image`	JPEG or PNG image. [required]

Options:

Option	Description
`--native`	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own `remoted` tunnel via the `remotepairingd` service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: `remoted` and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until `remoted` reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
`--keybag <file>`	Supervision identity (PEM with the supervisor certificate and private key). [required]
`--screen <lock\\|home\\|both>`	Screen(s) to apply the wallpaper to; iOS 16+ may apply it to both regardless. [default: home]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

pymobiledevice3 profile¶

list¶

install¶

cloud-configuration¶

download-cloud-configuration¶

store¶

remove¶

set-wifi-power¶

erase-device¶

create-keybag¶

supervise¶

install-wifi-profile¶

install-http-proxy¶

remove-http-proxy¶

install-restrictions-profile¶

request-unlock-token¶

clear-passcode¶

clear-restrictions-password¶

security-info¶

set-wallpaper¶

`pymobiledevice3 profile`¶

`list`¶

`install`¶

`cloud-configuration`¶

`download-cloud-configuration`¶

`store`¶

`remove`¶

`set-wifi-power`¶

`erase-device`¶

`create-keybag`¶

`supervise`¶

`install-wifi-profile`¶

`install-http-proxy`¶

`remove-http-proxy`¶

`install-restrictions-profile`¶

`request-unlock-token`¶

`clear-passcode`¶

`clear-restrictions-password`¶

`security-info`¶

`set-wallpaper`¶