Stop iCloud Keychain with a profile

This is a follow-up to my blog post macOS Sonoma silently enabled iCloud Keychain despite my precautions. A follower on Mastodon gave me a nice tip on how to prevent this in the future: create a configuration profile.

First, download the Apple Configurator app from the Mac App Store. Then open Apple Configurator, select New Profile from the File menu, uncheck Allow iCloud Keychain in Restrictions, and save the .mobileconfig file.

Open the file in Finder to install the profile, and approve the profile in the Privacy & Security pane of the System Settings. The Profiles section is at the bottom. Here's my profile:

For good measure, I also disallowed iCloud Photos, Siri (Assistant, which I've literally never used), Diagnostic Submission, and Apple Personalized Advertising. The other restrictions, technically non-restrictions in this case, were not changed by me from the defaults but just came along with the profile file.

Problem solved… hopefully. I haven't actually tested whether a profile prevents the bug where macOS updates automatically enable iCloud Keychain. If it doesn't, though, then that would be an even more massive bug!

Leave a Comment