HelpMDM
Preference keys
Customer-facing preference keys for a Veil configuration profile.
VPL- personal (2 Macs) · VTL- team (seats)
Preference domain com.itsveil.app. Forced keys win over Settings. A key that is absent stays employee-editable. Invalid values are ignored.
Ask for Touch ID when I come back is one setting for every veil, manual and automatic alike. It is checked when someone later tries to unveil, counted from when the screens first go dark. The time running out never locks macOS, never restores the displays, and never ends the login session. Do not add a lock-after-N-seconds key.
Two keys set it. automaticVeilAuthenticationDelay picks the value for every veil. requiresAuthenticationOnUnveil set to true forces Immediately for every veil, unless automaticVeilAuthenticationDelay is also managed: then that value wins, so the standard profile (true with fiveMinutes) means After 5 minutes. Either managed key locks the control. requiresAuthenticationOnUnveil set to false on its own does not lock it.
| Key | Type | Allowed | Settings control |
|---|---|---|---|
| TeamLicenseKey | String | Forced VTL- team key. Older VEILT- team keys still work. Personal keys are ignored. | Silent team activate. Not a paste field when managed. |
| TeamLicenseEmail | String | A real email. Do not leave $ unexpanded. Optional. Jamf $EMAIL is fine; Kandji does not expand it. | Optional email on team activate. There is no login screen. |
| LaunchAtLogin | Bool | true or false | Launch on login |
| automaticVeilEnabled | Bool | true or false | Veil when I’m away |
| automaticVeilDelay | Number (seconds) | 30, 60, 300, 600, 900, or 1800 only | Wait for (idle time before Automatic Veil starts). Not a lock timer. |
| requiresAuthenticationOnUnveil | Bool | true or false | Ask for Touch ID when I come back. true locks the control and forces Immediately, unless automaticVeilAuthenticationDelay is also managed, which then wins. false alone does not lock it. |
| automaticVeilAuthenticationDelay | String | immediately · oneMinute · fiveMinutes · fifteenMinutes · never | Ask for Touch ID when I come back, for every veil. Checked on a later unveil, counted from when the screens go dark. Expiration alone does nothing. Not a lock timer. |
| blocksPhysicalInputWhileVeiled | Bool | true or false | Block keyboard and mouse while veiled. Needs Accessibility or the row waits for approval. |
Do not manage
Leave these to the employee: the keyboard shortcut, Input Monitoring, Unveil on any key or mouse move, appearance, branded transitions and sounds, and Battery. Do not invent extra keys. Do not put a personal VPL- string in TeamLicenseKey.
The portal’s downloaded profile omits blocksPhysicalInputWhileVeiled. Add Accessibility on supervised Macs if you want the input block with zero clicks. One optional shortcut setting still needs the employee to allow it in System Settings.
Install order: profile, then pkg.