Apple blocks new Safari configuration-profile installs while Lockdown Mode is on. MDM can still push profiles later. Turn this on after the profile you want is already installed.
Why this is its own level
Apple’s Platform Security guide describes Lockdown Mode as an optional, extreme reduction of the attack surface for people who may be targeted by mercenary spyware. There is no Restrictions key that turns it on. A website cannot flip it. MDM cannot flip it. That is why the old Level 3/4 pages felt sloppy: Lockdown Mode was glued onto “erase and supervise,” even though the two are independent.
Level 3 is this switch. Level 4 is optional MDM (user enrollment without a wipe, or Supervised after a wipe). Use one, both, or neither.
What it does
- Most incoming message attachments are blocked except images.
- WebKit disables just-in-time JavaScript compilation and some other web technologies.
- Incoming FaceTime is limited to people you have called.
- Wired / USB data connections are refused while the phone is locked.
- 2G cellular is turned off.
- Configuration profiles cannot be installed from Safari until you turn Lockdown Mode off (or you use your own MDM).
Some everyday features break. That is the point. Turn it off later if you do not need it.
Turn it on
- Finish Level 1 or Level 2 in Safari.
- Settings → Privacy & Security → Lockdown Mode → Turn On.
- Enter your passcode. The phone restarts.
- Confirm 2G is off on the same screen.
Optional next step
If you also want a server you run to push settings, that is Level 4.1 (no erase) or Level 4.2 (Supervised, erases). Lockdown Mode still works on those phones. You do not have to enroll to use Level 3.