What is the MOBILECONFIG file format?
.mobileconfig is a configuration file for Apple systems - iOS, iPadOS, macOS, watchOS, and tvOS. A .mobileconfig file stores various information regarding device settings and configuration, including password policies, device access permissions, as well as VPN, email, and calendar settings. The file therefore covers most categories of network and account configuration.
Internally, .mobileconfig is an XML property list document - the same .plist format used throughout Apple platforms. The root <dict> holds a PayloadContent array, where each PayloadType key identifies the category of settings being applied - Wi-Fi, certificates, email accounts, VPN tunnels, passcode policies, and many more.
.mobileconfig files are typically hosted on a remote profile service or MDM (Mobile Device Management) server, whose purpose is to communicate with the device to configure and register it. Profiles can be digitally signed using CMS/PKCS#7 to ensure secure data transport and prevent tampering. A signed or encrypted profile is delivered as a binary CMS blob rather than readable XML, though iOS and macOS still install it normally. Signing certificates are commonly distributed as .p12 or .cer files.
.mobileconfig files continue to be widely used by enterprises and public institutions for implementing and managing configurations across multiple devices. A profile can be installed on an iOS or iPadOS device by tapping it in Safari or Mail, which prompts the Settings app to walk through the installation steps. Tools such as Apple Configurator 2 and iMazing Profile Editor let administrators create and edit profiles without writing raw XML.
Security & safety
RISK: HIGHConfiguration profiles are powerful and a real attack vector: a malicious .mobileconfig can install a root certificate (enabling traffic interception), redirect DNS, force a web/content proxy, or silently enroll your device into someone else's MDM that can then wipe it, install apps, and track it. Rules: only install profiles from a source you genuinely trust (your real employer/school/carrier); read the payload summary and issuer Apple shows on the install screen; be deeply suspicious of any 'free internet', 'free VPN', game-hack or jailbreak site that tells you to install a profile. To audit or remove profiles, on iOS go to Settings > General > VPN & Device Management and on macOS to System Settings > Privacy & Security > Profiles - if you see one you don't recognize, remove it. A device with no profile shows no such entry at all.
Format details
in a nutshellPrograms that open MOBILECONFIG files
Windows2 apps
iMazing Profile Editor
Free Free Windows app to create/edit/read .mobileconfig files (you still install the profile on the Apple device itself).
Text editor (Notepad++, VS Code)
Open-source An UNSIGNED .mobileconfig is XML - open it to read the payloads. Signed/encrypted ones look binary; use a profile editor instead. 
macOS3 apps
macOS System Settings (install)
Built-in Double-click the .mobileconfig, then approve it in System Settings > Privacy & Security > Profiles (or Device Management). Remove it from the same pane.
Apple Configurator 2
Free Free Mac App Store app: File > Open to view/edit a .mobileconfig, or create new profiles and deploy them to attached devices. Replaces the old iPhone Configuration Utility.
iMazing Profile Editor
Free Free dedicated editor for .mobileconfig (also on Windows). Build, read and validate profiles with every payload key.
iOS / iPadOS Settings (install)
Built-in Open/download the .mobileconfig (Mail attachment or web link), then Settings > General > VPN & Device Management > tap the profile > Install. Remove it from the same screen. Technical details
deep spec| Underlying format | Unsigned profile: UTF-8 XML property list beginning with <?xml and a <plist><dict> root. Signed or encrypted profile: binary CMS/PKCS#7 blob with no readable XML. |
| MIME type | application/x-apple-aspen-config |
| Root payload keys | PayloadContent (array), PayloadDisplayName, PayloadIdentifier, PayloadType (value: Configuration), PayloadUUID, PayloadVersion (integer, typically 1) |
| Payload types supported | 50+ types including com.apple.wifi.managed, com.apple.vpn.managed, com.apple.email.managed, com.apple.passcode.managed, com.apple.certificate, com.apple.proxy.http.global, and many more |
| Signing standard | CMS (Cryptographic Message Syntax, RFC 5652); signed profiles appear as binary blobs; signing authority can be a public CA or a private enterprise CA |
| Payload encryption | Profiles can be encrypted with the target device's identity certificate so only that specific device can decrypt and install the payload |
| iOS/iPadOS installation | Tapping the file in Safari or Mail opens the Settings app profile installer; user must confirm, and a passcode may be required |
| macOS installation | Double-clicking opens System Settings > Privacy & Security > Profiles; installation requires user authentication |
| MDM delivery | MDM servers push profiles over-the-air using Apple's MDM protocol; device must be enrolled; server requires an Apple-issued MDM push certificate |
| Supervision payloads | Apple Configurator 2 supervision or Automated Device Enrollment unlocks additional restriction payloads unavailable on unsupervised devices |
| Platform support | iOS, iPadOS, macOS, tvOS, watchOS, and visionOS; individual payload keys and their availability vary by platform |
| PayloadUUID tracking | Every profile and each sub-payload carries a PayloadUUID (UUID v4) used to identify the profile for update, replacement, or removal |
| Removal control | The boolean PayloadRemovalDisallowed key prevents user-initiated removal; MDM-locked profiles can only be removed via an MDM Remove Profile command |
| Developer | Apple Inc. (proprietary format; documented for third-party developers but without a published open specification) |
| Released | iPhone OS / iOS (2010, with iPhone Configuration Utility); current standard across iOS, iPadOS, macOS, tvOS |
| Specification | developer.apple.com |
MOBILECONFIG conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about MOBILECONFIG files.
