Pick your path
The 3 Ways to Lock Down Your Kid's iPhone (and how to choose)
Three viable setups, from a one-time static lockdown to a fully tamper-proof phone. Here is what each one actually buys you, so you can pick the one that fits your kid.
Every path starts the same way: supervise the phone with Apple Configurator using a local, self-signed organization (a made-up “business” name, no Apple account needed). The fork is what you add on top: nothing, mobile device management (MDM), or an MDM plus Apple Business Manager (ABM).
How the fork works
Apple Configurator + local org
(no Apple account, no ABM)
Path A
Local, no MDM · static lockdown only
Path B
Supervised + MDM
Path C
+ ABM, tamper-proof
What each path buys you
| What you get | Path ALocal, no MDM | Path BSupervised + MDM | Path C+ ABM |
|---|---|---|---|
| Supervised restrictions at setup (block apps, block factory reset, no-VPN, hide built-in apps) | Yes | Yes | Yes |
| Web content filter + DNS filtering (e.g. NextDNS) | Yes, set at setup | Yes | Yes |
| Change settings / block an app later, remotely (no cable) | No, re-plug to the Mac to change anything | Yes | Yes |
| Nightly Lost Mode shut-off, on demand from your phone | No | Yes | Yes |
| Live dashboard + bypass/usage alerts | No | Yes | Yes |
| Teen can't remove your control | Supervision stays until a computer wipe; block-factory-reset makes that hard | Removable: teen can "Remove Management" or wipe via a computer | Non-removable; re-supervises even after a factory reset |
| Business account / paperwork | None | None | ABM + DUNS* + Apple verification call (~1-2 weeks) |
| Rough ongoing cost | ~$0-2/mo (NextDNS optional) | ~$4-6/mo (SimpleMDM + NextDNS) | ~$4-6/mo (ABM itself is free) |
| Best for | Cooperative younger kid; set-and-forget | Most parents (the sweet spot) | Determined / tech-savvy teen |
* DUNS may have been dropped for new US Apple Business signups as of ~April 2026 (verify before relying on it).
In plain words
You supervise the phone and bake your restrictions and filters in at setup. It is genuinely locked down (block apps, force a DNS filter, block factory reset), but everything is static: to change anything you plug back into the Mac, and there is no remote anything, so no nightly Lost Mode shut-off. Good for a young, cooperative kid where you set it once and never touch it again.
Everything in Path A plus remote, ongoing control from your phone: change filtering, block or unblock an app, push new rules anytime, and the nightly Lost Mode shut-off. This is the full day-to-day power, no business account, a few dollars a month. The catch: a determined teen can remove the management profile or wipe the phone with a computer to escape.
Everything in Path B plus tamper-proof: management cannot be removed and supervision re-applies itself even after a factory reset, so the teen genuinely cannot escape without you. The cost is the ABM setup (a DUNS number, an Apple verification call, a week or two). Worth it for a determined or tech-savvy teen; overkill for a younger one. You can start at Path B and add ABM later on the same phone.
What none of these do (be honest)
- ·None can quietly read iMessage. No tool can on iOS without a finicky desktop sync that depends on the teen's cooperation.
- ·DNS filtering is defeatable by a motivated kid. Supervised profile-locking raises the bar but is not absolute.
- ·Setting up supervision always erases the phone once (your data returns via iCloud at Setup Assistant). Any tool advertising “no erase” is hiding an automatic backup/restore around the wipe.
The dead end (for completeness)
MDM without supervision does almost nothing. iOS ignores the restrictions (“Doesn't support this profile”). Supervision is the gate that unlocks the real controls, which is why every path above starts by supervising the phone.
Want the printable setup checklist?
The printable, step-by-step version, plus new dangerous-app alerts as I find them. No spam, unsubscribe anytime.