> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update an MDM control

> Partially update an existing MDM control by ID. Send only the fields you want to change — any omitted field is left unchanged. `type` is required and must match the control (it selects the config schema). Editable fields: `name`, `enabled`, `configurationPayload`, and targeting. `configurationPayload` fully replaces the stored config when present (not merged); omit it to keep the current config, or send null to clear it. Targeting is set via `targetMethod` (omit to keep current): "All" (every device) or "DeviceGroup" (`includedDeviceGroupIds`/`excludedDeviceGroupIds`). An unknown ID returns 404, invalid config/targeting 400, a name/profile conflict 409, and demo companies are not allowed to update MDM controls (403).

<span className="badge-write">Key: Write</span><span className="badge-company">Scope: Company</span>


## OpenAPI

````yaml https://api.getprimo.com/openapi.json patch /mdm-controls/{mdmControlId}
openapi: 3.1.1
info:
  title: Public API - BETA
  description: Read docs on https://docs.getprimo.com/
  version: '1.0'
  contact: {}
servers:
  - url: https://api.getprimo.com
security:
  - apikey: []
tags: []
paths:
  /mdm-controls/{mdmControlId}:
    patch:
      tags:
        - MdmControls
      summary: Update an MDM control
      description: >-
        Partially update an existing MDM control by ID. Send only the fields you
        want to change — any omitted field is left unchanged. `type` is required
        and must match the control (it selects the config schema). Editable
        fields: `name`, `enabled`, `configurationPayload`, and targeting.
        `configurationPayload` fully replaces the stored config when present
        (not merged); omit it to keep the current config, or send null to clear
        it. Targeting is set via `targetMethod` (omit to keep current): "All"
        (every device) or "DeviceGroup"
        (`includedDeviceGroupIds`/`excludedDeviceGroupIds`). An unknown ID
        returns 404, invalid config/targeting 400, a name/profile conflict 409,
        and demo companies are not allowed to update MDM controls (403).
      operationId: updateMdmControl
      parameters:
        - name: mdmControlId
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateMdmControlBody'
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateMdmControl_Output'
components:
  schemas:
    UpdateMdmControlBody:
      type: object
      properties:
        type:
          description: >-
            Control type discriminator, e.g. "wifi_macos". Read it from GET
            /mdm-controls/:id.
          type: string
          enum:
            - malwarebyte_macos
            - malwarebyte_windows
            - malwarebyte_linux
            - recoveryOs_macos
            - softwareUpdate_macos
            - appBlocking_macos
            - wifi_macos
            - wifi_ios
            - wifi_ipados
            - wifi_windows
            - wifi_android
            - wifi_linux
            - adminUserManagement_macos
            - adminUserManagement_windows
            - adminUserPasswordRotation_macos
            - adminUserPasswordRotation_windows
            - deviceNaming_macos
            - deviceNaming_windows
            - deviceNaming_linux
            - googleChrome_macos
            - googleChrome_windows
            - firewall_macos
            - firewall_windows
            - usbBlocking_macos
            - usbBlocking_windows
            - usbBlocking_linux
            - entraSSO_macos
            - oktaSSO_macos
            - primoSSO_macos
            - customFile_macos
            - customFile_ios
            - customFile_ipados
            - customFile_windows
            - customFile_android
            - customFile_linux
            - passwordPolicy_macos
            - passwordPolicy_windows
            - passwordPolicy_ios
            - passwordPolicy_ipados
            - passwordPolicy_android
            - sentinelOne_macos
            - sentinelOne_windows
            - sentinelOne_windows_arm64
            - sentinelOne_linux_deb
            - sentinelOne_linux_deb_arm64
            - sentinelOne_linux_rpm
            - sentinelOne_linux_rpm_arm64
            - diskEncryption_all
            - osUpdate_macos
            - osUpdate_windows
            - osUpdate_ios
            - osUpdate_ipados
            - rustdesk_macos
            - rustdesk_windows
            - disableProfilesPane_macos
            - screenCapture_macos
            - disableAirdrop_macos
            - airPrint_macos
            - webClip_macos
            - webClip_ios
            - webClip_ipados
        name:
          description: New display name. Omit to leave it unchanged.
          type: string
        enabled:
          description: New enabled state. Omit to leave it unchanged.
          type: boolean
        configurationPayload:
          description: >-
            Full replacement config payload for the control, in clear values.
            Omit the field to leave the current config unchanged; send null to
            clear it. A partial payload is not merged — when present, send the
            whole config. Secret fields are returned redacted ("REDACTED") by
            GET, so replace them with real values before sending.
          anyOf:
            - type: object
              propertyNames:
                type: string
              additionalProperties: {}
            - type: 'null'
        targetMethod:
          description: >-
            How the control is targeted. Omit to leave targeting unchanged.
            "All" ignores the group fields below.
          type: string
          enum:
            - All
            - DeviceGroup
        includedDeviceGroupIds:
          description: >-
            Device group IDs to include. Used only when targetMethod is
            "DeviceGroup".
          type: array
          items:
            type: string
        excludedDeviceGroupIds:
          description: >-
            Device group IDs to exclude. Used only when targetMethod is
            "DeviceGroup".
          type: array
          items:
            type: string
      required:
        - type
    UpdateMdmControl_Output:
      type: object
      properties:
        success:
          type: boolean
          description: Whether the MDM control was updated.
      required:
        - success
      additionalProperties: false
  securitySchemes:
    apikey:
      scheme: bearer
      bearerFormat: API key
      type: http
      description: >-
        Use your Primo API key in the Authorization header as `Bearer
        <API_KEY>`.

````