What is amsondevicestoraged on Mac?

Last updated: 2026-07-31

What it is

amsondevicestoraged is an Apple-signed, per-user background service. It belongs to the private OnDeviceStorage framework used by Apple Media Services. On a normal macOS installation, its executable is stored inside that protected framework, and its code-signing identifier is com.apple.amsondevicestoraged.

Its job is to manage encrypted, structured data stores for authorized system clients. Those stores include SQLite databases, but the service does more than read and write rows. It manages access credentials, storage-capacity and row-count limits, expiration-based cleanup, least-recently-used cleanup, and removal of registered data after an app is uninstalled.

The word “storage” can make the process sound like a place where Apple Music songs or Apple TV videos are downloaded. The verified evidence does not support that interpretation. It points to managed databases and their lifecycle, not to the transfer or storage of media files. The same evidence also does not make amsondevicestoraged a general-purpose tool for clearing space across the entire Mac.

Why it talks to the network

launchd registers online-maintenance work for amsondevicestoraged. One task has a target interval of roughly once per day, and another network-enabled maintenance task has a target interval of roughly once per week. These are scheduling targets rather than guaranteed execution times: macOS decides when the work actually runs.

The executable contains verified code paths for retrieving an Apple Media Services configuration “bag” and updating a list of revoked access credentials. A configuration bag supplies service configuration; seeing that connection does not, by itself, establish that personal media is being uploaded. Keeping a revoked-credential list current supports the access controls used by the managed stores.

There is also a path for submitting database operational metrics. That path checks whether Diagnostics & Usage sharing is allowed and whether the device is included in the applicable sample. It is therefore conditional, rather than evidence that every Mac continuously submits those metrics.

The supported description of its network peers is limited to broad categories: Apple Media Services configuration and credential services, plus an approved analytics service when the diagnostic conditions are met. The exact mapping between each maintenance task and each request has not been verified. Complete hostnames and request payloads also remain unverified, so a more specific list would go beyond the available evidence.

How much traffic is normal

Apple has not published a reliable normal-traffic baseline for amsondevicestoraged, and there is no reproducible long-term packet capture in the verified research. That means there is no defensible daily or monthly byte range to quote.

Based on the confirmed code paths, the process should produce no traffic most of the time. When maintenance runs, the expected activity consists mainly of low-frequency control traffic: service configuration, credential-revocation updates, and optional diagnostic events. Such activity would normally be much smaller than downloading a song, a video, or an app update.

That comparison is useful for understanding the likely scale, but it is not a numerical guarantee. Specific byte counts and the size of unusual peaks remain unverified. A single observation also may not represent the process well because the registered maintenance schedules include both daily and weekly target intervals.

Can you turn it off

Apple does not provide a System Settings switch for disabling amsondevicestoraged. There is therefore no supported settings path to follow.

Force-unloading the service, repeatedly terminating it, or blocking all of its network access by process may delay Apple Media Services configuration and credential-revocation updates. It may also affect App Store or other Apple Media Services features that depend on this managed local-storage system. Because the service is registered with launchd, ending the process may only be temporary; macOS can start it again.

The related setting at Apple menu > System Settings > Privacy & Security > Analytics & Improvements > Share Mac Analytics has a narrower effect. Turning it off controls the permitted analytics-data branch. It does not disable amsondevicestoraged, its local database work, or its other online-maintenance responsibilities.

What people get wrong

1. “The name is unfamiliar, so it must be malware.” The protected system copy is part of an Apple private framework and is Apple-signed with the identifier com.apple.amsondevicestoraged. An unfamiliar name alone is not evidence of malicious software.

2. “It downloads or stores Apple Music and Apple TV songs and videos.” No reliable evidence supports that claim. The verified behavior centers on structured databases, access credentials, capacity controls, row limits, and data lifecycle management—not media-file transfer.

3. “It cleans storage across the whole Mac.” Its cleanup responsibilities are limited to its managed containers and registered data tables. Quotas, TTL expiration, least-recently-used removal, and ownership cleanup do not make it a general disk-cleaning service.

4. “A connection to an Apple bag host proves it is uploading personal media or performing advertising tracking.” That conclusion cannot be drawn from the connection alone. The executable explicitly uses a configuration bag. A separate diagnostic-metrics path exists, but it checks the Diagnostics & Usage opt-in condition. The exact payloads remain unverified.

5. “Using pkill or launchctl to shut it down permanently is a safe way to save bandwidth.” There is no evidence for that advice, and Apple provides no supported disable switch. Normal traffic lacks a quantified baseline, while forced disabling may interfere with shared Apple Media Services storage and credential maintenance.

6. “Turning off Share Mac Analytics turns off amsondevicestoraged.” It does not. That preference affects permitted analytics submission, while local storage management and other online-maintenance work remain active.

Seeing what it actually used

If the process appears in a network monitor, the next step is to measure it over a representative period rather than infer a byte total from its name. Bytetally’s per-process statistics can show what amsondevicestoraged actually used on that Mac; include the daily and weekly maintenance windows when choosing the observation period. Use those measurements as local evidence, since no reliable public baseline is available.

Related processes

Common questions