diff --git a/server/mdm/apple/mobileconfig/file_vault_options.go b/server/mdm/apple/mobileconfig/file_vault_options.go
index 94f1ddc647..15d189ba22 100644
--- a/server/mdm/apple/mobileconfig/file_vault_options.go
+++ b/server/mdm/apple/mobileconfig/file_vault_options.go
@@ -12,7 +12,10 @@ type FDEFileVaultOptionsPayload struct {
 	DontAllowFDEEnable    *bool  `plist:"dontAllowFDEEnable"`
 }
 
-func ContainsFDEVileVaultOptionsPayload(contents []byte) (bool, error) {
+// ContainsFDEFileVaultOptionsPayload returns true if the payload contains any FileVault options.
+// https://developer.apple.com/documentation/devicemanagement/fdefilevaultoptions
+// Fleet users are not allowed to upload such payloads because Fleet fully manages disk encryption (FileVault).
+func ContainsFDEFileVaultOptionsPayload(contents []byte) (bool, error) {
 	if len(contents) == 0 {
 		return false, nil
 	}
diff --git a/server/mdm/apple/mobileconfig/file_vault_options_test.go b/server/mdm/apple/mobileconfig/file_vault_options_test.go
index 2d86b45559..83ddf8a0e0 100644
--- a/server/mdm/apple/mobileconfig/file_vault_options_test.go
+++ b/server/mdm/apple/mobileconfig/file_vault_options_test.go
@@ -36,6 +36,7 @@ func TestContainsFDEVileVaultOptionsPayload(t *testing.T) {
 			contains: false,
 		},
 		{
+			// Add all the FileVault options to the custom settings payload
 			name: "com.apple.MCX payload with all FDE options",
 			in: getFileVaultOptionsPayload(FDEFileVaultOptionsPayload{
 				PayloadType:           FleetCustomSettingsPayloadType,
@@ -46,6 +47,7 @@ func TestContainsFDEVileVaultOptionsPayload(t *testing.T) {
 			contains: true,
 		},
 		{
+			// Only add the dontAllowFDEDisable property to the custom settings payload
 			name: "contains dontAllowFDEDisable",
 			in: getFileVaultOptionsPayload(FDEFileVaultOptionsPayload{
 				PayloadType:         FleetCustomSettingsPayloadType,
@@ -54,6 +56,7 @@ func TestContainsFDEVileVaultOptionsPayload(t *testing.T) {
 			contains: true,
 		},
 		{
+			// Only add the dontAllowFDEEnable property to the custom settings payload
 			name: "contains dontAllowFDEEnable",
 			in: getFileVaultOptionsPayload(FDEFileVaultOptionsPayload{
 				PayloadType:        FleetCustomSettingsPayloadType,
@@ -62,6 +65,7 @@ func TestContainsFDEVileVaultOptionsPayload(t *testing.T) {
 			contains: true,
 		},
 		{
+			// Only add the DestroyFVKeyOnStandby property to the custom settings payload
 			name: "contains DestroyFVKeyOnStandby",
 			in: getFileVaultOptionsPayload(FDEFileVaultOptionsPayload{
 				PayloadType:           FleetCustomSettingsPayloadType,
@@ -72,7 +76,7 @@ func TestContainsFDEVileVaultOptionsPayload(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			result, err := ContainsFDEVileVaultOptionsPayload([]byte(tc.in))
+			result, err := ContainsFDEFileVaultOptionsPayload([]byte(tc.in))
 			require.NoError(t, err)
 			assert.Equal(t, tc.contains, result)
 		})
diff --git a/server/mdm/apple/mobileconfig/mobileconfig.go b/server/mdm/apple/mobileconfig/mobileconfig.go
index c3ac01a1aa..b59a939430 100644
--- a/server/mdm/apple/mobileconfig/mobileconfig.go
+++ b/server/mdm/apple/mobileconfig/mobileconfig.go
@@ -256,7 +256,7 @@ func (mc *Mobileconfig) ScreenPayloads() error {
 			case FleetFileVaultPayloadType, FleetRecoveryKeyEscrowPayloadType:
 				return errors.New(DiskEncryptionProfileRestrictionErrMsg)
 			case FleetCustomSettingsPayloadType:
-				contains, err := ContainsFDEVileVaultOptionsPayload(*mc)
+				contains, err := ContainsFDEFileVaultOptionsPayload(*mc)
 				if err != nil {
 					return fmt.Errorf("checking for FDEVileVaultOptions payload: %w", err)
 				}
diff --git a/server/service/integration_mdm_profiles_test.go b/server/service/integration_mdm_profiles_test.go
index 684566eeac..0bf334cfeb 100644
--- a/server/service/integration_mdm_profiles_test.go
+++ b/server/service/integration_mdm_profiles_test.go
@@ -2347,6 +2347,7 @@ func (s *integrationMDMTestSuite) TestBatchSetMDMAppleProfiles() {
 	// payloads with reserved types
 	for p := range mobileconfig.FleetPayloadTypes() {
 		if p == mobileconfig.FleetCustomSettingsPayloadType {
+			// FileVault options in the custom settings payload are checked in file_vault_options_test.go
 			continue
 		}
 		res := s.Do("POST", "/api/v1/fleet/mdm/apple/profiles/batch", batchSetMDMAppleProfilesRequest{Profiles: [][]byte{
@@ -4309,6 +4310,7 @@ func (s *integrationMDMTestSuite) TestBatchSetMDMProfiles() {
 	// payloads with reserved types
 	for p := range mobileconfig.FleetPayloadTypes() {
 		if p == mobileconfig.FleetCustomSettingsPayloadType {
+			// FileVault options in the custom settings payload are checked in file_vault_options_test.go
 			continue
 		}
 		res := s.Do("POST", "/api/v1/fleet/mdm/profiles/batch", batchSetMDMProfilesRequest{Profiles: []fleet.MDMProfileBatchPayload{
@@ -4592,6 +4594,7 @@ func (s *integrationMDMTestSuite) TestBatchSetMDMProfilesBackwardsCompat() {
 	// payloads with reserved types
 	for p := range mobileconfig.FleetPayloadTypes() {
 		if p == mobileconfig.FleetCustomSettingsPayloadType {
+			// FileVault options in the custom settings payload are checked in file_vault_options_test.go
 			continue
 		}
 		res := s.Do("POST", "/api/v1/fleet/mdm/profiles/batch", map[string]any{"profiles": map[string][]byte{