How iOS 12 Manages Enterprise Open-In Restrictions

Apple’s iOS 12 provides robust Data Loss Prevention (DLP) capabilities for enterprise environments through its Managed Open-In architecture. By establishing strict boundaries between corporate-managed data and personal user data, iOS 12 allows Mobile Device Management (MDM) solutions to control how files and documents are opened, shared, and viewed. This article explains the underlying mechanisms iOS 12 uses to prevent corporate document leakage to personal applications and cloud services.

The Foundation: Managed vs. Unmanaged Ecosystems

iOS 12 categorizes all applications, accounts, and data repositories into two distinct domains:

  • Managed: Applications installed via an MDM profile, corporate email accounts, managed domains, and associated documents.
  • Unmanaged: Applications downloaded directly by the user via the App Store, personal email accounts, and local user data.

Through configuration profiles, administrators apply restrictions via the Apple Configuration Profile Reference keys to govern data transfer across these boundaries.

Key Managed Open-In Restriction Keys

Two primary MDM restriction keys form the backbone of Managed Open-In in iOS 12:

  1. allowOpenFromManagedToUnmanaged (Set to False):
    Prevents enterprise documents originating from managed apps from being opened in unmanaged apps. For example, a PDF downloaded from a managed Microsoft Outlook account cannot be opened in a personal version of Dropbox or an unmanaged PDF reader.

  2. allowOpenFromUnmanagedToManaged (Set to False):
    Prevents personal files from being opened in managed applications. This prevents corporate storage repositories from being cluttered with personal data and protects managed apps from processing unvetted files.

Extensions, AirDrop, and Sharing Controls

In iOS 12, Managed Open-In extends beyond standard app-to-app document passing into the native system share sheets:

  • AirDrop Restrictions: When managed-to-unmanaged sharing is restricted, iOS 12 treats AirDrop as an unmanaged destination. As a result, AirDrop disappears from the Share Sheet when viewing a managed document, preventing users from wirelessly beaming enterprise files to nearby unmanaged devices.
  • Action and Share Extensions: Third-party app extensions displayed in the Share Sheet adhere strictly to the sandbox rules. If an enterprise document is selected, only managed share extensions (such as enterprise messaging tools or secure cloud drives) will appear.
  • Third-Party Keyboards: Administrators can enforce the allowOpenFromManagedToUnmanaged policy to prevent third-party keyboards from accessing text inside managed documents, mitigating keylogger risks.

Managed Web Domains and Safari

iOS 12 uses Managed Safari Web Domains to protect corporate documents hosted on internal intranets or web portals. Administrators specify URLs in the MDM payload that represent secure enterprise domains.

When a user downloads a document from a managed domain via Safari, iOS 12 flags the downloaded file as "managed." Consequently, the file inherits all Managed Open-In restrictions and cannot be saved to personal local storage or opened in unmanaged applications.

Integration with the Files App

The native Files app in iOS 12 fully respects Managed Open-In rules. When third-party cloud storage providers (such as Box, OneDrive, or Google Drive) integrate into the Files app:

  • If the cloud provider's app is installed via MDM, it operates within the managed container.
  • Users are blocked from moving or copying enterprise documents to unmanaged local storage ("On My iPhone") or personal cloud storage locations configured inside the Files app.