Restrict iCloud Backups on Corporate iOS 12

This article outlines the management controls and configurations available to prevent corporate data from being backed up to personal or unmanaged iCloud accounts on Apple devices running iOS 12. Organizations utilizing iOS 12 in enterprise environments can leverage Mobile Device Management (MDM) solutions, configuration profiles, and device supervision to enforce backup restrictions, ensuring corporate data remains compliant with enterprise security standards and data loss prevention policies.

Mobile Device Management (MDM) Restriction Payloads

The most scalable method to disable iCloud backups on iOS 12 is through an MDM solution utilizing Apple's Restrictions configuration payload.

  • The allowCloudBackup Key: Administrators can push a configuration profile containing the allowCloudBackup restriction set to false. When applied, the "iCloud Backup" option in the device Settings app is grayed out and switched to off, preventing both scheduled and manual backups to Apple's cloud infrastructure.
  • Supervised Device Requirement: While unsupervised devices running iOS 12 may accept the profile, complete enforcement of data separation and persistent restriction without user removal relies on the device being in Supervised mode. Devices enrolled via the Device Enrollment Program (DEP)—now part of Apple Business Manager—automatically achieve Supervised status upon activation.

Apple Configurator 2

For organizations managing devices locally without an active cloud-based MDM, Apple Configurator 2 provides direct profile deployment:

  1. Open Apple Configurator 2 on a macOS device.
  2. Create a new Configuration Profile and navigate to the Restrictions payload.
  3. Under the Functionality tab, uncheck the box labeled Allow iCloud backup.
  4. Save the profile and deploy it directly to connected iOS 12 devices via USB.

Managed Open In and Data Separation Controls

Beyond completely disabling full-device backups, iOS 12 offers granular controls to prevent corporate data leakage to iCloud services:

  • Prevent iCloud Document Sync (allowCloudDocumentSync): Setting this key to false stops apps from storing documents and application-specific data in iCloud Drive.
  • Managed Open In Restrictions: By configuring allowOpenFromManagedToUnmanaged to false, administrators prevent corporate documents managed by enterprise apps from opening in personal apps that might back up to personal iCloud accounts.
  • Disable Account Modification (allowAccountModification): Setting this key to false locks the Apple ID and iCloud account settings on Supervised iOS 12 devices, preventing end users from signing into personal iCloud accounts or altering existing corporate account configurations.