It is beneficial for both the device users and IT organizations to draw a clear line between work and non-work-related activities on a mobile device by separating the business and personal apps from each other. This security strategy is known as containerization.

Unlike for Android, there is no need to create a dedicated Work Profile container or workspace for business apps on Apple devices. Instead, on Apple iPhone and iPad devices, work and personal data are managed separately without segmenting the user's experience. Apple's framework in the device's operating system allows IT organizations to secure business data with a light touch through MDM software like LogMeIn Resolve MDM. No separate client is needed because the framework is part of the operating system.

iPadOS and iOS operating systems categorize applications into two categories: managed and unmanaged.

Managed apps are applications the organization's IT department deploys using LogMeIn Resolve MDM or some other MDM software. It can be any app from the App Store or custom in-house applications installed. You can remotely configure, update, or remove the managed app from the devices through the MDM. Mail clients, communications software, and office apps are typical examples of managed apps.

Unmanaged apps, on the other hand, are personal applications installed by the device user.

Prevent data transfer between managed and unmanaged apps

Device users can, by default, move data and contents between managed and unmanaged apps freely as they wish.

With LogMeIn Resolve MDM, you easily apply restrictions to protect company data and users' privacy by denying the data transfer between managed and unmanaged apps on devices used for work and personal matters. The devices don't even have to be supervised.

1. Navigate to Management > Configuration Profiles on your LogMeIn Resolve MDM site, and create a Restriction profile (Add > iOS > Restrictions).
2. Switch to the Security and privacy tab and check the Deny documents from managed sources in unmanaged destination and Deny documents from unmanaged sources in managed destination fields. See the below screen capture and field tooltips for further information. After applying these restrictions, device users cannot open data from managed apps in unmanaged apps or vice versa. The users still can open managed documents using other managed apps and unmanaged documents using other unmanaged apps.
   
   
   The layout of the screen may look different in the product.

   In addition, the admin can control what users can copy and paste with the restriction Require managed copy and paste on devices with iOS 15 or above. The restriction makes it possible to ensure that the Clipboard respects document settings of managed/unmanaged destinations. For example, this prevents the content of the managed application from being pasted into unmanaged ones and vice versa.

3. You can also consider implementing the following restrictions for added security:

   On the Device functionality tab:

   • • AirDrop: Force unmanaged drop target: This restriction specifies if AirDrop should be considered an unmanaged drop target.
     • Deny screen capture: This restriction prevents users from saving a screenshot of the device screen. This restriction affects the whole device, no matter whether the user has unmanaged or managed apps open.

   On the iCloud tab:

   • • Deny managed apps sync: This restriction prevents data sync from managed apps to iCloud.
   • Finally, remember to deploy the restrictions configuration profile to the desired devices. You can do that easily from the Devices page using the Deploy > Deploy configuration profile option.
     
     
     The layout of the screen may look different in the product.