Managed Domains on Work iPhones: How to Separate Work and Personal Browsing

Why is keeping work and personal browsing separate on iPhones difficult?

Keeping work and personal browsing separate is challenging because employees often use the same device for both. Managed domains on work iPhones help IT administrators distinguish corporate web content from personal activity and support controlled document handling.

Employees may access business portals, download confidential files, check work emails, and browse personal websites through Safari and other applications. Without clear boundaries, corporate documents can move into personal apps or unmanaged storage locations.

Managed domain settings help classify corporate web content so organizations can apply appropriate data-sharing restrictions while allowing employees to continue personal browsing.

What happens when corporate and personal data are not separated?

Without clear boundaries between corporate and personal data, organizations face several security and management risks:

• Corporate data exposure: Employees may transfer business documents downloaded from corporate websites to unmanaged applications or personal cloud storage.
• Accidental email disclosure: Employees may unknowingly send sensitive information to external recipients without recognizing that their email addresses fall outside approved corporate domains.
• Inconsistent data handling: Without managed domain classification and appropriate document-sharing restrictions, IT teams may struggle to enforce consistent data protection policies across managed iPhones.

What are managed domains on work iPhones?

Administrators define managed domains to help iOS identify corporate web content, distinguish external email recipients, and configure Safari password-autofill behavior.

They support work and personal data separation without requiring separate browsers or isolating browsing sessions. The three relevant settings are:

• Managed Web Domains: Classify documents downloaded through Safari from designated corporate websites as managed.
• Unmarked Email Domains: Highlight recipients outside approved corporate email domains.
• Managed Web Domains for Password Autofills: Configure Safari password-saving and autofill behavior for specified domains.

How do managed web domains work in Safari?

Managed Web Domains identify corporate websites whose downloaded documents are treated as managed.

For example, when an employee downloads a corporate PDF through Safari:

• The document is classified as managed.
• Applicable Managed Open In restrictions can prevent transfers to unmanaged applications, such as personal cloud storage.

How do unmarked email domains identify external recipients?

Unmarked Email Domains help employees recognize external recipients when composing messages in Apple’s native Mail app.

• Approved domains: Corporate email addresses remain unmarked.
• External domains: Recipient addresses outside the configured domains are highlighted.

This is a visual warning, not an email-blocking mechanism. Third-party email clients may behave differently.

How do managed domains control Safari password autofill?

Managed Web Domains for Password Autofill configure which domains are eligible for Safari password-saving and autofill behavior.

• Compatibility: Requires a supervised iPhone running a supported iOS version. Verify the minimum OS requirement and enrollment support before deployment.
• Configuration: Administrators specify the appropriate domains and subdomains.

This supports organizational control over password-autofill behavior on managed iPhones.

How do managed domains help protect corporate data on iPhones?

Managed domains support corporate data protection by classifying business content and working with Apple’s Managed Open In restrictions to control supported document transfers between managed and unmanaged applications.

How can IT administrators implement managed domains on iPhones?

Implementing managed domains requires identifying corporate domains, verifying device management requirements, configuring appropriate restrictions, and testing their behavior.

Step 1: Identify corporate domains and verify device requirements

Start by identifying corporate domains and checking device management prerequisites.

What IT administrators should verify

• Inventory domains: Identify corporate websites, document portals, approved email domains, and password-autofill domains. Include required subdomains and wildcard patterns where appropriate, as domain settings do not automatically cover all subdomains.
• Verify enrollment: Confirm that iPhones support the intended settings under their enrollment method.
• Review applications: Identify managed business apps and unmanaged personal apps to establish document-sharing boundaries.

Step 2: Configure managed domains and document-sharing restrictions

Configure the required domain settings and apply appropriate data-sharing restrictions.

Key configuration steps

• Configure domains: Define managed web domains, unmarked email domains, and password-autofill domains using a compatible device management solution.
• Apply restrictions: Use Managed Open In restrictions to control supported document transfers between managed and unmanaged destinations.
• Pilot deployment: Test the configuration on a small group of iPhones before wider rollout.

Step 3: Test and maintain managed domain configurations

Validate the deployed settings and review them whenever configurations change.

What to test and review

• Document transfers: Test corporate downloads across managed and unmanaged applications.
• Email warnings: Verify external recipient highlighting in Apple’s native Mail app.
• Password autofill: Confirm Safari behavior for configured domains.

Review configurations after domain changes, major iOS updates, or policy modifications to maintain consistent data handling.

How does Hexnode UEM simplify managed domain configuration on iPhones?

Hexnode UEM allows IT administrators to configure Managed Domain policies across enrolled iPhones, helping distinguish corporate content from personal activity.

To configure these settings, navigate to Policies > New Policy > Create a fully custom policy > iOS > Security > Managed Domain.

The policy provides three settings:

• Unmarked Email Domains: Define corporate email suffixes so Apple’s native Mail app highlights external recipients. Enter email domains without the @ symbol, such as company.com.
• Managed Web Domains: Specify corporate websites whose downloaded documents are classified as managed.
• Managed Web Domains for Password Autofills: Configure domains eligible for Safari password saving and autofill on iOS 9.3 and later.

Control document sharing with Hexnode Business Container

Under iOS > Hexnode Business Container, disable Open documents from managed apps in unmanaged apps to restrict supported transfers of corporate documents to personal applications.

Apps installed through Hexnode are treated as managed. Administrators can also use Manage App to designate eligible user-installed applications as managed.

To manage a user-installed app, navigate to Manage > Devices > Select Device > Applications, locate the app, and select Manage App from its gear icon.

Deploy policies to the appropriate iPhones

In the Policy Targets tab, administrators can assign the configuration to devices, device groups, users, user groups, or supported Domains/OUs.

For example, an employee can continue browsing personal websites while documents downloaded from designated corporate domains remain subject to managed application restrictions.

Featured resource

Hexnode iOS Management Solution

Explore Hexnode’s iOS management solution for streamlined deployment, app control, device security, and lifecycle management.

DOWNLOAD

Keep work and personal data distinct with Hexnode UEM

Hexnode UEM helps IT teams protect corporate data on iPhones through managed domain classification, application controls, and document-sharing restrictions. These capabilities support secure data handling without disrupting personal browsing.

Start your Hexnode UEM free trial or book a demo to explore managed domain configuration for your iPhone fleet.