The answer lies in containerization, a security strategy designed to draw a clear digital boundary between your professional and personal lives on a single device.

What is Containerization and How Does it Work?

Imagine a digital fence created on your phone. Containerization technology is the mechanism that builds and maintains this fence. It ensures that company rules govern sensitive corporate data and completely isolate it from your personal archives. If you were to bundle everything into a single backup, you’d risk mixing sensitive corporate files with your personal photos and messages. It might sound strict, but this separation is important, and protects both you and your employer, especially when you lose, steal, or replace a device.

The implementation differs slightly depending on your device’s operating system:

• Android Work Profile: This creates a fully encrypted “work” user profile on your phone. It’s essentially a separate, sealed-off environment.
• iOS Managed Apps: On iOS, your company’s Mobile Device Management (MDM) solution wraps individual work apps in special controls, creating secure “app silos.”

Protecting Data Ownership with Backups

A core, non-negotiable benefit of containerization is its strong influence on data backup and recovery, removing a frequent risk for corporate information in BYOD environments. The design keeps work files under corporate control and separates them from personal backups.

For Android

When your IT team enrolls a personal Android device with a UEM via Android Enterprise Profile Owner, they do more than install apps. Enrollment creates a secondary, fully separated user environment. This environment is securely provisioned for corporate applications and data. It is designated as the Work Profile.

• Secure Isolation: The Work Profile is an encrypted container with separate keys from your personal profile. Approved work apps, documents, and credentials reside inside it. They are isolated so other apps cannot access them. They also cannot be mixed into personal files.
• IT Control: Administrators retain control of the Work Profile and can manage its settings remotely. They can remotely wipe only work data if a device is lost, stolen, or an employee leaves. This thereby preserves personal photos, messages, and other personal content and personal accounts on the device.

For iOS

On iOS, BYOD deployments use iOS User Enrollment to create a separate logical partition called Business Container. Management does not target the full device; instead, it focuses on protecting and managing individual corporate applications.

• Logical Separation: User Enrollment creates a segregated APFS (Apple File System) volume on the device that has the Managed App Data. The Business Container keeps corporate content within managed apps, preventing its movement to personal apps like Photos or Contacts.
• Backup Dictated by Policy: When you back up a personal device using iCloud or Finder, your organization’s MDM settings and corporate policy strictly govern the inclusion of Managed App Data. In higher-security deployments, MDM can prevent the inclusion of managed app data in personal backups. In such configurations, the company often backs up corporate data to its own servers. It restores this data only via the MDM infrastructure. This ensures the corporate data lifecycle remains under organizational control while minimizing unauthorized restoration paths and improving auditability where required.

The Short Answer

No, you cannot directly back up or restore work-container data in the same manner you handle your personal photos or text messages. For more security and strict compliance with data regulations, the system locks down BYOD containers. Only your company’s specialized management tools can handle that data.

IT manages your work data backups as a necessary security protocol, not a user restriction. This directly safeguards corporate property and sensitive data. For you, it ensures protection from the administrative burden and liability associated with separating personal and work files during device changes or wipes. Containerization is the standard, secure foundation for effective BYOD programs.

The post Is It Possible to Back up and Restore Data from the Work Container in the Case of iOS and Android BYODs? appeared first on Hexnode Blogs.

Apple’s Screen Time is your primary tool for managing app usage and restricting access. It’s incredibly versatile for setting limits for yourself or for family members.

• App Limits: Set daily time limits for categories (like “Social Networking”) or specific apps. Once the limit is reached, the app is blocked until the next day.
• Content & Privacy Restrictions: This offers granular control. You can turn off pre-installed Apple apps like Safari, FaceTime, Camera, and Mail; they simply won’t appear on your Home Screen. You can also restrict app downloads based on age ratings, block explicit content, and prevent in-app purchases.
• Downtime: Schedule periods when most apps (except “Always Allowed” ones) are blocked. Great for focus or ensuring a good night’s sleep.

To access these, go to Settings > Screen Time. You’ll need to set a Screen Time Passcode to prevent unauthorized changes.

Blocking Apps with a Mobile Device Management (MDM) Solution

For a more robust and scalable approach, especially for businesses or educational environments, a Mobile Device Management (MDM) solution like Hexnode provides powerful administrative control over app usage.

Hexnode Blocklisting: An MDM solution can enforce a blocklist (or blacklist) of apps that are forbidden on managed devices. When a device is enrolled, any app on this list is either automatically uninstalled or prevented from being installed. This is a powerful way for administrators to ensure devices are used only for approved purposes.

Hiding Apps

Sometimes, you just want to make an app less visible without completely blocking it. iOS offers clever ways to achieve this:

• Remove from Home Screen: A quick way to declutter. Long-press an app icon, tap “Remove App,” then “Remove from Home Screen.” The app isn’t deleted; it moves to your App Library, still accessible there.
• Hide and Require Face ID (iOS 18+): For enhanced privacy on newer iOS versions, directly hide apps and require Face ID (or Touch ID/passcode) to access them. Long-press the app, tap “Require Face ID,” then “Hide and Require Face ID.” The app moves to a “Hidden” folder in your App Library and won’t appear in searches or Siri suggestions. Only third-party apps can be hidden; built-in Apple apps can only be locked.
• Hiding Home Screen Pages: If you have many app pages, hide entire ones to reduce visual clutter. Long-press a blank area on your Home Screen, tap the row of dots above the dock, and uncheck the pages you want to hide.

Important Considerations:

• Screen Time Passcode: Always use a strong, unique passcode for Screen Time, especially for parental controls.
• Notifications: Even if an app is hidden or blocked, notifications might still appear. Adjust notification settings for sensitive apps in Settings > Notifications.
• App Library: When an app is “hidden” from your Home Screen, it will almost always still be accessible via the App Library.

By utilizing these methods, you can gain greater control over your iOS device, ensuring your apps are exactly where you want them – or completely out of sight!

The post How can you hide and block apps for privacy on iOS? appeared first on Hexnode Blogs.

Warning: A remote wipe is irreversible. All data is permanently deleted, and the iPhone restores to factory settings. Use only if recovery is impossible or the device is compromised.

Prerequisites:

• “Find My” Enabled: Must be on your iPhone before it’s lost (Settings > [Your Name] > Find My).
• Internet Connection: The lost iPhone needs an active connection (Wi-Fi or cellular) to receive the wipe command.
• Apple ID & Password: Your credentials are required to access “Find My.”

Steps to Remotely Wipe Your iPhone:

Method 1: Using the “Find My” App (Another Apple Device)

1. Open “Find My”:On a trusted iPhone, iPad, or Mac.
2. Sign In: Use the same Apple ID as the lost iPhone.
3. Select Device: Tap “Devices,” then choose your lost iPhone.
4. Initiate Erase: Scroll down and tap “Erase This Device.”
5. Confirm & Authorize: Confirm the warning, then enter your Apple ID password.
6. Optional: Add a message and contact number.

Method 2: Using a Web Browser (iCloud.com)

1. Go to iCloud.com/find: Open any web browser.
2. Sign In: Use the same Apple ID as the lost iPhone.
3. Select Device: Click “All Devices,” then choose your lost iPhone.
4. Initiate Erase: Click “Erase iPhone.”
5. Confirm & Authorize: Confirm, then enter your Apple ID password.
6. Optional: Add a message and contact number.

Method 3: Using a Unified Endpoint Management (UEM) solution like Hexnode

Organizations using a UEM solution can leverage its remote wipe capabilities for managing corporate devices or BYOD (Bring Your Own Device) scenarios. Hexnode, a UEM provider, offers a remote wipe feature that allows IT administrators to perform a full or corporate wipe on an iPhone. A “corporate wipe” is particularly useful for BYOD, as it only removes corporate data (apps, emails, Wi-Fi configurations) while leaving the user’s personal data intact. A “complete wipe” is typically used for company-owned devices, restoring the device to its factory settings and deleting all data. This is an immediate action that can be executed from the Hexnode UEM portal, providing an efficient way to secure sensitive information in the event of a lost or stolen device.

What Happens After an Erase Request?

• Offline Devices: If offline, the wipe command queues and executes upon the next internet connection.
• Activation Lock: After wiping, the iPhone remains linked to your Apple ID via Activation Lock. This crucial security feature prevents anyone from activating or using the iPhone without your Apple ID, making it useless to a thief.
• Removing from Account: You can remove the device from your Apple ID account in “Find My” only after the wipe is confirmed complete (as this disables Activation Lock).

Performing a remote wipe is a vital security measure. While a last resort, it ensures your personal data remains secure.

The post How to perform a full remote wipe on an iPhone? appeared first on Hexnode Blogs.

Typically, when you enable your device’s “Find My” feature, Activation Lock turns on automatically. This is like an extra layer of security users can put on their Apple devices.

What to do if you lose your device?

We saw what Activation Lock is and what it does, but how do you lock down your device if it is lost? Don’t worry, it is really simple and requires only a few steps.

To start, go to the “Find My” app on a device that belongs to a member of your Family Sharing group or the Find page on the iCloud website. Thereafter, you can label your device as lost. The “Lost mode” or “Lock” option makes use of a passcode, other than the device lock screen passcode and only this passcode can unlock an Apple device in Lost mode. A personalized message, such as your phone number or address, can also be shown on the lost device.

In extreme cases, you can use the Find My app or the Find section in iCloud to wipe your device completely. However, the device still needs a passcode even after the wipe, the personalized message will still be displayed, and the Activation lock will still be turned on. As a result, your Apple device is completely protected from unauthorized access, ensuring that no one else can use your phone under any circumstances.

Therefore, your Apple device becomes completely secure against unauthorized access, ensuring that any unwanted users cannot use your phone under any circumstances.

Activation Lock can sometimes cause headaches. It can cause problems in a corporate setting, where an ex-employee has turned it on and forgot to switch it off before returning it. In such cases, there is no other option but to bypass the Activation lock.

Hexnode and Activation Lock

With a powerful UEM like Hexnode, managing Activation Lock settings in your Apple devices is simple. You can enable, clear, bypass, and view the status of the Activation lock using Hexnode UEM.

Clearing the Activation lock and bypassing it is a bit different. Clearing completely disables Activation Lock whereas bypassing it is a temporary solution to get past the Activation Lock page. In the case of bypass, Hexnode lets you create a bypass code which you can use to proceed with the Activation lock page.

There is also a section in the device summary page in the Hexnode console, where you can see whether the Activation Lock is enabled or not in an Apple device.

The post What is Activation Lock? appeared first on Hexnode Blogs.

The steps for iOS/iPadOS data tracking are as follows:

• Open Settings on iPad or iPhone.
• Tap on Mobile Data if you are an iPhone user or Cellular Data if you are an iPad user.
• Selecting the Current Period option will show how long the cellular data has been running at a stretch.
• Open the Usage option to see how much data you have consumed based on your current plan.
• If you want to restrict apps from using cellular data, you can do that by turning off the green button present beside each of the apps.
• When the cellular data is off, apps will consume only Wi-Fi data.
• The data consumed by system services can be checked by tapping System Services in the app list.
• Users can also reset the statistics by tapping on the Reset Statistics button.

At present, iOS and iPadOS does not have an inbuilt feature that allows users to view the Wi-Fi data consumption of individual apps. Users can use third-party apps like DataFlow to keep track of their data consumption history.

Data tracking by IT admins

Organizations wouldn’t want employees to use the data for non-work-related activities. So, they need to keep a check on the data consumed on each of their managed devices. Checking individual devices is a herculean task. The IT admins can monitor the data usage of all devices using a UEM solution. Hexnode UEM offers a data management solution that allows you to make iOS data tracking easier. It also helps to control and monitor the data utilized by iOS devices registered in the UEM console. Additionally, users will be able to monitor individual mobile data and Wi-Fi data consumption, allowing administrators to analyze detailed data.

Hexnode’s Network usage rules for iOS devices allow organizations to restrict cellular data or roaming data usage by apps installed via the UEM. This may be configured using the Expense Management policy.

Once the policies are paired with the devices, the Data Management tab displays a data use summary for each device. Additionally, administrators can manually export these data management reports as PDF or CSV files.

The post How do you check data usage on iPhone and iPad? appeared first on Hexnode Blogs.

There are some pre-requisites to enroll an iOS or iPadOS device to an MDM using User Enrollment:

• First, you should configure APNs on the device management portal.
• Managed Apple IDs to authenticate the user for MDM management.
• Ensure that the device is unsupervised and running iOS 13.0+ or iPadOS 13.1+.
• Ensure that the Safari browser in your iOS/iPadOS device is in Mobile View to download the User Enrollment profile. One can download only the Device Enrollment profile if Safari is in Desktop Site View.

You can proceed with iOS user enrollment if all these requirements are met. First, set up the device management platform, then authenticate the Managed Apple ID with valid credentials and download the device management profile. Once the profile is downloaded, it has to be approved and installed by the user. Not all device management features will be available, and the organization can manage only within the confined space assigned for work. If a lot of your employees are using personal devices for work, iOS user enrollment is perfect for you.

The post What is iOS User Enrollment? appeared first on Hexnode Blogs.

As devices might be either personal or corporate-owned, limits can be established in a variety of ways. Device owners can use the options available in the system preferences or employ a third-party app to make the restrictions. Organizations can use a UEM solution to block apps and websites by blacklisting them and solve many more device management issues too.

Steps to block websites and apps on personal devices

Suppose you don’t want a user to access certain websites. Since it is a personal device,

• You can set up an account with parental controls.
• Then enter the websites you want to allow/block under the Web option in the taskbar of the Parental Controls window.
• Create a user account for them and the system preferences will be implemented.

To block apps on personal devices,

• You go to the System Preferences Menu.
• Navigate to App Limits in the Screen Time section and select the apps you want to block.
• You can also set a specific duration for the apps to remain inaccessible.
• Setup screen time for yourself or for other users in Mac devices.
• If you are using family sharing, select yourself/the user from the popup under the Screen Time menu. If not, you can directly login to your respective account.

Websites can be blocked too under this section. An application called “Focus” can be installed to block websites, webpages and applications easily.

Blocking apps and websites on company-owned devices

For blocking websites and apps on Mac devices that are corporate-owned, organizations can use Hexnode UEM to block/allow websites. It can be done either by deploying a script via the execute custom script action or through the web-content filtering policy. Companies can automatically filter and block websites containing explicit material. Companies can also manually choose the websites that can override this feature. Applications can be blocked/allowed similarly through a UEM solution. The App Management feature allows admins to filter apps, as well as set the mandatory applications for the devices.

The post How to block websites and apps on Mac? appeared first on Hexnode Blogs.

How to check if your iPhone is being supervised?

If you have the iPhone or iPad in question. Turn the device on and go to

1. Settings
2. Click on “General”
3. Navigate to “About”.

If your device is managed, then we can see it in the About menu. Furthermore, you can also see the administrator who is managing your phone.

How to reset your iPhone or iPad?

Wipe Command:

When a device is being axed from the enterprise, the device is wiped/restored from the UEM/MDM portal. This feature restores the device to its initial state, and as the name suggests, it wipes everything on the device. So, it is suggested to back up all the files on the device before this action is executed. Further, the device is also unenrolled from the UEM portal

Restoring using Apple configurator:

If you are an unsuspecting customer who has just bought a used iPhone for a steal, only to find that the device is managed. Well, don’t worry because this is a totally fixable problem. We know how Apple likes to keep everything tightly knit in their ecosystem, so you’ll need a mac device installed with an Apple Configurator.
Step 1: Connect the iPhone/iPad to the Mac device.

Step 2: Open the Apple Configurator, to find the iPhone/iPad shown up in the configurator app

Step 3: Right-click on the device and select restore.

Restoring using iTunes:

Step 1: Open iTunes on your mac device

Step 2: Click on the mobile icon in the top left corner

Step 3: Click on the restore iPhone to finish off the process.

The post How to restore a managed iPad or iPhone appeared first on Hexnode Blogs.

Unlike Kernel extensions, system extensions run in the user space of macOS outside the kernel. System extensions work in the background to extend the functionality of your Mac. Even though it offers an opportunity to create apps with advanced functionalities, it has the potential to compromise the stability and security of the Mac. As a result, they are bound to obey the system security policies, thereby improving the stability of the system. Also, these extensions are granted high-level privileges and can perform tasks that were previously reserved for KEXTs. System extensions are replacing KEXTs as they won’t compromise the security and stability of macOS and are controlled by Mac’s security rules.  Additionally, with System Extensions, developers are free to write code in any programming language.  

System Extensions provide enhanced system stability without sacrificing power. The system extensions can be driver extensions, network extensions, and endpoint security extensions. These extensions are to be packed inside the app bundle and are installed on the system during runtime. You will have to remove the app to delete or disable the extension.   

UEM solutions like Hexnode offers policies to load applications and installers that use system extension on Mac devices and allow admins to set restrictions on loading user-approved system extensions. 

The post What is a system extension on Mac? appeared first on Hexnode Blogs.

• Frequently used contacts to either call or compose SMS
• Viewing PDFs or video files with external-facing links
• Composing a mail to a frequently used recipient
• iTunes music links
• Face time links
• FTP file links
• iBooks files
• iCloud shared documents
• Opening a specific location in maps
• App store app links

Apart from the special cases like contacts and addresses, you could open all of them in browsers like Chrome, Safari or Firefox provided you gave the appropriate prefix. By default, it opens them on Safari.

And now for the big question, how to get Web Clips on your device? As I mentioned before, you could access this feature using an MDM or even better, a UEM like Hexnode. Down are the steps you need to follow:

1. Setup the device by enrolling it into your network.
2. Add the web app to your portal by giving in the URL, name, and the icon picture.
3. Create a new Web Clips policy.
4. Configure the policy by adding the created web app.
5. Save it and associate it to the targeted device.

These are only the basic steps to follow although, they might be a bit different depending on the solution you use.
While configuring the policy you could choose to make them non-removable so users won’t be able to remove it as long as the policy is associated with the device. You could also check the option to open the URL in Full-Screen mode where it will be opened as a Web App with no URLs, search bars and bookmarks.

The post What are Web Clips on iOS? appeared first on Hexnode Blogs.