Category filter

Set up Apple’s Managed Open In settings using configuration profiles

This document serves as a guide on configuring Apple’s Managed Open In settings using a configuration profile.

Apple’s Managed Open In settings let organizations control how the data flows between managed and unmanaged apps. Data security is strategic in an enterprise, and preventing vulnerabilities is paramount. A key strategy for preventing data leaks and maintaining regulatory compliance is the strict separation of personal and corporate data. This approach is effective whether the users access corporate data on their personal or company-provided devices. The configuration profile described here can set up the Managed Open In settings. IT admins can use Hexnode’s Deploy Custom Configuration feature to deploy configuration profiles on iOS devices.


  • This configuration profile is supported only on supervised iOS devices.
  • This configuration profile is supported only if the devices are enrolled in an MDM (Mobile Device Management) solution.

The configuration profile provided below is adapted from a third-party open-source site.

Configuration profile to set up Apple’s Managed Open In settings

The below table shows each key that is used in the profile and its use:

Settings Keys Description Default Value Supported Versions
Allow documents from managed sources in unmanaged destinations allowOpenFromManagedToUnmanaged Allows the user to open or read documents from managed apps in unmanaged apps. false iOS 7.0 and above
Allow documents from unmanaged sources in managed destinations allowOpenFromUnmanagedToManaged Allows the user to open unmanaged documents in managed apps. false iOS 7.0 and above
Allow managed apps to write contacts to unmanaged contacts accounts allowManagedToWriteUnmanagedContacts Allows the users to save the contact information of a managed app to the built-in iOS Contacts app. true iOS 12.0 and above
Allow unmanaged apps to read contacts from unmanaged contacts accounts allowUnmanagedToReadManagedContacts Allows the user to read managed contact accounts in the unmanaged apps. true iOS 12.0 and above
Allow managed apps to store data in iCloud allowManagedAppsCloudSync Allows the user to sync data from managed apps with the iCloud account. false iOS 8.0 and above
Treat AirDrop as unmanaged destination forceAirDropUnmanaged Allows the user to AirDrop managed app data. true iOS 9.0 and above
Require managed pasteboard requireManagedPasteboard Allows the user to copy and paste between managed and unmanaged apps. true iOS 15.0 and above

What happens at the device end?

After associating the configuration profile, it will enforce the configured restrictions on data exchange between managed and unmanaged apps. For instance, when the user tries to open a confidential email attachment from the work email, the apps that can be shared or listed to include all the possible ones.

An email attachment can be opened in personal apps and saved it to iCloud

After deploying the configuration profile, only the apps that are installed and managed by the MDM (Mobile Device Management) solution can open that attachment. Consequently, the user’s unmanaged personal apps will not be listed as options for opening the attachment.

Removed the permission for the attachment in unmanaged app


  • To create and customize configuration profiles, you can use tools like Apple Configurator, and Profile Manager or manually create them using text editors.
  • Use non-encrypted .mobileconfig, .xml, or plist files to deploy profiles across devices.
  • Ensure that you do not associate conflicting configurations with the devices.
  • Use wildcards to fetch key values from the portal.
  • It is recommended to manually validate the configuration profile on a system before executing it in bulk.
  • Hexnode will not be responsible for any damage/loss to the system on the behavior of the configuration profile.

  • Configuration Profile Repository