The ability to control copy and paste was added to iOS 15. Before iOS 15, data flow control between managed and unmanaged app is limited to “open-in“ action only. With iOS 15, data flow control has been extended to cover copy and paste as well. User will be promoted with a warning message when copy and paste is restricted. For example, we can stop user from pasting copied data from a managed app to an unmanaged app. With this we can stop user from copy enterprise data to a personal app in a BYOD device.
The newly added key and the usage can be found from Apple developer site.
With the existing UEM console, we have to use custom XML to publish a policy for copy and paste control.
This control honors the existing DLP policy so you will need to use it together with the DLP restriction control policy. You can enable copy & paste restriction in the same profile with the custom XML.
Choose the right DLP based on your need. With the following setting, copy and paste is allowed from unmanaged source to managed destination but not the other way around.
This is an XML to be used in your policy to enable copy and paste control:
<dict>
<key>requireManagedPasteboard</key>
<true />
<key>PayloadIdentifier</key>
<string>195c2047-813f-423e-b8c6-56a47a721b6e.Restrictions</string>
<key>PayloadOrganization</key>
<string></string>
<key>PayloadType</key>
<string>com.apple.applicationaccess</string>
<key>PayloadUUID</key>
<string>56358411-4d7b-45c5-a876-43cdeae7abcd</string> <!--Change last four values XXXX to random alphanumeric characters-->
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
Here is a demo video on how copy and paste control is enforced.
We can also stop user from uninstalling mandatory enterprise app on a BYOD device. For example, to lock down intelligence HUB.
Comments