{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/", "slug": "dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception", "url": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/" }, "title": "Test the invocation path of an iOS app-protection transfer exception", "summary": "Why can an exempt unmanaged iOS app still fail to receive data through copy-and-paste or Open-in?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:41+00:00", "modified_at": "2026-09-17T16:42:36+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 196, "potentially_affected": "Use this check when an Intune iOS/iPadOS app-protection data-transfer exemption has been added for an unmanaged app. Record the exact transfer operation and the target app's supported invocation method.", "dse_recommendation": "DSE recommends documenting each approved exception as a particular transfer path.", "primary_source": { "name": "iOS/iPadOS App Protection Policy Settings - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-ios", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft requires an exempt unmanaged app to be invoked through an iOS URL protocol for this type of data-transfer exception. The exception does not bypass restricted cut, copy and paste operations. Microsoft also states that the managed app’s Open-in action remains blocked by this exception because it does not use that URL protocol. Microsoft Learn.

\n

Applicability

\n

Use this check when an Intune iOS/iPadOS app-protection data-transfer exemption has been added for an unmanaged app. Record the exact transfer operation and the target app’s supported invocation method.

\n

DSE recommendation

\n

DSE recommends documenting each approved exception as a particular transfer path. Confirm the application owner’s supported URL protocol and the business data that may pass through it. Preserve the intended restrictions on other transfer methods and explain those limits in the support guidance before assigning the exception.

\n

Verification

\n

On an approved test device, use nonsensitive content to compare the supported protocol invocation with copy-and-paste and Open-in. Record which action was performed and its result under the same policy. A failed alternative path should be evaluated against its own restriction before anyone broadens the exception.

\n

Official references

\n

Microsoft Learn: iOS App Protection Policy Settings. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft requires an exempt unmanaged app to be invoked through an iOS URL protocol for this type of data-transfer exception. The exception does not bypass restricted cut, copy and paste operations. Microsoft also states that the managed app’s Open-in action remains blocked by this exception because it does not use that URL protocol. Microsoft Learn.\nApplicability\nUse this check when an Intune iOS/iPadOS app-protection data-transfer exemption has been added for an unmanaged app. Record the exact transfer operation and the target app’s supported invocation method.\nDSE recommendation\nDSE recommends documenting each approved exception as a particular transfer path. Confirm the application owner’s supported URL protocol and the business data that may pass through it. Preserve the intended restrictions on other transfer methods and explain those limits in the support guidance before assigning the exception.\nVerification\nOn an approved test device, use nonsensitive content to compare the supported protocol invocation with copy-and-paste and Open-in. Record which action was performed and its result under the same policy. A failed alternative path should be evaluated against its own restriction before anyone broadens the exception.\nOfficial references\nMicrosoft Learn: iOS App Protection Policy Settings. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft requires an exempt unmanaged app to be invoked through an iOS URL protocol for this type of data-transfer exception. The exception does not bypass restricted cut, copy and paste operations. Microsoft also states that the managed app’s Open-in action remains blocked by this exception because it does not use that URL protocol. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-ios).\n\n## Applicability\n\nUse this check when an Intune iOS/iPadOS app-protection data-transfer exemption has been added for an unmanaged app. Record the exact transfer operation and the target app’s supported invocation method.\n\n## DSE recommendation\n\nDSE recommends documenting each approved exception as a particular transfer path. Confirm the application owner’s supported URL protocol and the business data that may pass through it. Preserve the intended restrictions on other transfer methods and explain those limits in the support guidance before assigning the exception.\n\n## Verification\n\nOn an approved test device, use nonsensitive content to compare the supported protocol invocation with copy-and-paste and Open-in. Record which action was performed and its result under the same policy. A failed alternative path should be evaluated against its own restriction before anyone broadens the exception.\n\n## Official references\n\n[Microsoft Learn: iOS App Protection Policy Settings](https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-ios). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/", "url": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Test the invocation path of an iOS app-protection transfer exception", "item": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/", "url": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/", "headline": "Test the invocation path of an iOS app-protection transfer exception", "description": "Why can an exempt unmanaged iOS app still fail to receive data through copy-and-paste or Open-in?", "abstract": "Why can an exempt unmanaged iOS app still fail to receive data through copy-and-paste or Open-in?", "articleBody": "Source facts\nMicrosoft requires an exempt unmanaged app to be invoked through an iOS URL protocol for this type of data-transfer exception. The exception does not bypass restricted cut, copy and paste operations. Microsoft also states that the managed app’s Open-in action remains blocked by this exception because it does not use that URL protocol. Microsoft Learn.\nApplicability\nUse this check when an Intune iOS/iPadOS app-protection data-transfer exemption has been added for an unmanaged app. Record the exact transfer operation and the target app’s supported invocation method.\nDSE recommendation\nDSE recommends documenting each approved exception as a particular transfer path. Confirm the application owner’s supported URL protocol and the business data that may pass through it. Preserve the intended restrictions on other transfer methods and explain those limits in the support guidance before assigning the exception.\nVerification\nOn an approved test device, use nonsensitive content to compare the supported protocol invocation with copy-and-paste and Open-in. Record which action was performed and its result under the same policy. A failed alternative path should be evaluated against its own restriction before anyone broadens the exception.\nOfficial references\nMicrosoft Learn: iOS App Protection Policy Settings. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:32:41+00:00", "dateModified": "2026-09-17T16:42:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Test the invocation path of an iOS app-protection transfer exception" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 196, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "iOS/iPadOS App Protection Policy Settings - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-ios" } } ] } }