# Test the invocation path of an iOS app-protection transfer exception

> Why can an exempt unmanaged iOS app still fail to receive data through copy-and-paste or Open-in?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:41+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Why can an exempt unmanaged iOS app still fail to receive data through copy-and-paste or Open-in?

## Potentially affected

Use this check when an Intune iOS/iPadOS app-protection data-transfer exemption has been added for an unmanaged app. Record the exact transfer operation and the target app's supported invocation method.

## DSE recommendation

DSE recommends documenting each approved exception as a particular transfer path.

## Article

## Source facts

Microsoft requires an exempt unmanaged app to be invoked through an iOS URL protocol for this type of data-transfer exception. The exception does not bypass restricted cut, copy and paste operations. Microsoft also states that the managed app’s Open-in action remains blocked by this exception because it does not use that URL protocol. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-ios).

## Applicability

Use this check when an Intune iOS/iPadOS app-protection data-transfer exemption has been added for an unmanaged app. Record the exact transfer operation and the target app’s supported invocation method.

## DSE recommendation

DSE recommends documenting each approved exception as a particular transfer path. Confirm the application owner’s supported URL protocol and the business data that may pass through it. Preserve the intended restrictions on other transfer methods and explain those limits in the support guidance before assigning the exception.

## Verification

On an approved test device, use nonsensitive content to compare the supported protocol invocation with copy-and-paste and Open-in. Record which action was performed and its result under the same policy. A failed alternative path should be evaluated against its own restriction before anyone broadens the exception.

## Official references

[Microsoft Learn: iOS App Protection Policy Settings](https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-ios). Source reviewed September 17, 2026.

## Primary reference

- Name: iOS/iPadOS App Protection Policy Settings - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-ios
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Test the invocation path of an iOS app-protection transfer exception,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-139-test-the-invocation-path-of-an-ios-app-protection-transfer-exception/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.