Test the invocation path of an iOS app-protection transfer exception

Source facts

Microsoft requires an exempt unmanaged app to be invoked through an iOS URL protocol for this type of data-transfer exception. The exception does not bypass restricted cut, copy and paste operations. Microsoft also states that the managed app’s Open-in action remains blocked by this exception because it does not use that URL protocol. Microsoft Learn.

Applicability

Use this check when an Intune iOS/iPadOS app-protection data-transfer exemption has been added for an unmanaged app. Record the exact transfer operation and the target app’s supported invocation method.

DSE recommendation

DSE recommends documenting each approved exception as a particular transfer path. Confirm the application owner’s supported URL protocol and the business data that may pass through it. Preserve the intended restrictions on other transfer methods and explain those limits in the support guidance before assigning the exception.

Verification

On an approved test device, use nonsensitive content to compare the supported protocol invocation with copy-and-paste and Open-in. Record which action was performed and its result under the same policy. A failed alternative path should be evaluated against its own restriction before anyone broadens the exception.

Official references

Microsoft Learn: iOS App Protection Policy Settings. Source reviewed September 17, 2026.