Changes to applications’ backup and restore behavior on iOS/iPadOS and macOS devices

Hi Joachimb89 ,

as described in my answer to ChrisNeu , you cannot backup your corporate IDs inside Authenticator to iCloud. It only stores your private MS Account IDs. Hence, you better leave the Block managed apps from storing data in iCloud is set to Yes.

You are right, this setting applies to all managed apps in a whole, and should be turned on. But it has nothing to do with iCloud Backup. It is the iCloud Sync feature. Two different things, people always mix up.

Sync is controlled with one setting for all apps inside the iOS platform restrictions, Backup is controlled with an individual setting per-app inside the App catalogue. As the latter is a setting, which is not sent to the device during every check-in, but only when the specific app is getting installed or updated or re-installed. This is by design, intended by Apple.

• Corporate iOS devices with MDM & MAM policies applied

• > What is backed up and what not, depends on your policies. Please specify the setting in doubt, than only your question can be answered.

• VPP apps deployed to all devices. Either required or available

• > no effect on the backup mechanism. The iCloud backup and the iCloud sync mechanisms are depending on whether the app is managed or unmanaged, and for MAM (APP), whether or not you deployed the App setting "IntuneMAMUPN".

• App assignment configured with setting Prevent iCloud app backup set to Yes

• > completely blocks the backup of app data to iCloud via iCloud Backup mechanisms. No effect on iCloud Sync

In an App Protection policy -> Data Protection ->

• Prevent Backup org data to iTunes and iCloud backups set to Block

• > same as "prevent iCloud app backup" but only for apps which support MAM, not applicable to all Managed Apps. this MAM policy is supported both, managed and unmanaged devices

• Save copies or org data set to Block

• > applies only to organizational data from the corporate account. you can define exceptions like corporate onedrive or sharepoint

• In a device restriction policy Block managed apps from storing data in iCloud is set to Not Configured

• > has nothing to do with app backup. applies only to iCloud Sync feature

iCloud Sync: Apps store their data in iCloud autonomously. Needs to be implemented by the app developer.

iCloud Backup: is the device Backup feature by Apple which is triggered by the system/by the user and copies the app storage.

When I check in Settings -> * Apple ID * -> Apps using iCloud -> all managed apps are enabled (green tick)

> This is iCloud Sync

When I check in Settings -> * Apple ID * -> *Current iOS Device name* -> iCloud Backup -> All Device backups -> All managed apps show "Backup not Supported"

> This is iCloud Backup

The remaining questions should be answered with my post above.

Hi ChrisNeu,

What kind of app data is even backed up using the new prevention feature compared without using it?

> you cannot backup any app data if this feature is enabled. It is valid for the app in a whole.

- the app itself or only a reference to the app so it is re-installed from App Store after restore?

> apps binary data is never backed up to iCloud/iTunes, the backup mechanism is aware, that the app binary data is available on the Apple App Store. During restore, the app binary is re-downloaded from Apple. That ensures a smaller backup and avoids backing up loads of data which is unnecessary. Only the list of installed apps and their position on the homescreen is stored. For apps that are pre-paid via Apple VPP (license belongs to the company) or line-of-business apps, the apps cannot be re-downloaded automatically from Apple. For that you need to check-in again with Intune and download from Comp Portal. Hence, for any app, where there is no backup prevention, the reference for app binary is backed-up plus the data inside the app (user data, which cannot be re-downloaded from Apple)

- App including its data saved in managed locations like OneDrive for Business?

> the above documentation is not affecting the storages that are enabled inside an application. it is only affecting the backup behavior on system-level (iCloud/iTunes only). If you wish to control Backup on App-level, please use the Intune App Protection Policies.

- App including its data saved in iCloud if access not blocked by any other means?

> yes, if you don't block backups via Setting in the Intune App Catalog Assignment nor via the App Protection Policies, the user data plus an App Store reference for the binary installation is stored as a backup.

- App including its data saved locally to devices?

> I don't really understand the question.

- only the Information from where the app should by installed after restoring the device (cloud symbol vs “Waiting…”)?

> generally, if all information is available to the device after the restore, the app would queue for installation ("Waiting..."). You'll see a cloud symbol in the following situations:

--> App was managed before as an optional app assignment > you need to re-download from Comp Portal

--> App was managed before as a required app assignment > you need to check-in and wait for all the required apps to be re-pushed

--> app was not managed but was automatically off-loaded by iOS mechanisms --> you tap on the app icon which triggers a re-download from App Store

- behavior of Microsoft Authenticator App: restoring account information only possible with icloud backup combined with MSA (Microsoft Account)?

> not possible in any way, if you make the restore on a new device. Corporate identities need to be re-setup after the iCloud restore because the keychain won't be restored completely and Authenticator is aware that it was restored on a different devices.

> for restore on the same device, I am not sure right now. Better you test on your own, but I think as the keychain is restored 1:1, the Authenticator probably restored with all the identities, too.

> the built-in "iCloud Backup" (inside the Authenticator App Menu) is in reality the iCloud Sync feature. It only syncs your personal Account identities, plus your Passwords if you use the password manager feature. Corporate Account Identities (Azure Accounts) are not synced. However, once iCloud Sync feature was disabled for managed Apps via MDM, this feature will be deactivated.

Using the same configuration like @Joachimb89 I would appreciate a best practice guide for backing up a supervised iOS device with private use allowed (managed Authenticator App, and all Office Apps protected by managed app protection policy blocking access to iCloud).

> I think this is highly individual per Company and use case, hence there is no general best practice. Sometimes also according to law, you need to ensure certain settings. However, I generally recommend to ensure blocking iCloud Backup for every single managed app via the app catalog. Additionally you should block the iCloud Sync feature for Managed Apps. Both settings are part of iOS restrictions. It is vendor-independent, working for all MDM/EMMs. That way, the corporate data is prevented from being backed up by iCloud Backup mechanisms. Plus you give your users the freedom to use the integrated backup mechanisms to backup their personal data. Hope this helps.
DM me, if you want to know more about secure integration of personal use in corporate devices.

Best regards

Patrick

Hello Intune_Support_Team,

following Joachimb89‘s last blog question from July 2023, I do have the same question regarding backing up Office Apps and its data with iCloud Backup.

What kind of app data is even backed up using the new prevention feature compared without using it?

- the app itself or only a reference to the app so it is re-installed from App Store after restore?

- App including its data saved in managed locations like OneDrive for Business?

- App including its data saved in iCloud if access not blocked by any other means?

- App including its data saved locally to devices?

- only the Information from where the app should by installed after restoring the device (cloud symbol vs “Waiting…”)?

- behavior of Microsoft Authenticator App: restoring account information only possible with icloud backup combined with MSA (Microsoft Account)?

Using the same configuration like Joachimb89 I would appreciate a best practice guide for backing up a supervised iOS device with private use allowed (managed Authenticator App, and all Office Apps protected by managed app protection policy blocking access to iCloud).

Best regards 

Our goal is to block all managed apps from storing data in iCloud except for MS Authenticator. It is/was not possible to define this on a per-app level. In a device restriction policy the setting Block managed apps from storing data in iCloud is set to Yes

During my test explained below I changed the restriction Block managed apps from storing data in iCloud to Not Configured which enables backing up Authenticator with a personal MS account but ofcourse also enables this for all other apps.

Can someone (Intune_Support_Team ?) please clarify as I'm a bit confused what is and what is not backed up to iCloud in the following setup:

• Corporate iOS devices with MDM & MAM policies applied
• VPP apps deployed to all devices. Either required or available
• App assignment configured with setting Prevent iCloud app backup set to Yes
• In an App Protection policy -> Data Protection ->
  
  • Prevent Backup org data to iTunes and iCloud backups set to Block
  • Save copies or org data set to Block
• In a device restriction policy Block managed apps from storing data in iCloud is set to Not Configured

When I check in Settings -> * Apple ID * -> Apps using iCloud -> all managed apps are enabled (green tick)

When I check in Settings -> * Apple ID * -> *Current iOS Device name* -> iCloud Backup -> All Device backups -> All managed apps show "Backup not Supported"

My question is: with the above setup, does that fully block the apps from storing and/or backing up data in iCloud? Or does this only prevent the "app installation info" from being being backed up? Aka, when restoring from an iCloud backup; does it restore the app with or without data and is that data stored in iCloud?

jatom9 

If I understand your request correctly, you are referring to the Outlook contact sync feature. It is possible to turn off the "sync" of contacts from Outlook to native contacts. In fact, this is not a true sync, but rather an export (contacts are stored under the user's local/iCloud address book). So all the native iOS settings which apply for your offline/iCloud contacts also apply for the Outlook-synced contacts. To turn it off, you can utilize a managed app configuration for Outlook on iOS.

To learn more:

https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-configuration-with-microsoft-intune#general-app-configuration-scenarios 

If you require business contacts availability in native contacts, (e.g. for bluetooth-car-integration), you can still deploy a native exchange profile which is limited to contacts sync and cannot be changed by the user. Then you profit from all the native iOS managed open-in mechanisms and control these contacts via iOS restrictions. (e.g. no access by privately-installed apps, like Whatsapp). iOS backup for contacts which synced from a managed Exchange profile, is blocked by default.

Hence, the origin of your issue is not really related to this topic here, but belongs to iOS and Outlook contact handling.

Hello,

Could you please let us know if  this change will affect Outlook synchronized Contacts? Currently even after disabling "Outlook" Backup from Settings->My Account->iCloud->iCloud Backup->My device (at the bottom)->Show All Apps-> Outlook , contacts are still saved correctly in Contacts iOS app. In one of the screenshot we could see that some applications have "Backup not supported" option enabled, how it looks in case of Outlook iOS app? If it will be enabled then re-installation of Outlook app is probably needed, so how it will behave next with synchronization between Outlook and iOS Contacts applications?

Checking if an app is backed up by iCloud

there is a mistake in the location where to check for iCloud backups. In the text above it says: "Settings > iCloud > Under ”Apps using iCloud”, select show all". This is not what is shown in the screenshot!

the mentioned location is actually the place to enable iCloud App Data Sync, which is a completely different iOS feature and can be controlled by iOS Restriction "iCloud Documents and Data Sync". It can be turned off completely or only for managed apps, but not for apps individually.

The iCloud device backup feature where you can check if a managed app is allowed to be backed up, can be found here: 

Settings > iCloud > Under "Device Backups", select iCloud Backup > scroll down and select your device > "show all apps"

Now you will see what is shown in the screenshot above.

Intune will block the iCloud Backup for all managed apps in the 2301 release.
From an iOS MDM point of view, it is technically possible to control this for each managed app individually, if the MDM vendor supports it.

Let's see, if the individual control for each managed app - whether it supports iCloud Backup or not - will come in a future Intune release.

Keep in mind, that this information - if iCloud Backup is allowed for an app - is delivered during installation of the app. I.e. once the setting changed on the MDM site, the app either needs to be updated or re-installed. So if you expect to see this on your device but don't see it, check in with your device and wait for Intune to push the updated information to the device. In case of impatience, re-install the app manually 😉 

Andy_Cerat Intune_Support_Team 

Things impacts managed apps on fully enrolled Corp devices. 

Does this apply to a non-enrolled Mobile Application Managed (MAM) device as well aka BYOD or will this only apply if a device is fully enrolled? On BYOD devices that are MAM Managed after this change will it block the backup from triggering against managed apps?