Transferred data is encrypted by Intune and unreadable by unmanaged apps. Policy managed apps with OS sharing : Only allow data transfer to other policy managed apps, as well as file transfers to other MDM managed apps on enrolled devices. If this setting is targeted to a user on an unenrolled device, the behavior of the Policy managed apps value applies.

Note: Users may be able to transfer content via Open-in or Share extensions to unmanaged apps if Intune private data type are supported by the app. In addition, when set to Policy managed apps or None , the Spotlight search enables searching data within apps and Siri shortcuts iOS features are blocked. General web links are managed by the Open app links in Intune Managed Browser policy setting.

There are some exempt apps and services to which Intune may allow data transfer by default. In addition, you can create your own exemptions if you need to allow data to transfer to an app that doesn't support Intune APP. See data transfer exemptions for more information.

All apps Select apps to exempt This option is available when you select Policy managed apps for the previous option. You must contact the application developer to determine the correct universal link format for each application. Save copies of org data Choose Block to disable the use of the Save As option in this app. Choose Allow if you want to allow the use of Save As. When set to Block , you can configure the setting Allow user to save copies to selected services. It can also be supported by third-party and LOB apps.

This setting will be "Allow" when the setting Send org data to other apps is set to All apps. This setting will be "Block" with no allowed service locations when the setting Send org data to other apps is set to None.

All other services are blocked. SharePoint: you can save files to on-premises SharePoint. Local Storage: you can save files to local storage. For this setting, choose how to handle this type of content transfer when it is initiated from a policy-managed app: None, do not transfer this data between apps : Do not transfer communication data when a phone number is detected. A specific dialer app : Allow a specific dialer app to initiate contact when a phone number is detected.

Any dialer app : Allow any dialer app to be used to initiate contact when a phone number is detected. If your apps rely on dialer functionality and are not using the correct Intune SDK version, as a workaround, consider adding "tel;telprompt" as a data transfer exemption. Once the apps support the correct Intune SDK version, the exemption can be removed.

For more information, see Apple's documentation about Phone Links. Blank Receive data from other apps Specify what apps can transfer data to this app: All apps : Allow data transfer from any app. None : Do not allow data transfer from any app, including other policy-managed apps.

Policy managed apps : Allow transfer only from other policy-managed apps. All apps with incoming Org data : Allow data transfer from any app. Treat all incoming data without a user identity as data from your organization.

If this setting is targeted to a user on an unenrolled device, the behavior of the Any apps value applies. Multi-identity MAM enabled applications will attempt to switch to an unmanaged account when receiving unmanaged data if this setting is configured to None or Policy managed apps. If there is no unmanaged account signed into the app or the app is unable to switch, the incoming data will be blocked.

All apps Open data into Org documents Select Block to disable the use of the Open option or other options to share data between accounts in this app. Select Allow if you want to allow the use of Open. When set to Block you can configure the Allow user to open data from selected services to specific which services are allowed for Org data locations. Note: This setting is only configurable when the setting Receive data from other apps is set to Policy managed apps.

This setting will be "Allow" when the setting Receive data from other apps is set to All apps or All apps with incoming Org data. This setting will be "Block" with no allowed service locations when the setting Receive data from other apps is set to None. The following apps support this setting: OneDrive Outlook for iOS 4. Allow Allow users to open data from selected services Select the application storage services that users can open data from.

Selecting no services will prevent users from opening data from external locations. All selected Restrict cut, copy and paste between other apps Specify when cut, copy, and paste actions can be used with this app. Select from: Blocked : Don't allow cut, copy, and paste actions between this app and any other app. Policy managed apps : Allow cut, copy, and paste actions between this app and other policy-managed apps.

Policy managed with paste in : Allow cut or copy between this app and other policy-managed apps. Allow data from any app to be pasted into this app.

Any app : No restrictions for cut, copy, and paste to and from this app. Any app Cut and copy character limit for any app Specify the number of characters that may be cut or copied from Org data and accounts. This will allow sharing of the specified number of characters to any application, regardless of the Restrict cut, copy, and paste with other apps setting.

When this setting is enabled, the user receives a one-time message stating that the use of third-party keyboards is blocked. This message appears the first time a user interacts with organizational data that requires the use of a keyboard.

This setting will affect both the organization and personal accounts of multi-identity applications. This setting does not affect the use of third-party keyboards in unmanaged applications.

Apps with SDK versions from 8. When you enable this setting, the user may be required to set up and use a device PIN to access their device.

If there's no device PIN and encryption is required, the user is prompted to set a PIN with the message "Your organization has required you to first enable a device PIN to access this app. Require Functionality Setting How to use Default value Sync policy managed app data with native apps Choose Block to prevent the policy managed apps from saving data to the native Contacts app on the device. If you choose Allow , the app can save data to the native Contacts app on the device, when those features are enabled within the policy managed app.

When you perform a selective wipe to remove work, or school data from the app, contacts data synced directly from the app to the native Contacts app are removed. Any contacts data synced from the native Contacts app to another external source can't be wiped.

Allow Printing Org data Select Block to prevent the app from printing work or school data. If you leave this setting to Allow , the default value, users will be able to export and print all Org data. Choose from: Any app : Allow web links in any app. This browser is a policy-managed browser. Microsoft Edge : Allow web content to open only in the Microsoft Edge.

Unmanaged browser : Allow web content to open only in the unmanaged browser defined by Unmanaged browser protocol setting.

The web content will be unmanaged in the target browser. If you're using Intune to manage your devices, see Manage Internet access using managed browser policies with Microsoft Intune.

If a policy-managed browser is required but not installed, your end users will be prompted to install the Microsoft Edge. Intune device enrollment If you are using Intune to manage your devices, see Manage Internet access using managed browser policies with Microsoft Intune. Users who sign in with their corporate Azure AD accounts in the Microsoft Edge browser application will be protected by Intune.

The Microsoft Edge browser integrates the Intune SDK and supports all of its data protection policies, with the exception of preventing: Save-as : The Microsoft Edge browser does not allow a user to add direct, in-app connections to cloud storage providers such as OneDrive. Connect and share knowledge within a single location that is structured and easy to search. A few of our users never seem to download the apple-app-site-association file no matter how many times they delete and reinstall the app.

Redirecting through universal links is essential for our sign in flow so this issue renders the app unusable for the affected users. The universal links themselves work perfectly well, it is just that for whatever reason the file is never requested from our servers, I have been through the server logs in great detail and identified that the users for whom this issue occurs never request the file, even after deleting and reinstalling the app 4 or 5 times.

Is there any known issue which could cause something like this? Should I file a bug with apple? Is it possible that the users are blocking requests to a bank of ip's including ours? I found an article about a bug in universal links last year which was preventing their correct functioning which seemed to be related to the daemon crashing, could the daemon be crashing in the case of these users?

As you indicate that you are not seeing the client even hit the server, this is likely due to a firewall blocking the request or the devices running versions of iOS prior to 9, which do not support Universal Linking. If you are seeing the clients hit the server, then there are a number of potential issues:.

Stack Overflow for Teams — Collaborate and share knowledge with a private group. Create a free Team What is Teams? Collectives on Stack Overflow. Learn more. Did you do anything else prior to clicking on the restore button? Apr 14, PM. Did you make sure it was the exact file for your device and the latest version? I just downloaded the latest file for my iPhone4, put it in the folder I mentioned above and it ran the install versus downloading the file.

This problem where it times out after downloading is a big Bug within iTunes that has been there ever since IOS 7. I wished these apple developers would just fix iTunes. There are a ton of complaints about this issue.

I sure miss Steve Jobs running this business, I really feel like it's gone down hill after he left. Apr 15, AM in response to igolfalot In response to igolfalot. From where were you able to download the latest file for your device? I got mine from a site on the internet and it said it was the latest version, but maybe not. I agree it is a major bug that Apple needs to get fixed. I was on the phone with a tech from AppleCare.

We were trying to restore my iPad to solve a minor problem I had and he saw the download problem. I had him go online and see all of the other people complaining about this, yet when we were through he was going to replace my iPad. Thanks again. Apr 15, AM.

I got it here. You must download the lastest version or iTunes will just try to download the correct one, then your stuck with the timeout problem.

Good luck. Apr 15, PM.