How iOS Managed Open In Controls Corporate Links in Safari

This article provides a comprehensive overview of how iOS Managed Open In restrictions govern the flow of web links between corporate applications and a user's personal Safari browser. By utilizing Mobile Device Management (MDM) policies, IT administrators can prevent corporate data leakage by dictating how URLs inside managed work apps are handled, ensuring sensitive information does not cross over into unmanaged personal browsing sessions.

Understanding the Managed Open In Framework

Managed Open In is a core iOS security feature designed to separate corporate data from personal data on a single device. When an IT administrator deploys an app via an MDM solution, that app is flagged as "managed." Apps downloaded by the user from the App Store on their own are flagged as "unmanaged."

To control data flow between these two environments, administrators use two primary MDM restrictions:

  • Allow documents from managed sources in unmanaged destinations: Controls whether corporate data can leave managed apps.
  • Allow documents from unmanaged sources in managed destinations: Controls whether personal data can enter corporate apps.

In the iOS ecosystem, opening a hyperlink is treated similarly to sharing a document. When a user taps a link inside a corporate email client or document viewer, the operating system checks the Managed Open In restrictions before passing that URL to the default web browser.

Because Safari is a built-in system app, it cannot be designated as entirely "managed" or "unmanaged" in the same way third-party apps are. Instead, iOS uses specific MDM payloads to divide Safari’s behavior based on the links being accessed and the restrictions applied.

To stop links inside corporate apps from opening in a personal Safari environment, Managed Open In relies on the Domains payload combined with data movement restrictions. Here is how the control mechanism works in practice:

1. Blocking Unmanaged Destinations The administrator sets the "Allow documents from managed sources in unmanaged destinations" restriction to False. This immediately tells iOS that no data—including tapped URLs—can leave a corporate app to be opened in an unmanaged personal app.

2. Configuring Managed Web Domains Because Safari is a dual-use app, the administrator must define which websites are considered corporate by configuring "Managed Web Domains" in the MDM. Any URL listed here (such as an internal company intranet) is treated by Safari as a managed destination. Any URL not on this list is treated as an unmanaged, personal destination.

3. Enforcing the Link Restriction When a user taps a link inside a managed corporate app, iOS evaluates the URL against the Managed Web Domains list and the Open In restrictions:

  • If the link is a Managed Domain: iOS allows the link to open in Safari, and any data or documents downloaded from that site will be forced back into managed corporate apps.
  • If the link is NOT a Managed Domain: Because unmanaged destinations are blocked, iOS prevents the corporate app from passing the non-work link to the personal context of Safari, or it strips the corporate context entirely so no company session data is shared.

In many enterprise environments, administrators want to bypass Safari entirely for corporate links to ensure complete isolation from personal browsing history, cookies, and caches.

While native iOS Managed Open In handles the baseline restrictions, administrators often pair it with third-party App Protection Policies (such as Microsoft Intune) or specific MDM browser configurations. By restricting unmanaged destinations via Managed Open In and whitelisting a specific managed browser's URL scheme (like Microsoft Edge or Chrome Enterprise), corporate apps are forced to route all web links directly into the managed third-party browser. If a user attempts to open the link, the personal Safari browser is completely bypassed, keeping corporate web traffic strictly isolated.