White Listing Apps on iOS and Still Allow iCloud

Hello internet people!

Wanted to post about a recent issue that came up at a client. This particular client was using corporate owned Apple Business Manager (new DEP) devices that were being locked down with a white list of applications. This customer also wanted to allow people to sign into iCloud to retrieve their personal contacts and photos and things like that. 

The issue was every time we attempted to sign into iCloud it would fail. We narrowed it down to the white list policy by flipping the policy off and trying again, seeing a success, wiping and flipping the policy back on and seeing a failure again. 

After we had narrowed it down I did a little digging and found this gem

https://support.apple.com/en-us/HT209205

Maybe this was common knowledge, but it wasn't for me or the customer I was working with.

Sure enough after adding com.apple.CoreCDPUI.localsecretprompt to the app white list we were able to log into iCloud without issue. 

If you are wondering what I mean when I say an app "white list" inside of Intune its the show/hide application settings and looks like the image below.

Hey, I mean is the word 'secret' is in the app name it cant be that well known right?

Have a good one!

Intune App Protection Policies and iOS Exemptions

Disclaimer: While the below information should be true, it can still be hit or miss getting this to work!

Hello Everyone!

No amount of searching has been very helpful for me personally when trying to find iOS application identifier URLs. 

A URL identifier is a unique name that each iOS application must have. Using this name an existing application on an iOS device can call upon that app to perform actions, such as open a file. 

To my knowledge there is no list out there for such identifiers. What I would like to do is start that list here in this post A Mobile Attempt: List Of Possible iOS Identifiers

Edit: 5/2021 If something is not on that list you can try the simple method below of follow the more in depth method here https://c7solutions.com/2021/04/intune-mam-exemptions-discovering-url-protocols

My only methods to finding out this URL identifier are to either ask the developer or to take a guess and test it inside of safari. If you open safari and type the following into the address bar

guessedappname:// 

You should get a result of either app not found, or something that asks if you would like to allow an app to open the webpage. For an example using Salesforce (salesforce1://) see screen shots below.

BAD GUESS

CORRECT GUESS

Without further ado here is the very short list of ones I have used in the past. If you know any additional ones leave a comment below and lets get them added to the list.

• Salesforce - salesforce1
• Go To Meeting - gotomeeting
• AutoCAD DWG Viewer and Editor - autocad
• Webex - wbx
• Zoom Cloud Meetings - zoomus
• Slack - slack
• Apple Maps - maps
• Google Maps - googlemaps
• Docusign - Docusignit

The items on this list were generated by myself and the community. I have not verified the accuracy of most of them. I am asking for the communities help in either adding to the list or for a more foolproof way of finding out the applications URL identifier.

Thanks everyone!