Skip to content
Avanet

Sophos Mobile: Understanding policies for Apple User Enrollment

Sophos Mobile

Check the management mode first: The iOS user policy in Sophos Mobile is intended for iPhones and iPads enrolled through Apple User Enrollment. This enrollment mode is for personal devices (BYOD). It is not Apple Device Enrollment, where Sophos Mobile manages the entire device, nor is it Automated Device Enrollment (ADE) through Apple Business. iPhones and iPads automatically enrolled in that way are supervised. A supervised device cannot be enrolled through Apple User Enrollment. Do not apply settings from an iOS device policy or ADE instructions to a user policy without checking them first.

What separation actually means

Apple User Enrollment uses a managed Apple Account alongside the personal Apple Account. Business data resides on a managed APFS volume, including managed apps and app data, a managed keychain, and data from the managed Apple Account. When a user unenrolls from Sophos Mobile, iOS removes this managed volume from the device. This does not mean that an admin can reset the entire personal device or read personal content. With this enrollment type, Sophos Mobile cannot retrieve personal data or device identifiers such as the UDID, IMEI, and MAC address; because the MAC address is unavailable, NAC is not available for these devices.

Before deployment, confirm that the device is actually enrolled in User Enrollment mode and that the user has a managed Apple Account for enrollment. According to Sophos, profile-based enrollment is available only up to iOS/iPadOS 17; do not base newer rollouts on an old profile workflow. This draft does not provide a specific enrollment or tenant procedure.

Choose policies by purpose

  • Device passcode: When Password policies is assigned to a device enrolled through Apple User Enrollment, Sophos requires a six-digit device PIN and prohibits PINs with repeated or consecutive digits (Sophos gives 555555 and 987654 as examples). This also affects personal access to the device. Sophos Mobile cannot reset a forgotten device passcode. If the device does not meet the password requirements when this configuration is assigned, Sophos says a 60-minute grace period begins. During this period, the device prompts the user to change the device passcode every time they open the Home Screen. After the period expires, it may no longer be possible to launch any apps, including built-in and personal apps. Do not treat this configuration as a harmless workspace rule or deploy it without communicating with users first.
  • Business accounts: Email account adds Exchange Online or Exchange Server to Apple Mail; that account is managed. IMAP/POP configures incoming and outgoing mail servers separately, while Google account requires the user to enter their Google credentials. CalDAV and CardDAV cover calendar and contact synchronization, respectively. Servers, ports, authentication, and TLS must match the actual service; example URLs are not universal configuration values. Both %_USERNAME_% and %_EMAILADDRESS_% occur in each of Email account and IMAP/POP, with field-dependent roles. Maintain the corresponding Sophos Fusion user fields; for Email account, populate Exchange Login and Email Address in particular.
  • Mail data flows: A managed mail account and the managed APFS volume alone do not guarantee complete isolation. For Email account and IMAP/POP, separately check whether Allow move permits moving messages into other accounts or replying/forwarding through another account, whether Allow recent address syncing synchronizes recently used addresses through iCloud to other devices, and whether Use in Mail only restricts use as a sending account from other apps. For IMAP/POP, also check Allow Mail Drop as a separate data flow. Do not treat any one of these options as a proven DLP guarantee.
  • Data flows: Restrictions contains separate document rules for managed → unmanaged and unmanaged → managed, for unmanaged apps reading managed contacts, and for the clipboard and iCloud synchronization. The documented separation of managed mail attachments requires both a managed account and managed apps. If the rule for documents within managed apps/accounts is turned off, the following two options (contact sharing and the document rule for unmanaged apps/accounts) are disabled. If both document rules are off, the clipboard restriction has no effect. Check the desired direction, contact sharing, iCloud synchronization, and observable data flows separately on a test device; do not promise blanket data isolation.
  • Access and presentation: Single sign-on describes Kerberos SSO for third-party apps; the documented configuration applies only up to iOS 26 or iPadOS 26. AirPrint adds printers to the printer list; IP address, resource path, port, and TLS depend on the print service. Web Clip adds a shortcut to the Home Screen. According to Sophos, a non-removable Web Clip may disappear only when the policy that installed it is removed; do not plan this option without a way to undo it.

Managed apps and per-app VPN: no shortcuts

A managed app is not simply any app on the personal device. For User Enrollment, Sophos describes only apps acquired through Apple Business: distribution takes place through Sophos Mobile or by assignment to the managed Apple Account. If the same app is already installed personally, it cannot also be installed as a managed app. A managed app removed by the user remains managed when reinstalled. Mail, Notes, and Calendar, however, can hold data from both the personal and managed accounts; do not classify their data based on the app name alone.

Apple permits the AppLayerVPN payload under User Enrollment; that platform allowance does not prove that Sophos Mobile can assign a user-policy connection to an app. Sophos lists Per app VPN (German help: VPN pro App) as a configuration in an iOS user policy and links from it to app-assignment instructions. Those instructions, however, specify one or more device policies with Per app VPN as a prerequisite and describe selectable connections exclusively as configurations from device policies; at the same time, they link back to the iOS user policy. There is therefore an unresolved tension in the documentation between the user-policy page and the assignment description limited to device policies, not evidence of contradictory product behavior. Whether a connection from a user policy is actually available in the app VPN selector under Apple User Enrollment remains unresolved. Consequently, this draft neither instructs readers to assign such a connection to an app nor provides a click path or promises any VPN effect; no VPN assignment for personally installed apps can be inferred from it either. Any later operational instructions require independent confirmation in the approved User Enrollment tenant: an appropriately licensed managed app, availability of the user-policy configuration in the selector, on-demand behavior, the actual per-app data path, and removal of the assignment. The Send all traffic through VPN field (German help: Alle Daten über VPN übertragen) in the Per-App profile does not establish device-wide VPN routing.

Outstanding before approval

Before a production rollout, the affected person’s consent, an agreed backup and retention plan, and a test on a device approved for that purpose are still needed: record the enrollment mode, OS version, edition/license, app license and management status, accounts, and existing data. Agree on an escalation path for a forgotten device passcode instead of relying on a Sophos reset that is not available; after the documented 60-minute grace period, personal apps may also be blocked. Approve document and mail data flows and VPN traffic only on the basis of observable results.

Test rollback for each payload rather than inferring it from the removal of a policy assignment: check accounts and app status after policy removal; for a non-removable Web Clip, include the policy that installed it; for managed apps, also check uninstallation or license revocation and the state of a reinstalled app. Decide in advance which business data must be retained and how it will be backed up outside the device. Unenrollment removes the managed APFS volume, including the business data stored there; it is not a lossless rollback, even though it does not indiscriminately delete personal device data. Neither a tenant nor an iPhone/iPad was tested here; no rollback sequence has been confirmed in practice, and no payload effect has been technically approved. Approval of this article as documentation must be kept separate from technical approval of a production rollout; it does not confirm any effect in the tenant or on the device. In particular, do not use passcode enforcement, document-sharing rules, or VPN assignment as production instructions without that technical approval.