Last updated: July 24, 2026

How to achieve containerization in iOS using restrictions?

Since Apple doesn't offer built-in containerization on iOS, this guide explains how to create a logical container-like setup using MDM restrictions. Administrators create a Restrictions profile and configure settings covering data sharing between managed and unmanaged apps, device wipe, unauthorized certificates/accounts, USB pairing, app installation, and Wi-Fi/VPN and iCloud controls (some requiring Supervised devices), isolating corporate data from personal use.

Description

Unlike Android which provides containerization by default when provisioned as Profile Owner, Apple doesn't offer containerization on iOS devices by default. However, with more organizations adopting a mobile-only workforce containerization on mobile devices is increasingly becoming a necessity. Containerization isolates personal and corporate data through a logical container ensuring there's no unauthorized access of corporate data. Containerization further helps in case of personal devices, whereby it ensures enterprises can control only the corporate data and enterprise apps while having zero control over the personal space. Though Apple doesn't provide containerization by default, MDM lets you achieve iOS containerization with a logical container-like setup using multiple restrictions as explained below:

Steps

On your MDM console, click on Device Mgmt and select Profiles from the left menu.
Click on Create Profile and select Apple from the dropdown.
Click on Restrictions from the policy list. You can know more about Restrictions here.
Configure below given restrictions to achieve a container-like setup on managed devices. This is thhe recommended setup though it can be modified based on the needs of your organization.

Restrictions marked with * are applicable only if the devices are Supervised.

AVAILABILE UNDER	PARAMETER TO BE RESTRICTED	PRE-REQUISITES	COMMENTS
SECURITY	Share data from managed apps to unmanaged apps	Applicable for devices running 7.0 or later versions	These restrictions prevent unauthorized access of corporate data by unapproved apps and also prevent users from removing the existing configurations by factory resetting the device.
	Share data from unmanaged apps to managed apps	Applicable for devices running 7.0 or later versions
	Allow user to wipe device by erasing all content and settings*	Applicable for devices running 8.0 or later versions
ADVANCED SECURITY	Install configuration profiles and certificates interactively*	Applicable for devices running 6.0 or later versions	These restrictions prevent users from adding unauthorized certificates/profiles on the devices as well as prevent users from adding non-corporate accounts to the device or allow devices to be paired using iTunes or via USB, thereby preventing data from being shared through USB.
	Add/Modify iCloud, Mail and other accounts*	Applicable for devices running 7.0 or later versions
	Allow iTunes pairing and other USB connections*	Applicable for devices running 7.0 or later versions
APPLICATION	Users can install unapproved apps*	N/A	Prevents unapproved apps from being installed on the device, thereby preventing these apps from accessing corporate apps or the data they work with.
NETWORK AND ROAMING	Connect to Wi-Fi, only if distributed via MDM*	Applicable for devices running 10.3 or later versions	This prevents users from connecting to untrusted Wi-Fi connections as well as configure unauthorized VPN connections on the device, thus ensuring secure transmission of corporate data.
NETWORK AND ROAMING	Allow users to configure VPN*	Applicable for devices running 11.0 or later versions
ICLOUD	iCloud Device Backup	N/A	This prevents corporate data from being saved on iCloud, which is a third-party cloud service.
ICLOUD	iCloud Sync Data and Documents of Managed Apps	Applicable for devices running 8.0 or later versions

Now, Save and Publish this profile. Distribute it to devices and/or groups.
On successful profile association, you would have a container-like setup on devices.

Frequently asked questions

Why doesn't iOS support containerization the way Android does?

Apple doesn't provide built-in containerization on iOS the way Android does through Profile Owner mode, so MDM achieves an equivalent container-like setup using a combination of Restrictions instead.

Which restrictions actually create this container-like isolation?

Blocking data sharing between managed and unmanaged apps, preventing installation of unapproved apps, disallowing iTunes/USB pairing and unauthorized certificate or account installation, and restricting Wi-Fi/VPN configuration and iCloud backup/sync together isolate corporate data from personal use.

Do all of these restrictions work on any iOS device?

No, restrictions marked with an asterisk in the table require the device to be Supervised, and several also have minimum iOS version requirements such as 7.0 or 8.0 and later.