How to get files from Intunes secured OneDrive on MDM Device to iOS Application?

For an Intune-managed iOS app to read files that are protected in a managed OneDrive container, the app must be Intune MAM–enabled and use the Intune App SDK for iOS to handle encrypted content. The best practice is not to bypass Intune encryption, but to integrate with the SDK so the app can decrypt and work with protected files according to policy.

Key points and best-practice approach:

1. Integrate the Intune App SDK into the iOS app
   The app must be built with the Intune App SDK so it can participate in Intune MAM policies and understand encrypted content. For iOS:
   • Add the Intune App SDK (or the libIntuneMAMSwiftFileProvider.xcframework for File Provider extensions) to the app.
   • Ensure Xcode build settings are configured as required:
     • Set Strip Swift Symbols (STRIP_SWIFT_SYMBOLS) = NO.
     • Set Enable Bitcode (ENABLE_BITCODE) = NO.
     • If using the “Enhanced Security” capability in Xcode 26+, disable Authenticate pointers and Enable Read-only Platform Memory.
2. Use IntuneMAMPolicy to determine when encryption applies
   When the app interacts with files that originate from OneDrive (or other managed locations), it should query Intune policy to see if file-provider encryption is required:
   • Call [[IntuneMAMPolicy instance] shouldFileProviderEncryptFiles] before storing or sharing files.
   • In File Provider–based flows (for example, if the app exposes or consumes files via a File Provider extension), this check determines whether the file must be encrypted on disk or in transit.
3. Encrypt and decrypt files with IntuneMAMFileProtectionManager
   To make a OneDrive-managed file readable inside the app while still honoring Intune policy:
   • When providing or storing a file under MAM control, use:
     • encryptFile:forAccountId: from IntuneMAMFileProtectionManager to encrypt a copy of the file for the managed account.
     • Store or share a copy of the file when encryption is required so that the app does not keep an encrypted version in its own cloud storage.
   • When consuming a file that may be encrypted (for example, a user selects a OneDrive file via Files/OneDrive picker and it arrives encrypted):
     • Use isFileEncrypted: to detect whether the file is Intune-encrypted.
     • If encrypted, call decryptFile:toCopyPath: to produce a decrypted copy that the app can read.
   • In multi-identity scenarios, before accepting a shared file, check canReceiveSharedFile: on the destination owner’s IntuneMAMPolicy to ensure the account is allowed to receive that file.
4. Protect File Provider items when using File Provider extensions
   If the app uses a File Provider extension (for example, to surface its storage into the Files app or to interact more directly with OneDrive-managed content):
   • For Non-Replicated File Provider (NSFileProviderExtension):
     • In - startProvidingItemAtURL:completionHandler::
       • Check shouldFileProviderEncryptFiles and, if required, encrypt using encryptFile:forAccountId: and share a copy.
     • In - importDocumentAtURL:toParentItemIdentifier:completionHandler::
       • Use isFileEncrypted: and, if needed, decryptFile:toCopyPath:.
       • In multi-identity apps, also use canReceiveSharedFile:.
   • For Replicated File Provider (NSFileProviderReplicatedExtension, iOS 16+):
     • Wherever an NSFileProviderItem is created and passed to the system, call protectFileProviderItem:forAccountId: on IntuneMAMFileProtectionManager with the owner identity.
5. Use the correct “open” and “save” locations for MAM policy checks
   When implementing “Open from OneDrive” or “Save to OneDrive” flows, use the Intune App SDK’s open/save location enums to correctly classify where data is coming from or going to. For example:
   • Use IntuneMAMOpenLocationAccountDocument for organizational cloud locations tied to a managed account (such as a corporate OneDrive or LOB cloud service).
   • Use IntuneMAMOpenLocationOther for non-organizational or unknown locations.
   • IntuneMAMOpenLocationLocalStorage is only for app-sandbox storage and should not be used for files accessible via the Files app or device storage.

By following this pattern—integrating the Intune App SDK, using IntuneMAMPolicy to determine encryption requirements, and using IntuneMAMFileProtectionManager to encrypt/decrypt copies—the app can safely receive a file from Intune-secured OneDrive and make it readable inside the app while remaining compliant with MDM/MAM policies.

References:

• Stage 3: Intune SDK Integration Into Your iOS App
• Intune App SDK for iOS - App Participation Features