Feature Request: Managed AirDrop

Published February 15, 2021 / 893 words / ~4 minutes to read

I’m going to try something different for this post. Instead of solving a technical problem or analzying an element of Apple device management, I’m going to propose a new feature. This particular feature has been on my mind since 2018 when I first opened an Apple enterprise support case asking product engineering to consider it for their future roadmap. Of course that’s mostly wishful thinking. What I want is not what everyone wants. Even years later though, I can’t shake the feeling this would help in a variety of scenarios. What I’m proposing is a managed AirDrop feature, and I hope after reading through why you’ll file feedback too.

AirDrop today can be managed in limited ways. forceAirDropUnmanaged forces AirDrop to be considered an unmanaged drop target which in turn stops managed apps from sending data using Airdrop through the share sheet or similar. There’s also the boolean allowAirDrop key which can either disable or enable AirDrop entirely. Receiving off, contacts only, and everyone options can’t be managed, and there is currently no other way to limit AirDrop on MDM enrolled and supervised devices.

https://developer.apple.com/documentation/devicemanagement/restrictions

As an example, AirPlay has a few more options, such as the Whitelist key which takes a list of MAC addresses to trust. When the key is used, only supervised devices included are available as AirPlay destinations. An iPad with the key set can only AirPlay to these specific Apple TVs. A good start, but still not what I’m after.

<dict>
    <key>PayloadDescription</key>
    <string></string>
    <key>PayloadDisplayName</key>
    <string>com.apple.airplay</string>
    <key>PayloadEnabled</key>
    <true/>
    <key>PayloadIdentifier</key>
    <string>26C206C5-0DE5-43C2-B4B1-724F6795B8DE</string>
    <key>PayloadOrganization</key>
    <string>Shakopee ISD720</string>
    <key>PayloadType</key>
    <string>com.apple.airplay</string>
    <key>PayloadUUID</key>
    <string>26C206C5-0DE5-43C2-B4B1-724F6795B8DE</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>Whitelist</key>
    <array>
        <dict>
            <key>DeviceID</key>
            <string>C8:D0:83:F2:98:BD</string>
        </dict>
    </array>
</dict>

Unfortunately, the original reason for requesting more granular management features isn’t kind. AirDrop is an incredibly useful tool to quickly share files, links, and contacts across Apple devices. Our middle school students can’t use it. There were dozens of incidents per year where students shared hateful, adult, or otherwise inappropriate content from their personal iPhone or other iOS/iPadOS device to a school managed iPad. Those incidents were difficult or impossible to track because we don’t manage, and have no interest in managing, personal student devices. Students can name their iPhone whatever they want, share an image over AirDrop, and get away with it every time. With the existing MDM features there’s no way to enable AirDrop for our managed iPads while also disallowing unmanaged devices from interacting through AirDrop. That’s at the core of what I’m asking. I would like to see a managed AirDrop feature where AirDrop sending and receiving can only occur between supervised devices enrolled in the same MDM.

  1. Only iOS/iPadOS devices enrolled in the same MDM can discover each other and share through AirDrop.
  2. MDM be able to report on the AirDrop status of the device to ensure the setting is enforced as expected. “Managed”, “unmanaged”, or “unknown/null" where managed is set by the MDM, unmanaged is left up to the user, and unknown/null is self explanatory.
  3. AirDrop logs are easily accessible on device and clearly marked when AirDrop traffic occurs between two managed devices enrolled in the same MDM.

Since device names can already be managed, students wouldn’t be able to use AirDrop anonymously. I understand how this can be seen as a behavior problem as opposed to a technology problem. However, I see applications outside of education as well. In highly controlled environments AirDrop is often disabled. By ensuring only corp managed devices can share between each other the risk of data exfiltration or other security compromises is reduced. To extend the feature, you could introduce an allow list of devices by identifier like what exists with AirPlay today. Only devices on another device’s allow list would be able to AirDrop between each other. Though that adds complexity, it means the ease and intuitiveness of AirDrop can be extended securely to a set of devices while maintaining security. Another example would be a research setting with multiple labs managed by the same organization. Though iPads could be enrolled in the same MDM, it might not be reasonable to allow sharing data between labs, only within the same lab. By allowing a set of devices to share amongst themselves there’s a mitigated risk of data being shared that shouldn’t be. The same could be said for medical, manufacturing, and other industry scenarios.

I imagine this being implemented where by default the key being set to true means devices enrolled in the same MDM can AirDrop between each other, and then locked down further to only specific devices when an array is included as well. The current options for AirDrop management - off or on - don’t offer enough granular control. If you’d like to see a similar feature, considering opening your own case or filing feedback and referencing case 100686819935. The more customers letting Apple know they’re interested the better. Help make AirDrop safe for our students to use again, and better for everyone.

#ipad #mdm