A user enrolled their personally owned iPhone in your MDM solution to access organizational services. Which of these is cryptographically separated for managed and personal data?

On a personally owned device enrolled using Apple's User Enrollment framework, iOS creates a separate Apple File System (APFS) volume for all managed data. This volume is cryptographically separated from the user's personal data, using its own distinct set of encryption keys. A key component of this separated environment is a dedicated keychain for managed apps and accounts. This ensures that sensitive organizational credentials, certificates, and authentication tokens are stored securely and are inaccessible to personal apps, and vice-versa. Upon unenrollment, this entire volume, including the managed keychain, is securely destroyed.

B. Safari profiles: This is a user-facing feature within Safari for logically organizing browsing data (like history and cookies), not a fundamental, OS-level cryptographic separation mechanism enforced by MDM.
C. Safari bookmarks: While an MDM solution can push managed bookmarks, they are integrated into the Safari application. The core cryptographic separation applies to the entire managed data volume, not specifically to bookmarks.
D. Contacts: Although contacts from a managed account are stored on the separate managed volume, the keychain separation is a more fundamental security control that underpins the entire managed ecosystem on the device.

1. Apple Platform Security Guide (May 2024): Under the section "User Enrollment data separation," the guide states, "For User Enrolled devices, iOS and iPadOS create a separate Apple File System (APFS) volume for managed data... This separation is secured by using a separate set of cryptographic keys for the data on the volume... This includes: ... A separate keychain for managed accounts." (Page 41).

2. Apple Developer Documentation, "User Enrollment": The documentation details the separation model: "User enrollment installs a separate volume on the device to store managed data... Managed apps and accounts have access to a separate keychain, which the system removes when the user unenrolls the device." (Section: "Separating Personal and Managed Data").

3. WWDC 2019, Session 303 "What's New in Apple Device Management": This session introduced User Enrollment and explained its core principles. It highlights the creation of a separate APFS volume and the cryptographic separation of work data, explicitly mentioning the separate keychain as a key privacy and security feature. (Timestamp: 10:15 - 11:30).