I did some research on the various ways how corporate data can be protected on a user owned device (BYOD) running iOS.
My understanding is that, through mobile device management (MDM), I could create networking and usage restrictions for certain apps specifically. For example, I could require the user to be connected through a specific VPN in order to use app "X".
I also understand that data is separated logically in the way that, for example, the contact data retrieved from an Exchange Server is only available as long as the configuration setting for said server is active on the device. Deleting it also removes the contacts from the device.
What I cannot figure out is if there is a possibility to limit the scope of the contact data provided by such a corporate server without resorting to third party apps that containerize the data entirely. I'll try to make this clearer with an example.
On my private iPhone, I can allow apps such as WhatsApp or facebook to access my contacts. I am using multiple cloud accounts that sync contacts to my device but on my private device without any mdm, I am not able to restrict this setting to just one specific cloud account - if I understand correctly, "contacts" just means any contact the device has access to.
As the corporate administrator of an mdm solution, would it be possible for me to restrict this, i.e. prevent the user from giving access to company owned contact data to third party apps while not restricting him if he does so with the contact data held locally or coming from a private server?
