Environment:
Intune App SDK (iOS) | 21.7.1 (revision d59aec5cba1c9b7200462c266b53fe7e6bd17840)
iOS version | iOS 26.0+
Xcode | 16.x / Swift 5.0
Device | Physical device, enrolled / MAM-managed
Integration | Swift Package Manager
App type | MAM-WE (MAM without enrollment)
Policy configuration
"Send org data to other apps" = Policy managed apps (also reproduces under variants: OS sharing, Open-In/Share filtering).
Not reproducible under All apps.
Summary
On iOS 26 with the SDK integrated, previewing a managed document with QLPreviewController displays a blank/empty preview for file types that Quick Look renders out-of-process (Office doc/docx/xls/xlsx/ppt/pptx, iWork pages/numbers/key).
QLPreviewController delegates rendering to a separate OS process (Quick Look preview service / WebContent renderer).
Because that helper process lives outside the app's managed container, the SDK's data-protection boundary blocks it from reading the managed file when "Send org data to other apps" is anything other than All apps → the preview is blank.
This matches the behavior tracked in #661.
Formats that render in-process (PDF via PDFKit, plain text via UITextView) are not affected
Steps to reproduce
Enroll device / apply a MAM policy with "Send org data to other apps" = Policy managed apps.
In the managed app, obtain a managed .docx (or .xlsx, .pptx, .pages) file inside the app container.
Present it via QLPreviewController with a QLPreviewControllerDataSource pointing at the local managed file URL.
Observe the preview.
Expected: Document renders in the in-app Quick Look preview.
Actual: Preview is blank/empty. No error is surfaced to the app; QLPreviewController reports success.
Questions for Microsoft
Is the out-of-process Quick Look renderer expected to be blocked under Policy managed apps, or is this a regression?
Is there a supported way to allow the Quick Look preview service to read managed files (e.g., an SDK-provided in-process preview, or an entitlement/hook for the renderer extension)?
Is there a public API to distinguish "All apps" from "Managed apps" at runtime? IntuneMAMPolicy.isAppSharingAllowed returns TRUE for both, so an app cannot tell them apart to choose a safe preview strategy.
When can we expect a fix if this is considered a bug?
Environment:
Intune App SDK (iOS) | 21.7.1 (revision d59aec5cba1c9b7200462c266b53fe7e6bd17840)
iOS version | iOS 26.0+
Xcode | 16.x / Swift 5.0
Device | Physical device, enrolled / MAM-managed
Integration | Swift Package Manager
App type | MAM-WE (MAM without enrollment)
Policy configuration
"Send org data to other apps" = Policy managed apps (also reproduces under variants: OS sharing, Open-In/Share filtering).
Not reproducible under All apps.
Summary
On iOS 26 with the SDK integrated, previewing a managed document with QLPreviewController displays a blank/empty preview for file types that Quick Look renders out-of-process (Office doc/docx/xls/xlsx/ppt/pptx, iWork pages/numbers/key).
QLPreviewController delegates rendering to a separate OS process (Quick Look preview service / WebContent renderer).
Because that helper process lives outside the app's managed container, the SDK's data-protection boundary blocks it from reading the managed file when "Send org data to other apps" is anything other than All apps → the preview is blank.
This matches the behavior tracked in #661.
Formats that render in-process (PDF via PDFKit, plain text via UITextView) are not affected
Steps to reproduce
Enroll device / apply a MAM policy with "Send org data to other apps" = Policy managed apps.
In the managed app, obtain a managed .docx (or .xlsx, .pptx, .pages) file inside the app container.
Present it via QLPreviewController with a QLPreviewControllerDataSource pointing at the local managed file URL.
Observe the preview.
Expected: Document renders in the in-app Quick Look preview.
Actual: Preview is blank/empty. No error is surfaced to the app; QLPreviewController reports success.
Questions for Microsoft
Is the out-of-process Quick Look renderer expected to be blocked under Policy managed apps, or is this a regression?
Is there a supported way to allow the Quick Look preview service to read managed files (e.g., an SDK-provided in-process preview, or an entitlement/hook for the renderer extension)?
Is there a public API to distinguish "All apps" from "Managed apps" at runtime? IntuneMAMPolicy.isAppSharingAllowed returns TRUE for both, so an app cannot tell them apart to choose a safe preview strategy.
When can we expect a fix if this is considered a bug?