How to Block Gmail Attachment Downloads on iOS Using JumpCloud MDM?

Deploy this custom MDM configuration via JumpCloud

Prerequisites

• The iOS devices must already be enrolled in JumpCloud MDM.

• For the Web Filter to work seamlessly and be non-removable by the user, the devices should ideally be Supervised (though it will still install on non-supervised devices).

The Custom MDM Profile (XML)

You can save the code below as a file named gmail_app.mobileconfig.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" 
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>

  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadType</key>
      <string>com.apple.applicationaccess</string>

      <key>PayloadVersion</key>
      <integer>1</integer>

      <key>PayloadIdentifier</key>
      <string>com.company.restrict.openin</string>

      <key>PayloadUUID</key>
      <string>9F4A1234-ABCD-4567-8901-EXAMPLE12345</string>

      <key>PayloadDisplayName</key>
      <string>Managed App Attachment Restrictions</string>

      <!-- Restrict Open In -->
      <key>allowOpenFromManagedToUnmanaged</key>
      <false/>

      <key>allowOpenFromUnmanagedToManaged</key>
      <true/>

      <!-- Restrict saving to Files -->
      <key>allowManagedAppsCloudSync</key>
      <false/>

    </dict>
  </array>

  <key>PayloadType</key>
  <string>Configuration</string>

  <key>PayloadVersion</key>
  <integer>1</integer>

  <key>PayloadIdentifier</key>
  <string>com.company.mobileconfig.restrict.gmail.attachments</string>

  <key>PayloadUUID</key>
  <string>12345678-ABCD-1234-ABCD-1234567890AB</string>

  <key>PayloadDisplayName</key>
  <string>iOS Attachment Restrictions (Managed Gmail)</string>

  <key>PayloadOrganization</key>
  <string>Your Company Name</string>

</dict>
</plist>

Step 1: Create the Policy

1. Log in to the JumpCloud Admin Portal.

2. Navigate to DEVICE MANAGEMENT > Policy Management.

3. Click the (+) Plus button to create a new policy.

4. Select the iOS tab.

5. In the search bar, type Custom and select MDM Custom Profile.

   • Note: If you don't see this exact name, look for "iOS Custom Configuration".

Step 2: Upload Your File

1. Policy Name: Give it a clear name, e.g., "Download restriction on Gmail App in iOS" .

2. Upload Profile: Click Upload File and select the gmail_app.mobileconfig file you just saved.

Step 3: Assign to Devices

1. Click the Device Groups tab (within the policy window).

2. Select the group of iOS devices you want to lock down (e.g., "Corporate iPhones").

   • Tip: It is highly recommended to test this on a "Test Group" with just one device first.

3. Click save.

Step 4: Verification

After saving, the policy will be queued.

1. On the iOS device, go to Settings > General > VPN & Device Management.

2. You should see the profile appear shortly (devices usually sync with JumpCloud every 15-60 minutes, or you can force a sync).

3. Click on the profile to view details. You should see "Example Restriction Profile" listed.

FAQ

1) How can I block Gmail attachment downloads on iOS devices?

You can block Gmail attachment downloads by deploying a custom iOS MDM configuration profile that restricts “Open In” and disables managed app cloud sync using JumpCloud MDM.

2) Does this restriction work only on supervised iOS devices?

Supervised devices provide stronger enforcement and prevent user removal, but the profile can still be installed and function on non-supervised iOS devices.

3) What does the “Open In” restriction prevent on iOS?

It prevents users from opening attachments from managed apps like Gmail into unmanaged apps, reducing the risk of data leakage to personal storage or apps.

4) Can users still view attachments inside the Gmail app?

Yes. Users can view attachments within the managed Gmail app, but downloading or exporting them to Files or unmanaged apps is blocked.

5) How do admins verify the Gmail restriction policy is applied?

On the device, navigate to Settings > General > VPN & Device Management and confirm the custom restriction profile is installed and active.