Back up managed Apple devices
Overview
Migrating users and their data to a new iPhone, iPad, or Apple Vision Pro is a common workflow in many organizations. This migration often involves a device management service.
Migrating users and their data to a new iPhone, iPad, or Apple Vision Pro is a common workflow in many organizations. This migration often involves a device management service—which may also link to Apple School Manager or Apple Business. You can use this workflow for organization-owned devices or devices that the user owns. A backup and restore flow helps to avoid data loss and reduces user disruption when replacing a device.
Depending on your deployment model, there are different approaches to backing up and restoring devices. Also, users might be using their personal Apple Account, your organization’s Managed Apple Account, or—in the case of account-driven enrollments—possibly both. See User Enrollment and device management. If you’re migrating to a different device management service, see Migrate managed devices to another device management service.
Note: Use Apple Configurator for Mac when manually preparing, updating, or backing up Apple devices instead of the Apple Devices app.
What does an iPhone, iPad, or Apple Vision Pro backup include?
Backups include information such as the layout of the Home Screen, app data, device settings, and photos and videos (if iCloud Photos isn’t used). Backups don’t include apps and media that users synced from their computer or stored in iCloud. Backups can also be unencrypted or encrypted.
Encryption determines how data is protected and how much sensitive data is included. Unencrypted backups never include:
Any saved passwords
Call history
Health data
Website history
Wi-Fi settings
Organizations that need full data protection during backup and restore should require encrypted backups using the force encrypted backups restriction.
How are backups created?
You can create backups using any of the following methods:
iCloud Backup: Requires a personal Apple Account or a Managed Apple Account and is encrypted by default. iCloud Backup works only when the device is locked, is connected to a power source, and has Wi-Fi access to the internet.
Finder: Doesn’t require a personal Apple Account or a Managed Apple Account and is unencrypted by default.
Apple Configurator for Mac: Doesn’t require a personal Apple Account or a Managed Apple Account and is unencrypted by default.
Backups that use Apple Configurator for Mac
You can manually set up one iPhone or iPad the way you want it, back it up using Apple Configurator for Mac, and then restore that backup to other devices.
Important: Backups created when a user is signed in with a personal Apple Account or a Managed Apple Account can contain private information—such as app data, account and password information, and browser history. Before backing up a device, review the device’s content for any information you don’t want restored to other devices.
Backup restrictions
iOS and iPadOS support various restrictions to manage how backups are being stored and what data they contain:
iCloud Backup: Turns off iCloud Backup on supervised devices.
Force encrypted backups: If set, backups created using the Finder or Apple Configurator are encrypted.
Backup proprietary in-house books: Books distributed by the organization aren’t included in the backup.
Management configuration in backups on devices with iOS 27, iPadOS 27, and visionOS 27
On devices with iOS 27, iPadOS 27, visionOS 27, backups don’t include device management information such as the enrollment profile, management configuration, and supervision status. Prior to those operating system versions, an encrypted backup of a device enrolled using profile-based Device Enrollment or Automated Device Enrollment included the management configuration. This configuration describes, among other things, whether a device is supervised or a Shared iPad. It also contains configuration profiles and their associated data.
Management configuration in backups on devices with iOS 26, iPadOS 26, visionOS 26, or earlier
When you create an encrypted backup of a device enrolled using profile-based Device Enrollment or Automated Device Enrollment, the backup includes the management configuration. This configuration describes, among other things, whether a device is supervised or a Shared iPad. It also contains configuration profiles and their associated data.
Managed apps
Apps that you install using a device management service are called managed apps, and you can assign them to a device, a personal Apple Account, or a Managed Apple Account. When you install a managed app, the enrollment method determines whether the managed app stays on the device after it unenrolls from a device management service. When you remove the app, you also remove its data.
Profile-based Device Enrollment and Automated Device Enrollment: The device management service determines whether managed apps get removed.
Account-driven enrollments: The device management service always removes managed apps.
A device management service can also determine for each managed app whether its data is included in a backup. The app itself isn’t part of the backup and you need to install it after restoring the backup. For more information on managed apps, see Distribute managed apps.
Managed books
You can use a device management service to distribute EPUB books and PDFs that you create. If you do, the device management service can prevent the backup from including those managed books.
Backups for User Enrollment and account-driven Device Enrollment
Account-driven enrollments require a Managed Apple Account. In this deployment model, a user may also be signed in with their personal Apple Account. Backups using a personal Apple Account behave as described above. A backup taken with a Managed Apple Account contains only managed app data and can’t be used to fully restore a device.