Resolve accidental uploads to iCloud
Overview
Employees sign into Apple iCloud to take advantage of services like receiving iMessages on their devices, updating shared Notes, or syncing with family calendars. Unfortunately, doing so can make it easy to automatically (and accidentally) upload business files to a personal iCloud account. If you see file events involving an iCloud destination in Forensic Search or in alerts, this article helps you resolve such accidental uploads.
Affects
Users who are signed into iCloud and have accidentally uploaded business files to a personal account because the iCloud Drive app is enabled. These accidental uploads appear in Forensic Search as events to iCloud destinations and create alert notifications if you have an alert rule that monitors for iCloud uploads from endpoints.
This article does not apply to you if the iCloud Drive app is not enabled, you are not signed into iCloud, or you have not started to use iCloud. To check your iCloud status, go to your Apple ID or open System Preferences on Mac devices.
Before you begin
Copy the files stored in your Desktop and Documents folders, as well as all files stored in any other folders you accidentally synced to iCloud, to a temporary folder on your device (such as the Downloads folder).
To avoid losing important company data, be sure to copy all files to a temporary location before you begin. As part of the solution below, you'll delete the business files that were accidentally uploaded from your iCloud account. If you do not copy these files to a temporary location first, these files will be permanently deleted from your iCloud account and cannot be restored.
Solution
Step 1: Remove business files from iCloud
- To prevent data loss, make a backup copy of the files stored in your Desktop and Documents folders as directed above.
- Work with your security team to identify the company files that were accidentally uploaded to iCloud.
- Use a web browser to sign in to your personal iCloud account.
- Select iCloud Drive and review and delete all company-related files.
Step 2: Prevent business files from uploading to iCloud
To prevent accidental iCloud uploads from recurring, use one of the following options:
- Turn off the Desktop & Documents Folders option in iCloud. Use this option to prevent the accidental upload of files in the Documents and Desktop folders on the endpoint to iCloud while retaining access to other useful iCloud services.
- Turn off the iCloud Drive app in iCloud settings. Turning off the app disables it from connecting to iCloud, and prevents files from uploading to iCloud by keeping all files locally on the device. Other apps remain enabled and can connect to iCloud for data exchange and syncing.
- Disable iCloud entirely by signing out of the iCloud account. This method prevents files from automatically uploading to iCloud, but also disables all other iCloud services, such as shared notes, reminders, iMessages, Apple Pay, and so on.
Which option you select depends on your organization's needs, policies, and culture. You may also be able to disable accidental uploads to iCloud in your mobile device management (MDM) tool. Consult your MDM tool's documentation for details.
Option 1: Turn off folder access in iCloud
- Access your Apple ID or iCloud settings on your device.
- Change iCloud's options to turn off Desktop & Documents Folders.
- Copy the files from the temporary directory back to their original locations on your device.
Option 2: Turn off the iCloud Drive app
- Access your Apple ID or iCloud settings on your device.
- Change your iCloud settings to deselect the iCloud Drive app and turn it off.
- Copy the files from the temporary directory back to their original locations on your device.
Option 3: Disable iCloud by signing out
- On your device, sign out of iCloud.
- Copy the files from the temporary directory back to their original locations on your device.
External resources
Apple: