---
title: "Preventing data transfer to iCloud Drive"
slug: "preventing-data-transfer-to-icloud-drive"
updated: 2026-11-05T14:30:37Z
published: 2026-11-05T14:30:37Z
canonical: "docs.trellix.com/preventing-data-transfer-to-icloud-drive"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Preventing data transfer to iCloud Drive

Monitors and blocks classified content copied, uploaded, or synchronized to iCloud Drive storage on macOS devices. This feature prevents unauthorized exfiltration, tracks data movement to enforce corporate security policy compliance.

Trellix DLP Endpoint for macOS enforces protection only on files in an unsaved or draft state during iCloud Drive synchronization. The software does not intercept files already saved to the local device through this mechanism.

## Benefits

- Prevent data exfiltration: Block unauthorized file transfers to iCloud Drive storage accounts to ensure corporate files remain in the organization
- Enforce compliance: Monitor data movement to track the movement of corporate files

## Task

### Create the iCloud Drive protection rule

1. In Trellix ePO, go to **Menu → Data Protection → DLP Policy Manager.**
2. Select the **Rule Sets** tab.
3. Open an existing rule set, or select **Actions → New Rule Set.**
4. Under **Actions**, select **New Rule → Cloud Protection.**
5. Enter a unique rule name and set the rule status to **Enabled.**
6. In the **Enforce On** section, select **Trellix DLP Endpoint for Mac OS X** to enforce the rule on macOS machines.
7. On the **Condition** tab:
  1. Select the needed classifications or definitions.
  2. In the **and top-level Subfolder name**, specify the subfolder name. For more information, see section ***File interception behavior during iCloud synchronization.***
  3. Select **iCloud** in the **Cloud Service** field.
8. (Optional) On the **Exceptions** tab, configure exceptions by selecting **Actions → Add Rule Exception.**
9. On the **Reactions** tab, configure the action for matching content (for example, **Block**, **Block with Justification**, or **Monitor**).
10. Select **Save** and then apply policy.

## Apply policy changes

1. Go to **Menu** → **Systems** → **System Tree**.
2. Select the checkbox of one or more systems that you want to assign the policy to.
3. Click **Wake Up Agents** to push the policy to Trellix DLP endpoints immediately. The **Wake Up Trellix Agent** window opens.
4. Next to **Wake-up call** type, select whether to send an **Agent Wake-Up Call** or a **SuperAgent Wake-Up Call**.
5. Accept the default Randomization (0–60 minutes) or type a different value. If you type 0, agents respond immediately.
6. Click **OK** to send the wake-up call to the endpoints.

Or, you can use the **Break inheritance and assign the policy and settings below** option to push the policy.

For information, see [Assign and push a policy to a system](https://docs.trellix.com/data-and-email/docs/assign-and-push-a-policy-to-a-system-2).

## File interception behavior during iCloud Drive synchronization

Trellix DLP Endpoint for macOS monitors files syncing to iCloud Drive based on their save state and directory location.

iCloud application synchronization enables seamless cross-device collaboration. Trellix DLP Endpoint evaluates and enforces policies on these files differently depending on whether an item is an unsaved draft or a saved local file.

### Unsaved drafts versus local file states

- **Draft and unsaved files:** When a user creates a new document in an iCloud-enabled app with syncing turned on, the app automatically places an untitled draft in its iCloud Drive container before the user explicitly saves it locally. As iCloud attempts to synchronize this draft across devices, Trellix DLP Endpoint inspects the content. If classified or sensitive data is detected, the agent intercepts the synchronization and enforces the configured policy action (such as blocking or quarantine).
- **Local file saves:** If a document is saved strictly to a local directory outside the iCloud Drive hierarchy, it does not traverse the iCloud sync pipeline. Consequently, it remains outside the scope of iCloud-specific protection rules.

# Configuring iCloud sync subfolder paths

To apply DLP protection rules to iCloud synchronization workflows, configure the designated subfolder paths as outlined below.

### User-created subfolders in iCloud Drive

For custom subfolders created directly in the root of iCloud Drive, use the following directory format:

`None~/Library/Mobile Documents/com~apple~CloudDocs/<MySubFolder>/`

### Application-specific iCloud sync folders

iCloud-compatible macOS apps generate dedicated default containers inside `~/Library/Mobile Documents/`. Typical system paths include:

- **Numbers:** `~/Library/Mobile Documents/com~apple~Numbers/Documents`
- **Pages:** `~/Library/Mobile Documents/com~apple~Pages/Documents`

**Important:** When defining DLP rules for application-specific sync paths, the path must point to a **user-created subfolder** within the app's directory, rather than the root app container itself.

- **Correct:** `~/Library/Mobile Documents/com~apple~Numbers/MySubFolder/` *(Targets the user-created subfolder within the app container.)*
- **Incorrect:** `~/Library/Mobile Documents/com~apple~Numbers/` *(Targeting the base container directly will prevent the rule from triggering as expected.)*