{"id":72091,"date":"2026-07-07T08:34:25","date_gmt":"2026-07-07T15:34:25","guid":{"rendered":"https:\/\/cirasync.com\/?p=72091"},"modified":"2026-07-07T08:34:25","modified_gmt":"2026-07-07T15:34:25","slug":"carddav-contact-sync","status":"publish","type":"post","link":"https:\/\/cirasync.com\/de\/blog-articles\/carddav-contact-sync","title":{"rendered":"How Enterprise IT Teams Deliver Corporate Contacts to Managed iPhones Without Installing an App\u00a0"},"content":{"rendered":"

You manage 2,000 iOS devices across a distributed financial institution, and every one of them needs\u00a0accurate, up-to-date corporate contacts. The obvious fix, a third-party sync app on each phone, requires broad Exchange Online permissions you cannot safely grant at scale. The fallback most teams settle for is manual. There is a better path.<\/span>\u00a0<\/span><\/p>\n

CiraSync\u00a0<\/span>Mobile Direct<\/span><\/a>\u00a0now supports\u00a0Microsoft Intune and Workspace ONE\u00a0alongside SOTI,\u00a0Jamf,\u00a0Mosyle, and Sophos\u00a0for\u00a0CardDAV-based contact delivery to managed iOS devices. No app installs\u00a0on employee\u00a0phones. No end-user configuration. This is how enterprise IT teams solve corporate contact delivery without creating new governance problems.<\/span>\u00a0<\/span><\/p>\n

TL;DR<\/span><\/b>\u00a0<\/span><\/p>\n

CiraSync\u00a0Mobile Direct now supports\u00a0Microsoft Intune and Workspace ONE\u00a0for\u00a0CardDAV-based contact delivery to managed iOS devices. No app installs on employee phones. No end-user configuration.\u00a0CardDAV\u00a0is an open, HTTP-based protocol built natively into Apple iOS. IT deploys a configuration profile through its existing MDM platform, and contacts appear automatically in the native iOS Contacts app.\u00a0CiraSync\u00a0connects to the Microsoft 365 source once, at the tenant level, through the Microsoft Azure Consent Framework. No passwords are sent to\u00a0CiraSync, and the consent token cannot be reused by any other application. Contacts\u00a0synced\u00a0this way are classified as managed contacts within iOS. Because the\u00a0CardDAV\u00a0account\u00a0rides on\u00a0an MDM configuration profile, it is removed when that profile is removed, either on demand by IT or automatically when a device is unenrolled or retired. The deployment supports users without Exchange mailboxes\u00a0and\u00a0mixed device populations.\u00a0<\/span>\u00a0<\/span><\/p>\n

<\/span>Why Third-Party Apps Create Enterprise Governance Problems<\/span><\/b>\u00a0<\/span><\/span><\/h2>\n

Most contact sync applications that live on the phone require Exchange Online permissions that are all or nothing. You cannot grant sync access without also granting broader access that creates compliance exposure,\u00a0and for\u00a0firms under SEC, FINRA, or GDPR oversight, that is an untenable position.<\/span>\u00a0<\/span><\/p>\n

The core issue is permission scope. On-device apps typically request application-level permissions across the entire Exchange Online tenant, and once granted, those cannot be selectively revoked without\u00a0breaking\u00a0the service. They also pass user tokens to external systems and give IT no reliable way to confirm which devices hold which\u00a0version of the directory. Regulated firms are moving away from on-device contact apps for exactly these reasons.<\/span>\u00a0<\/span><\/p>\n

<\/span>What CardDAV\u00a0Is and Why It Solves This<\/span><\/b>\u00a0<\/span><\/span><\/h2>\n

CardDAV\u00a0is an open, HTTP-based protocol built natively into Apple iOS. It\u00a0operates\u00a0at the operating system level, so there is no app to install and no user configuration. IT deploys a configuration profile through its existing MDM platform, and contacts appear automatically in the native iOS Contacts app.<\/span>\u00a0<\/span><\/p>\n

The architecture is what makes this work for regulated environments.\u00a0CiraSync\u00a0connects to the Microsoft 365 source once, at the tenant level, through the Microsoft Azure Consent Framework, to read the\u00a0Global Address List\u00a0or shared mailbox\u00a0you choose. No passwords are sent to\u00a0CiraSync, and the consent token cannot be reused by any other application. Contact data then reaches each device over a managed, encrypted\u00a0CardDAV\u00a0connection\u00a0that passes no user\u00a0OAuth\u00a0tokens\u00a0down to the device or to any on-device app.\u00a0and needs no Exchange permissions on the device side.<\/span>\u00a0<\/span><\/p>\n

Contacts\u00a0synced\u00a0this way are classified as managed contacts within iOS, unlike on-device apps that write to the user\u2019s primary container. Because the\u00a0CardDAV\u00a0account\u00a0rides on\u00a0an MDM configuration profile, it is removed when that profile is removed, either on demand by IT or automatically when a device is unenrolled or retired. The directory stays under IT control for its full lifecycle.<\/span>\u00a0<\/span><\/p>\n

<\/span>How MDM\u00a0Deployments Work<\/span><\/b>\u00a0<\/span><\/span><\/h2>\n

The deployment model is built for scale. IT enables Mobile Direct inside a\u00a0CiraSync\u00a0Sync Tunnel, downloads a pre-configured profile, and deploys it as a custom configuration profile through Intune or\u00a0Workspace\u00a0ONE. The profile carries everything the device needs, including the\u00a0CardDAV\u00a0principal URL, sync tunnel details, user Object ID, and secure access credentials, and it installs silently on targeted devices.<\/span>\u00a0<\/span><\/p>\n

Freshness\u00a0runs on\u00a0two cycles, and it is worth being precise about both.\u00a0CiraSync\u00a0caches the directory from the source on a\u00a0schedule you\u00a0set:\u00a0daily, weekly, or monthly. Each device then pulls from that cache on its own interval,\u00a0following the iOS Fetch New Data setting (15, 30, or 60 minutes, manual, or Push where supported).\u00a0A source change reaches devices on the next caching cycle, not within 15 minutes, so match the source schedule to how quickly your directory\u00a0actually changes. If someone edits or\u00a0deletes\u00a0a synced contact on the phone, the next cycle restores the authoritative record without IT intervention.<\/span>\u00a0<\/span><\/p>\n

<\/span>Governance, Compliance, and Data Residency\u00a0<\/strong><\/span><\/h2>\n

Where the data sits matters, and Mobile Direct is explicit about it. To serve contacts over\u00a0CardDAV,\u00a0CiraSync\u00a0caches the selected directory in\u00a0CiraSync\u00a0Cloud, which means contact data is processed outside your Microsoft 365 tenant.<\/span>
\nWhat you get in return:<\/span>\u00a0<\/span><\/p>\n