Secure Exclaves: assess camera and microphone use at work
Apple’s technical note published today provides a starting point for reviewing camera and microphone use at work. For IT teams, the useful decision is which uses to allow, on which devices and with what evidence. Here is Underside’s proposed method.
1. What Apple describes
Apple presents Secure Exclaves as isolated environments for processing camera and microphone data. Ambient mode shares limited metadata; active mode allows full data with a secure indicator. Apple specifically names indicators on iPhone 18 Pro, iPhone 18 Pro Max, iPhone Duo and the camera on MacBook Neo. The note is not an announcement of an MDM setting.
2. Define the need before selecting hardware
We recommend starting with the business scenario: video meetings, voice commands, reception or a shared workstation. For each scenario, identify the people present, the service owner and the expected data. Separate a necessary function from a convenience users can disable. This record should help the business owner explain why the sensor is used, including in a room that visitors pass through.
3. Build a qualification matrix
Create a row for each model, operating system version, application and function tested. Link each announced capability to its official documentation before treating it as available across the fleet. Do not extrapolate Apple’s stated scope to other devices. Where support remains uncertain, mark it as pending verification and pause the decision to extend deployment.
4. Test the user journey and support
On a pilot device without sensitive data, test deliberate camera and microphone activation, permission refusal, closing the application and switching between users. Record the visible signal, functional result and support procedure. These tests assess your user journey; they do not prove internal silicon isolation. Avoid inferring a technical guarantee that the protocol does not measure.
5. What this changes in Belgium and France
For a small business, we suggest a simple record for each use, with an owner and an explicit decision. Mid-sized companies, large enterprises and public bodies can organise the same approach by site, business function and user population. Involve security, IT, business owners and the data protection officer where the project warrants it. For teams in Belgium, France or elsewhere in Europe, verify local availability of each product and service separately before purchasing; this guide assumes no commercial availability.
6. Underside analysis: connect architecture and governance
Our view is to treat this architecture as one element in the security assessment. The usage decision should also examine application permissions, business data flows and incident procedures. Ask the Jamf or MDM administrator to document only controls actually supported in your configuration; do not invent a supposed “Secure Exclaves” policy. Keep inventory, Apple references, pilot results and the owner’s decision together. A change committee can then distinguish the protection described by the vendor from the validation performed in your environment.
Continue with: Apple permissions and consent · Apple Intelligence MDM restrictions.
Source : Apple Security Research — Secure Exclaves and Ambient Sensing (2026-11-12).