How to enable iOS unmanaged apps to read managed contacts & write unmanaged contacts without compromising security using Microsoft Intune

The contacts saved in Exchange is considered managed contacts. with iOS 12 onwards managed contacts are not visible from unmanaged Apps.

As stated in Apple Article (https://support.apple.com/en-au/HT208749)  iOS 12, you can use MDM to make the following exceptions to this policy:

• Allow unmanaged apps to access managed contacts

• Allow managed apps to save contacts to the local Contacts app

Microsoft Intune have introduced new feature, but it has pre-requisite to "Viewing corporate documents in unmanaged apps" to write contact to unmanaged app and "Viewing non-corporate documents in corporate apps" to read managed contacts in unmanaged app. 

This can be security issue for many organisations. However, you can enable this without changing the parent policy by following trick!

1. Go to iOS restriction settings in Intune, go to 'App Store, Doc Viewing, Gaming controls'.
   
2. As highlighted above 'Allow managed apps to write contacts to unmanaged contacts accounts (supervised only)' and 'Allow unmanaged apps to read from managed contacts accounts (supervised only)' options are disabled without configuring parent settings. 
3. Click on Block -  'the Viewing corporate documents in unmanaged apps'.
   
4. Click on 'Allow -  'Allow managed apps to write contacts to unmanaged contacts accounts'.
5. Change 'Viewing corporate documents in unmanaged apps' to Not configured. you will notice the allow managed apps to write contacts does not change as shown in screenshot below.
   
6. Assign policy to the test devices, monitor per-settings status.