← Blog

Disabling iCloud Drive should not disable CloudKit access on macOS and iOS

Jaanus Kase
February 7, 2021

Among other things, Tact is a technical experiment: is it possible to build an app like Tact using iCloud as backend?

The answer so far seems to be mostly “yes”. There are many quirks and esoterics to be aware of and work around, so it’s not a super smooth developer experience. We’ll document some of those in this blog over time.

There is one major platform limitation I’ve run into: when you disable iCloud Drive, this also disables iCloud (CloudKit) access to apps like Tact, even though the UI indicates otherwise.

This unfortunately prevents some of our private beta users running Tact. I hope Apple will change the platform behavior in the future to something that makes more sense. The current combination of UI and API doesn’t.

Here’s the relevant portion of settings UI on iOS, where you turn iCloud on and off for various apps.

iCloud settings in iOS

Seems like a pretty clear UI. You can turn iCloud on and off individually for system apps, iCloud Drive, and third-party apps like our CloudKitAccess test app.

However, when you turn off iCloud Drive, this also disables CloudKit access for the CloudKitAccess example app and any other third-party apps, even though the UI indicates otherwise.

What do we mean by disabled access? Make a simple test app, configure it with a CloudKit container, and have this piece of code:

CKContainer.default().accountStatus { status, error in
	print("CK account status: \(status.rawValue), error: \(String(describing: error))")
}

With all accesses enabled, the status is reported as 1 (available) as expected. If you turn iCloud Drive off in this UI, make no other changes, and run the app with this code, the status is 3 (noAccount). Other CloudKit API-s also report that there’s no access to CloudKit container.

Same story on macOS. The settings UI has a different form factor, but all the behavior is the same.

“What’s the big deal? Just turn on iCloud Drive then?” you might ask. And it’s a fair suggestion. Except there are cases where you can’t do that. Case in point: you might have a company-issued laptop with iCloud Drive disabled by system policy. Yet there are not many other restrictions and you are free to install and run third-party apps like Tact. (Not a hypothetical case. We have a private beta member exactly in this situation.)

It makes perfect sense for companies to disable iCloud Drive if they choose to do that, yet leave the rest of iCloud access working. I don’t see why these things should be connected: indeed, the UI makes it look like they aren’t. The UI feels correct, and the system behavior feels wrong.

We hope that Apple will change this behavior in the future, ideally by making iCloud Drive and third-party app iCloud access configuration independent from one another.

If any Apple folks would like to take a look, or if anyone else would like to refer to an existing Feedback item, I filed FB8994677 about this.