Configure Your Org to Allow Images and Other Content When Using iOS Mobile App on iOS 14+

My Domain Name Requirements

A My Domain name must be set and deployed.


XSS and Content Sniffing Protection

Ensure the following settings are enabled in Session Settings:

After all of the above conditions are met, images will load successfully for users accessing Salesforce using our Mobile app on iOS 14+. Experience Builder will also open successfully. For users using earlier versions of iOS, image loading and Experience Builder will continue to work as before.


Visualforce in Page Layouts in Lightning Experience

If you use Lightning Experience and have Visualforce pages embedded within page layouts, additionally enable the Enhanced Domains setting:

1. From Setup, in the Quick Find box, enter My Domain, and then select My Domain.
2. Under My Domain Details, select Edit.
3. If more suffixes are available for your org’s My Domain, a suffix dropdown list appears. Enhanced domains can only be enabled for the Standard (my.salesforce.com) suffix.
4. Select Use enhanced domains.

Uncheck "Include the instance name in Visualforce URLs when third-party cookies are blocked" while the enhanced domains are not available to production till Mar 2021 to address the issues related "To unblock third-party content for the Salesforce app only "for iOS (ITP).

1. From Setup, in the Quick Find box, enter My Domain, and then select My Domain.
2. Edit
3. Uncheck "Include the instance name in Visualforce URLs when third-party cookies are blocked"

Please see: Get Ready for Changes to Apple’s Privacy Policy in Spring '21 Release Notes

Note: existing integrations that expect visualforce.com hostnames will need to turn off the "Include the instance name in Visualforce URLs when third-party cookies are blocked" setting, though ITP also needs to be turned off in Safari to work with visualforce.com. If integration works with either visual.force.com or visualforce.com, then keeping "Include the instance name in Visualforce URLs when third-party cookies are blocked" on generally allows ITP to be enabled in iOS and Safari.

These help article links could also be helpful.

Enable Enhanced Domains
https://help.salesforce.com/articleView?id=sf.domain_name_enhanced_enable.htm&type=5

What Determines Your URL Formats?
https://help.salesforce.com/articleView?id=sf.domain_name_url_formats_what_determines.htm&type=5


Third-Party Canvas Apps

If you experience issues with content loading in your third-party canvas applications, your third-party developers need to update those applications. Read more about developing Canvas applications that don’t rely on cookies in this Release Note: 
Get Ready for Changes to Apple’s Privacy Policy


Restore Behavior of Earlier Versions of Safari

To have Salesforce's features work as they had in earlier versions of iOS, you can modify the settings of the Salesforce App. The following configuration works regardless of whether the aforementioned workarounds are activated in your org. Keep in mind that modifications to  settings affect all websites included in the Salesforce app, not just the Salesforce authored experience. Please ensure that your organization's Information Technology policies allow this type of change before proceeding.
 

First, for Safari in iPadOS:

• Go to Settings > Safari.
• Turn off "Prevent Cross-Site Tracking" within Safari's settings.

Then, for Salesforce App in iOS and iPadOS:

• Go to Settings > Salesforce.
• Turn on "Allow Cross-Website Tracking." 

Salesforce is actively exploring additional options and will update this article as more information becomes available.