Thanks for all of this helpful information. Is it possible on iOS (not iPadOS, if it matters) to distinguish between Safari and Safari View Controller, for the purposes of filtering? For instance, is it possible, within the extension or via a profile, to specify that the filter only apply to com.apple.WebKit.Networking, but not com.apple.mobilesafari? I may be misunderstanding the networking layer.

Thanks for the helpful walkthrough. My goal is to filter in-app browsers, say in Maps, while making an exception for Safari. Therefore on the config profile, under "Content Filter", I checked "Filter Webkit Traffic" but did not check "Filter Socket Traffic". Below that I entered "com.apple.mobilesafari" and "allow". On my config profile, I added my distribution certificate, and specified that .p12 file in the Content Filter. In all this, filtering is still not happening. Any suggestions?