Abstract: Persistence can be enabled in a volatile secure workspace. A management service may be configured to provide a managed application image containing a managed application to a host agent on a user computing device. When a secure workspace is deployed on the user computing device, the host agent can attach the managed application image to the secure workspace to create an injected volume. The host agent can also provide image details of the managed application image to a file system filter in the secure workspace. The file system filter may cause the managed application to be loaded from the managed application image and may then redirect I/O performed by the managed application to the injected volume which in turn will cause such I/O to be persisted in the managed application image. In this way, the managed application, any files it creates or modifies, and any state will be persisted even though the secure workspace is volatile.