intune-app-protection

Name: intune-app-protection
Author: vinayaklatthe

161stars34forks

How to install intune-app-protection?

vinayaklatthe/microsoft-security-skills/intune-app-protection

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill intune-app-protection

Installs into the current project.

Summary

Guidance for Microsoft Intune app protection policies (MAM) — protecting corporate data inside mobile apps with or without device enrollment. Covers MAM-WE for BYOD vs APP on managed devices, data-relocation controls (cut/copy/paste, Save As, encryption), app PIN/biometric and of

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Intune - App Protection Policies (MAM)
2
3	Intune app protection policies (APP / MAM) protect organisational data inside apps at
4	the application layer, with or without device enrollment. They make BYOD safe by isolating
5	corporate data inside managed apps and enabling selective wipe of org data without touching
6	personal content.
7
8	## When to use
9	Protecting Microsoft 365 and Intune-SDK-enabled app data on mobile devices, especially
10	unmanaged / personal devices (MAM without enrollment, MAM-WE). Use this skill when full
11	device enrollment is undesirable or impractical.
12
13	Do not use this skill for full device management (`intune-device-mgmt`) or disk
14	encryption (`bitlocker-design`).
15
16	## Pick the protection model
17
18	\| Scenario \| Model \| Notes \|
19	\|---\|---\|---\|
20	\| BYOD - no enrollment \| MAM without enrollment (MAM-WE) \| Default for personal devices \|
21	\| Corporate-owned, managed \| APP on managed devices \| Layered on top of MDM \|
22	\| Mix of corporate + BYOD \| Both \| Same APP, different deployment scope \|
23	\| Frontline / shared device \| App protection + Shared Device mode \| Per-user data isolation \|
24	\| Strict regulated data \| APP + Conditional Access app filter \| CA-enforced gating \|
25
26	> Rule of thumb: if you want the user to keep their personal data and the device, but
27	> the company to keep its data, MAM-WE. APP without CA enforcement is optional; APP with CA
28	> "Require app protection policy" is enforced.
29
30	## Approach
31
32	1. Choose the model and target audience — MAM-WE for BYOD, APP on managed devices for
33	corporate. Both target users and groups, not devices. Per platform: iOS/iPadOS and
34	Android.
35	*Verify: APP assignment shows the right user groups; status report shows policy delivered
36	to the target population.*
37
38	2. Data protection settings — Restrict cut/copy/paste to managed apps; prevent "Save As"
39	to personal locations; restrict backup to iCloud/Google Drive; require encryption of
40	org data at rest in the app.
41	*Verify: testing on a personal device shows paste from Outlook → personal Notes is
42	blocked.*
43
44	3. Access requirements — Require app PIN (6 digits min) or biometric to open managed
45	apps; set offline grace period (typically 12-48 hours); block jailbroken / rooted
46	devices; minimum OS version.
47
48	4. Selective wipe — Use "wipe corporate data only" to remove org data from the app while
49	leaving personal data intact. Critical for BYOD departures.
50	*Verify: pilot wipe on a personal device removes Outlook/OneDrive corp data, keeps photos
51	and personal apps untouched.*
52
53	5. Combine with Conditional Access for enforcement — APP alone doesn't gate sign-in.
54	Create a CA policy with grant control Require app protection policy for the target
55	cloud apps (Exchange Online, SharePoint, Teams). This is the enforcement.
56	Verify: CA What If on Exchange from an unprotected app = blocked.
57
58	6. App configuration — Pair APP with app configuration policies for managed app
59	settings (Outlook signature, allowed account types).
60
61	## Guardrails
62	- MAM-WE protects data in supported apps only. Confirm the app is on the Intune-SDK /
63	approved-app list. An unsupported app = no protection.
64	- Communicate the user experience (PIN, restrictions) before rollout to reduce friction.
65	Users on BYOD will uninstall if surprised by a new PIN prompt.
66	- Combine with Conditional Access for enforcement; APP alone doesn't gate sign-in.
67	Without CA, users can use unmanaged Outlook and bypass APP.
68	- Offline grace period is a trade-off. Too short = users locked out on a flight; too
69	long = stale data stays on a lost device. 24-48 hours typical.
70	- Selective wipe is queued. Wipe initiates next time the user opens the app online. Not
71	instant - revoke sessions in parallel for high-risk departures.
72	- Don't run APP without app configuration. Default Outlook on BYOD allows personal
73	account; APP doesn't stop that. Configuration policy restricts to corp account only.
74
75	## Common anti-patterns
76	- "Deploy APP, expect data protection" - Without CA enforcement

People who liked this also viewed

6 picks

Type

intune-app-protection

161stars34forks

View on GitHub

How to install intune-app-protection?

vinayaklatthe/microsoft-security-skills/intune-app-protection

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill intune-app-protection

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Intune - App Protection Policies (MAM)
2
3	Intune app protection policies (APP / MAM) protect organisational data inside apps at
4	the application layer, with or without device enrollment. They make BYOD safe by isolating
5	corporate data inside managed apps and enabling selective wipe of org data without touching
6	personal content.
7
8	## When to use
9	Protecting Microsoft 365 and Intune-SDK-enabled app data on mobile devices, especially
10	unmanaged / personal devices (MAM without enrollment, MAM-WE). Use this skill when full
11	device enrollment is undesirable or impractical.
12
13	Do not use this skill for full device management (`intune-device-mgmt`) or disk
14	encryption (`bitlocker-design`).
15
16	## Pick the protection model
17
18	\| Scenario \| Model \| Notes \|
19	\|---\|---\|---\|
20	\| BYOD - no enrollment \| MAM without enrollment (MAM-WE) \| Default for personal devices \|
21	\| Corporate-owned, managed \| APP on managed devices \| Layered on top of MDM \|
22	\| Mix of corporate + BYOD \| Both \| Same APP, different deployment scope \|
23	\| Frontline / shared device \| App protection + Shared Device mode \| Per-user data isolation \|
24	\| Strict regulated data \| APP + Conditional Access app filter \| CA-enforced gating \|
25
26	> Rule of thumb: if you want the user to keep their personal data and the device, but
27	> the company to keep its data, MAM-WE. APP without CA enforcement is optional; APP with CA
28	> "Require app protection policy" is enforced.
29
30	## Approach
31
32	1. Choose the model and target audience — MAM-WE for BYOD, APP on managed devices for
33	corporate. Both target users and groups, not devices. Per platform: iOS/iPadOS and
34	Android.
35	*Verify: APP assignment shows the right user groups; status report shows policy delivered
36	to the target population.*
37
38	2. Data protection settings — Restrict cut/copy/paste to managed apps; prevent "Save As"
39	to personal locations; restrict backup to iCloud/Google Drive; require encryption of
40	org data at rest in the app.
41	*Verify: testing on a personal device shows paste from Outlook → personal Notes is
42	blocked.*
43
44	3. Access requirements — Require app PIN (6 digits min) or biometric to open managed
45	apps; set offline grace period (typically 12-48 hours); block jailbroken / rooted
46	devices; minimum OS version.
47
48	4. Selective wipe — Use "wipe corporate data only" to remove org data from the app while
49	leaving personal data intact. Critical for BYOD departures.
50	*Verify: pilot wipe on a personal device removes Outlook/OneDrive corp data, keeps photos
51	and personal apps untouched.*
52
53	5. Combine with Conditional Access for enforcement — APP alone doesn't gate sign-in.
54	Create a CA policy with grant control Require app protection policy for the target
55	cloud apps (Exchange Online, SharePoint, Teams). This is the enforcement.
56	Verify: CA What If on Exchange from an unprotected app = blocked.
57
58	6. App configuration — Pair APP with app configuration policies for managed app
59	settings (Outlook signature, allowed account types).
60
61	## Guardrails
62	- MAM-WE protects data in supported apps only. Confirm the app is on the Intune-SDK /
63	approved-app list. An unsupported app = no protection.
64	- Communicate the user experience (PIN, restrictions) before rollout to reduce friction.
65	Users on BYOD will uninstall if surprised by a new PIN prompt.
66	- Combine with Conditional Access for enforcement; APP alone doesn't gate sign-in.
67	Without CA, users can use unmanaged Outlook and bypass APP.
68	- Offline grace period is a trade-off. Too short = users locked out on a flight; too
69	long = stale data stays on a lost device. 24-48 hours typical.
70	- Selective wipe is queued. Wipe initiates next time the user opens the app online. Not
71	instant - revoke sessions in parallel for high-risk departures.
72	- Don't run APP without app configuration. Default Outlook on BYOD allows personal
73	account; APP doesn't stop that. Configuration policy restricts to corp account only.
74
75	## Common anti-patterns
76	- "Deploy APP, expect data protection" - Without CA enforcement

People who liked this also viewed

6 picks

Type