Nowadays users want to make use of other platforms to be productive besides the managed company workstation. They want the liberty to use their handeld devices like smartphones or tablets, to check Teams messages, review a document, or respond to an e-mail from wherever they happen to be. That flexibility comes with challenges for IT admins.
Firstly, corporate data following users across personal devices must be handled in a secure manner. This is where Intune’s app protection policies come into play. App protection policies provide administrators with the necessary tools to ensure corporate data used in apps like Teams or Outlook gets encrypted and is stored separately from private data. Furthermore, app protection policies can impose restrictions on actions on company data within protected apps, e.g. restrict copy-pasting corporate data to personal apps. When a device must be retired, IT admins can wipe corporate data remotely from the device without touching anything personal.
A second challenge follows from users bringing their own devices into the corporate environment. Unlike managed corporate devices, personal devices are not part of an IT admin’s hardware inventory. There is no visibility into the make and model of the smartphones or tablets users are connecting with, and no certainty that operating system versions are still actively supported by the vendor. This makes it harder to assess whether a devices meet the security baseline an organisation expects.
Limited visibility in Intune’s native reporting
Intune does offer built-in reporting on app protection policies, but its native capabilities have serious limitations. The App protection status report consists of nothing more than a list of records of individual apps each user has accessed from a specific device hitting a specific app protection policy.
This report does not provide administrators with an easy general overview of the broader picture of the devices being used to access the environment. Understanding which device types, platforms, or OS versions are present across the user base requires additional effort that the native report does not readily support.
What to expect in this series
This series of blog posts will provide IT admins a high-level overview of the capabilities of app protection policies to restrict access to corporate data from devices that do not meet company security baseline in the first place. Through the use of data exposed by Graph we will gain valuable insights which will make app protection policy maintenance easier.
The first post covers the basics of app protection policies and how device requirements can be configured to control which devices are allowed to launch protected apps.
The second post takes a closer look at what data the Graph exposes around app protection.
From there, the series zooms in on Apple mobile devices specifically, examining what additional insights Apple’s own data can provide in managing iOS and iPadOS devices.
A fourth post will address how device requirements can be tightened to further restrict access.
The series concludes with a tool built to bring it all together — combining data from Microsoft Graph with data from Apple’s and Google to give administrators a clearer picture of their environment than Intune’s native reporting alone provides.