Staff want to check email and open files on their own phones. You want to keep company data safe. App protection policies in Microsoft Intune let you do both, by protecting the data inside apps such as Outlook, Teams and OneDrive without taking control of the whole device.
What are app protection policies?
An app protection policy is a set of rules that applies to Microsoft 365 mobile apps. It controls how company data can be accessed, stored and shared inside those apps. Because the protection travels with the app, it works on personal devices that you do not manage, which makes it ideal for bring-your-own-device (BYOD) setups.
Why businesses need them
- Lost or stolen phones. Company data can be protected with a PIN and removed remotely.
- Data leaking to personal apps. Stop staff copying work content into personal email, messaging or cloud storage.
- Privacy for staff. You protect company data without seeing or controlling personal photos, apps and messages.
- Compliance. Show that mobile access to business information is controlled.
How they work in Microsoft Intune
You create a policy in Intune for iOS and Android, choose which apps it covers, and assign it to groups of users. When a person opens a protected app and signs in with their work account, the policy is applied to the company data in that app. Combined with Conditional Access, you can require that only apps protected by a policy are allowed to reach Microsoft 365 data.
Key settings to turn on
- Require a PIN or biometric to open work data in the app.
- Encrypt company data stored in the app.
- Block copy, cut and paste of work data into personal apps.
- Block saving company files to personal storage and personal backups.
- Restrict sharing of work content to other managed apps.
- Require a minimum operating system and app version.
- Block access on jailbroken or rooted devices.
- Automatically wipe company data after a period offline or on non-compliance.
Best practices for implementation
- Decide who is covered and which apps they use.
- Start with a pilot group and gather feedback.
- Choose a security level that balances protection with ease of use.
- Pair the policy with a Conditional Access rule that requires an approved, protected app.
- Explain clearly to staff what the company can and cannot see on their phone.
- Review reports and adjust settings regularly.
The business impact
Done well, app protection policies let your team work from anywhere on the devices they prefer, while keeping your data under control. It is one of the most cost-effective mobile security measures for small and medium businesses.
Key takeaways
- App protection policies protect company data inside Microsoft 365 mobile apps without taking control of the whole device.
- Because the protection travels with the app, they suit bring-your-own-device setups.
- Pair the policy with a Conditional Access rule that requires an approved, protected app.
App protection policies: frequently asked questions
What are app protection policies?
A set of rules, created in Microsoft Intune, that applies to Microsoft 365 mobile apps and controls how company data can be accessed, stored and shared inside them. Because the protection travels with the app, it works on personal devices that you do not manage.
What settings should I turn on?
Require a PIN or biometric, encrypt company data in the app, block copy, cut and paste into personal apps, block saving to personal storage and backups, restrict sharing to other managed apps, require a minimum operating system and app version, block jailbroken or rooted devices, and automatically wipe company data after a period offline or on non-compliance.
Will staff privacy be affected?
You protect company data without seeing or controlling personal photos, apps and messages, which is why app protection policies suit personal phones.
Related reading: Microsoft Intune consulting.
Total Solutions IT sets up Intune and app protection for Australian businesses. Call 02 6061 4222 to talk it through.
