Data Protection Framework Using Application Protection Policies - Microsoft Intune (2023)

As more and more organizations implement mobile device policies to access work or school data, preventing data breaches has become critical. Intune's data loss prevention mobile application management solution is Application Protection Policies (APP). Apps are the rules that ensure your organization's data remains secure or included in managed apps, whether the device is enrolled or not. For more information, seeOverview of Application Protection Policies.

When configuring an application protection policy, the number of different configurations and options allow organizations to tailor protection to their specific needs. Because of this flexibility, the permutation of policy settings required to implement a complete scenario may not be obvious. To help organizations prioritize their client endpoint hardening efforts, Microsoft introduces a new taxonomySecurity settings in Windows 10Intune utilizes a similar taxonomy for managing mobile applications in its application data protection framework.

The application data protection configuration framework is divided into three different configuration scenarios:

• Basic Enterprise 1 Data Protection: Microsoft recommends this setting as the minimum data protection configuration for enterprise devices.

• Level 2 Enhanced Enterprise Data Protection: Microsoft recommends this setting for devices where users have access to sensitive information. This setting works for most mobile users who access data at work or school. Certain controls may affect user experience.

  See Also

  What does the new Microsoft Intune suite include? |Technical goalsSet up account-based Apple user enrollment - Microsoft Intune

• Enterprise Data Protection Level 3: Microsoft recommends this setting for devices managed by organizations with larger or more complex security teams, or for specific users or groups with uniquely high risk (users who handle highly sensitive data, not Authorized disclosure can lead to major problems). Material damage to the organization). An organization that could be a target for a well-funded and experienced adversary should be targeted with this setup.

App Data Protection Framework Application Methodology

As with any new software, feature, or configuration implementation, Microsoft recommends investing in a ring approach to test validation before implementing an application's data protection framework. Defining deployment rings is often an isolated (or at least rare) incident, but IT should review these groups to ensure the order is still correct.

Microsoft recommends the following ring implementation methods for the APP data protection framework:

As shown in the table above, all changes to the application protection policy should be made first in a pre-production environment to understand the effect of the policy settings. After testing is complete, the changes can be moved to production and applied to a subset of production users, usually IT and other appropriate groups. Finally, the rollout to the rest of the mobile user community can be done. Deployment to production may take longer, depending on the scale of impact of the change. If there is no impact on users, the change should be implemented quickly, whereas if the change has an impact on users, the implementation may need to be slower because the change needs to be communicated to the user community.

Keep this in mind when testing changes to your applicationdelivery time.You can track the application delivery status for a specific user. For more information, seeHow to Monitor Application Protection Policies.

Individual app settings for each app can be verified on the device using Edge and a URLRelated: Intune Help.For details, seeCheck the client application protection logsyesAccess managed application logs using Edge for iOS and Android.

Configure the application's data protection framework

The following app protection policy settings must be enabled for applicable apps and assigned to all mobile users. For details about each policy setting , seeiOS App Privacy Policy SettingsyesConfigure the Android application protection policy.

Microsoft recommends that you review and categorize your usage scenarios, then use this level of guidance to provision users. As with any framework, settings may need to be tuned to the appropriate level based on the needs of the organization, as data protection requires an assessment of the threat environment, risk appetite, and impact on availability.

Admins can incorporate the following configuration levels into their ring deployment method for testing and production use by importing the exampleJSON template for configuring Intune app protection policiescheatPowerShell and Intune scripts.

Conditional Access Policy

Azure Active Directory Conditional Access Policies are required to ensure that only applications that comply with the application protection policies can access data in work or school accounts. These policies areConditional Access: Require Approval for Client Applications or Application Protection Policies.

VersionClient application or mobile application protection policy that requires approvalexistConditional Access: Require Approval for Client Applications or Application Protection PoliciesSteps to implement specific policies. Finally, apply the steps toBlock Legacy AuthenticationBlock iOS and Android apps using traditional authentication.

Applications to be included in the application protection policy

For each application protection policy, target the Core Microsoft Apps group, which includes the following applications:

• must
• stand out
• office
• a drive
• a note
• panoramic
• power point
• share point
• equipment
• I am doing
• word

Policies should include other Microsoft applications based on business needs, other third-party public applications that integrate the Intune SDK used in the organization, and line-of-business applications that integrate the Intune SDK.Intune SDK(or already wrapped).

Basic Enterprise Data Protection Tier 1

Level 1 is the minimum data protection setting for enterprise mobile devices. This setting replaces the need for a basic Exchange Online device access policy by requiring a PIN to access work or school data, encrypting work or school account data, and providing the ability to selectively delete data from school or work. However, unlike the Exchange Online device access policy, the following app protection policy settings apply to all apps selected in the policy, ensuring that data access is protected outside of mobile messaging scenarios.

Policies in Tier 1 enforce a reasonable level of data access while minimizing impact to users, and reflect the default data protection and access requirement settings when creating application protection policies in Microsoft Endpoint Manager.

data protection

access requirements

speech

Level 2 Enhanced Enterprise Data Protection

Level 2 is the standard data protection setting recommended for devices where users have access to more sensitive information. These devices are a natural target for today's businesses. These recommendations don't require a large number of highly skilled security professionals, so they should be within reach of most enterprise organizations. This setting extends the Tier 1 setup by restricting data transfer scenarios and requiring a minimum OS version.

Policy settings that apply to level 2 include all recommended policy settings from level 1, but only the following settings are listed that have been added or changed to allow more control and more complex configuration than level 1. While these settings may have a slightly higher impact on users or applications, implement a level of data protection more commensurate with the risks users face when accessing sensitive information on mobile devices.

data protection

speech

Advanced Enterprise Data Protection 3

Level 3 is the standard recommended data protection setting for organizations with large, complex security organizations or for specific users and groups who will be the only targets of adversaries. Such organizations are often the target of well-financed and experienced adversaries and as such should be subject to the additional restrictions and controls described above. This setting extends the Level 2 setup by limiting other data transfer scenarios, adding complexity to PIN setup, and adding mobile threat detection.

Policy settings applied to Layer 3 include all policy settings recommended for Layer 2, but only those listed below have been added or changed to allow more control and more complex configuration than Layer 2. These policy setting policies can have potentially significant implications. Impose a level of security on users or applications commensurate with the risk to the target organization.

data protection

access requirements

speech

Next step

Admins can incorporate the above configuration levels into their ring development approach for testing and production use by importing the exampleJSON template for configuring Intune app protection policiescheatPowerShell and Intune scripts.

see also

• How to Create and Deploy Application Protection Policies Using Microsoft Intune
• Microsoft Intune provides Android app protection policy settings
• Microsoft Intune offers iOS/iPadOS app privacy settings