MT.1239 - Ensure iOS app protection policy keeps organization data inside managed apps.
Overview
Ensure at least one assigned iOS app protection policy keeps organization data inside managed apps.
This is the control a device compliance policy cannot provide. A tenant can require a compliant, passcode-protected, up-to-date iPhone and still let a user forward an attachment from Outlook into a personal cloud drive, paste a customer list into a note-taking app, or let iCloud back the whole mailbox up to a personal Apple account. Compliance evaluates the device; app protection evaluates what the app may do with the data.
Four settings decide whether organization data can leave the managed boundary:
- Send org data to other apps (
allowedOutboundDataTransferDestinations) must be Policy managed apps or None, not All apps. - Cut, copy and paste with other apps (
allowedOutboundClipboardSharingLevel) must not be Any app. - Save copies of org data (
saveAsBlocked) must be Block. - Backup org data to iTunes and iCloud backups (
dataBackupBlocked) must be Block.
Any one of them left open is a route out, so all four are read from the same policy.
Policies that are not assigned to any group are reported by this test but do not count towards a pass, because an app protection policy with no assignment is never applied to a user.
Remediation action
- Navigate to the Microsoft Intune admin center.
- Go to Apps > App protection policies.
- Select an existing iOS policy, or select + Create policy and choose iOS.
- Under Data protection > Data transfer, set Send org data to other apps to Policy managed apps.
- Set Save copies of org data to Block (add only the organization locations you need under Allow user to save copies to selected services).
- Set Cut, copy and paste with other apps to Policy managed apps or Policy managed apps with paste in.
- Set Backup org data to iTunes and iCloud backups to Block.
- On the Assignments tab, assign the policy to the user groups whose apps hold organization data.
- Select Next and then Create or Save.
The Intune data protection framework publishes these values as part of its enterprise basic, enhanced and high data protection levels; the related link below gives the full set per level.
Related links
- Microsoft Learn - Data protection framework using app protection policies
- Microsoft Learn - iOS app protection policy settings
- Microsoft Learn - Apps protected by Intune
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1239 |
| Severity | Medium |
| Suite | Maester |
| Product | Intune |
| Feature | App protection |
| Area | Data protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1567.002 Exfiltration to Cloud Storage, T1115 Clipboard Data |
| Supports controls | nist-800-53-r5:AC-4, nist-800-53-r5:AC-19 |
| PowerShell test | Test-MtIosAppProtectionDataTransfer |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/maester/intune/Test.MT.1239.ps1 - Documentation:
tests/maester/intune/Test.MT.1239.md