MT.1242 - Ensure iOS app protection policy limits offline access to organization data.
Overview
Ensure at least one assigned iOS app protection policy limits offline access to organization data.
Every revocation an administrator can perform on an unenrolled phone travels through the app protection check: disabling the account, removing the user from the assigned group, or issuing a selective wipe. The offline grace period is how long the managed app keeps opening organization data without that check, and a device kept in airplane mode is a device that has received none of those decisions.
Two settings bound it:
- Offline grace period (
periodOfflineBeforeAccessCheck) blocks access until the app can check in again. - Offline grace period / wipe (
periodOfflineBeforeWipeIsEnforced) removes the organization's data from a device that never comes back.
This test asks for at most 12 hours before access is blocked and at most 90 days before the data is wiped, the values the Intune data protection framework publishes for enterprise data protection.
Policies that are not assigned to any group are reported by this test but do not count towards a pass, because an app protection policy with no assignment is never applied to a user.
Remediation action
- Navigate to the Microsoft Intune admin center.
- Go to Apps > App protection policies.
- Select an existing iOS policy, or select + Create policy and choose iOS.
- Under Conditional launch > App conditions, add Offline grace period with the action Block access and a value of 720 minutes (12 hours) or less.
- Add a second Offline grace period condition with the action Wipe data and a value of 90 days or less.
- On the Assignments tab, assign the policy to the user groups whose apps hold organization data.
- Select Next and then Create or Save.
Both values are stored as ISO 8601 durations. A value of zero means the condition exists but bounds nothing, so this test requires a positive value as well as one under the limit.
Related links
- Microsoft Learn - Data protection framework using app protection policies
- Microsoft Learn - iOS app protection policy settings
- Microsoft Learn - App protection policies overview
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1242 |
| Severity | Low |
| Suite | Maester |
| Product | Intune |
| Feature | App protection |
| Area | Access control |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-12, nist-800-53-r5:AC-19 |
| PowerShell test | Test-MtIosAppProtectionOfflineGracePeriod |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/maester/intune/Test.MT.1242.ps1 - Documentation:
tests/maester/intune/Test.MT.1242.md