MT.1244 - Ensure Android app protection policy requires a strong app PIN.
Overview
Ensure at least one assigned Android app protection policy requires a strong app PIN.
An app protection policy applies to a phone the organization never enrolled. On such a phone the app PIN is the only gate between whoever is holding the device and the organization's mail, files and chats inside Outlook, Teams and the Office apps: there is no device lock the organization can require, and no remote lock it can trigger.
A PIN that is required but four digits long and retried without limit is a lock with the key left beside it. Three settings together make it a control: the PIN itself, a length that resists guessing, and a retry limit that wipes the organization's data before the guessing succeeds.
All three are read from the same policy. Intune keeps and returns the minimum PIN length and the retry limit whether or not a PIN is required, so a policy can carry a six-character minimum while the PIN itself is switched off. A pass needs the whole set on one policy, assigned to users.
Policies that are not assigned to any group are reported by this test but do not count towards a pass, because an app protection policy with no assignment is never applied to a user.
Remediation action
- Navigate to the Microsoft Intune admin center.
- Go to Apps > App protection policies.
- Select an existing Android policy, or select + Create policy and choose Android.
- Under Access requirements, set PIN for access to Require.
- Set Simple PIN to Block and Select minimum PIN length to 6 or more.
- Under Conditional launch > App conditions, set Max PIN attempts to 5 or fewer and the action to Reset PIN or Wipe data.
- On the Assignments tab, assign the policy to the user groups whose apps hold organization data.
- Select Next and then Create or Save.
Android also offers Device lock required (deviceLockRequired) with an action when it is not set. That is a separate condition from the app PIN and is not evaluated by this test.
Related links
- Microsoft Learn - Android app protection policy settings
- Microsoft Learn - Data protection framework using app protection policies
- Microsoft Learn - Create and assign app protection policies
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1244 |
| Severity | Medium |
| Suite | Maester |
| Product | Intune |
| Feature | App protection |
| Area | Access control |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1110.001 Password Guessing |
| Supports controls | nist-800-53-r5:IA-5, nist-800-53-r5:AC-19 |
| PowerShell test | Test-MtAndroidAppProtectionPinPolicy |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/maester/intune/Test.MT.1244.ps1 - Documentation:
tests/maester/intune/Test.MT.1244.md