# Ensure iOS app protection policy keeps organization data inside managed apps

Ensure at least one assigned iOS app protection policy keeps organization data inside managed apps.

Source: https://maester.dev/docs/tests/MT.1239

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/earbona23" title="Eduard Arbona · Original author"><img src="https://github.com/earbona23.png" alt="Eduard Arbona" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/earbona23">Eduard Arbona</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Intune · App protection · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1239
```

## Overview

Ensure at least one **assigned** iOS app protection policy keeps organization data inside managed apps.

**This is the control a device compliance policy cannot provide.** A tenant can require a compliant, passcode-protected, up-to-date iPhone and still let a user forward an attachment from Outlook into a personal cloud drive, paste a customer list into a note-taking app, or let iCloud back the whole mailbox up to a personal Apple account. Compliance evaluates the device; app protection evaluates what the app may do with the data.

Four settings decide whether organization data can leave the managed boundary:

- **Send org data to other apps** (`allowedOutboundDataTransferDestinations`) must be **Policy managed apps** or **None**, not **All apps**.
- **Cut, copy and paste with other apps** (`allowedOutboundClipboardSharingLevel`) must not be **Any app**.
- **Save copies of org data** (`saveAsBlocked`) must be **Block**.
- **Backup org data to iTunes and iCloud backups** (`dataBackupBlocked`) must be **Block**.

Any one of them left open is a route out, so all four are read from the **same** policy.

Policies that are **not assigned** to any group are reported by this test but do not count towards a pass, because an app protection policy with no assignment is never applied to a user.

#### Remediation action

1. Navigate to the [Microsoft Intune admin center](https://intune.microsoft.com).
2. Go to **Apps** > **App protection policies**.
3. Select an existing **iOS** policy, or select **+ Create policy** and choose **iOS**.
4. Under **Data protection** > **Data transfer**, set **Send org data to other apps** to **Policy managed apps**.
5. Set **Save copies of org data** to **Block** (add only the organization locations you need under **Allow user to save copies to selected services**).
6. Set **Cut, copy and paste with other apps** to **Policy managed apps** or **Policy managed apps with paste in**.
7. Set **Backup org data to iTunes and iCloud backups** to **Block**.
8. On the **Assignments** tab, assign the policy to the user groups whose apps hold organization data.
9. Select **Next** and then **Create** or **Save**.

The Intune data protection framework publishes these values as part of its enterprise basic, enhanced and high data protection levels; the related link below gives the full set per level.

#### Related links

- [Microsoft Learn - Data protection framework using app protection policies](https://learn.microsoft.com/intune/app-management/protection/data-protection-framework)
- [Microsoft Learn - iOS app protection policy settings](https://learn.microsoft.com/intune/app-management/protection/ref-settings-ios)
- [Microsoft Learn - Apps protected by Intune](https://learn.microsoft.com/intune/app-management/ref-protected-apps)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1239 |
| Severity | Medium |
| Suite | Maester |
| Product | Intune |
| Feature | App protection |
| Area | Data protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1567.002 Exfiltration to Cloud Storage, T1115 Clipboard Data |
| Supports controls | nist-800-53-r5:AC-4, nist-800-53-r5:AC-19 |
| PowerShell test | [Test-MtIosAppProtectionDataTransfer](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1239.ps1) |
| Services | Graph |
| Compatible licenses | INTUNE_A |

</details>

## Source

- Test: [`tests/maester/intune/Test.MT.1239.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1239.ps1)
- Documentation: [`tests/maester/intune/Test.MT.1239.md`](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1239.md)