Contributed by Eduard ArbonaAll contributors →
Part of Maester · Intune · App protection · All checks
```powershell title="Run this check" Invoke-Maester -TestId MT.1243 ``` ## Overview Ensure at least one **assigned** iOS app protection policy acts on the device threat level. A device compliance policy can refuse a jailbroken iPhone, but it only evaluates a device the organization **enrolled**. On an unenrolled phone the equivalent signal reaches the organization through the app protection policy: a mobile threat defense partner such as Microsoft Defender reports a threat level for the device, and the policy decides what the managed app does about it. Two values decide that together: - **Max allowed device threat level** (`maximumAllowedDeviceThreatLevel`) is the gate. **Not configured** means the signal is ignored. - **Mobile threat defense remediation action** (`mobileThreatDefenseRemediationAction`) is what happens when the gate is crossed. **Warn** leaves the data available on a device the organization has been told is compromised. A level of **high** accepts every threat the partner reports, so this test treats it as configured but not protective and reports it as a note. This check has a prerequisite: a mobile threat defense connector must be set up and the app protection policy must be enabled for it, otherwise no threat level ever arrives. Policies that are **not assigned** to any group are reported by this test but do not count towards a pass, because an app protection policy with no assignment is never applied to a user. #### Remediation action 1. Navigate to the [Microsoft Intune admin center](https://intune.microsoft.com). 2. Go to **Apps** > **App protection policies**. 3. Select an existing **iOS** policy, or select **+ Create policy** and choose **iOS**. 4. Set up a mobile threat defense connector and turn on **app protection policy evaluation** for iOS (see the related link). 5. Under **Conditional launch** > **Device conditions**, add **Max allowed device threat level** with a value of **Secured**, **Low** or **Medium** and the action **Block access** or **Wipe data**. 6. On the **Assignments** tab, assign the policy to the user groups whose apps hold organization data. 7. Select **Next** and then **Create** or **Save**. Without the connector the condition is configured and inert: nothing reports a threat level, so nothing is ever blocked. Verify the connector status in **Tenant administration** > **Connectors and tokens**. #### Related links - [Microsoft Learn - Configure Microsoft Defender for Endpoint integration with Intune](https://learn.microsoft.com/intune/device-security/microsoft-defender/configure-integration) - [Microsoft Learn - iOS app protection policy settings](https://learn.microsoft.com/intune/app-management/protection/ref-settings-ios) - [Microsoft Learn - App protection policies overview](https://learn.microsoft.com/intune/app-management/protection/overview) ## Details