MAM app access timeout and re-authentication are enforced after idle period

Overview

Mobile Application Management (MAM) app protection policies protect corporate data inside managed apps even when the device itself is not enrolled. If protected apps can remain open indefinitely without rechecking access requirements, a lost, shared, or unattended mobile device can continue exposing corporate data through already-open apps and cached sessions. Enforcing a short app access recheck window requires the app to re-evaluate access requirements after the configured period, such as app PIN, biometric-backed app PIN, or organizational credentials. This reduces the window in which an attacker can use an unattended app session to read, copy, or exfiltrate corporate data.

This check verifies that Intune App Protection Policies for both Android and iOS/iPadOS are assigned and require access requirements to be rechecked within 30 minutes while the device is online.

Remediation

• Create and assign app protection policies
• Data protection framework using app protection policies
• Android managed app protection resource type
• iOS managed app protection resource type

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Medium
Pillar	Devices
Category	Devices
Product	Intune
Feature	App protection
Area	Authentication
ATT&CK	T1078.004 Cloud Accounts
Licence	INTUNE_A
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.