Implementing App protection policies using Tier based Data Protection Framework

If you are managing your mobile devices using Intune or another MDM, then you should look at implementing App protection policies (APP), also known as MAM. APP are rules that ensure an organization's data remains safe or contained in a managed app. The APP policy gets enforced when a user attempts to access or move "corporate" data, or a set of actions that are prohibited or monitored when the user is inside the app.

When configuring App Protection Policies, there are a number of settings and options available which can become overwhelming. To make it easier for organizations to implement APP, Microsoft has broken down the APP policies in form of a Tier based framework for mobile app management.

• Level 1 enterprise basic data protection – This configuration replaces the need for basic Exchange Online device access policies by requiring a PIN to access work or school data, encrypting the work or school account data, and providing the capability to selectively wipe the school or work data. However, unlike Exchange Online device access policies, the App Protection Policy settings apply to all the apps selected in the policy, thereby ensuring data access is protected beyond mobile messaging scenarios. The policies in level 1 enforce a reasonable data access level while minimizing the impact to users and mirror the default data protection and access requirements settings when creating an App Protection Policy within Microsoft Endpoint Manager. Microsoft recommends this configuration as the minimum data protection configuration for an enterprise device.
• Level 2 enterprise enhanced data protection – This data protection configuration is recommended as a standard for devices where users access more sensitive information. These devices are a natural target in enterprises today. This configuration expands upon the configuration in Level 1 by restricting data transfer scenarios and by requiring a minimum operating system version. Microsoft recommends this configuration for devices where users access sensitive or confidential information.
• Level 3 enterprise high data protection – This data protection configuration is recommended as a standard for organizations with large and sophisticated security organizations, or for specific users and groups. Such organizations are typically targeted by well-funded and sophisticated adversaries, and as such merit the additional constraints and controls described. This configuration expands upon the configuration in Level 2 by restricting additional data transfer scenarios, increasing the complexity of the PIN configuration, and adding mobile threat detection. Microsoft recommends this configuration for devices run by an organization with a larger or more sophisticated security team, or for specific users or groups who are at uniquely high risk (users who handle highly sensitive data where unauthorized disclosure causes considerable material loss to the organization).

I have captured the recommended settings by Microsoft in the table below -

Depending on the Level of configuration settings you choose, you may need to implement additional configuration requirements for implementing APP on iOS/iPadOS enrolled devices. You can check out one of my earlier blog posts "Intune - Application Protection Policies for enrolled devices" that covers the additional requirements.

For context, I created a Level 2 APP policy for Android enrolled devices and the following is what the policy configuration should look like.

You can head over to App Protection Status report under Apps->Monitor->App Protection Status->Reports. Select the User and verify for the APP getting applied or not.

While these are Microsoft recommended settings, one should review and categorize usage scenarios based on the needs of the organization and then accordingly fine tune the configuration settings as necessary.

(Credits to Microsoft. Information gathered from various Microsoft’s sources.)