Skip to main content

035: Data protection

Implementation Effort: Medium
User Impact: Medium

Overview​

Data protection settings in Microsoft Intune app protection policies define how organizational data can move, be stored, and be used inside protected mobile apps. These controls are central to a Zero Trust mobile strategy because they create the boundary that keeps work data from flowing freely into unmanaged apps, storage locations, or services.

Administrators should treat these settings as a baseline standard, not as one-off exceptions per app.

Implementation Guidance​

  1. Start with the primary data movement decisions:
    • Can users copy and paste work data to personal apps?
    • Can users save files to personal storage locations?
    • Can users open work documents in unmanaged apps?
    • Can users print or share work data outside protected apps?
  2. Build a minimum baseline for all users that keeps organizational data within managed apps and approved services.
  3. Increase restrictions for higher-risk groups, especially if they handle regulated or confidential information.
  4. Test real user workflows such as opening attachments, saving annotated files, and moving between Outlook, Teams, OneDrive, and Edge.
  5. Do not rely on a single setting. Combine data transfer restrictions, encryption, access requirements, Conditional Launch, and selective wipe.
  6. Publish exception criteria so business units understand when a less restrictive policy is justified.
  7. Review policy effectiveness with security, legal, and business stakeholders at least annually.

The best data protection design is one that blocks risky data movement while still allowing approved productivity paths.

Reference​