Skip to main content

037: Conditional launch

Overview​

Conditional Launch Settings for MAM in Microsoft Intune​

Conditional Launch settings in Microsoft Intune's Mobile Application Management (MAM) policies help ensure that only compliant users can access corporate data via MAM protected apps. These settings validate various aspects of the app and device before allowing access to work or school account data.

The App Protection Policy Conditional Launch settings in Microsoft Intune for Android devices provide a way to enforce security requirements for accessing corporate applications. Here’s a detailed overview of the available options:

1. Max PIN Attempts​

  • Description: Set the maximum number of incorrect PIN attempts before access is blocked.
  • Actions: You can choose to block access or wipe corporate data if the limit is exceeded.

2. Offline Grace Period​

  • Description: Define how long a user can be offline before access to managed apps is restricted.
  • Actions: Options include blocking access or wiping corporate data after the grace period expires.

3. Jailbroken/Rooted Devices​

  • Description: Determine whether access is allowed on devices that are jailbroken or rooted.
  • Actions: You can block access or wipe corporate data if a device is detected as compromised.

4. Minimum OS Version​

  • Description: Specify the minimum Android OS version required for accessing managed apps.
  • Actions: If the device does not meet this requirement, you can block access or wipe data.

5. Maximum OS Version​

  • Description: Set a maximum OS version for accessing managed apps.
  • Actions: Similar to the minimum version, you can block access or wipe data if the device exceeds this version.

6. Minimum App Version​

  • Description: Specify the minimum version of the app required for access.
  • Actions: If the app version is outdated, you can block access or wipe data.

7. Device Manufacturer(s)​

  • Description: Allow or block access based on specific device manufacturers.
  • Actions: You can set actions to block access or wipe data for non-compliant manufacturers.

8. Play Integrity Verdict​

  • Description: Use Google Play Integrity API to assess the integrity of the app and device.
  • Actions: Depending on the verdict, you can block access or wipe data.

9. Require Threat Scan on Apps​

  • Description: Ensure that apps are scanned for threats before access is granted.
  • Actions: You can block access or wipe data if a threat is detected.

10. Minimum Company Portal Version​

  • Description: Specify the minimum version of the Intune Company Portal app required.
  • Actions: If the version is below the specified threshold, you can block access or wipe data.

11. Disabled Account​

  • Description: Block access if the user’s account is disabled.

  • Actions: Automatically block access to managed apps.

Benefits​

  1. Enhanced Security: Ensures that only users meeting specific criteria can access sensitive data in procted apps, reducing the risk of data breaches.
  2. Data Protection: Allows for selective wiping of corporate data atthe application level(e.g., jailbroken/rooted devices).
  3. Compliance Enforcement: Helps organizations enforce compliance with security policies across MAM protected apps.
  4. Flexibility: Offers a range of settings to tailor security measures to specific organizational needs.

Drawbacks​

  1. Complex Configuration: Setting up and managing these policies can be complex and may require significant administrative effort.
  2. User Disruption: Users may experience disruptions if their devices or apps do not meet the compliance requirements, potentially impacting productivity.
  3. Resource Intensive: Implementing and maintaining these policies can be resource-intensive, requiring dedicated IT staff.

Impact on End Users​

  1. Improved Security: Users benefit from enhanced security measures, protecting their personal and corporate data with almost no impact to end users.
  2. Access Restrictions: Users may face access restrictions if their devices do not comply with the set policies, which could limit their ability to work.

Relation to Zero Trust​

Zero Trust is a security model that assumes breaches are inevitable and focuses on verifying every request as though it originates from an open network. Conditional Launch settings in Intune support Zero Trust principles in several ways:

  1. Verify Explicitly: Policies ensure that every device and user is verified before granting access.
  2. Least Privilege Access: Policies enforce the principle of least privilege, ensuring users have only the access they need.
  3. Assume Breach: Intune integrates with threat detection and response services to monitor and respond to potential threats in real-time.

Reference​