メインコンテンツへスキップ

036: Access requirements

Implementation Effort: Medium
User Impact: Medium

Overview​

Access requirements in Microsoft Intune app protection policies determine what a user must satisfy before opening a protected app or accessing protected organizational data inside it. These settings commonly include app PIN requirements, biometric use, work or school account credentials, and recheck behavior after inactivity.

In Zero Trust, access to data inside a protected app should not be assumed just because the user previously signed in. Access requirements provide the local policy gate inside the app experience.

Implementation Guidance​

  1. Configure access requirements separately for Android and iOS/iPadOS where needed, because capabilities can differ.
  2. Decide whether users must enter an app PIN, use biometrics, or reauthenticate after a period of inactivity.
  3. Set timeout and recheck values based on data sensitivity and realistic mobile usage patterns.
  4. Use stronger requirements for privileged users, executives, and high-sensitivity populations.
  5. Avoid confusing app-level access requirements with device compliance policies; they are related but not the same control.
  6. Test the user journey for first-run, idle timeout, account switch, and lost-device scenarios.
  7. Align help desk guidance with the exact prompts users will see when an app requires PIN reset or reauthentication.

Well-designed access requirements strike a balance: strong enough to protect organizational data, but not so disruptive that users look for unmanaged workarounds.

Reference​