メインコンテンツへスキップ

Encryption in App Protection Policies

Implementation Effort: Low

User Impact: Low

Overview​

Encryption in the MAM context means organizational data used by supported apps is protected at rest within the managed app experience, according to the platform capabilities and the Intune APP implementation documented by Microsoft. This is an important foundational control, but it should not be presented as a stand-alone security strategy.

For Zero Trust guidance, administrators should combine app data encryption with app PIN and biometric requirements, data transfer restrictions, conditional launch checks, and Conditional Access. The protection goal is to keep work data usable only inside the intended managed context.

Implementation Guidance​

  1. Review the current Microsoft Learn guidance for how encryption is handled on Android and iOS/iPadOS in app protection policies because implementation details can change over time and should not be frozen into workshop text unless Microsoft documents them explicitly.
  2. In the relevant app protection policies, enable or retain the documented encryption protections and pair them with Require PIN for access, backup restrictions, and data transfer restrictions so encrypted data is not simply copied to an unmanaged destination.
  3. For regulated scenarios, confirm that device-level encryption, OS version requirements, and related compliance controls are handled in the device-management and Conditional Access layers as appropriate.
  4. Test supported app behavior on representative devices and record any app-specific limitations from Microsoft Learn rather than assuming identical encryption handling across every platform and client app.

Video Walkthrough​

Reference​