跳到主要內容

020: Data protection

Implementation Effort: Medium – Requires data classification decisions, app inventory review, and staged rollout across user populations.

User Impact: Medium – Stronger data-protection settings can change copy-paste behavior, save destinations, reauthentication frequency, and user prompts.

Overview​

Data protection in Microsoft Intune often starts with app protection policies that keep organizational data inside approved managed apps. Many organizations use a tiered model so they can apply a baseline set of controls broadly and reserve stricter settings for more sensitive roles or information types. In Zero Trust, this is a practical way to align data sensitivity with user impact instead of treating every app and every mobile workflow the same.

Implementation Guidance​

  1. Define a small number of protection tiers, such as baseline, enhanced, and high protection, based on the sensitivity of the data and the risk profile of the users.
  2. For the baseline tier, require core controls such as approved apps, work-data encryption in supported apps, and selective wipe capability.
  3. For enhanced or high-protection tiers, consider stronger access requirements such as app PIN, biometrics, stricter data-transfer restrictions, shorter recheck intervals, or narrower save locations.
  4. Map each tier to real user populations and business scenarios. Tier design should follow data sensitivity and risk, not generic labels.
  5. Pilot with representative users before scaling. Data-protection settings that are technically correct can still fail if critical app workflows were not tested.
  6. Review offboarding and incident-response flows so the organization can wipe work data quickly without unnecessary action on personal data.

Reference​