跳到主要內容

023: Backup to iCloud

Implementation Effort: Low to Medium
User Impact: Low

Overview​

For iOS/iPadOS app protection scenarios, administrators should evaluate whether organizational data stored by protected apps can be included in consumer backup locations such as iCloud or local device backups. In Zero Trust terms, unmanaged backup destinations can create an additional copy of business data outside the app protection boundary.

The recommended posture for most organizations is to prevent protected app data from being backed up to consumer backup services unless there is a documented business requirement and compensating controls.

Implementation Guidance​

  1. Identify which iOS/iPadOS apps store organization data locally and are managed through Intune app protection policies.
  2. In the Microsoft Intune admin center, review the iOS/iPadOS app protection policy data protection settings that control backup of organization data.
  3. For BYOD and lightly managed mobile scenarios, prefer the setting that prevents backup of work data to consumer backup locations.
  4. Validate how Microsoft 365 mobile apps behave after device replacement or app reinstallation so support teams can explain the recovery experience to users.
  5. Communicate clearly that blocking backup of work data does not prevent the user from backing up personal content; it limits protected organizational content.
  6. If executives or regulated teams require stricter data handling, combine this setting with controls for save-as, copy/paste, print, screen capture, and approved apps.

This setting is usually most valuable where the device itself is not corporately managed, because app protection is acting as the primary control plane for organizational data.

Reference​