Data Protection Framework (App Protection Policies) in Intune

Platforms

iOSAndroid

Products

IntuneEntra IDMicrosoft Graph

Result

Level 1, 2 and 3 app protection policies ready in Intune for iOS/iPadOS and Android apps

Overview

Protect company data in mobile apps with Microsoft's three recommended levels of app protection policies, from basic to high, for iOS/iPadOS and Android.

The Data Protection Framework is a set of preconfigured, recommended app protection policies (APP) that protect apps and data on mobile devices (iOS/iPadOS and Android). It's a similar idea to the Security Configuration Framework (SecCon) for hardening Windows devices.

The framework has three configuration levels:

• Level 1 enterprise basic data protection
• Level 2 enterprise enhanced data protection
• Level 3 enterprise high data protection

Before you apply them to Microsoft Intune protected apps, read the differences between the levels and go through every setting in detail.

In this post I show how I imported the policy sets (JSON templates) into Intune in 2020, and what to do instead today.

Prerequisites

Before you start, check that you have the following.

Configuration

Create the app protection policies first, then optionally harden Android Enterprise devices.

App protection policies (APP)

Note (October 2026): the 2020 method below no longer works. The Intune-Config-Frameworks repository with the JSON templates and the powershell-intune-samples repository with the scripts are gone from GitHub, and the scripts used the retired AzureAD PowerShell module. Today, create the policies in the Intune admin center under Apps > Protection > Create policy with the settings listed for each level in Data Protection Framework using app protection policies. To move policies between tenants, use the Microsoft Graph PowerShell scripts in mggraph-intune-samples, for example ManagedAppPolicy_Import_From_JSON.ps1.

In 2020, on a Windows 10 machine with the AzureAD PowerShell module, I unzipped Intune-Config-Frameworks-master.zip, opened the AppProtectionPolicies folder and put the ManagedAppPolicy_Import_FromJSON.ps1 script in the same folder:

Then I ran the script from an elevated PowerShell prompt. At the first run it asked for a Global Administrator account to consent to the Intune PowerShell app, and then for the JSON file to import. This is my session, shortened:

.\ManagedAppPolicy_Import_FromJSON.ps1

Please specify your user principal name for Azure Authentication: hubertm@hmaslowski.com

Checking for AzureAD module...
Please specify a path to a JSON file to import data from e.g. C:\IntuneOutput\Policies\policy.json: level-3-enterprise-high-data-protection-iOS.json

App Protection Policy 'iOS/iPadOS Enterprise High Data Protection v1.2' Found...

{
    "displayName":  "iOS/iPadOS Enterprise High Data Protection v1.2",
    "periodOfflineBeforeAccessCheck":  "PT12H",
    "allowedInboundDataTransferSources":  "managedApps",
    "allowedOutboundDataTransferDestinations":  "managedApps",
    "allowedOutboundClipboardSharingLevel":  "managedAppsWithPasteIn",
    "dataBackupBlocked":  true,
    "deviceComplianceRequired":  true,
    "pinRequired":  true,
    "minimumPinLength":  6,
    "printBlocked":  true,
    "appActionIfDeviceComplianceRequired":  "wipe",
    ...
}

I repeated it for all six JSON templates:

• level-1-enterprise-basic-data-protection-Android.json
• level-1-enterprise-basic-data-protection-iOS.json
• level-2-enterprise-enhanced-data-protection-Android.json
• level-2-enterprise-enhanced-data-protection-iOS.json
• level-3-enterprise-high-data-protection-Android.json
• level-3-enterprise-high-data-protection-iOS.json

In the Intune admin center (intune.microsoft.com), the policies appear under Apps > Protection:

Review the policies and adjust them to your security requirements: add or remove apps from the default app list and decide which devices they target:

• iOS/iPadOS: managed or unmanaged (BYOD) devices
• Android: unmanaged (BYOD) devices or Android Enterprise. Android device administrator is no longer supported on devices with Google Mobile Services (see Android device administrator).

Today you target managed or unmanaged devices with assignment filters (see Create and assign app protection policies).

Optional: device configuration profiles and compliance policies

The same ZIP had an AndroidEnterprise folder with two subfolders, FullyManaged and WorkProfile, with device configuration profiles and compliance policies. I imported them the same way with two more scripts. Their Microsoft Graph versions are in mggraph-intune-samples:

• CompliancePolicy_Import_FromJSON.ps1

• DeviceConfiguration_Import_FromJSON.ps1

These templates harden Android Enterprise devices (work profile and fully managed) on top of the app protection policies.