Now that we have verified that the device is not enrolled, open an app that is targeted with Contoso’s MAM without Enrollment policy: the OneDrive app. We have logged in to this app as Isaiah Langer with his corporate identity at Contoso. As you can see, there are a few prompts, some notifying you the apps are being managed to require you to create a 4 digit PIN. Now, we will open a Word document from his OneDrive folder – a corporate location – and see what all is allowed or disallowed by the MAM policy defined by Contoso’s IT Administrator. When attempting to save the corporate document to the local device, we received an error stating “Your administrator doesn’t allow saving to personal locations”. The iPad location here is a local storage space, not considered a corporate location by the MAM policy. When saving this same document to the corporate OneDrive for Business, there are no restrictions. Isaiah may still attempt to transfer corporate data through copy/paste. MAM without Enrollment policy can control where corporate data can be pasted to as well. Let’s attempt to paste this data into a new document. As you can see the Paste function is not available in a newly created document. If prompted, type the PIN you set for the app. Scroll down, then tap Holiday Web Marketing Strategies document. At the top of the screen, tap the Word icon. The document will open in Word app. In the Word menu, tap File > Save a Copy. Tap iPad. Tap Save. Note the prompt that disallows save. Tap OK on the error message. Tap OneDrive. Tap Save. Note that save is allowed. Tap/hold (1-2 secs) anywhere in the document, then release to reveal copy menu. Tap Select All > Copy. On the document menu bar, tap the Back Button. Tap New > Blank Document. Tap/hold (1-2 secs) then release anywhere in the document. Tap Paste. Note the text that is pasted. Tap the File Menu > Name Tap OneDrive – Contoso <tenant> > Save. Tap/hold (1-2 secs) on the previously pasted text then release. Tap Select All. Tap Paste. Press the Home button. Tap on the Notes app. In the upper right corner, tap the New Note icon. Click on the cursor.
There are only 2 things the IT needs to do to enable conditional access. First, we define a compliance policy in Intune Admin Console which basically checks to verify, if the device is healthy or not. As you can see, there are multiple settings that can be checked on the devices running Windows, Windows Phone, iOS, and Android. Second, we enable the conditional access policy. In this example, it is enabled for Exchange Online. The appropriate restrictions and targeted groups are configured. Now employees in these groups need to have their devices enrolled and healthy in order to access the email. Click Device Compliance. Under MANAGE, click Policies. Click Enterprise Compliance Policy and click Properties. Review some of the settings in the policy by clicking on Settings and clicking on each of the categories: Email Device Health Device Properties System Security Click X on each open blade until back at the Microsoft Intune overview blade. In the list, click Conditional Access. In the list, click Conditional Access in Azure Active Directory. Click Exchange Online Policy. Click on Cloud Apps to show Exchange Online is selected. On the Exchange Online Policy blade, under Access Controls, click Grant to show the requirement for compliant device. On the Exchange Online Policy blade, point to Enable Policy setting. On the Exchange Online Policy blade, click Users and groups to show the selected groups. Create a Configuration Policy In Microsoft Intune, configuration policies are groups of settings that control features on computers and mobile devices. You create policies by using templates that contain recommended or customized settings, and then deploy them to device or user groups. In these demos, I will show you a variety of policy setting for managing mobile devices. You add all configuration policies the same way. The only difference is that you choose different policy templates, depending on what you want to manage. Within each type of profile there are a whole variety of configuration settings, from device restrictions to configuring Wi-Fi and VPN settings for devices. Click X on each open blade until back at the Microsoft Intune overview blade. Click Device configuration. Click Profiles. Click + Create profile. Set the Name to Enterprise Device Profile. In the Platform drop down list, select iOS. Review some of the options in the Profile Type drop down list. In the drop down list, click Device restrictions. Review the categories of restrictions.