Rules/INT-002.app-protection-coverage.psd1
|
@{ Id = 'INT-002' Title = 'App protection policies cover iOS and Android' Area = 'IntuneAppProtection' Severity = 'Medium' References = @( 'https://learn.microsoft.com/intune/intune-service/apps/app-protection-policy' ) Rationale = 'On mobile devices, app protection (MAM) is the line between corporate data and private apps - without it, corporate data in Outlook/Teams on BYOD is one copy-paste away from anywhere.' Remediation = 'Create and assign app protection policies for both iOS and Android covering the Microsoft 365 core apps.' Test = { param($Snapshot) $appProtection = $Snapshot.IntuneAppProtection $iosAssigned = @(@($appProtection.iosPolicies) | Where-Object { @($_.assignments).Count -gt 0 }) $androidAssigned = @(@($appProtection.androidPolicies) | Where-Object { @($_.assignments).Count -gt 0 }) $missing = @() if ($iosAssigned.Count -eq 0) { $missing += 'iOS' } if ($androidAssigned.Count -eq 0) { $missing += 'Android' } if ($missing.Count -eq 0) { New-TLRuleResult -Status Pass -Evidence ("iOS: {0}, Android: {1} assigned app protection policies." -f $iosAssigned.Count, $androidAssigned.Count) } else { New-TLRuleResult -Status Fail -Evidence ("No assigned app protection policy for: {0}." -f ($missing -join ', ')) } } } |