Question

A financial services company allows employees to access a line-of-business web application containing customer PII from unmanaged personal laptops and mobile devices. Security requires that data displayed in the app cannot be saved locally, copied to unmanaged apps, or printed, while avoiding full device enrollment to respect employee privacy on personal hardware. The application is accessed exclusively through a browser. Which solution best meets these requirements?

Accepted Answer

Deploy Microsoft Edge for mobile/desktop as a managed app with Intune App Protection Policies (MAM) enforcing restrictions on cut/copy/paste, save-as, and printing, combined with a Conditional Access app-enforced restriction requiring the managed browser.

Answer

Enroll all personal devices in Intune MDM and apply a device compliance policy that blocks local storage and printing.

Answer

Configure a Purview sensitivity label with encryption on the web application's pages to prevent copying and printing of PII.

Answer

Apply an endpoint DLP policy through Microsoft Purview to block copy and print actions on the unmanaged personal devices.