Question

A financial services company allows employees to access Microsoft 365 email and Teams from personal iOS and Android devices (BYOD). Security requirements mandate that corporate data must be protected on these devices — preventing copy/paste to personal apps, requiring app-level PIN, and enabling selective wipe of corporate data — WITHOUT enrolling the personal devices into full device management or taking control of the entire device. Which approach should the security architect specify?

Accepted Answer

Deploy Intune App Protection Policies (MAM) without enrollment, combined with Conditional Access app-based access controls

Answer

Enroll all personal devices in Microsoft Intune MDM and apply device compliance policies with full device wipe capability

Answer

Require devices to join Microsoft Entra ID and enforce a security baseline via Windows LAPS

Answer

Configure Defender for IoT enterprise agentless monitoring to inventory and protect the personal mobile devices