Real-world lesson: in most MDM projects, the hardest part isn’t the tool — it’s applying the right policies in a way that fits people’s work. Below are the 8 policies I use to keep data safe and users happy, with how it works, where to configure, and tips for common platforms (Microsoft Intune, VMware Workspace ONE, Jamf, Google).
1) Identity & Authentication Policy
Goal: Only authorized users get in, and devices lock when idle.
How it works
- Enable MFA (TOTP, push, biometrics).
- Use SSO via your identity provider (e.g., Entra ID/Azure AD, Okta).
- Set auto-lock after X minutes idle.
Where to configure
- Intune: Identity → Conditional Access (require MFA), Device Configuration → Configuration profiles (lock screen timeout).
- Workspace ONE: Access Policies + Profiles (Passcode/Auto-lock).
- Jamf Pro (Apple): Configuration Profiles → Passcode/Screen Saver, SSO Extensions.
- Google Admin: Security → 2-Step Verification; Devices → Settings → Screen lock.
- Require MFA on all cloud apps
- Set lock after 5–10 min idle
- Block legacy/basic auth
2) Password (or Passcode/Biometrics) Policy
Goal: Strong, renewable credentials with lockout on brute force.
How it works
- Length & complexity requirements
- Rotation or passwordless (where possible)
- Lockout after failed attempts
Where to configure
- Intune: Device Compliance & Configuration → Password.
- Workspace ONE / Jamf / Google: Passcode/Screen Lock payloads.
3) Encryption Policy
Goal: Data remains confidential at rest and in transit.
How it works
- Full-Disk Encryption: BitLocker (Windows), FileVault (macOS), native Android/iOS encryption.
- TLS everywhere (apps, email, VPN).
- Encrypt backups (Time Machine, iTunes/Android backups, cloud backups).
Where to configure
- Intune: Endpoint security → Disk encryption (BitLocker) / Device profiles (FileVault).
- Jamf: Configuration Profiles → FileVault; escrow recovery keys.
- Workspace ONE / Google: Encryption settings in profiles.
4) Containerization (Work Profile) Policy
Goal: Separate company data from personal (BYOD-friendly).
How it works
- Android Work Profile, iOS/iPadOS Managed Open-In, Windows/macOS App Protection.
- Company data lives in a managed container; copy/share restricted across boundaries.
Where to configure
- Intune: App Protection Policies (MAM) + Enrollment restrictions.
- Workspace ONE: Work Profile (Android), Managed Domains (iOS).
- Jamf: Restrictions + Managed Apps configuration.
5) Application Management Policy
Goal: Allow only trusted apps; block risky sources.
How it works
- Allow-list (Company Portal/App Catalog) and Block-list.
- Disable unknown sources (Android), enforce App Store only (iOS/macOS), SmartScreen/AppControl (Windows).
Where to configure
- Intune: Apps → Windows/iOS/Android/macOS (required/available), App Control.
- Workspace ONE: Internal/Public Apps + Compliance rules.
- Jamf: App Installers, Mac App Store, Restrictions.
6) Patch & Update Policy
Goal: Close vulnerabilities fast and block outdated devices.
How it works
- Automatic OS & app updates; maintenance windows.
- Compliance rules: out-of-date devices lose access.
Where to configure
- Intune: Update Rings (Windows), Feature updates, macOS/iOS update policies.
- Workspace ONE: Sensors + Update policies.
- Jamf: Software Updates + Deferrals.
7) Network Access Policy
Goal: Safe connectivity only (trusted Wi-Fi/VPN, no MITM).
How it works
- Pre-configure corporate Wi-Fi (WPA2-E/WPA3-E w/ certificates).
- Force corporate VPN / Per-app VPN for managed apps.
- Block access on open/public networks or warn + restrict.
Where to configure
- Intune/Workspace ONE/Jamf: Wi-Fi and VPN payloads (cert-based auth recommended).
- Combine with Conditional Access / Network Access Control (NAC).
8) Lost Device Policy
Goal: Act fast: lock, locate, wipe, and log an incident.
How it works
- Remote Lock/Wipe (full or selective for BYOD).
- Geolocation where legal and appropriate.
- Automated IR workflow: ticket, notify, revoke tokens.
Where to configure
- Console actions (Intune/Workspace ONE/Jamf/Google) + automation (webhooks, Logic Apps, API).
Roll-Out Blueprint (Quick Start)
- Decide ownership: Corporate vs BYOD (defines how strict).
- Baseline profiles: Identity/MFA → Passcode → Encryption → Update ring.
- Access controls: Conditional Access (compliant device required).
- Apps: Publish allow-listed apps; block unknown sources.
- Network: Push Wi-Fi certs + per-app VPN for sensitive apps.
- Lost device: Document remote lock/wipe SOP; test monthly.
- Monitor: Compliance reports, update status, risky sign-ins.
- Iterate: Gather user feedback; tune friction points.
Bottom Line
Success = security × usability. Flexible, well-explained policies keep people productive while protecting data. The tech is ready; the art is in how we roll it out.
Question for you
Where is the bigger challenge in your org — technology limits or user adoption? My take: policy design + change management wins projects.
Leave a Comment