From cybersecurity-skills
Implements MAM policies via Intune for iOS/Android enterprise apps, with DLP, selective wipe, config, and containerization for BYOD data protection.
npx claudepluginhub mukul975/anthropic-cybersecurity-skills --plugin cybersecurity-skillsThis skill uses the workspace's default tool permissions.
Use this skill when:
Applies Acme Corporation brand guidelines including colors, fonts, layouts, and messaging to generated PowerPoint, Excel, and PDF documents.
Builds DCF models with sensitivity analysis, Monte Carlo simulations, and scenario planning for investment valuation and risk assessment.
Calculates profitability (ROE, margins), liquidity (current ratio), leverage, efficiency, and valuation (P/E, EV/EBITDA) ratios from financial statements in CSV, JSON, text, or Excel for investment analysis.
Use this skill when:
Do not use when full device management (MDM) is already deployed and sufficient -- MAM adds complexity when MDM already provides the needed controls.
Classify data sensitivity and define protection tiers:
| Tier | Data Type | Controls |
|---|---|---|
| Tier 1 - Basic | General corporate email | Require PIN, block screenshots |
| Tier 2 - Enhanced | Financial data, HR records | Encrypt app data, restrict cut/copy/paste |
| Tier 3 - High | PII, healthcare, legal | Selective wipe, offline access limits, DLP |
Android App Protection Policy:
{
"displayName": "Corporate App Protection - Tier 2",
"platform": "android",
"dataProtectionSettings": {
"allowedDataStorageLocations": ["oneDriveForBusiness", "sharePoint"],
"blockDataTransferToOtherApps": "managedApps",
"blockDataTransferFromOtherApps": "managedApps",
"saveAsBlocked": true,
"clipboardSharingLevel": "managedAppsWithPasteIn",
"screenCaptureBlocked": true,
"encryptAppData": true,
"backupBlocked": true
},
"accessSettings": {
"pinRequired": true,
"minimumPinLength": 6,
"biometricEnabled": true,
"offlineGracePeriod": 720,
"offlineWipeInterval": 90
},
"conditionalLaunchSettings": {
"maxOsVersion": "15.0",
"minOsVersion": "12.0",
"jailbreakBlocked": true,
"maxPinRetries": 5
}
}
Deploy managed app configuration for automatic endpoint setup:
{
"displayName": "Email App Configuration",
"targetedManagedApps": ["com.microsoft.outlooklite"],
"settings": [
{"key": "com.microsoft.outlook.EmailProfile.AccountType", "value": "ModernAuth"},
{"key": "com.microsoft.outlook.EmailProfile.ServerName", "value": "outlook.office365.com"},
{"key": "com.microsoft.outlook.EmailProfile.AllowedDomains", "value": "corporate.com"}
]
}
Azure AD > Conditional Access > New Policy:
- Users: All users with corporate apps
- Cloud apps: Office 365, custom LOB apps
- Conditions: All platforms
- Grant: Require app protection policy
- Session: App enforced restrictions
Test each policy control on both platforms:
# Verify data transfer restrictions
1. Open managed app (Outlook)
2. Copy text from email body
3. Attempt paste in unmanaged app (Notes) -- should be blocked
4. Attempt paste in managed app (Teams) -- should work
# Verify selective wipe
1. Enroll test device with MAM
2. Access corporate data in managed apps
3. Trigger selective wipe from Intune portal
4. Verify corporate data removed, personal data intact
# Verify offline grace period
1. Access managed app while connected
2. Disconnect from network
3. After grace period expires, verify app access blocked
Configure MAM monitoring dashboards:
| Term | Definition |
|---|---|
| MAM | Mobile Application Management - app-level policies without requiring full device enrollment |
| App Protection Policy | Set of rules enforcing data protection at the app level (encryption, DLP, access controls) |
| Selective Wipe | Removing only corporate data from managed apps while preserving personal data |
| App Wrapping | Post-build process applying MAM SDK policies to apps without source code modification |
| Containerization | Isolating corporate app data in an encrypted container separate from personal apps |