npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Use this skill when:
Implements MAM policies via Intune for iOS/Android enterprise apps, with DLP, selective wipe, config, and containerization for BYOD data protection.
Implements Mobile Application Management (MAM) policies with app-level controls like DLP, selective wipe, app config, and containerization on iOS/Android for BYOD enterprise data protection via Intune.
Implements BYOD privacy compliance frameworks for personal device use in workplaces. Covers data separation, MDM capabilities/limits, employee consent, data wiping boundaries, and monitoring restrictions.
Share bugs, ideas, or general feedback.
Use this skill when:
Do not use when full device management (MDM) is already deployed and sufficient -- MAM adds complexity when MDM already provides the needed controls.
Classify data sensitivity and define protection tiers:
| Tier | Data Type | Controls |
|---|---|---|
| Tier 1 - Basic | General corporate email | Require PIN, block screenshots |
| Tier 2 - Enhanced | Financial data, HR records | Encrypt app data, restrict cut/copy/paste |
| Tier 3 - High | PII, healthcare, legal | Selective wipe, offline access limits, DLP |
Android App Protection Policy:
{
"displayName": "Corporate App Protection - Tier 2",
"platform": "android",
"dataProtectionSettings": {
"allowedDataStorageLocations": ["oneDriveForBusiness", "sharePoint"],
"blockDataTransferToOtherApps": "managedApps",
"blockDataTransferFromOtherApps": "managedApps",
"saveAsBlocked": true,
"clipboardSharingLevel": "managedAppsWithPasteIn",
"screenCaptureBlocked": true,
"encryptAppData": true,
"backupBlocked": true
},
"accessSettings": {
"pinRequired": true,
"minimumPinLength": 6,
"biometricEnabled": true,
"offlineGracePeriod": 720,
"offlineWipeInterval": 90
},
"conditionalLaunchSettings": {
"maxOsVersion": "15.0",
"minOsVersion": "12.0",
"jailbreakBlocked": true,
"maxPinRetries": 5
}
}
Deploy managed app configuration for automatic endpoint setup:
{
"displayName": "Email App Configuration",
"targetedManagedApps": ["com.microsoft.outlooklite"],
"settings": [
{"key": "com.microsoft.outlook.EmailProfile.AccountType", "value": "ModernAuth"},
{"key": "com.microsoft.outlook.EmailProfile.ServerName", "value": "outlook.office365.com"},
{"key": "com.microsoft.outlook.EmailProfile.AllowedDomains", "value": "corporate.com"}
]
}
Azure AD > Conditional Access > New Policy:
- Users: All users with corporate apps
- Cloud apps: Office 365, custom LOB apps
- Conditions: All platforms
- Grant: Require app protection policy
- Session: App enforced restrictions
Test each policy control on both platforms:
# Verify data transfer restrictions
1. Open managed app (Outlook)
2. Copy text from email body
3. Attempt paste in unmanaged app (Notes) -- should be blocked
4. Attempt paste in managed app (Teams) -- should work
# Verify selective wipe
1. Enroll test device with MAM
2. Access corporate data in managed apps
3. Trigger selective wipe from Intune portal
4. Verify corporate data removed, personal data intact
# Verify offline grace period
1. Access managed app while connected
2. Disconnect from network
3. After grace period expires, verify app access blocked
Configure MAM monitoring dashboards:
| Term | Definition |
|---|---|
| MAM | Mobile Application Management - app-level policies without requiring full device enrollment |
| App Protection Policy | Set of rules enforcing data protection at the app level (encryption, DLP, access controls) |
| Selective Wipe | Removing only corporate data from managed apps while preserving personal data |
| App Wrapping | Post-build process applying MAM SDK policies to apps without source code modification |
| Containerization | Isolating corporate app data in an encrypted container separate from personal apps |