iOS Devices can manually unenroll and still access corporate resource (Outlook app not removed)

[JD1234535]

We are looking to migrate to Intune for MDM on our phone but are having an issue with iOS. 

With Android, if you try to un-enroll your device it forces you to wipe the work profile.  This means that the phone is always managed and can be wiped if the employee leaves or it is wiped automatically if the employee decides to remove the Company Portal app from their device.

With iOS, you can remove the device management profile under settings and you can remove the Company Portal and Authenticator app from the device without it also removing the applications like Outlook and Teams which were installed and managed by Intune.  There must be a configuration somewhere to force these applications to be removed if a phone is un-enrolled from Intune.  Otherwise, there is no way to wipe corporate data off a device since it is no longer managed.  Even if you manually block active sync for email, change their password or remove their account all that cached data is still present on the device.

Thanks

[#2]

Hi @JD1234535, Can you share a little more details on your scenario?

1. Are we talking corp owned or BYOD?
2. Do you by any chance use Apple Business Manager (DEP) or Apple Configurator to MDM enroll corp iOS devices? If you do, you can set your iOS devices to supervised mode. In this mode, un-enrollment can be blocked. That should solve your problem. 

[#3]

@Oktay Sari 

BYOD.  No we do not use Apple Business Manager.  After speaking with Apple this didnt seem to work for BYOD and was really for corp owned devices.

[#4]

Hi @JD1234535

I'm guessing here but please fill me in with more info along the way so we can help you better.

1. What is the reason to MDM enroll and Intune manage personal devices?
2. Do you have a conditional access policy requiring devices to be compliant (forced enrollment)?
3. How do users enroll? (if not because of CA.. Q2 above)

Finally;

Do you have an app protection policy (APP) configured for managed apps? I assume you do, since you mentioned apps are installed using Intune (therefore are managed apps) and you're not able do do a wipe (assuming you mean a wipe on app level). When a user removes the management profile, authenticator and Intune company portal app, the device becomes unmanaged and with that, the applications are now unmanaged too. I did not test this fully but I believe that's the reason you're not able to do a selective wipe using the app protection policy, because it was targeting managed apps.

Since these are personal devices, what you can consider is not to install the outlook app using Intune, but have the user install it from the store. Where am I going with this you may ask...

Well, if the apps are unmanaged, you can use app protection policies for unmanaged apps. This way, the device state does not matter (basically falling back to MAM and not MDM) . However, you're still able to have the devices MDM managed if that is a requirement. Now, in this scenario, if devices become unmanaged, the app is still managed. And this gives you options like selective wipe or conditional launch to automatically wipe corporate data under certain conditions. What ever comes first. 

Please note that in the example below I've deliberately set some settings to 1 minute/day...

What I did not try is to create an APP for managed and unmanaged apps, and see if the app picks up the APP for unmanaged apps after becoming an unmanaged app/device. (still with me?) You could give that a try too.

Hope this helps but if this does not meet your business requirements, please give as much information as you can.

Regards

Oktay 

[#5]

Oktay thanks for the quick reply!
1. We do a stipend instead of Corp devices. We want to be able to remote wipe and have access control to corporate data for DLP and HIPAA reason.
2. Yes we have a CAE in place to require a device is marked as compliant and require use of an approved app. This policy is set to iOS and Android and for All Cloud Apps.
3. Users enroll using the Company Portal App

Yes we have app protection policy. One policy is target to iOS and MS Apps. We have conditions set for Offline grace period, disabled account and Jailbroken.
Your thought about relying on app protection MAM is interesting. I am going test using the conditional launch to see if that helps.
I don’t see how to create an App protection policy and distinguish between managed and non managed apps. All I can do is select either MS built in apps or Public apps (where the MS apps are already selected).
Is there a way to use an app protection policy to force an immediate wipe? If someone is unmanaged and leaves the company the best we could do is wipe the data after 1 day?
Thanks
John

[#6]

Hi @JD1234535,

Q: I don’t see how to create an App protection policy and distinguish between managed and non managed app

A: When you create an APP, you can  choose between managed and unmanaged device. So you distinguish on device level:

Q: Is there a way to use an app protection policy to force an immediate wipe?

A:  the only thin I can think of is conditional launch disabled account; (and maybe device threat level but I never worked with that). However, you'll have to test with disabling an account and then see when the policy kicks in. It will be on next authentication check.

And what you can always do is a user/device based selective wipe when ever you need to:

Intune > Apps > App selective wipe 

hope this helps.

[#7]

Hi @JD1234535, I was wondering if you had time to have a look at this? Any updates? Thx and have a great Sunday