iOS/iPadOS - Compliance Policy

Compliance policy for iOS/iPadOS devices

Settings this baseline controls

Setting	What it does
Managed email profile required	Require a managed email profile. Learn more
Block jailbroken devices	Devices must not be jailbroken or rooted. Learn more
Mobile Threat Defense level	Required Mobile Threat Defense level. Learn more
Minimum iOS version	Minimum iOS version. Learn more
Maximum iOS version	Maximum iOS version. Learn more
Minimum iOS build version	Minimum iOS build version. Learn more
Maximum iOS build version	Maximum iOS build version. Learn more
Maximum machine risk score	Required Advanced Threat Protection level. Learn more

10 more settings

Setting	What it does
Passcode required	Require a passcode to unlock iOS devices. Learn more
Block simple passcodes	Block simple passcodes. Learn more
Minimum passcode length	Minimum passcode length. Learn more
Required passcode type	Type of characters in passcode. Learn more
Minimum character set count	Number of character sets required in the password. Learn more
Minutes until screen locks	Minutes of inactivity before the screen times out. Learn more
Minutes before passcode required	Minutes of inactivity before a passcode is required. Learn more
Days until passcode expires	Number of days before the passcode expires. Learn more
Previous passcodes remembered	Number of previous passcodes to prevent reuse. Learn more
Restricted apps	List of apps that are not allowed to be installed on the device. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

Add this to a tenant that enrols iPhones or iPads, so Intune can keep jailbroken or under-protected devices off your Conditional Access-protected resources.

1. Add the baseline to the tenant directly (Adding a baseline), or include it in a scheme you deploy to every tenant enrolling Apple mobile devices (Deploying a scheme).

2. Leave Passcode required on, with Required passcode type set to alphanumeric, Minimum passcode length at 8, and reuse blocked for the last 5 passcodes. That’s a full device passcode, not the four-digit PIN Android gets.

3. Leave Block jailbroken devices and Managed email profile required on. The first rules out a compromised device outright; the second requires mail to be delivered through Intune’s managed profile rather than the device’s built-in Mail app.

4. Set Minimum iOS version to 15, and leave Maximum iOS version and its build-version counterparts blank. This sets a floor, not a ceiling.

5. Save, and turn on Auto-remediation if you want Octiga to create or correct this policy in Intune the next time it detects a deviation, rather than fixing it by hand.

Caution

A device that already fails these settings — a passcode too short, or a profile missing the managed mail requirement — becomes noncompliant on its next check-in, and loses access to anything behind a Conditional Access device-compliance policy until the user brings it up to standard.

Licence: Intune

Check it worked

This baseline shows Passing once the policy exists in Intune with these settings and an iOS or iPadOS device reports back as compliant. Check progress in the Microsoft Intune admin centre: Devices → Manage devices → Compliance → Policies, open the policy, and use its device status and per-setting status views. A user on a noncompliant device sees what needs fixing in the Company Portal app, and may be blocked from mail and other protected resources until they fix it.

Standards this addresses

CISv8 4.1v8 3.6

NISTPR.DS-1SC-28CM-6

ISO 27001A.8.13A.8.22

GDPRArticle 32

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→