Create and deploy device security policies

You can use Mobile Device Management for Office 365 to create device policies that help protect your organization’s information on Office 365 from unauthorized access. You can apply policies to any mobile device in your organization where the user of the device has an applicable Office 365 license and has enrolled the device in MDM for Office 365.

In this article:

Before you begin

  • Learn about the devices, mobile device apps, and security settings that MDM for Office 365 supports. See Capabilities of Mobile Device Management for Office 365.

  • Create security groups that include Office 365 users that you want to deploy policies to and for users that you might want to exclude from being blocked access to Office 365. We recommend that before you deploy a new policy to your organization, you test the policy by deploying it to a small number of users. You can create and use a security group that includes just yourself or a small number Office 365 users that can test the policy for you. To learn more about security groups, see Create, edit, or delete a security group.

  • Important: Before you can create a mobile device policy, you must activate and set up MDM for Office 365. See Overview of Mobile Device Management for Office 365.

  • To create and deploy mobile device management policies in Office 365, you need to be an Office 365 global admin. See Permissions in Office 365 Security & Compliance admin center.

  • Before you deploy policies, let your organization know the potential impacts of enrolling a device in MDM for Office 365. Depending on how you set up the policies, noncompliant devices can be blocked from accessing Office 365 and data, including installed applications, photos, and personal information on an enrolled device, can be deleted.

Note: Policies and access rules created in MDM for Office 365 will override Exchange ActiveSync mobile device mailbox policies and device access rules created in the Exchange admin center. After a device is enrolled in MDM for Office 365, any Exchange ActiveSync mobile device mailbox policy or device access rule applied to the device will be ignored. To learn more about Exchange ActiveSync, see Exchange ActiveSync in Exchange Online.

Step 1: Create a device policy and deploy to a test group

Before you can start, make sure you have activated and set up MDM for Office 365. See Overview of Mobile Device Management for Office 365 for instructions.

  1. Sign in to Office 365 with your global admin account.

  2. From your browser type: https://protection.office.com.

  3. Go to Data loss prevention > Device policies and select Create a policy.

    Add a device security policy
  4. On the Policy settings page, specify the requirements you want applied to mobile devices in your organization.

    1. Require managing email profile: When enabled, devices that don't have an email profile managed by Office 365 MDM are considered not compliant. A device can't have a managed email profile when it's not correctly targeted, or if the user manually set up the email account on the device. When you leave it Not Enabled (default), this setting isn't evaluated for compliance or non-compliance. See Existing Company Email account found for instructions on how users can get compliant when this option is selected,

  5. On the Do you want to apply this policy now?, choose the groups that you want to apply this policy to.

  6. Select Create this policy when you're done.

Each user that the policy applies to will have the policy pushed to their device the next time they sign in to Office 365 using their mobile device. If users haven't had a policy applied to their mobile device before, then after you deploy the policy, they’ll get a notification on their device that includes the steps to enroll and activate MDM for Office 365. Until they complete enrollment into Office 365 MDM hosted by the Intune Service, access to email, OneDrive, and other services will be restricted. After they complete enrollment using the Intune Company Portal app, they'll be able to use the services and the policy will be applied to their device.

Step 2: Verify your policy works

After you’ve created a device policy, you should check that the policy works as you expect before you deploy it to your organization.

  1. Sign in to Office 365 with your global admin account.

  2. From your browser type: https://protection.office.com.

  3. Go to Data loss prevention > Device management > View the list of managed devices.

  4. Check the status of user devices that have the policy applied. You want the State of devices to be Managed. 

  5. You can also do a full or selective wipe on a device by clicking on Factory reset or Remove company data from Manage button after selecting a device. For instructions, see Wipe a mobile device in Office 365.

Step 3: Deploy a policy to your organization

After you’ve created a device policy and verified that it works as expected, deploy it to your organization.

  1. Sign in to Office 365 with your global admin account.

  2. From your browser type: https://protection.office.com.

  3. Select the policy you want to deploy, and choose Edit next to Groups applied to.

  4. Search for a group to add and click on Select.

  5. Click on Close on Change setting.

  6. Click on Close on Edit policy.

Each user that the policy applies to will have the policy pushed to their device the next time they sign in to Office 365 from their mobile device. If users haven't had a policy applied to their mobile device, they’ll get a notification on their device with steps to enroll and activate it for MDM for Office 365. After they’ve completed the enrollment, the policy will be applied to their device.

Step 4: Block email access for unsupported devices

To help secure your organization’s information, you should block app access to Office 365 email for mobile devices that are not supported by MDM for Office 365. See Supported devices for a list of devices that are supported. To do this:

  1. Sign in to Office 365 with your global admin account.

  2. From your browser type: https://protection.office.com.

  3. Go to Data loss prevention > Device policies and select Device policies > Manage organization-wide device access settings.

  4. To block unsupported devices, choose Block under If a device isn't supported by MDM for Office 365, do you want to allow or block it from using an Exchange account to access your organization's email > Save.

    Go to Compliance center > Device Security policies> Manage organization-wide device access settings > Block.

Step 5: Choose security groups to be excluded from conditional access checks

If you want to exclude some people from conditional access checks on their mobile devices and you've created one or more security groups for those people, add the security groups here. The people in these groups will not have any policies enforced for their supported mobile devices. This is the recommended option if you no longer want to use Office 365 MDM in your organization..

  1. Sign in to Office 365 with your global admin account.

  2. Click this link: Activate Mobile Device Management.

  3. Go to Data loss prevention > Device policies and select Manage organization-wide device access settings.

    Add a device security policy
  4. Select Add to add the security group that has users that you’d like to exclude from being blocked access to Office 365. When a user has been added to this list, they’ll be able to access Office 365 email when using an unsupported device.

  5. Select the security group you want to use in the Select group panel.

  6. Select the name, and then Add > Save.

  7. On the Organization-wide device access settings panel, choose Save.

    On the Organization-wide device access settings choose groups that are excluded from access control.

What is the impact of security policies on different device types?

When you apply a policy to user devices, the impact on each device varies somewhat between different device types. See the following table for examples of the impact of policies on different devices.

Security Policy

Windows Phone 8.1+

Android 4+

Samsung Knox

IOS 6+

Notes

Require encrypted backup

IOS encrypted backup required.

Block cloud backup

Block Google backup on Android (grayed out), cloud backup on iOS.

Block document synchronization

iOS: Block documents in the cloud.

Block photo synchronization

iOS (native): Block Photo Stream.

Block screen capture

X

Blocked when attempted.

Block video conference

FaceTime blocked on iOS, not Skype or others.

Block sending diagnostic data

X

Block sending Google crash report on Android.

Block access to app store

X

App store icon missing on Android home page, disabled on Windows, missing on iOS.

Require password for app store

iOS: Password required for iTunes purchases.

Block connection to removable storage

X

NA

Android: SD card will be grayed out in settings, Windows notifies user, apps installed there are not available

Block Bluetooth connection

***

***

***We can't disable BlueTooth as a setting on Android. Instead, we disable all the transactions that require BlueTooth: Advanced Audio Distribution, Audio/Video Remote Control, hands-free devices, headset, Phone Book Access, and Serial Port. A small toast message appears at the bottom of the page when any of these are used.

What happens when you delete a policy or remove a user from the policy?

When you delete a policy or remove a user from a group to which the policy was deployed to, the policy settings, Office 365 email profile and cached emails may be removed from the user's device. See the following table to see what is removed for the different device types:

What's removed

Windows Phone 8.1+

iOS 6+

Android 4+ (including Samsung Knox)

Managed email profiles*

Policy settings


Except for Block sending diagnostic data from device.

Note: *If the policy was deployed with the option Email profile is managed selected, then the managed email profile and cached emails in that profile will be deleted from the user's device.

Each user that the removed policy applied to will have the policy removed from their device the next time their mobile device checks in with MDM for Office 365 . If you deploy a new policy that applies to these users' devices, they'll be prompted to re-enroll in MDM for Office 365.

You can also wipe a device, either completely, or selectively wipe organizational information from the device.

Related Topics

Overview of Mobile Device Management for Office 365
Capabilities of Mobile Device Management for Office 365

Expand your Office skills
Explore training
Get new features first
Join Office Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×