Encrypting Corporate Data in Managed Apps on iOS with Intune APP
Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that corporate data in managed apps is encrypted at rest. Which setting should you configure?
Quick Answer
The correct answer is the App protection policy – Data protection – Encrypt app data setting. This is because Intune App Protection Policy (APP) encrypts corporate data at rest on iOS by leveraging the device’s hardware-backed Data Protection class, which ties the encryption key to the user’s device passcode, ensuring that managed app data remains inaccessible if the device is lost or stolen. On the MD-102 exam, this question tests your ability to distinguish between app-level encryption (configured under Data Protection in APP) and device-level encryption (such as BitLocker or FileVault), a common trap where candidates mistakenly choose a device compliance policy. Remember that for iOS, the "Encrypt app data" setting within APP is the only way to enforce encryption of corporate data inside managed apps without requiring full device enrollment. A helpful memory tip: think of APP as the "app armor" that wraps around your data, while device encryption protects the entire phone—for managed app data on iOS, always look under Data Protection.
⚠ Common exam trap
Watch out — candidates often confuse device-level encryption (which is always on for iOS with a passcode) with app-level encryption, and incorrectly choose a Device Compliance Policy or Configuration Profile, not realizing that only App Protection Policies can enforce encryption specifically for corporate data within managed apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
App protection policy – Data protection – Encrypt app data.
App Protection Policies (APP) in Microsoft Intune include a 'Data Protection' setting called 'Encrypt app data' that enforces encryption of corporate data at rest on iOS/iPadOS devices. This setting uses hardware-backed file-level encryption (Data Protection class) to protect data in managed apps, ensuring that even if the device is lost or stolen, the data remains inaccessible without the user's passcode.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Device compliance policy – Require data encryption.
Why it's wrong here
This encrypts the device, not app data.
- ✓
App protection policy – Data protection – Encrypt app data.
Why this is correct
Encrypts app data at rest.
- ✗
Enrollment restrictions – Require encrypted backup.
Why it's wrong here
Not related to app data encryption.
- ✗
Device configuration profile – Encryption settings.
Why it's wrong here
Does not encrypt app data.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data is protected when users access Microsoft 365 apps. Which policy should you configure?
hard- A.Use a Mobile App Configuration policy to enforce app settings.
- ✓ B.Deploy an Intune App Protection Policy (APP) for Microsoft 365 apps.
- C.Create a Device Compliance policy for iOS devices.
- D.Configure a Conditional Access policy to require compliant devices.
Why B: Intune App Protection Policies (APP) protect corporate data at the app level for Microsoft 365 apps, without requiring device enrollment or management. Option A is incorrect because Mobile App Configuration policies enforce app settings but do not protect data. Option C is incorrect because Device Compliance policies ensure devices meet compliance criteria but do not protect data within apps. Option D is incorrect because Conditional Access policies control access based on conditions but do not directly protect data within apps.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.