Configuring Microsoft Intune

Microsoft Entra ID or Intune administrator must complete this configuration.

Creating and assigning the application protection policy

Create and assign an iOS or iPadOS application protection policy for Infor XM Mobile.

  1. Sign on to the Microsoft Intune admin center.
  2. Select App protection policies in the App menu.
  3. Click Create policy.
  4. Select iOS/iPadOS.
  5. Specify information on these fields:
    • Basics
      Name
      Specify a name, such as Infor Expense iOS - App Protection.
      Platform
      Select iOS/iPadOS.
    • Apps
      1. Set the value of the Target apps on all device types field to No.
      2. Select Unmanaged device types. This configuration applies protection at the app level without requiring device enrollment.
      3. Click Select custom apps in the Custom apps menu.
      4. Specify com.infor.hl.xm in the Bundle ID field.
        Note: Add Infor XM Mobile as a custom application. The application is not included in the built-in Intune public application catalog.
    • Data Protection
      Setting Recommended value
      Restrict cut, copy, and paste between other apps Select Policy managed apps. Set Cut and copy character limit for any app to 2.
      Screen capture Select Block.
      PIN for access Configure a numeric PIN with a minimum length of six digits and block simple PINs.
      Note: This field is mandatory.
      PIN reset after number of days Configure a reset interval, such as every 90 days.
      Touch ID / Face ID instead of PIN for access Select Allow for both settings
      Override biometrics with PIN after timeout Specify a timeout that exceeds the access recheck interval, such as 120 minutes.
      Note: This field is mandatory.
      Recheck the access requirements after (minutes of inactivity) Specify 30 minutes. This is the default Intune setting.
      Note: For iOS, the Screen capture setting is available on the Functionality tab in the Data Protection menu. When the value is set to Block, you cannot capture screenshots, record the screen, share the screen, or mirror application content using AirPlay. Attempts to capture application content result in a blank image.
    • Access Requirements
      Setting Recommended value
      PIN for access Select Require to mandate users to specify a PIN to access the app.
      PIN type / minimum length Select Numeric as the PIN type and specify 6 as the minimum PIN length.
      Simple PIN Select Block to prevent users from setting simple PINs, such as 1234 or 1111.
      Touch ID / Face ID instead of PIN Select Allow to enable users to use Touch ID or Face ID instead of entering a PIN
      Recheck access requirements after inactivity Specify 30 minutes to recheck the access requirements after the application has been inactive for this period.
      Override biometrics with PIN after timeout Select Require and specify a timeout value that is higher than the Recheck access requirements after inactivity value, for example, 120 minutes.
      Note: 
      • 30 minutes is the default value for the Recheck access requirements after inactivityfield , not the minimum value. You can specify a shorter interval to prompt users more frequently. For example, you can use 2 minutes for testing.
      • For Face ID or Touch ID to work reliably, set Override biometrics with PIN after timeout to a value greater than Recheck access requirements after inactivity. If both settings have the same value, users are prompted for the PIN instead of biometric authentication.
    • Conditional Launch
      Condition Recommended Value Action
      Maximum PIN attempts 5 Reset PIN
      Offline grace period 720 to 1,440 minutes Block access temporarily until the device reconnects.
      Offline grace period 90 days Wipe data permanently to remove company data from the application.
      Jailbroken/rooted devices Not applicable Block access
      Minimum operating system version (Optional) For example, iOS 17.0 Block access
  6. Add the group you created when configuring Microsoft Entra, to the Included groups on the Assignments tab. See, Configuring Microsoft Entra ID.
  7. Review the settings and click Create to create the policy.
    Note: Users who are not included in an assigned group cannot access the app and receive a message indicating that no App Protection Policy is assigned to the account. Ensure that the assigned group includes all users who require access to the application.