Fleet compliance, conditional access and app protection policies
You tie a device's state to the decision to reach company data: compliance rules, conditional access, app protection policies on unenrolled devices, exception handling and measuring fleet health.
Level 401 · 18 lessons · 15 practice labs
Lessons
Designing compliance
- Designing a compliance baseline
- Version and patch rules: how old is too old
- Device integrity signals: root access, bootloader, attestation verdict
- Grace periods and user notices
- Mobile hardening benchmarks and checklists
- Short task: write a compliance baseline for a bank branch fleet
Conditional access
- The conditional access model: who, which device, which app, which condition
- Using device compliance as an access signal
- Policy conflicts and gaps: the app left out of scope
- Reading a policy's effect from sign-in logs
- Safe rollout with report-only mode
- Short task: find the policy gap that lets a non-compliant device reach email
App protection and exceptions
- App protection policies: work data on unenrolled devices
- Data transfer rules and the app PIN
- Exception management: time-bound, justified, recorded
- Fleet health metrics and the management report
- Short task: find the expired and unjustified entries in the exception list
Capstone
- Capstone: design and test access rules for BYOD and company devices at a hospital group
Practice labs
- Read the minimum version in a compliance rule: Find the version and patch threshold in the rule file.
- Write a baseline for a bank branch fleet: Write version, passcode, encryption and integrity rules for Yelkovan Bankası with their grace periods.
- Compute a threshold's effect on the fleet from data: Try the patch threshold at three values, compute how many devices would fall out and write a recommendation.
- Read the conditions of a conditional access rule: List the user, app and device conditions.
- Find the gap that lets a non-compliant device reach email: Test the rule set on the identity provider stub and show the client left out of scope.
- Close the gap and test in report-only mode: Fix the rule, measure its effect from sign-in records in report-only mode and write the rollout decision.
- Count the blocked sign-ins: Filter the sign-ins refused by policy in the log.
- Find the rule that blocks the most users: Group the refused sign-ins by rule and report the most common cause.
- Find the wrongly blocked user group and fix the rule: Identify the field team wrongly blocked from the log, correct the rule's condition and retest.
- Read the data transfer setting in an app protection policy: Find the copy and save rules.
- Write an app protection policy for unenrolled devices: Write a policy with an app PIN, copy restriction and selective wipe conditions.
- Design and test access rules for BYOD and company devices: Write separate rules for the two device types at Lavinya Klinikleri and test six scenarios on the stub.
- Find the expired entries in the exception list: Filter the exceptions past their end date.
- Clean up unjustified and ownerless exceptions: Find the entries with missing fields and write a close-or-renew decision for each.
- Compute fleet health metrics and report to management: Compute compliance rate, mean patch age and exception count from the data and write a one-page report.
About this course
You tie a device's state to the decision to reach company data: compliance rules, conditional access, app protection policies on unenrolled devices, exception handling and measuring fleet health.
What you will learn
- Designing compliance
- Conditional access
- App protection and exceptions
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.