Previously, for the iOS/iPadOS platform, there was no control in the Intune MAM policy to prevent screen capture or screen sharing from a managed account within a MAM-protected app.
Thus, even after having a restricted data-sharing app protection policy, users could still capture screenshots within a MAM-protected managed app.
This default behavior for screen capture/screen sharing for your Intune MAM-protected app on iOS/iPadOS has now changed.
As communicated via Message Center Message ID – MC994266, based on your Intune app protection policy settings, now when a user attempts to screen capture or share the screen from a managed account within a MAM-protected app, a blank screen will be captured/shared instead of the actual screen display content.
How is iOS/iPadOS screen capture restriction enforced on an Intune MAM-protected app?
For the iOS/iPadOS platform, the screen capture functionality is controlled using the existing Send Org data to other apps setting within the Data Protection section of the App Protection policy.
For a MAM-protected app on the iOS/iPadOS platform that is updated to use Intune App SDK v19.7.6 or later for Xcode 15 and v20.2.1 or later for Xcode 16, blocking screen capture functionality is enabled by default when the Send Org data to other apps configuration item is configured to anything other than “All apps“ in the applying App Protection policy.
However, if in your existing App Protection policy, you have set the “Send Org data to other apps” to “All apps”, it means you are not really enforcing any data protection restrictions, and thus blocking screen capture will not be enforced.
Blocking screen capture is enabled by default on the iOS/iPadOS platform for MAM-protected apps with a restricted data-sharing policy in place. If data sharing is allowed with all apps, screen capture will not be blocked.
The way Microsoft implemented the functionality to have screen captures restricted in iOS/iPadOS with MAM is in contrast to the same thing for the Android platform where it is a completely separate independent configuration item with a toggle button to enable or disable the functionality within the app protection policy.
How to override Intune MAM default behavior for screen capture?
If you want to revert to the old behavior and let users take screen captures without removing the data-sharing restriction as imposed by the app protection policy, by which the block screen capture functionality is also being enforced, you need to have an app configuration policy configured and deployed with the setting “com.microsoft.intune.mam.screencapturecontrol" set to "Disabled”.
This overrides the screen capture restriction that is now being imposed as part of the Apple platform’s secure-by-default philosophy.
You can start having this configuration by heading over to Apps > App configuration policies in the Microsoft Intune Admin Center and, from there on, create an App Configuration policy of type Managed Apps.
Next in the Settings Catalog page, you don’t need to configure anything. Just click on Next to proceed to the next screen. Here in the Settings section, expand General configuration settings and add the key like this:
Name: com.microsoft.intune.mam.screencapturecontrol Value: Disabled
Complete creating the profile/policy from there on and have it assigned to the required group of users. It is very important here to use a User group only.
Though the default Intune MAM sync cycle is 30 minutes, I have seen this configuration take a considerable amount of time to take effect on the device. In general, you have to wait till the configuration policy downloads to the device and you restart the app, which could take anywhere up to 24 hours.
Ending
In the end, I can say that this update closes a significant gap and aligns Intune’s functionality across all the platforms.
However, if you require to lift the restriction of screen capture, for the iOS platform, it takes some additional effort on the IT admin side, which is otherwise a simple toggle button within the Android app protection policy.
Be the first to comment