Create defaultManagedAppProtection
Namespace: microsoft.graph
Important: Microsoft Graph APIs under the /beta version are subject to change; production use is not supported.
Note: The Microsoft Graph API for Intune requires an active Intune license for the tenant.
Create a new defaultManagedAppProtection object.
This API is available in the following national cloud deployments.
| Global service | US Government L4 | US Government L5 (DOD) | China operated by 21Vianet |
|---|---|---|---|
| ✅ | ✅ | ✅ | ✅ |
Permissions
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.
| Permission type | Permissions (from least to most privileged) |
|---|---|
| Delegated (work or school account) | DeviceManagementConfiguration.ReadWrite.All, DeviceManagementApps.ReadWrite.All |
| Delegated (personal Microsoft account) | Not supported. |
| Application | DeviceManagementConfiguration.ReadWrite.All, DeviceManagementApps.ReadWrite.All |
HTTP Request
POST /deviceAppManagement/defaultManagedAppProtections
Request headers
| Header | Value |
|---|---|
| Authorization | Bearer {token}. Required. Learn more about authentication and authorization. |
| Accept | application/json |
Request body
In the request body, supply a JSON representation for the defaultManagedAppProtection object.
The following table shows the properties that are required when you create the defaultManagedAppProtection.
| Property | Type | Description |
|---|---|---|
| displayName | String | Policy display name. Inherited from managedAppPolicy |
| description | String | The policy's description. Inherited from managedAppPolicy |
| createdDateTime | DateTimeOffset | The date and time the policy was created. Inherited from managedAppPolicy |
| lastModifiedDateTime | DateTimeOffset | Last time the policy was modified. Inherited from managedAppPolicy |
| roleScopeTagIds | String collection | List of Scope Tags for this Entity instance. Inherited from managedAppPolicy |
| id | String | Key of the entity. Inherited from managedAppPolicy |
| version | String | Version of the entity. Inherited from managedAppPolicy |
| periodOfflineBeforeAccessCheck | Duration | The period after which access is checked when the device is not connected to the internet. Inherited from managedAppProtection |
| periodOnlineBeforeAccessCheck | Duration | The period after which access is checked when the device is connected to the internet. Inherited from managedAppProtection |
| allowedInboundDataTransferSources | managedAppDataTransferLevel | Sources from which data is allowed to be transferred. Inherited from managedAppProtection. Possible values are: allApps, managedApps, none. |
| allowedOutboundDataTransferDestinations | managedAppDataTransferLevel | Destinations to which data is allowed to be transferred. Inherited from managedAppProtection. Possible values are: allApps, managedApps, none. |
| organizationalCredentialsRequired | Boolean | Indicates whether organizational credentials are required for app use. Inherited from managedAppProtection |
| allowedOutboundClipboardSharingLevel | managedAppClipboardSharingLevel | The level to which the clipboard may be shared between apps on the managed device. Inherited from managedAppProtection. Possible values are: allApps, managedAppsWithPasteIn, managedApps, blocked. |
| dataBackupBlocked | Boolean | Indicates whether the backup of a managed app's data is blocked. Inherited from managedAppProtection |
| deviceComplianceRequired | Boolean | Indicates whether device compliance is required. Inherited from managedAppProtection |
| managedBrowserToOpenLinksRequired | Boolean | Indicates whether internet links should be opened in the managed browser app, or any custom browser specified by CustomBrowserProtocol (for iOS) or CustomBrowserPackageId/CustomBrowserDisplayName (for Android) Inherited from managedAppProtection |
| saveAsBlocked | Boolean | Indicates whether users may use the "Save As" menu item to save a copy of protected files. Inherited from managedAppProtection |
| periodOfflineBeforeWipeIsEnforced | Duration | The amount of time an app is allowed to remain disconnected from the internet before all managed data it is wiped. Inherited from managedAppProtection |
| pinRequired | Boolean | Indicates whether an app-level pin is required. Inherited from managedAppProtection |
| maximumPinRetries | Int32 | Maximum number of incorrect pin retry attempts before the managed app is either blocked or wiped. Inherited from managedAppProtection |
| simplePinBlocked | Boolean | Indicates whether simplePin is blocked. Inherited from managedAppProtection |
| minimumPinLength | Int32 | Minimum pin length required for an app-level pin if PinRequired is set to True Inherited from managedAppProtection |
| pinCharacterSet | managedAppPinCharacterSet | Character set which may be used for an app-level pin if PinRequired is set to True. Inherited from managedAppProtection. Possible values are: numeric, alphanumericAndSymbol. |
| periodBeforePinReset | Duration | TimePeriod before the all-level pin must be reset if PinRequired is set to True. Inherited from managedAppProtection |
| allowedDataStorageLocations | managedAppDataStorageLocation collection | Data storage locations where a user may store managed data. Inherited from managedAppProtection. Possible values are: oneDriveForBusiness, sharePoint, box, localStorage, photoLibrary. |
| contactSyncBlocked | Boolean | Indicates whether contacts can be synced to the user's device. Inherited from managedAppProtection |
| printBlocked | Boolean | Indicates whether printing is allowed from managed apps. Inherited from managedAppProtection |
| fingerprintBlocked | Boolean | Indicates whether use of the fingerprint reader is allowed in place of a pin if PinRequired is set to True. Inherited from managedAppProtection |
| disableAppPinIfDevicePinIsSet | Boolean | Indicates whether use of the app pin is required if the device pin is set. Inherited from managedAppProtection |
| maximumRequiredOsVersion | String | Versions bigger than the specified version will block the managed app from accessing company data. Inherited from managedAppProtection |
| maximumWarningOsVersion | String | Versions bigger than the specified version will block the managed app from accessing company data. Inherited from managedAppProtection |
| maximumWipeOsVersion | String | Versions bigger than the specified version will block the managed app from accessing company data. Inherited from managedAppProtection |
| minimumRequiredOsVersion | String | Versions less than the specified version will block the managed app from accessing company data. Inherited from managedAppProtection |
| minimumWarningOsVersion | String | Versions less than the specified version will result in warning message on the managed app from accessing company data. Inherited from managedAppProtection |
| minimumRequiredAppVersion | String | Versions less than the specified version will block the managed app from accessing company data. Inherited from managedAppProtection |
| minimumWarningAppVersion | String | Versions less than the specified version will result in warning message on the managed app. Inherited from managedAppProtection |
| minimumWipeOsVersion | String | Versions less than or equal to the specified version will wipe the managed app and the associated company data. Inherited from managedAppProtection |
| minimumWipeAppVersion | String | Versions less than or equal to the specified version will wipe the managed app and the associated company data. Inherited from managedAppProtection |
| appActionIfDeviceComplianceRequired | managedAppRemediationAction | Defines a managed app behavior, either block or wipe, when the device is either rooted or jailbroken, if DeviceComplianceRequired is set to true. Inherited from managedAppProtection. Possible values are: block, wipe, warn. |
| appActionIfMaximumPinRetriesExceeded | managedAppRemediationAction | Defines a managed app behavior, either block or wipe, based on maximum number of incorrect pin retry attempts. Inherited from managedAppProtection. Possible values are: block, wipe, warn. |
| pinRequiredInsteadOfBiometricTimeout | Duration | Timeout in minutes for an app pin instead of non biometrics passcode Inherited from managedAppProtection |
| allowedOutboundClipboardSharingExceptionLength | Int32 | Specify the number of characters that may be cut or copied from Org data and accounts to any application. This setting overrides the AllowedOutboundClipboardSharingLevel restriction. Default value of '0' means no exception is allowed. Inherited from managedAppProtection |
| notificationRestriction | managedAppNotificationRestriction | Specify app notification restriction Inherited from managedAppProtection. Possible values are: allow, blockOrganizationalData, block. |
| previousPinBlockCount | Int32 | Requires a pin to be unique from the number specified in this property. Inherited from managedAppProtection |
| managedBrowser | managedBrowserType | Indicates in which managed browser(s) that internet links should be opened. When this property is configured, ManagedBrowserToOpenLinksRequired should be true. Inherited from managedAppProtection. Possible values are: notConfigured, microsoftEdge. |
| maximumAllowedDeviceThreatLevel | managedAppDeviceThreatLevel | Maximum allowed device threat level, as reported by the MTD app Inherited from managedAppProtection. Possible values are: notConfigured, secured, low, medium, high. |
| mobileThreatDefenseRemediationAction | managedAppRemediationAction | Determines what action to take if the mobile threat defense threat threshold isn't met. Warn isn't a supported value for this property Inherited from managedAppProtection. Possible values are: block, wipe, warn. |
| mobileThreatDefensePartnerPriority | mobileThreatDefensePartnerPriority | Indicates how to prioritize which Mobile Threat Defense (MTD) partner is enabled for a given platform, when more than one is enabled. An app can only be actively using a single Mobile Threat Defense partner. When NULL, Microsoft Defender will be given preference. Otherwise setting the value to defenderOverThirdPartyPartner or thirdPartyPartnerOverDefender will make explicit which partner to prioritize. Possible values are: null, defenderOverThirdPartyPartner, thirdPartyPartnerOverDefender and unknownFutureValue. Default value is null Inherited from managedAppProtection. Possible values are: defenderOverThirdPartyPartner, thirdPartyPartnerOverDefender, unknownFutureValue. |
| blockDataIngestionIntoOrganizationDocuments | Boolean | Indicates whether a user can bring data into org documents. Inherited from managedAppProtection |
| allowedDataIngestionLocations | managedAppDataIngestionLocation collection | Data storage locations where a user may store managed data. Inherited from managedAppProtection. Possible values are: oneDriveForBusiness, sharePoint, camera, photoLibrary. |
| appActionIfUnableToAuthenticateUser | managedAppRemediationAction | If set, it will specify what action to take in the case where the user is unable to checkin because their authentication token is invalid. This happens when the user is deleted or disabled in AAD. Inherited from managedAppProtection. Possible values are: block, wipe, warn. |
| dialerRestrictionLevel | managedAppPhoneNumberRedirectLevel | The classes of dialer apps that are allowed to click-to-open a phone number. Inherited from managedAppProtection. Possible values are: allApps, managedApps, customApp, blocked. |
| gracePeriodToBlockAppsDuringOffClockHours | Duration | A grace period before blocking app access during off clock hours. Inherited from managedAppProtection |
| protectedMessagingRedirectAppType | messagingRedirectAppType | Defines how app messaging redirection is protected by an App Protection Policy. Default is anyApp. Inherited from managedAppProtection. Possible values are: anyApp, anyManagedApp, specificApps, blocked. |
| appDataEncryptionType | managedAppDataEncryptionType | Type of encryption which should be used for data in a managed app. (iOS Only). Possible values are: useDeviceSettings, afterDeviceRestart, whenDeviceLockedExceptOpenFiles, whenDeviceLocked. |
| screenCaptureBlocked | Boolean | Indicates whether screen capture is blocked. (Android only) |
| allowWidgetContentSync | Boolean | Indicates if content sync for widgets is allowed for iOS on App Protection Policies |
| encryptAppData | Boolean | Indicates whether managed-app data should be encrypted. (Android only) |
| disableAppEncryptionIfDeviceEncryptionIsEnabled | Boolean | When this setting is enabled, app level encryption is disabled if device level encryption is enabled. (Android only) |
| minimumRequiredSdkVersion | String | Versions less than the specified version will block the managed app from accessing company data. (iOS Only) |
| customSettings | keyValuePair collection | A set of string key and string value pairs to be sent to the affected users, unalterned by this service |
| deployedAppCount | Int32 | Count of apps to which the current policy is deployed. |
| minimumRequiredPatchVersion | String | Define the oldest required Android security patch level a user can have to gain secure access to the app. (Android only) |
| minimumWarningPatchVersion | String | Define the oldest recommended Android security patch level a user can have for secure access to the app. (Android only) |
| exemptedAppProtocols | keyValuePair collection | iOS Apps in this list will be exempt from the policy and will be able to receive data from managed apps. (iOS Only) |
| exemptedAppPackages | keyValuePair collection | Android App packages in this list will be exempt from the policy and will be able to receive data from managed apps. (Android only) |
| faceIdBlocked | Boolean | Indicates whether use of the FaceID is allowed in place of a pin if PinRequired is set to True. (iOS Only) |
| minimumWipeSdkVersion | String | Versions less than the specified version will block the managed app from accessing company data. |
| minimumWipePatchVersion | String | Android security patch level less than or equal to the specified value will wipe the managed app and the associated company data. (Android only) |
| allowedIosDeviceModels | String | Semicolon seperated list of device models allowed, as a string, for the managed app to work. (iOS Only) |
| appActionIfIosDeviceModelNotAllowed | managedAppRemediationAction | Defines a managed app behavior, either block or wipe, if the specified device model is not allowed. (iOS Only). Possible values are: block, wipe, warn. |
| allowedAndroidDeviceManufacturers | String | Semicolon seperated list of device manufacturers allowed, as a string, for the managed app to work. (Android only) |
| appActionIfAndroidDeviceManufacturerNotAllowed | managedAppRemediationAction | Defines a managed app behavior, either block or wipe, if the specified device manufacturer is not allowed. (Android only). Possible values are: block, wipe, warn. |
| thirdPartyKeyboardsBlocked | Boolean | Defines if third party keyboards are allowed while accessing a managed app. (iOS Only) |
| filterOpenInToOnlyManagedApps | Boolean | Defines if open-in operation is supported from the managed app to the filesharing locations selected. This setting only applies when AllowedOutboundDataTransferDestinations is set to ManagedApps and DisableProtectionOfManagedOutboundOpenInData is set to False. (iOS Only) |
| disableProtectionOfManagedOutboundOpenInData | Boolean | Disable protection of data transferred to other apps through IOS OpenIn option. This setting is only allowed to be True when AllowedOutboundDataTransferDestinations is set to ManagedApps. (iOS Only) |
| protectInboundDataFromUnknownSources | Boolean | Protect incoming data from unknown source. This setting is only allowed to be True when AllowedInboundDataTransferSources is set to AllApps. (iOS Only) |
| requiredAndroidSafetyNetDeviceAttestationType | androidManagedAppSafetyNetDeviceAttestationType | Defines the Android SafetyNet Device Attestation requirement for a managed app to work. Possible values are: none, basicIntegrity, basicIntegrityAndDeviceCertification. |
| appActionIfAndroidSafetyNetDeviceAttestationFailed | managedAppRemediationAction | Defines a managed app behavior, either warn or block, if the specified Android SafetyNet Attestation requirement fails. Possible values are: block, wipe, warn. |
| requiredAndroidSafetyNetAppsVerificationType | androidManagedAppSafetyNetAppsVerificationType | Defines the Android SafetyNet Apps Verification requirement for a managed app to work. Possible values are: none, enabled. |
| appActionIfAndroidSafetyNetAppsVerificationFailed | managedAppRemediationAction | Defines a managed app behavior, either warn or block, if the specified Android App Verification requirement fails. Possible values are: block, wipe, warn. |
| customBrowserProtocol | String | A custom browser protocol to open weblink on iOS. (iOS only) |
| customBrowserPackageId | String | Unique identifier of a custom browser to open weblink on Android. (Android only) |
| customBrowserDisplayName | String | Friendly name of the preferred custom browser to open weblink on Android. (Android only) |
| minimumRequiredCompanyPortalVersion | String | Minimum version of the Company portal that must be installed on the device or app access will be blocked |
| minimumWarningCompanyPortalVersion | String | Minimum version of the Company portal that must be installed on the device or the user will receive a warning |
| minimumWipeCompanyPortalVersion | String | Minimum version of the Company portal that must be installed on the device or the company data on the app will be wiped |
| allowedAndroidDeviceModels | String collection | List of device models allowed, as a string, for the managed app to work. (Android Only) |
| appActionIfAndroidDeviceModelNotAllowed | managedAppRemediationAction | Defines a managed app behavior, either block or wipe, if the specified device model is not allowed. (Android Only). Possible values are: block, wipe, warn. |
| customDialerAppProtocol | String | Protocol of a custom dialer app to click-to-open a phone number on iOS, for example, skype:. |
| customDialerAppPackageId | String | PackageId of a custom dialer app to click-to-open a phone number on Android. |
| customDialerAppDisplayName | String | Friendly name of a custom dialer app to click-to-open a phone number on Android. |
| biometricAuthenticationBlocked | Boolean | Indicates whether use of the biometric authentication is allowed in place of a pin if PinRequired is set to True. (Android Only) |
| requiredAndroidSafetyNetEvaluationType | androidManagedAppSafetyNetEvaluationType | Defines the Android SafetyNet evaluation type requirement for a managed app to work. (Android Only). Possible values are: basic, hardwareBacked. |
| blockAfterCompanyPortalUpdateDeferralInDays | Int32 | Maximum number of days Company Portal update can be deferred on the device or app access will be blocked. |
| warnAfterCompanyPortalUpdateDeferralInDays | Int32 | Maximum number of days Company Portal update can be deferred on the device or the user will receive the warning |
| wipeAfterCompanyPortalUpdateDeferralInDays | Int32 | Maximum number of days Company Portal update can be deferred on the device or the company data on the app will be wiped |
| deviceLockRequired | Boolean | Defines if any kind of lock must be required on device. (android only) |
| appActionIfDeviceLockNotSet | managedAppRemediationAction | Defines a managed app behavior, either warn, block or wipe, if the screen lock is required on device but is not set. (android only). Possible values are: block, wipe, warn. |
| connectToVpnOnLaunch | Boolean | Whether the app should connect to the configured VPN on launch (Android only). |
| appActionIfDevicePasscodeComplexityLessThanLow | managedAppRemediationAction | If the device does not have a passcode of low complexity or higher, trigger the stored action. Possible values are: block, wipe, warn. |
| appActionIfAccountIsClockedOut | managedAppRemediationAction | Defines a managed app behavior, either block or warn, if the user is clocked out (non-working time). Possible values are: block, wipe, warn. |
| appActionIfDevicePasscodeComplexityLessThanMedium | managedAppRemediationAction | If the device does not have a passcode of medium complexity or higher, trigger the stored action. Possible values are: block, wipe, warn. |
| appActionIfDevicePasscodeComplexityLessThanHigh | managedAppRemediationAction | If the device does not have a passcode of high complexity or higher, trigger the stored action. Possible values are: block, wipe, warn. |
| requireClass3Biometrics | Boolean | Require user to apply Class 3 Biometrics on their Android device. |
| requirePinAfterBiometricChange | Boolean | A PIN prompt will override biometric prompts if class 3 biometrics are updated on the device. |
| fingerprintAndBiometricEnabled | Boolean | Indicate to the client to enable both biometrics and fingerprints for the app. |
| minimumWarningSdkVersion | String | Versions less than the specified version will result in warning message on the managed app from accessing company data. (iOS only) |
| messagingRedirectAppUrlScheme | String | When a specific app redirection is enforced by protectedMessagingRedirectAppType in an App Protection Policy, this value defines the app url redirect schemes which are allowed to be used. |
| messagingRedirectAppDisplayName | String | When a specific app redirection is enforced by protectedMessagingRedirectAppType in an App Protection Policy, this value defines the app name which are allowed to be used. |
| messagingRedirectAppPackageId | String | When a specific app redirection is enforced by protectedMessagingRedirectAppType in an App Protection Policy, this value defines the app package ids which are allowed to be used. |
Response
If successful, this method returns a 201 Created response code and a defaultManagedAppProtection object in the response body.
Example
Request
Here is an example of the request.
POST https://graph.microsoft.com/beta/deviceAppManagement/defaultManagedAppProtections
Content-type: application/json
Content-length: 6236
{
"@odata.type": "#microsoft.graph.defaultManagedAppProtection",
"displayName": "Display Name value",
"description": "Description value",
"roleScopeTagIds": [
"Role Scope Tag Ids value"
],
"version": "Version value",
"periodOfflineBeforeAccessCheck": "-PT17.1357909S",
"periodOnlineBeforeAccessCheck": "PT35.0018757S",
"allowedInboundDataTransferSources": "managedApps",
"allowedOutboundDataTransferDestinations": "managedApps",
"organizationalCredentialsRequired": true,
"allowedOutboundClipboardSharingLevel": "managedAppsWithPasteIn",
"dataBackupBlocked": true,
"deviceComplianceRequired": true,
"managedBrowserToOpenLinksRequired": true,
"saveAsBlocked": true,
"periodOfflineBeforeWipeIsEnforced": "-PT3M22.1587532S",
"pinRequired": true,
"maximumPinRetries": 1,
"simplePinBlocked": true,
"minimumPinLength": 0,
"pinCharacterSet": "alphanumericAndSymbol",
"periodBeforePinReset": "PT3M29.6631862S",
"allowedDataStorageLocations": [
"sharePoint"
],
"contactSyncBlocked": true,
"printBlocked": true,
"fingerprintBlocked": true,
"disableAppPinIfDevicePinIsSet": true,
"maximumRequiredOsVersion": "Maximum Required Os Version value",
"maximumWarningOsVersion": "Maximum Warning Os Version value",
"maximumWipeOsVersion": "Maximum Wipe Os Version value",
"minimumRequiredOsVersion": "Minimum Required Os Version value",
"minimumWarningOsVersion": "Minimum Warning Os Version value",
"minimumRequiredAppVersion": "Minimum Required App Version value",
"minimumWarningAppVersion": "Minimum Warning App Version value",
"minimumWipeOsVersion": "Minimum Wipe Os Version value",
"minimumWipeAppVersion": "Minimum Wipe App Version value",
"appActionIfDeviceComplianceRequired": "wipe",
"appActionIfMaximumPinRetriesExceeded": "wipe",
"pinRequiredInsteadOfBiometricTimeout": "-PT3M9.8396734S",
"allowedOutboundClipboardSharingExceptionLength": 14,
"notificationRestriction": "blockOrganizationalData",
"previousPinBlockCount": 5,
"managedBrowser": "microsoftEdge",
"maximumAllowedDeviceThreatLevel": "secured",
"mobileThreatDefenseRemediationAction": "wipe",
"mobileThreatDefensePartnerPriority": "thirdPartyPartnerOverDefender",
"blockDataIngestionIntoOrganizationDocuments": true,
"allowedDataIngestionLocations": [
"sharePoint"
],
"appActionIfUnableToAuthenticateUser": "wipe",
"dialerRestrictionLevel": "managedApps",
"gracePeriodToBlockAppsDuringOffClockHours": "PT2M4.5004762S",
"protectedMessagingRedirectAppType": "anyManagedApp",
"appDataEncryptionType": "afterDeviceRestart",
"screenCaptureBlocked": true,
"allowWidgetContentSync": true,
"encryptAppData": true,
"disableAppEncryptionIfDeviceEncryptionIsEnabled": true,
"minimumRequiredSdkVersion": "Minimum Required Sdk Version value",
"customSettings": [
{
"@odata.type": "microsoft.graph.keyValuePair",
"name": "Name value",
"value": "Value value"
}
],
"deployedAppCount": 0,
"minimumRequiredPatchVersion": "Minimum Required Patch Version value",
"minimumWarningPatchVersion": "Minimum Warning Patch Version value",
"exemptedAppProtocols": [
{
"@odata.type": "microsoft.graph.keyValuePair",
"name": "Name value",
"value": "Value value"
}
],
"exemptedAppPackages": [
{
"@odata.type": "microsoft.graph.keyValuePair",
"name": "Name value",
"value": "Value value"
}
],
"faceIdBlocked": true,
"minimumWipeSdkVersion": "Minimum Wipe Sdk Version value",
"minimumWipePatchVersion": "Minimum Wipe Patch Version value",
"allowedIosDeviceModels": "Allowed Ios Device Models value",
"appActionIfIosDeviceModelNotAllowed": "wipe",
"allowedAndroidDeviceManufacturers": "Allowed Android Device Manufacturers value",
"appActionIfAndroidDeviceManufacturerNotAllowed": "wipe",
"thirdPartyKeyboardsBlocked": true,
"filterOpenInToOnlyManagedApps": true,
"disableProtectionOfManagedOutboundOpenInData": true,
"protectInboundDataFromUnknownSources": true,
"requiredAndroidSafetyNetDeviceAttestationType": "basicIntegrity",
"appActionIfAndroidSafetyNetDeviceAttestationFailed": "wipe",
"requiredAndroidSafetyNetAppsVerificationType": "enabled",
"appActionIfAndroidSafetyNetAppsVerificationFailed": "wipe",
"customBrowserProtocol": "Custom Browser Protocol value",
"customBrowserPackageId": "Custom Browser Package Id value",
"customBrowserDisplayName": "Custom Browser Display Name value",
"minimumRequiredCompanyPortalVersion": "Minimum Required Company Portal Version value",
"minimumWarningCompanyPortalVersion": "Minimum Warning Company Portal Version value",
"minimumWipeCompanyPortalVersion": "Minimum Wipe Company Portal Version value",
"allowedAndroidDeviceModels": [
"Allowed Android Device Models value"
],
"appActionIfAndroidDeviceModelNotAllowed": "wipe",
"customDialerAppProtocol": "Custom Dialer App Protocol value",
"customDialerAppPackageId": "Custom Dialer App Package Id value",
"customDialerAppDisplayName": "Custom Dialer App Display Name value",
"biometricAuthenticationBlocked": true,
"requiredAndroidSafetyNetEvaluationType": "hardwareBacked",
"blockAfterCompanyPortalUpdateDeferralInDays": 11,
"warnAfterCompanyPortalUpdateDeferralInDays": 10,
"wipeAfterCompanyPortalUpdateDeferralInDays": 10,
"deviceLockRequired": true,
"appActionIfDeviceLockNotSet": "wipe",
"connectToVpnOnLaunch": true,
"appActionIfDevicePasscodeComplexityLessThanLow": "wipe",
"appActionIfAccountIsClockedOut": "wipe",
"appActionIfDevicePasscodeComplexityLessThanMedium": "wipe",
"appActionIfDevicePasscodeComplexityLessThanHigh": "wipe",
"requireClass3Biometrics": true,
"requirePinAfterBiometricChange": true,
"fingerprintAndBiometricEnabled": true,
"minimumWarningSdkVersion": "Minimum Warning Sdk Version value",
"messagingRedirectAppUrlScheme": "Messaging Redirect App Url Scheme value",
"messagingRedirectAppDisplayName": "Messaging Redirect App Display Name value",
"messagingRedirectAppPackageId": "Messaging Redirect App Package Id value"
}
Response
Here is an example of the response. Note: The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
HTTP/1.1 201 Created
Content-Type: application/json
Content-Length: 6408
{
"@odata.type": "#microsoft.graph.defaultManagedAppProtection",
"displayName": "Display Name value",
"description": "Description value",
"createdDateTime": "2017-01-01T00:02:43.5775965-08:00",
"lastModifiedDateTime": "2017-01-01T00:00:35.1329464-08:00",
"roleScopeTagIds": [
"Role Scope Tag Ids value"
],
"id": "77064c51-4c51-7706-514c-0677514c0677",
"version": "Version value",
"periodOfflineBeforeAccessCheck": "-PT17.1357909S",
"periodOnlineBeforeAccessCheck": "PT35.0018757S",
"allowedInboundDataTransferSources": "managedApps",
"allowedOutboundDataTransferDestinations": "managedApps",
"organizationalCredentialsRequired": true,
"allowedOutboundClipboardSharingLevel": "managedAppsWithPasteIn",
"dataBackupBlocked": true,
"deviceComplianceRequired": true,
"managedBrowserToOpenLinksRequired": true,
"saveAsBlocked": true,
"periodOfflineBeforeWipeIsEnforced": "-PT3M22.1587532S",
"pinRequired": true,
"maximumPinRetries": 1,
"simplePinBlocked": true,
"minimumPinLength": 0,
"pinCharacterSet": "alphanumericAndSymbol",
"periodBeforePinReset": "PT3M29.6631862S",
"allowedDataStorageLocations": [
"sharePoint"
],
"contactSyncBlocked": true,
"printBlocked": true,
"fingerprintBlocked": true,
"disableAppPinIfDevicePinIsSet": true,
"maximumRequiredOsVersion": "Maximum Required Os Version value",
"maximumWarningOsVersion": "Maximum Warning Os Version value",
"maximumWipeOsVersion": "Maximum Wipe Os Version value",
"minimumRequiredOsVersion": "Minimum Required Os Version value",
"minimumWarningOsVersion": "Minimum Warning Os Version value",
"minimumRequiredAppVersion": "Minimum Required App Version value",
"minimumWarningAppVersion": "Minimum Warning App Version value",
"minimumWipeOsVersion": "Minimum Wipe Os Version value",
"minimumWipeAppVersion": "Minimum Wipe App Version value",
"appActionIfDeviceComplianceRequired": "wipe",
"appActionIfMaximumPinRetriesExceeded": "wipe",
"pinRequiredInsteadOfBiometricTimeout": "-PT3M9.8396734S",
"allowedOutboundClipboardSharingExceptionLength": 14,
"notificationRestriction": "blockOrganizationalData",
"previousPinBlockCount": 5,
"managedBrowser": "microsoftEdge",
"maximumAllowedDeviceThreatLevel": "secured",
"mobileThreatDefenseRemediationAction": "wipe",
"mobileThreatDefensePartnerPriority": "thirdPartyPartnerOverDefender",
"blockDataIngestionIntoOrganizationDocuments": true,
"allowedDataIngestionLocations": [
"sharePoint"
],
"appActionIfUnableToAuthenticateUser": "wipe",
"dialerRestrictionLevel": "managedApps",
"gracePeriodToBlockAppsDuringOffClockHours": "PT2M4.5004762S",
"protectedMessagingRedirectAppType": "anyManagedApp",
"appDataEncryptionType": "afterDeviceRestart",
"screenCaptureBlocked": true,
"allowWidgetContentSync": true,
"encryptAppData": true,
"disableAppEncryptionIfDeviceEncryptionIsEnabled": true,
"minimumRequiredSdkVersion": "Minimum Required Sdk Version value",
"customSettings": [
{
"@odata.type": "microsoft.graph.keyValuePair",
"name": "Name value",
"value": "Value value"
}
],
"deployedAppCount": 0,
"minimumRequiredPatchVersion": "Minimum Required Patch Version value",
"minimumWarningPatchVersion": "Minimum Warning Patch Version value",
"exemptedAppProtocols": [
{
"@odata.type": "microsoft.graph.keyValuePair",
"name": "Name value",
"value": "Value value"
}
],
"exemptedAppPackages": [
{
"@odata.type": "microsoft.graph.keyValuePair",
"name": "Name value",
"value": "Value value"
}
],
"faceIdBlocked": true,
"minimumWipeSdkVersion": "Minimum Wipe Sdk Version value",
"minimumWipePatchVersion": "Minimum Wipe Patch Version value",
"allowedIosDeviceModels": "Allowed Ios Device Models value",
"appActionIfIosDeviceModelNotAllowed": "wipe",
"allowedAndroidDeviceManufacturers": "Allowed Android Device Manufacturers value",
"appActionIfAndroidDeviceManufacturerNotAllowed": "wipe",
"thirdPartyKeyboardsBlocked": true,
"filterOpenInToOnlyManagedApps": true,
"disableProtectionOfManagedOutboundOpenInData": true,
"protectInboundDataFromUnknownSources": true,
"requiredAndroidSafetyNetDeviceAttestationType": "basicIntegrity",
"appActionIfAndroidSafetyNetDeviceAttestationFailed": "wipe",
"requiredAndroidSafetyNetAppsVerificationType": "enabled",
"appActionIfAndroidSafetyNetAppsVerificationFailed": "wipe",
"customBrowserProtocol": "Custom Browser Protocol value",
"customBrowserPackageId": "Custom Browser Package Id value",
"customBrowserDisplayName": "Custom Browser Display Name value",
"minimumRequiredCompanyPortalVersion": "Minimum Required Company Portal Version value",
"minimumWarningCompanyPortalVersion": "Minimum Warning Company Portal Version value",
"minimumWipeCompanyPortalVersion": "Minimum Wipe Company Portal Version value",
"allowedAndroidDeviceModels": [
"Allowed Android Device Models value"
],
"appActionIfAndroidDeviceModelNotAllowed": "wipe",
"customDialerAppProtocol": "Custom Dialer App Protocol value",
"customDialerAppPackageId": "Custom Dialer App Package Id value",
"customDialerAppDisplayName": "Custom Dialer App Display Name value",
"biometricAuthenticationBlocked": true,
"requiredAndroidSafetyNetEvaluationType": "hardwareBacked",
"blockAfterCompanyPortalUpdateDeferralInDays": 11,
"warnAfterCompanyPortalUpdateDeferralInDays": 10,
"wipeAfterCompanyPortalUpdateDeferralInDays": 10,
"deviceLockRequired": true,
"appActionIfDeviceLockNotSet": "wipe",
"connectToVpnOnLaunch": true,
"appActionIfDevicePasscodeComplexityLessThanLow": "wipe",
"appActionIfAccountIsClockedOut": "wipe",
"appActionIfDevicePasscodeComplexityLessThanMedium": "wipe",
"appActionIfDevicePasscodeComplexityLessThanHigh": "wipe",
"requireClass3Biometrics": true,
"requirePinAfterBiometricChange": true,
"fingerprintAndBiometricEnabled": true,
"minimumWarningSdkVersion": "Minimum Warning Sdk Version value",
"messagingRedirectAppUrlScheme": "Messaging Redirect App Url Scheme value",
"messagingRedirectAppDisplayName": "Messaging Redirect App Display Name value",
"messagingRedirectAppPackageId": "Messaging Redirect App Package Id value"
}