Financial Services · Managed platform (Microsoft Intune)

Mobile Device Management

Firm apps and client data on advisors' own phones, kept separate and removable

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, configures and runs Microsoft Intune so advisors can use firm email, Teams and documents on their personal phones inside protected apps. Intune keeps business data in those apps, stops it being copied to personal ones, and removes it with a selective wipe when an advisor leaves or loses a phone, without touching personal photos or messages. Moraph runs the service day to day, and your security and compliance teams approve the policies and see the evidence.

The problem it solves

Advisors want to answer clients from their own phones, and firms cannot realistically hand every advisor a second device. Without controls, client information ends up in personal email, personal cloud storage and photo galleries, and when an advisor leaves the firm there is no reliable way to get it back. Full device management on a personal phone is intrusive and advisors resist it. Meanwhile examiners ask how customer information is protected on mobile devices and how the firm knows its policies are actually applied.

  • Client information leaks into personal apps and cloud storage on advisors' phones
  • Departing advisors may keep business data the firm cannot remove
  • Advisors resist full management of devices they own and pay for
  • Mobile policies and their enforcement are hard to evidence for examiners

Who uses it

  • Broker-dealers, RIAs and banks whose advisors use personal phones for work
  • Chief information security officers and IT leaders responsible for mobile access
  • Chief compliance officers who answer for customer information safeguards and supervision
  • IT teams who want Intune run well without adding headcount
  • Internal audit and examiners reviewing mobile access controls

Requirements it supports

Regulation S-P (17 CFR Part 248), safeguarding and disposal of customer informationGramm-Leach-Bliley Act safeguards requirements (15 U.S.C. 6801 et seq.)SEC Rule 17a-4 and FINRA Rule 4511 (books and records)FINRA Rule 3110 (supervision)NYDFS Cybersecurity Regulation (23 NYCRR Part 500)FFIEC IT Examination Handbook, Information Security booklet

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Microsoft provides and operates Intune, Moraph configures and runs it for you, and your firm decides the policies and supports its advisors.

AreaMoraphMicrosoftYour organization
LicensingResells Microsoft licensing that includes Intune and keeps counts aligned with your usersSets license terms and what each plan includesAgrees the users and plans and pays under the order
Platform availabilityWatches Microsoft service health and raises issues with Microsoft supportOperates the Intune and Entra ID cloud services under its own service commitmentsTells Moraph about business impact
Tenant and identityConfigures Conditional Access rules for mobile apps as approvedProvides Entra ID and Conditional AccessOwns the tenant, user accounts, groups and administrator role assignments
Policy configurationProposes, builds and maintains app protection and compliance policies against the approved baselineProvides the policy features and supported appsApproves the baseline and every change and exception
Advisor onboardingPlans waves, prepares instructions and tracks coveragePublishes its apps in the public app storesCommunicates with advisors and collects the mobile use acknowledgment
MonitoringReviews protection status, alerts and blocked sign-ins each dayProvides reporting and alerts in IntuneProvides current escalation contacts
Selective wipe and offboardingIssues wipes for approved requests and confirms the resultRemoves firm data from protected apps when they next connectRaises requests promptly and records departures in the directory
Changes and platform updatesReviews Microsoft's announced Intune and app changes for effect on your settings and plans any needed changesReleases Intune service and app updatesApproves changes and pilot groups
Incident responseInvestigates mobile-related security events and takes approved actionsHandles incidents in its own platformDecides on response, notification and any regulatory reporting
User supportResolves configuration issues passed from your help deskSupports Moraph on platform issuesProvides first-line support to advisors

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Microsoft Intune itself, which belongs to its vendor.

  1. Step 1

    Onboarding tracker

    Advisors are brought on in waves, and Moraph tracks who has protected apps checked in and who still needs help.

    WaveGroupAdvisorsProtectedNot yet seenStatus
    1Pilot (IT and 6 advisors)14140Live
    2Example Office North48453Following up
    3Example Office South625111In progress
    4Home-based advisors37037Scheduled
    Advisors are brought on in waves, and Moraph tracks who has protected apps checked in and who still needs help.

  2. Step 2

    Configuration baseline review

    The daily check compares live Intune settings with the baseline your security and compliance teams approved.

    iOS app protection policy · Advisors

    Baseline version
    v7, approved by security lead
    Apps covered
    Outlook, Teams, OneDrive, Edge, Word, Excel
    Access requirement
    App PIN or biometric
    Copy to personal apps
    Blocked
    Minimum iOS version
    Differs from baseline
    Offline period before wipe
    As baseline

    Findings

    • Minimum OS version set one release lower than the approved baseline
    • Change found in Intune audit log, made under change CR-2291 still awaiting approval
    • No other differences
    The daily check compares live Intune settings with the baseline your security and compliance teams approved.

  3. Step 3

    A change request

    Policy changes are proposed, approved, piloted and applied, and each step is recorded.

    CR-2304 · Add Example CRM app to protected apps

    1. Request raised with business reasonIT administrator
    2. Confirmed the app supports Intune app protectionMoraph engineer
    3. Reviewed as an approved app for client communicationCompliance officer
    4. Change approvedSecurity lead
    5. Applied to pilot group and testedMoraph engineer
    6. Applied to all advisors and baseline updated to v8Moraph engineer
    Policy changes are proposed, approved, piloted and applied, and each step is recorded.

  4. Step 4

    Alert triage

    Moraph works through blocked access and policy failures each day and passes advisor actions to your help desk.

    UserEventAppAssessmentNext step
    Advisor 2041Blocked: OS below minimumOutlookPhone needs updateHelp desk to contact
    Advisor 1187Jailbreak detectedTeamsPossible compromiseEscalated to security lead
    Advisor 3320Unprotected app sign-in blockedPersonal mail appPolicy working as intendedClosed
    Advisor 0954Not seen for 30 daysAllPossible lost phoneHelp desk to confirm
    Moraph works through blocked access and policy failures each day and passes advisor actions to your help desk.

  5. Step 5

    Selective wipe for a departure

    A departure in the directory starts a wipe request, and the record shows it was issued and confirmed.

    WR-0188 · Advisor 2766 (departed)

    1. Account removed from advisor groupHR offboarding
    2. Wipe request created and matched to runbook ruleMoraph engineer
    3. Selective wipe issued for Outlook, Teams and OneDriveMoraph engineer
    4. Wipe confirmed by Intune for all three appsIntune
    5. Requester and compliance officer notifiedMoraph service manager
    A departure in the directory starts a wipe request, and the record shows it was issued and confirmed.

  6. Step 6

    Monthly service review

    Each month Moraph brings coverage, changes, wipes and recommendations to your security and compliance leads.

    Monthly service review · Example Wealth Partners (fictional)

    Advisors protected
    156 of 161
    Changes applied
    3, all approved
    Selective wipes
    4 issued, 4 confirmed
    Open exceptions
    2, review due next month
    Baseline differences
    1 open

    Recommendations

    • Raise minimum Android version after the announced Microsoft support change
    • Close the remaining baseline difference by approving or reverting CR-2291
    • Contact the five advisors not seen this month
    Each month Moraph brings coverage, changes, wipes and recommendations to your security and compliance leads.

Workflows

The principal workflows

  1. Onboard

    Moraph sets up Intune app protection for your firm's apps and brings advisors on in waves, so each group is supported as it starts using firm apps on personal phones.

    • Your security and compliance teams approve the mobile policy baseline
    • Moraph configures app protection and Conditional Access for each group
    • Advisors receive instructions and install the firm's apps from the public app store
    • Signing in to a firm app applies the protection policy to that app
    • Moraph tracks who is protected and follows up on anyone not yet covered

  2. Protect

    Intune applies the approved policies every time a firm app is opened: an app PIN or biometric, restrictions on copying data to personal apps, and checks on the phone's operating system and integrity.

    • Advisor opens Outlook, Teams or another protected app
    • Intune checks the app PIN and the conditions your policy sets
    • Copy, paste, save and share are limited to other firm apps
    • Phones that fail a condition, such as an out-of-date OS, are warned or blocked as your policy sets
    • Conditional Access blocks firm data from apps that are not protected

  3. Monitor

    Moraph watches app protection status, sign-in blocks and policy failures, triages them, and works with your help desk on anything that needs the advisor.

    • Moraph reviews protection status and Intune alerts each day
    • Users who are unprotected or repeatedly blocked are triaged
    • Issues needing the advisor are passed to your help desk with instructions
    • Suspected loss or misuse is escalated to your security team
    • Findings are recorded for the monthly service review

  4. Wipe and offboard

    When an advisor leaves, or a phone is lost or replaced, Moraph issues a selective wipe that removes firm data from the protected apps and leaves personal data alone.

    • Request comes from HR offboarding, your help desk or the advisor
    • Moraph confirms the request against your approval rules
    • Selective wipe issued for the user's protected apps in Intune
    • Intune removes firm data the next time the apps connect
    • Wipe status recorded and confirmed to the requester

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Moraph endpoint engineer

Moraph endpoint engineer, mobility engineer

Configures and operates Intune for your firm, within the baseline and change approvals you set.

Sees

  • Intune policies, app configurations and Conditional Access rules for your tenant
  • Protection status and check-in history for users and apps
  • Intune alerts, blocked sign-ins and policy failures
  • Open change requests and wipe requests

Does

  • Builds and maintains app protection and compliance policies
  • Applies approved changes, piloting them with a test group first where agreed
  • Triages protection gaps and policy failures each day
  • Issues selective wipes for approved requests and confirms the result
  • Checks the live configuration against the approved baseline
  • Raises issues with Microsoft support for platform problems

Cannot

  • Apply a policy change without an approved change request, except an emergency change your security lead authorizes
  • See advisors' personal apps or data on their phones
  • Grant themselves Intune or Entra administrator roles; their access is assigned by your firm and activated for a limited time
Approvals
Policy changes and exceptions are approved by your security lead; wipes follow the approval rules agreed in the runbook.
Notified about
Intune alerts, wipe and change requests assigned to them, and baseline differences found in the daily check.

Moraph service manager

Service delivery manager, client service manager

Owns the service relationship: runs the change process, reports on the service and escalates what needs your decision.

Sees

  • All service tickets, change requests and wipe records for your firm
  • Protection coverage and alert trends
  • Microsoft service health notices that affect Intune

Does

  • Chairs change review and brings requests to your approvers
  • Prepares and presents the monthly service review
  • Tracks actions from reviews and incidents until closed
  • Communicates Microsoft platform changes and outages that affect you
  • Coordinates licensing changes with your procurement team

Cannot

  • Approve a change on your behalf
  • Change Intune configuration directly
  • Decide policy questions that belong to your security or compliance teams
Approvals
None of their own; they route changes, exceptions and policy questions to your approvers.
Notified about
Escalated incidents, changes awaiting approval, and Microsoft notices affecting the service.

Security lead

CISO, information security officer, security manager

Decides what the mobile policies should be and approves changes and exceptions.

Sees

  • The approved baseline and every change made to it
  • Protection coverage, blocked sign-ins and policy failures
  • Wipe requests and their outcomes
  • The monthly service review and open actions

Does

  • Approves or returns policy changes and exceptions
  • Authorizes emergency changes and wipes outside the routine process
  • Sets the conditions, such as minimum OS version, that firm apps require
  • Decides on response when a phone is suspected lost or compromised
  • Reviews administrator access to Intune periodically

Cannot

  • Approve a change they requested themselves where your rules require a second approver
  • Edit Intune or Moraph change records after the fact
  • See advisors' personal data on their phones
Approvals
Approves policy changes, exceptions, emergency changes and non-routine wipes.
Notified about
Changes and exceptions awaiting approval, suspected lost devices, and significant gaps in protection coverage.

Compliance officer

Chief compliance officer, compliance manager, supervision principal

Makes sure mobile use fits the firm's recordkeeping, supervision and customer information obligations.

Sees

  • The mobile policy baseline and change history
  • Protection coverage by office or business line
  • Wipe records for departed advisors

Does

  • Confirms which apps advisors may use for business communication
  • Reviews policy changes that affect recordkeeping or supervision
  • Uses coverage and wipe records in compliance testing and exam responses
  • Approves the advisor acknowledgment used at onboarding

Cannot

  • Change Intune configuration
  • Issue a wipe directly; they raise a request
  • See advisors' personal data on their phones
Approvals
Reviews changes that affect which apps may be used for business communication; final approval of technical changes stays with the security lead.
Notified about
Changes affecting approved communication apps, and departed advisors whose wipe has not been confirmed.

IT administrator

IT manager, endpoint administrator, Microsoft 365 administrator

Holds administration of your Microsoft tenant and works with Moraph on Intune configuration and enrollment.

Sees

  • Intune configuration and status for the scope your firm assigns
  • Change requests and wipe records
  • Firm-owned device inventory and enrollment status

Does

  • Assigns administrator roles in Intune and Entra ID, including Moraph's
  • Maintains the user groups that policies target
  • Enrolls firm-owned devices
  • Raises change and wipe requests
  • Applies approved changes alongside Moraph where agreed

Cannot

  • Bypass the change process for policy changes without the security lead's approval
  • Delete Intune audit logs
  • See advisors' personal data on their phones
Approvals
Administrator role assignments are reviewed by the security lead.
Notified about
Changes to their scope, enrollment failures on firm-owned devices, and access reviews coming due.

Help desk

Service desk analyst, advisor support

Helps advisors install and use the firm's protected apps and raises requests when a phone is lost or replaced.

Sees

  • Protection status for the advisor they are helping
  • Setup instructions and known issues from Moraph
  • Status of requests they raised

Does

  • Guides advisors through installing and signing in to firm apps
  • Raises selective wipe requests for lost or replaced phones
  • Passes problems that need configuration to Moraph
  • Confirms with advisors when an issue is resolved

Cannot

  • Change policies
  • Issue a wipe themselves
  • See advisors' personal data on their phones
Approvals
Wipe requests they raise follow the runbook's approval rules.
Notified about
Updates on requests they raised and advisors Moraph asks them to contact.

Advisor

Financial advisor, registered representative, relationship manager

Uses firm email, Teams and documents on a personal phone inside protected apps.

Sees

  • Firm data in the protected apps on their own phone
  • Messages from Intune when a condition is not met, such as an outdated OS
  • The firm's mobile use acknowledgment

Does

  • Installs the firm's apps and signs in with firm credentials
  • Sets an app PIN or biometric
  • Keeps the phone's operating system current
  • Reports a lost or replaced phone to the help desk

Cannot

  • Copy firm data into personal apps or storage
  • Use firm data in apps without a protection policy
  • Turn off the protection policy
Approvals
None; their access depends on meeting the policy conditions.
Notified about
Intune prompts in the app, and help desk contact when their protection status needs attention.

Auditor or examiner (read-only)

Internal auditor, external auditor, regulatory examiner (under temporary access)

Reviews mobile policies, changes and wipe records without being able to change them.

Sees

  • The approved baseline and change history
  • Protection coverage and wipe records
  • Monthly service reviews

Does

  • Reads and exports evidence within the scope granted
  • Requests additional evidence through the service manager

Cannot

  • Change, approve or delete anything
  • Keep access after it expires
Approvals
Their access is approved by the security lead with a scope and an end date.
Notified about
Nothing by default.

Permissions at a glance

ActionMoraph engMoraph SMSecurity leadComplianceIT adminHelp deskAdvisorAuditor
Propose a policy changeFullFullFullFullFullNo accessNo accessNo access
Approve a policy change or exceptionNo accessNo accessApprovesView onlyNo accessNo accessNo accessNo access
Apply approved changes in IntuneFullNo accessNo accessNo accessFullNo accessNo accessNo access
Raise a selective wipe requestFullFullFullFullFullFullOwn work onlyNo access
Issue a selective wipeFullNo accessApprovesNo accessFullNo accessNo accessNo access
Install firm apps on a personal phoneNo accessNo accessNo accessNo accessNo accessNo accessOwn work onlyNo access
Triage alerts and protection gapsFullView onlyView onlyNo accessFullNo accessNo accessNo access
View protection coverage reportsFullFullFullFullFullView onlyOwn work onlyView only
View change and wipe recordsFullFullView onlyView onlyView onlyOwn work onlyNo accessView only
Assign Intune administrator rolesNo accessNo accessApprovesNo accessFullNo accessNo accessNo access
View audit logsView onlyView onlyView onlyView onlyView onlyNo accessNo accessView only
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Nobody sees an advisor's personal apps, photos or messages. With app protection on personal phones, Intune manages only the firm's apps and the data inside them.
  • Moraph's engineers hold Intune administrator roles that your firm assigns, scoped to your tenant and activated for a limited time with approval, so you can see and withdraw that access at any point.
  • Policy changes and exceptions are approved by your security lead, and changes that affect which apps may carry business communication are reviewed by compliance first.
  • Roles are agreed with you during onboarding, and auditors and examiners get temporary read-only access with a defined scope and an end date.

Features

What it does

App protection without enrollment

Intune protects firm data inside the apps themselves, so advisors' personal phones are not enrolled or managed as whole devices.

Selective wipe

Intune removes firm email, files and app data from a phone on request, without touching the advisor's photos, messages or personal apps.

Data transfer controls

Copy, paste, save-as and share are limited to other protected apps, so client information does not move into personal email or storage.

App access requirements

Firm apps ask for a PIN or biometric, and Intune checks operating system version and signs of jailbreak or root before opening firm data.

Conditional Access

Microsoft Entra Conditional Access lets firm data reach only apps that carry an Intune protection policy, so unprotected apps cannot sign in.

Personal data stays personal

With app protection on a personal phone, the firm does not see the advisor's personal apps, photos, messages or location.

Firm-owned devices

Where you issue devices, Intune enrollment and compliance policies manage the whole device, configured by Moraph to the same baseline.

Approved policy baseline

Moraph maintains a documented baseline of your mobile policies, approved by your security and compliance teams, and checks Intune against it.

Managed changes

Every policy change goes through a change request with your approval, a pilot group where it matters, and a record of what changed.

Daily monitoring

Moraph reviews protection status, blocked sign-ins and policy failures and works through them with your help desk.

Offboarding link

Departures recorded in your identity directory trigger a selective wipe request, so firm data does not stay on a departed advisor's phone.

Evidence for examiners

Policy settings, change history, protection coverage and wipe records are kept and exportable for audit and examination.

Integrations

How it connects to your systems

Connects toHowWhat flows
Microsoft Entra IDUser accounts, groups and Conditional Access, so firm data reaches only protected apps and policies target the right people.In: users, groups and sign-in outcomes. Out: Conditional Access rules configured by Moraph.
Microsoft 365 appsOutlook, Teams, OneDrive, SharePoint, Edge and Office apps carry the Intune protection policy on the phone.Policy applied in the apps; firm data stays inside them.
Line-of-business appsOther apps can be protected where their vendor supports Intune app protection; Moraph checks support before they are added.Policy applied in apps that support Intune.
HR offboardingDepartures recorded in your identity directory, usually fed from HR, raise a selective wipe request.In: account disabled or removed from the advisor group.
Communication archivingKeeping business messages in approved firm apps supports capture by your archiving service, including Moraph's Communication Archiving.No data passes through Intune to the archive; capture is configured in the archiving service.
TicketingWipe, change and support requests can be raised in your service desk tool and linked to Moraph's tickets.In and out: request details, status and outcome.
Security monitoringIntune audit logs and alerts can be sent to your security monitoring or SIEM, as well as reviewed by Moraph.Out: Intune audit and operational logs.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Administrators, including Moraph's engineers, sign in through Microsoft Entra ID with multi-factor authentication.

Role-based access

Intune administrator roles and scope limit each administrator to the tasks and users their work needs.

Time-bound privileged access

Moraph's administrator access is activated for a limited time with approval, and staff cannot use it without explicit, time-bound authorization.

Logged changes

Every policy change, wipe and role assignment is recorded in Intune's audit log and in Moraph's change records with the person, time and approval.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Microsoft's own platform assurance reports are available from Microsoft under its terms.

Data residency

Intune data stays in the Microsoft region of your tenant, and Moraph's service records stay in the United States, United Kingdom or Australia region you choose.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Service operations

Protection coverage

For moraph engineers, IT administrator, security lead

Advisors in scope, those with protected apps checked in, and those not yet covered or not seen recently.

Break down by
Office or team, App, Platform (iOS or Android), Last check-in
Delivered as
Weekly report; included in the monthly service review; CSV export
Used for
Following up with advisors who are not yet protected.

Alerts and blocked access

For moraph engineers, security lead

Intune alerts, sign-ins blocked by Conditional Access and policy condition failures, with how each was handled.

Break down by
Reason, User, App, Outcome
Delivered as
Monthly service review; CSV export
Used for
Spotting advisors who need help and policies that block more than intended.

Tickets and requests

For service manager, IT administrator

Support, change and wipe requests opened, in progress and closed, with their age.

Break down by
Request type, Requester, Status, Age
Delivered as
Monthly service review; CSV export
Used for
Making sure requests are worked and seeing where issues recur.

Compliance and evidence

Policy baseline and differences

For security lead, compliance officer, auditors

The approved mobile policy baseline, the live Intune settings, and any differences found by the daily check.

Break down by
Policy, Setting, Platform, Status
Delivered as
Monthly service review; PDF and CSV export
Used for
Showing that the policies in force are the ones the firm approved.

Change history

For security lead, compliance officer, auditors

Every change to mobile policies, with the request, approver, pilot result and date applied.

Break down by
Policy, Change type, Approver, Date
Delivered as
On request; PDF and CSV export
Used for
Evidencing that changes were approved and controlled.

Selective wipe record

For security lead, compliance officer, auditors

Each wipe requested, who requested and approved it, when it was issued and when Intune confirmed it.

Break down by
Reason (departure, loss, replacement), Requester, Status, Date
Delivered as
Monthly service review; CSV export
Used for
Showing that firm data was removed from phones of departed advisors.

Exceptions register

For security lead, compliance officer

Approved exceptions to the baseline, who they apply to, why, who approved them and when they are due for review.

Break down by
Policy, User or group, Approver, Review date
Delivered as
Monthly service review; CSV export
Used for
Keeping exceptions few, justified and reviewed.

Administrator access review

For security lead, IT administrator

Everyone holding Intune administrator roles, including Moraph staff, with role, scope and last activation.

Break down by
Role, Organization, Scope, Last used
Delivered as
Quarterly or as your policy sets; CSV export
Used for
Certifying that administrator access is still needed.

Management

Monthly service review

For security lead, IT leadership, compliance officer

Coverage, alerts, changes, wipes, open actions, Microsoft changes coming and recommendations for the period.

Break down by
Period, Topic, Action owner
Delivered as
PDF; presented in a meeting
Used for
Overseeing the service and deciding on recommendations.

License usage

For iT leadership, procurement

Licenses held against users assigned, and users who have left but still hold a license.

Break down by
License plan, Office or team, Assigned or unassigned
Delivered as
Monthly service review; CSV export
Used for
Keeping license counts aligned with the advisors who need them.

Exports, access and evidence

  • Reports are prepared by Moraph from Intune data and Moraph's own service records, and the monthly service review brings them together with recommendations.
  • Intune's own reports remain available in the Microsoft admin center to administrators your firm authorizes.
  • Evidence reports, such as change history and wipe records, can be exported to PDF and CSV for audit and examination.
  • Reports cover the firm's apps and data only; nothing about advisors' personal use of their phones is collected or reported.
  • Intune audit logs can also be sent to your own security monitoring, so your teams can report on them alongside other sources.

Deployment

Where and how it runs

App protection on personal phones

Intune protects firm apps on advisors' own iOS and Android phones without enrolling the device.

Enrolled firm-owned devices

For devices the firm issues, Intune enrollment manages the whole device under the same baseline.

Your existing Intune tenant

Moraph can take over operation of Intune you already use, starting with a review of the current configuration against your requirements.

With other managed services

Run alongside Moraph's Identity Access Management, Data Loss Prevention or Communication Archiving services where you use them.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Discovery

We review your Microsoft tenant, current mobile access, the apps advisors use and your recordkeeping and supervision requirements. We need a tenant administrator and a compliance contact.

Policy baseline

We propose app protection, Conditional Access and, where needed, device compliance policies, and agree the baseline with your security and compliance teams.

Pilot

The baseline is applied to a pilot group, usually IT staff and a few advisors, and adjusted from what they find.

Runbook and approvals

We agree the change process, wipe approval rules, escalation contacts and how requests reach Moraph.

Rollout in waves

Advisors are brought on by office or team with instructions for your help desk, and coverage is tracked for each wave.

Handover to service

Daily monitoring, the change process and monthly service reviews begin, and the first review confirms the baseline is in force.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not Microsoft. Intune and Entra ID belong to Microsoft, and Microsoft's own service commitments, roadmap, maintenance and outages apply to them.
  • Licenses are subject to Microsoft's terms, and the features available depend on the Microsoft plans you license.
  • Intune does not archive messages. Recordkeeping for business communication depends on your archiving service and on advisors using approved apps.
  • Selective wipe removes firm data from protected apps when they next connect; a phone that never reconnects keeps the data until it does, although protected apps can be set to block access after a period offline.
  • App protection controls what the apps allow. It cannot stop someone photographing the screen with another device or retyping information.
  • On personal phones without enrollment, the firm cannot locate, lock or fully wipe the device; those actions are available only on enrolled devices.
  • Only apps that support Intune app protection can be protected. Personal messaging apps and other unsupported apps cannot carry firm data under the policy.
  • Policy decisions, exceptions and responses to incidents, including any regulatory notification, are your firm's decisions.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Install the protected apps on a test personal phone and try copying firm data into a personal app
  2. Issue a selective wipe on the test phone and confirm personal data is untouched
  3. Review the proposed baseline with your security and compliance leads
  4. Check how a departure in your directory turns into a wipe request and record
  5. Ask for a sample monthly service review and change record
  6. Confirm which of the apps your advisors use support Intune app protection

Questions

Frequently asked questions

Can the firm see what is on an advisor's personal phone?

No. With app protection on a personal phone, Intune manages only the firm's apps and the data in them. The firm does not see personal apps, photos, messages or location.

What happens to firm data when an advisor leaves?

A selective wipe removes firm data from the protected apps when they next connect, and the record shows when it was issued and confirmed. Personal data on the phone is not touched.

We already have Intune. Can Moraph run it?

Yes. We start by reviewing your current configuration against your requirements, agree a baseline with you, and then take over day-to-day operation.

Does this capture text messages for recordkeeping?

No. Intune protects data in approved apps; capturing business communication is done by your archiving service. Keeping advisors in approved apps supports that capture.

How is it priced?

The managed service is a subscription, usually measured by the number of users, with Microsoft licensing resold or brought by you and onboarding charged separately. See Working with Moraph for what drives a quotation.

Who approves policy changes?

Your security lead, with compliance reviewing changes that affect which apps may be used for business communication. Moraph proposes and applies changes but does not approve them.

Next steps

Evaluate Mobile Device Management

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Mobile Device Management guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Mobile Device Management support guide.

Related products