Mobile Device Management

Principal workflows

• Onboard: Moraph sets up Intune app protection for your firm's apps and brings advisors on in waves, so each group is supported as it starts using firm apps on personal phones.
• Protect: Intune applies the approved policies every time a firm app is opened: an app PIN or biometric, restrictions on copying data to personal apps, and checks on the phone's operating system and integrity.
• Monitor: Moraph watches app protection status, sign-in blocks and policy failures, triages them, and works with your help desk on anything that needs the advisor.
• Wipe and offboard: When an advisor leaves, or a phone is lost or replaced, Moraph issues a selective wipe that removes firm data from the protected apps and leaves personal data alone.

Who uses it

• Broker-dealers, RIAs and banks whose advisors use personal phones for work
• Chief information security officers and IT leaders responsible for mobile access
• Chief compliance officers who answer for customer information safeguards and supervision
• IT teams who want Intune run well without adding headcount
• Internal audit and examiners reviewing mobile access controls

Reporting

• Protection coverage by office, app and platform
• Alerts, blocked sign-ins and how they were handled
• Policy baseline and differences from it
• Change history with approvals
• Selective wipe record for departures and lost phones
• Monthly service review with open actions

Features

• App protection without enrollment: Intune protects firm data inside the apps themselves, so advisors' personal phones are not enrolled or managed as whole devices.
• Selective wipe: Intune removes firm email, files and app data from a phone on request, without touching the advisor's photos, messages or personal apps.
• Data transfer controls: Copy, paste, save-as and share are limited to other protected apps, so client information does not move into personal email or storage.
• App access requirements: Firm apps ask for a PIN or biometric, and Intune checks operating system version and signs of jailbreak or root before opening firm data.
• Conditional Access: Microsoft Entra Conditional Access lets firm data reach only apps that carry an Intune protection policy, so unprotected apps cannot sign in.
• Personal data stays personal: With app protection on a personal phone, the firm does not see the advisor's personal apps, photos, messages or location.
• Firm-owned devices: Where you issue devices, Intune enrollment and compliance policies manage the whole device, configured by Moraph to the same baseline.
• Approved policy baseline: Moraph maintains a documented baseline of your mobile policies, approved by your security and compliance teams, and checks Intune against it.
• Managed changes: Every policy change goes through a change request with your approval, a pilot group where it matters, and a record of what changed.
• Daily monitoring: Moraph reviews protection status, blocked sign-ins and policy failures and works through them with your help desk.
• Offboarding link: Departures recorded in your identity directory trigger a selective wipe request, so firm data does not stay on a departed advisor's phone.
• Evidence for examiners: Policy settings, change history, protection coverage and wipe records are kept and exportable for audit and examination.

Integrations

• Microsoft Entra ID: User accounts, groups and Conditional Access, so firm data reaches only protected apps and policies target the right people.
• Microsoft 365 apps: Outlook, Teams, OneDrive, SharePoint, Edge and Office apps carry the Intune protection policy on the phone.
• Line-of-business apps: Other apps can be protected where their vendor supports Intune app protection; Moraph checks support before they are added.
• HR offboarding: Departures recorded in your identity directory, usually fed from HR, raise a selective wipe request.
• Communication archiving: Keeping business messages in approved firm apps supports capture by your archiving service, including Moraph's Communication Archiving.
• Ticketing: Wipe, change and support requests can be raised in your service desk tool and linked to Moraph's tickets.
• Security monitoring: Intune audit logs and alerts can be sent to your security monitoring or SIEM, as well as reviewed by Moraph.

Deployment

• App protection on personal phones: Intune protects firm apps on advisors' own iOS and Android phones without enrolling the device.
• Enrolled firm-owned devices: For devices the firm issues, Intune enrollment manages the whole device under the same baseline.
• Your existing Intune tenant: Moraph can take over operation of Intune you already use, starting with a review of the current configuration against your requirements.
• With other managed services: Run alongside Moraph's Identity Access Management, Data Loss Prevention or Communication Archiving services where you use them.

Security and privacy

• Single sign-on: Administrators, including Moraph's engineers, sign in through Microsoft Entra ID with multi-factor authentication.
• Role-based access: Intune administrator roles and scope limit each administrator to the tasks and users their work needs.
• Time-bound privileged access: Moraph's administrator access is activated for a limited time with approval, and staff cannot use it without explicit, time-bound authorization.
• Logged changes: Every policy change, wipe and role assignment is recorded in Intune's audit log and in Moraph's change records with the person, time and approval.
• Independent audits: Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Microsoft's own platform assurance reports are available from Microsoft under its terms.
• Data residency: Intune data stays in the Microsoft region of your tenant, and Moraph's service records stay in the United States, United Kingdom or Australia region you choose.

Limitations

• Moraph is not Microsoft. Intune and Entra ID belong to Microsoft, and Microsoft's own service commitments, roadmap, maintenance and outages apply to them.
• Licenses are subject to Microsoft's terms, and the features available depend on the Microsoft plans you license.
• Intune does not archive messages. Recordkeeping for business communication depends on your archiving service and on advisors using approved apps.
• Selective wipe removes firm data from protected apps when they next connect; a phone that never reconnects keeps the data until it does, although protected apps can be set to block access after a period offline.
• App protection controls what the apps allow. It cannot stop someone photographing the screen with another device or retyping information.
• On personal phones without enrollment, the firm cannot locate, lock or fully wipe the device; those actions are available only on enrolled devices.
• Only apps that support Intune app protection can be protected. Personal messaging apps and other unsupported apps cannot carry firm data under the policy.
• Policy decisions, exceptions and responses to incidents, including any regulatory notification, are your firm's decisions.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/mobile-device-management. Purchasing routes and company information: www.moraph.com/how-to-buy.