Access Control & Data Protection Procedure

Document Number: ISMS-PROC-BYOD-03

Version: 0.1.3

Parent Policy: BYOD Security Policy (ISMS-POL-BYOD-01)

Author: Lucas Shin — Security Director

Last Modified: March 1, 2026

Document Control

1. Purpose

This procedure defines:

• How access to corporate SaaS applications and M365 services is controlled across BYOD platforms
• How corporate data is protected through Conditional Access (CA), Mobile Application Management (MAM), and platform-specific data isolation
• Platform-specific access pathways, data access architecture, and their technical enforcement

2. Access Control

2.1 Platform-Specific Access Pathways

⚠️ Windows BYOD limitation: Windows MAM only covers Managed Edge. Office desktop apps (Teams, Outlook, Word, etc.) cannot receive MAM protection. The default pathway therefore restricts M365 access to web apps via Managed Edge only.

2.2 Managed Edge Controls

2.3 Conditional Access (CA) Architecture

CA 3-Policy Evaluation Flow

The following diagram illustrates how Conditional Access policies evaluate user access requests to M365 services. The evaluation order is: Assignment (who is the user?) → Grant (device/app compliance) → Session Control (SPO/ODB restrictions).

flowchart TD
    Start["🔐 사용자가 M365 접근 시도"] --> Assignment{"📋 Assignment 평가<br>(누구인가?)"}
    Assignment -->|"Break-glass 계정"| BG["✅ 모든 정책 Exclude<br>→ 무제한 접근"]
    Assignment -->|"Guest (#EXT#)"| GuestPolicy{"정책 2<br>CA-Permit-Guest-MFA<br>MFA 충족?"}
    GuestPolicy -->|"Yes"| GuestOK["✅ M365 접근 허용<br>(MFA 필수, 네이티브 앱 포함)"]
    GuestPolicy -->|"No"| GuestBlock["❌ 차단"]
    Assignment -->|"내부 사용자"| P1{"정책 1<br>CA-Require-AllApps-CompliantOrAPP<br>Grant 평가"}
    P1 --> OR{"Compliant Device<br>**OR**<br>App Protection Policy?"}
    OR -->|"macOS ADUE<br>→ Compliant ✅"| Pass["✅ Grant 통과"]
    OR -->|"Windows MAM Edge<br>→ APP ✅"| Pass
    OR -->|"Windows Full MDM<br>→ Compliant ✅"| Pass
    OR -->|"미충족"| Block["❌ 차단<br>(별도 Block 정책 불필요)"]
    Pass --> SPO{"SPO / ODB<br>접근인가?"}
    SPO -->|"아니오"| Done["✅ 접근 허용"]
    SPO -->|"예"| P3{"정책 3<br>CA-Restrict-SPO-Unmanaged<br>Session Control 평가"}
    P3 --> Managed{"디바이스 상태?"}
    Managed -->|"Managed<br>(macOS ADUE,<br>Windows Full MDM)"| Full["✅ 전체 기능<br>download/print 허용"]
    Managed -->|"Unmanaged<br>(Windows MAM Edge)"| Restricted["⚠️ 제한 접근<br>download/print 차단"]
    style Block fill:#ff6b6b,color:#fff
    style GuestBlock fill:#ff6b6b,color:#fff
    style BG fill:#51cf66,color:#fff
    style Done fill:#51cf66,color:#fff
    style Full fill:#51cf66,color:#fff
    style GuestOK fill:#74c0fc,color:#fff
    style Restricted fill:#ffd43b,color:#333

Device & App Control

Data Access Control (SharePoint / OneDrive)

Corporate data is protected by two layers: (1) SPO site permissions = Teams membership — users can only access SharePoint sites for teams they belong to, even via direct URL; (2) CA policies enforce device/app compliance and restrict actions on unmanaged devices.

• Level 2 users (Business Basic + Entra ID P1): SPO access is scoped to Teams membership. Session Control blocks download/sync/print on unmanaged devices. Access is restricted to browser-only viewing within the membership scope.
• External Guests: CA-Permit-Guest-MFA requires MFA. Access scoped to teams/channels where Guest is a member. Native app access permitted (Teams, Outlook).
• Why P1 is mandatory for Basic users: CA policies require Entra ID P1 to operate. Without P1: (1) Session Control cannot restrict download/sync/print on unmanaged devices, (2) Windows BYOD Teams Desktop app login is not blocked → bypasses Edge-only restriction. See M365 Workspace & Access Policy (ISMS-POL-M365-01) §6.3 for full architecture.

2.4 Windows BYOD — Default Path vs Exception Path

Exception Path — Required Technical Controls:

1. BitLocker + Key Escrow — Full disk encryption; recovery key stored in Entra ID. Provides the organisation with final authority over storage, enabling lock/wipe at offboarding.
2. OneDrive KFM (Known Folder Move) — Desktop, Documents, and Pictures folders redirected to corporate OneDrive. ⚠️ KFM is cloud sync for specific folders, not OS-level volume isolation like macOS ADUE.
3. Standard User Enforcement — Local admin rights removed. Prevents tampering with security policies (BitLocker, KFM, Intune).

Exception Path — Prerequisite:

• BYOD Full MDM Consent Form must be signed before enrollment (covers storage control delegation, Full Wipe possibility, personal data loss liability).

3. Data Protection

3.1 MAM (Mobile Application Management) Controls by Platform

⚠️ MAM Common Limitations (all platforms):

- No inbound control: Cannot prevent personal data from entering the managed area

- No account filtering: Cannot inspect or block which SaaS account a user logs into within Managed Edge

- No personal browser blocking: Personal browser use (Safari, Chrome, Edge personal profile) is permitted by BYOD design — corporate SaaS access is blocked by CA, not by device-level browser restrictions

3.2 macOS Data Protection (ADUE)

• ADUE (Account-Driven User Enrollment) creates a separate APFS Managed Volume for work data
• Work data is isolated in the Managed Volume; personal data remains untouched
• Intune APP (App Protection Policy) is not supported on macOS. Data protection relies on Managed Volume isolation (storage-level), not app-level DLP (copy/paste, save-as controls are unavailable). See §3.1 table.
• Native desktop app use is fully supported via VPP deployment into the Managed Volume (Teams, Outlook, Edge, OneDrive, Word, Excel, etc.).
• Residual gap: Clipboard copy/paste from managed apps to personal apps cannot be blocked on macOS (no APP, no Managed Pasteboard for macOS desktop apps). Accepted as residual risk — see BYOD Security Policy §6 and Domain Context §3.6.
• Note: Windows BYOD also intentionally allows copy/paste (same risk rationale — see §3.3). Both platforms accept clipboard as residual risk; screenshot channel is open on both regardless.
• Selective Wipe: Removes the entire Managed Volume only (personal area preserved)

3.3 Windows BYOD Data Protection

Default Path (Managed Edge Only):

• No OS-level data isolation mechanism (WIP deprecated, no replacement)
• Corporate data exists only within Managed Edge browser sessions
• APP enforcement summary (Managed Edge):
  • Download to local: Blocked (no OS-level storage isolation)
  • Save-as to unmanaged storage: Blocked (no OS-level storage isolation)
  • Copy/paste to unmanaged apps: Allowed — risk accepted (macOS parity; clipboard is per-instance manual copy with low exfiltration efficiency; screenshot channel open on both platforms). Pending CISO approval.
  • Print: Blocked (alternative: export to PDF → send via Outlook)
• Selective Wipe: Removes organisational data from Edge only

Exception Path (Full MDM):

• BitLocker + Key Escrow: Full disk encryption with recovery key in Entra ID — provides organisational final authority over storage
• OneDrive KFM (Known Folder Move): Core folders redirected to corporate OneDrive for cloud-based data recovery
• Standard User: Prevents policy tampering by removing local admin rights
• Offboarding sequence: Selective Wipe first → if unsuccessful, BitLocker key-based Full Wipe → device deregistration from Entra ID + key disposal
• ⚠️ This is an approximate equivalent of macOS ADUE’s data isolation, not identical — KFM is folder-level cloud sync, not volume-level OS isolation

3.4 iOS / Android Data Protection

• MAM (App Protection Policy) controls data movement between managed and unmanaged apps
• Corporate data within managed apps cannot be copied, saved, or shared to personal apps
• Selective Wipe: Removes corporate data from managed apps only (personal apps and data preserved)

4. Exception App Approval

Note: For Windows BYOD users requiring Office desktop app access, see Section 2.4 (Exception Path — Full MDM). This section covers exceptions for third-party SaaS tools not available through the managed Edge pathway.

When a user requires access to a SaaS tool not covered by the managed Edge pathway:

5. Operational Routine

6. Evidence Retention

7. Periodic Review

• Quarterly: Review CA policy effectiveness, blocked access trends, shadow IT risk
• Annually: Review MAM policy adequacy, assess need for additional app controls, management review input

[End of Procedure]