Security, data and compliance in Mobile Device Management

How Mobile Device Management protects data and supports your compliance obligations.

Security controls

Single sign-on

Administrators, including Moraph's engineers, sign in through Microsoft Entra ID with multi-factor authentication.

Role-based access

Intune administrator roles and scope limit each administrator to the tasks and users their work needs.

Time-bound privileged access

Moraph's administrator access is activated for a limited time with approval, and staff cannot use it without explicit, time-bound authorization.

Logged changes

Every policy change, wipe and role assignment is recorded in Intune's audit log and in Moraph's change records with the person, time and approval.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Microsoft's own platform assurance reports are available from Microsoft under its terms.

Data residency

Intune data stays in the Microsoft region of your tenant, and Moraph's service records stay in the United States, United Kingdom or Australia region you choose.

Requirements it supports

• Regulation S-P (17 CFR Part 248), safeguarding and disposal of customer information
• Gramm-Leach-Bliley Act safeguards requirements (15 U.S.C. 6801 et seq.)
• SEC Rule 17a-4 and FINRA Rule 4511 (books and records)
• FINRA Rule 3110 (supervision)
• NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
• FFIEC IT Examination Handbook, Information Security booklet

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• App protection on personal phones: Intune protects firm apps on advisors' own iOS and Android phones without enrolling the device.
• Enrolled firm-owned devices: For devices the firm issues, Intune enrollment manages the whole device under the same baseline.
• Your existing Intune tenant: Moraph can take over operation of Intune you already use, starting with a review of the current configuration against your requirements.
• With other managed services: Run alongside Moraph's Identity Access Management, Data Loss Prevention or Communication Archiving services where you use them.

Limitations

• Moraph is not Microsoft. Intune and Entra ID belong to Microsoft, and Microsoft's own service commitments, roadmap, maintenance and outages apply to them.
• Licenses are subject to Microsoft's terms, and the features available depend on the Microsoft plans you license.
• Intune does not archive messages. Recordkeeping for business communication depends on your archiving service and on advisors using approved apps.
• Selective wipe removes firm data from protected apps when they next connect; a phone that never reconnects keeps the data until it does, although protected apps can be set to block access after a period offline.
• App protection controls what the apps allow. It cannot stop someone photographing the screen with another device or retyping information.
• On personal phones without enrollment, the firm cannot locate, lock or fully wipe the device; those actions are available only on enrolled devices.
• Only apps that support Intune app protection can be protected. Personal messaging apps and other unsupported apps cannot carry firm data under the policy.
• Policy decisions, exceptions and responses to incidents, including any regulatory notification, are your firm's decisions.