Mobile Device Management

Moraph resells, configures and runs Microsoft Intune so advisors can use firm email, Teams and documents on their personal phones inside protected apps. Intune keeps business data in those apps, stops it being copied to personal ones, and removes it with a selective wipe when an advisor leaves or loses a phone, without touching personal photos or messages. Moraph runs the service day to day, and your security and compliance teams approve the policies and see the evidence.

The problem it solves

Advisors want to answer clients from their own phones, and firms cannot realistically hand every advisor a second device. Without controls, client information ends up in personal email, personal cloud storage and photo galleries, and when an advisor leaves the firm there is no reliable way to get it back. Full device management on a personal phone is intrusive and advisors resist it. Meanwhile examiners ask how customer information is protected on mobile devices and how the firm knows its policies are actually applied.

Who it’s for

• Broker-dealers, RIAs and banks whose advisors use personal phones for work
• Chief information security officers and IT leaders responsible for mobile access
• Chief compliance officers who answer for customer information safeguards and supervision
• IT teams who want Intune run well without adding headcount
• Internal audit and examiners reviewing mobile access controls

1. OnboardMoraph sets up Intune app protection for your firm's apps and brings advisors on in waves, so each group is supported as it starts using firm apps on personal phones.
2. ProtectIntune applies the approved policies every time a firm app is opened: an app PIN or biometric, restrictions on copying data to personal apps, and checks on the phone's operating system and integrity.
3. MonitorMoraph watches app protection status, sign-in blocks and policy failures, triages them, and works with your help desk on anything that needs the advisor.
4. Wipe and offboardWhen an advisor leaves, or a phone is lost or replaced, Moraph issues a selective wipe that removes firm data from the protected apps and leaves personal data alone.

App protection without enrollment

Intune protects firm data inside the apps themselves, so advisors' personal phones are not enrolled or managed as whole devices.

Selective wipe

Intune removes firm email, files and app data from a phone on request, without touching the advisor's photos, messages or personal apps.

Data transfer controls

Copy, paste, save-as and share are limited to other protected apps, so client information does not move into personal email or storage.

App access requirements

Firm apps ask for a PIN or biometric, and Intune checks operating system version and signs of jailbreak or root before opening firm data.

Conditional Access

Microsoft Entra Conditional Access lets firm data reach only apps that carry an Intune protection policy, so unprotected apps cannot sign in.

Personal data stays personal

With app protection on a personal phone, the firm does not see the advisor's personal apps, photos, messages or location.

Firm-owned devices

Where you issue devices, Intune enrollment and compliance policies manage the whole device, configured by Moraph to the same baseline.

Approved policy baseline

Moraph maintains a documented baseline of your mobile policies, approved by your security and compliance teams, and checks Intune against it.

Managed changes

Every policy change goes through a change request with your approval, a pilot group where it matters, and a record of what changed.

Daily monitoring

Moraph reviews protection status, blocked sign-ins and policy failures and works through them with your help desk.

Offboarding link

Departures recorded in your identity directory trigger a selective wipe request, so firm data does not stay on a departed advisor's phone.

Evidence for examiners

Policy settings, change history, protection coverage and wipe records are kept and exportable for audit and examination.

Moraph endpoint engineer

Configures Intune, applies approved changes, triages alerts and issues selective wipes

Moraph service manager

Runs the change process and monthly service reviews, and is your point of contact

Security lead

Approves mobile policies, exceptions and wipes outside the routine process

Compliance officer

Confirms policies meet recordkeeping and supervision needs and reviews the evidence

IT administrator and help desk

Co-administers Intune, supports advisors and raises wipe and change requests

Advisor

Uses firm apps on a personal phone under the protection policy

Microsoft Entra ID

User accounts, groups and Conditional Access, so firm data reaches only protected apps and policies target the right people.

Microsoft 365 apps

Outlook, Teams, OneDrive, SharePoint, Edge and Office apps carry the Intune protection policy on the phone.

Line-of-business apps

Other apps can be protected where their vendor supports Intune app protection; Moraph checks support before they are added.

HR offboarding

Departures recorded in your identity directory, usually fed from HR, raise a selective wipe request.

Communication archiving

Keeping business messages in approved firm apps supports capture by your archiving service, including Moraph's Communication Archiving.

Ticketing

Wipe, change and support requests can be raised in your service desk tool and linked to Moraph's tickets.

Security monitoring

Intune audit logs and alerts can be sent to your security monitoring or SIEM, as well as reviewed by Moraph.

Single sign-on

Administrators, including Moraph's engineers, sign in through Microsoft Entra ID with multi-factor authentication.

Role-based access

Intune administrator roles and scope limit each administrator to the tasks and users their work needs.

Time-bound privileged access

Moraph's administrator access is activated for a limited time with approval, and staff cannot use it without explicit, time-bound authorization.

Logged changes

Every policy change, wipe and role assignment is recorded in Intune's audit log and in Moraph's change records with the person, time and approval.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Microsoft's own platform assurance reports are available from Microsoft under its terms.

Data residency

Intune data stays in the Microsoft region of your tenant, and Moraph's service records stay in the United States, United Kingdom or Australia region you choose.

App protection on personal phones

Intune protects firm apps on advisors' own iOS and Android phones without enrolling the device.

Enrolled firm-owned devices

For devices the firm issues, Intune enrollment manages the whole device under the same baseline.

Your existing Intune tenant

Moraph can take over operation of Intune you already use, starting with a review of the current configuration against your requirements.

With other managed services

Run alongside Moraph's Identity Access Management, Data Loss Prevention or Communication Archiving services where you use them.

Discovery

We review your Microsoft tenant, current mobile access, the apps advisors use and your recordkeeping and supervision requirements. We need a tenant administrator and a compliance contact.

Policy baseline

We propose app protection, Conditional Access and, where needed, device compliance policies, and agree the baseline with your security and compliance teams.

Pilot

The baseline is applied to a pilot group, usually IT staff and a few advisors, and adjusted from what they find.

Runbook and approvals

We agree the change process, wipe approval rules, escalation contacts and how requests reach Moraph.

Rollout in waves

Advisors are brought on by office or team with instructions for your help desk, and coverage is tracked for each wave.

Handover to service

Daily monitoring, the change process and monthly service reviews begin, and the first review confirms the baseline is in force.

• Moraph is not Microsoft. Intune and Entra ID belong to Microsoft, and Microsoft's own service commitments, roadmap, maintenance and outages apply to them.
• Licenses are subject to Microsoft's terms, and the features available depend on the Microsoft plans you license.
• Intune does not archive messages. Recordkeeping for business communication depends on your archiving service and on advisors using approved apps.
• Selective wipe removes firm data from protected apps when they next connect; a phone that never reconnects keeps the data until it does, although protected apps can be set to block access after a period offline.
• App protection controls what the apps allow. It cannot stop someone photographing the screen with another device or retyping information.
• On personal phones without enrollment, the firm cannot locate, lock or fully wipe the device; those actions are available only on enrolled devices.
• Only apps that support Intune app protection can be protected. Personal messaging apps and other unsupported apps cannot carry firm data under the policy.
• Policy decisions, exceptions and responses to incidents, including any regulatory notification, are your firm's decisions.

• Install the protected apps on a test personal phone and try copying firm data into a personal app
• Issue a selective wipe on the test phone and confirm personal data is untouched
• Review the proposed baseline with your security and compliance leads
• Check how a departure in your directory turns into a wipe request and record
• Ask for a sample monthly service review and change record
• Confirm which of the apps your advisors use support Intune app protection