https://github.com/mizcausevic-dev/intune-app-protection-lab
Operator surface for Microsoft Intune app protection, BYOD scope, policy gaps, and enforcement posture.
https://github.com/mizcausevic-dev/intune-app-protection-lab
app-protection azure byod intune mam microsoft-365 mobile-application-management platform-engineering security-operations typescript
Last synced: 3 days ago
JSON representation
Operator surface for Microsoft Intune app protection, BYOD scope, policy gaps, and enforcement posture.
- Host: GitHub
- URL: https://github.com/mizcausevic-dev/intune-app-protection-lab
- Owner: mizcausevic-dev
- License: agpl-3.0
- Created: 2026-05-29T04:08:04.000Z (6 days ago)
- Default Branch: main
- Last Pushed: 2026-05-31T20:45:44.000Z (3 days ago)
- Last Synced: 2026-05-31T22:19:18.459Z (3 days ago)
- Topics: app-protection, azure, byod, intune, mam, microsoft-365, mobile-application-management, platform-engineering, security-operations, typescript
- Language: TypeScript
- Homepage: https://protect.kineticgain.com/
- Size: 493 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 10
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md
Awesome Lists containing this project
README
# Intune App Protection Lab
[](https://github.com/mizcausevic-dev/intune-app-protection-lab/actions/workflows/ci.yml)
[](./LICENSE)
[](https://github.com/mizcausevic-dev/intune-app-protection-lab/actions/workflows/pages.yml)
Operator control plane for Microsoft Intune app protection, unmanaged transfer risk, BYOD scope, managed-browser posture, and enforcement readiness across mobile app lanes.
## Why this matters (KG Embedded tie-back)
- Intune app-protection posture usually lives in policy screens, rollout notes, and exception threads instead of one buyer-readable operating surface.
- Security and workplace-platform teams need to see which app lanes are missing policy coverage, which exceptions still allow data escape, and which rollout lanes are safe to expand.
- This Kinetic Gain operator surface turns synthetic MAM-style packets into app-lane, policy-gap, and enforcement views that can later be embedded inside a tenant-safe Microsoft admin product.
## What it includes
- app-protection lane visibility for active Intune MAM / BYOD / contractor routes
- policy-gap review across missing assignments, unmanaged transfer controls, stale sync, and rooted-device exposure
- enforcement packets for rollout timing and exception cleanup
- offline-safe analysis of captured app-protection assignment packets
- library + CLI + Express operator surface + static Pages deploy
## Routes
- `/`
- `/protection-lane`
- `/policy-gaps`
- `/enforcement-posture`
- `/verification`
- `/docs`
## API
- `/api/dashboard/summary`
- `/api/protection-lane`
- `/api/policy-gaps`
- `/api/enforcement-posture`
- `/api/verification`
- `/api/sample`
## Screenshots
## CLI
```powershell
npx intune-app-protection .\fixtures\app-protection.json --format markdown
```
Optional flags:
- `--format json|markdown|summary`
- `--now `
- `--stale-after-days `
- `--fail-on-high`
- `--out `
## Local run
```powershell
cd intune-app-protection-lab
npm install
npm run verify
npm run prerender
npm run render:assets
npm run dev
```
Then open:
- [http://127.0.0.1:5512/](http://127.0.0.1:5512/)
- [http://127.0.0.1:5512/protection-lane](http://127.0.0.1:5512/protection-lane)
- [http://127.0.0.1:5512/policy-gaps](http://127.0.0.1:5512/policy-gaps)
- [http://127.0.0.1:5512/enforcement-posture](http://127.0.0.1:5512/enforcement-posture)
## Live surface
- [https://protect.kineticgain.com/](https://protect.kineticgain.com/)
## Synthetic-data note
This repo publishes synthetic sample app-protection data only. It does not ship live tenant exports, Graph tokens, or authenticated write paths.