Dynamics 365 Business Central: Expense Agent mobile app

🚨 The Signal: A new mobile app for Dynamics 365 Business Central allows employees to capture and submit expense receipts from iOS/Android devices, including offline. This expands the attack surface for sensitive financial data and introduces new mobile endpoint risks.

The Impact

Users handling financial data are affected, increasing risk of data exfiltration and unauthorised access via mobile endpoints.

• End-users: Risk of sensitive financial data exposure if mobile devices are compromised or lost.
• Security Team: Increased mobile attack surface requiring enhanced endpoint security and data loss prevention policies.
• Admins: Need to secure and manage a new mobile application and its access to Dynamics 365 Business Central data.
• Compliance Officers: New considerations for data residency and protection on mobile devices, especially in offline mode.

The Action

1. Review and update Intune Mobile Application Management (MAM) policies for Dynamics 365 Business Central Expense Agent.
2. Implement or strengthen Mobile Device Management (MDM) policies for devices accessing financial data.
3. Configure Conditional Access policies to restrict access to Dynamics 365 Business Central from unmanaged or non-compliant mobile devices.
4. Conduct a privacy impact assessment (PIA) for data captured and stored offline by the Expense Agent app.
5. Educate users on secure mobile device practices and reporting lost/stolen devices.

Domain: Intune · Impact: high · Workload: Other