App configuration¶
App configuration policies set an app up for the user: the mail server, the home page, which accounts are allowed. Users get a working app on first launch, and you avoid support calls.
Create them under Apps > Configuration.
Two delivery channels¶
| Managed devices | Managed apps | |
|---|---|---|
| How it's delivered | Through the operating system's MDM channel (Apple managed app configuration, Android managed configurations) | Through the Intune App SDK inside the app |
| Device must be enrolled | Yes | No |
| Works with | Any app that supports the platform's app config standard | Apps with the Intune App SDK |
| Typical use | Corporate devices | Personal devices with app protection, or settings only SDK apps understand |
Apps with the SDK check for managed apps configuration about every 30 minutes when an app protection policy also applies to the user, and every 720 minutes when it doesn't.
Tokens¶
Instead of hard-coding values, use tokens that Intune replaces per user or device:
| Token | Value |
|---|---|
{{userprincipalname}} |
The user's UPN |
{{mail}} |
The user's email address |
{{userid}} |
The user's Entra object ID |
{{deviceid}} |
The Intune device ID |
{{serialnumber}} |
The device serial number (managed devices) |
Common configurations¶
Allow only work accounts in Microsoft 365 apps¶
On corporate devices you often want Outlook, Teams and the Office apps to accept only the user's work account.
| Key | Type | Value |
|---|---|---|
IntuneMAMAllowedAccountsOnly |
String | Enabled |
IntuneMAMUPN |
String | {{userprincipalname}} |
IntuneMAMOID |
String | {{userid}} |
Intune sends IntuneMAMUPN and IntuneMAMOID automatically to some Microsoft apps, but setting them explicitly is harmless and covers the rest.
| Key | Value |
|---|---|
com.microsoft.intune.mam.AllowedAccountUPNs |
{{userprincipalname}} |
Android also supports the Configuration designer in the policy, which lists each app's settings from its managed configuration schema.
Outlook¶
Outlook for iOS and Android has a built-in configuration section in the app configuration policy: account setup for managed devices, organization-allowed accounts, default signature, contact sync, and data protection settings that go beyond app protection policies. Use it rather than raw keys where possible.
Microsoft Edge¶
Edge on all platforms supports app configuration for:
- Managed favorites and the home page for the work profile
- Allowed and blocked URLs, with redirection of blocked sites to the personal profile
- Account restrictions, so only work accounts can sign in to the work profile
On Windows and macOS, configure Edge with the Edge settings in the settings catalog or the Edge security baseline instead.
Mac app preferences¶
For Mac apps that read preferences from a property list, use a Preference file profile (Devices > Manage devices > Configuration > macOS > Templates > Preference file) with the app's bundle ID and a .plist file. Microsoft apps such as Office, Edge, Defender and OneDrive also have settings in the settings catalog.
Troubleshooting¶
- Check the policy's device status (managed devices) or user status (managed apps).
- Key names are case-sensitive. A typo fails silently.
- Make sure the app is assigned or installed in a way that can receive the configuration: managed devices configuration only reaches apps Intune installed or manages.
- For SDK apps, check that the user also has an app protection policy, or expect the 720-minute check-in interval.