App protection (MAM)¶
App protection policies protect work data inside apps, whether or not the device is enrolled. They're the standard answer for personal phones: the user keeps control of their device, and you control what happens to company email, files and chats.
Create them under Apps > Protection.
What app protection can do¶
| Area | Examples |
|---|---|
| Access | Require a PIN or biometric to open work apps, and recheck it after a timeout |
| Data transfer | Stop copy and paste, "Save as" and "Open in" from work apps to personal apps, restrict printing, block backups to iCloud or Google |
| Encryption | Encrypt work data at rest in the app |
| Conditional launch | Block or wipe if the device is jailbroken or rooted, the OS or app is too old, or the user hasn't signed in for too long |
| Selective wipe | Remove only work data from the apps, leaving personal data untouched |
Policies apply only when the app is used with a work account. Personal accounts in the same app (for example a personal Outlook.com mailbox) aren't affected. Only one work or school account per device is supported.
Requirements¶
- Users need an Intune license and must sign in to the app with their Entra account.
- Policies target users, and the specific apps must be included in the policy.
- The app must include the Intune App SDK (Microsoft 365 apps, Edge, Teams and many partner apps do).
- Android needs the Company Portal app installed (it doesn't need to be signed in or enrolled), because it acts as the policy broker.
- For Conditional Access that requires app protection, the device also needs a broker app to register with Entra ID: Microsoft Authenticator on iOS, and Authenticator or Company Portal on Android.
Use Microsoft's data protection framework¶
Rather than designing policies from scratch, start from Microsoft's three-level App protection policy data protection framework:
| Level | For | In short |
|---|---|---|
| Level 1: Enterprise basic | Minimum for any user accessing work data on mobile | PIN, encryption, selective wipe, basic OS and jailbreak checks |
| Level 2: Enterprise enhanced | Most users who handle sensitive data | Adds data transfer restrictions: work data stays in managed apps, saves only to OneDrive or SharePoint, no backups |
| Level 3: Enterprise high | Users with highly sensitive data, admins | Adds stronger PINs, stricter device checks and threat-level requirements |
Pick a level per user population, then adjust. The framework's exact settings are in Microsoft's documentation.
Different rules for managed and unmanaged devices¶
Because app protection targets users, the same policy can hit a user's personal phone and their corporate phone. Use managed app filters to split them:
- One policy for unmanaged devices (personal, not enrolled) with strict data transfer rules.
- One policy for managed devices (enrolled corporate devices) with lighter rules, since the device itself is managed.
On Intune-enrolled iOS devices, managed apps need to know which account is the managed one. Intune sends the IntuneMAMUPN, IntuneMAMOID and IntuneMAMDeviceID values automatically to Outlook, Teams, Word, Excel and PowerPoint. For other apps, send them yourself with an app configuration policy.
Conditional launch settings that matter¶
| Setting | Suggested action |
|---|---|
| Jailbroken or rooted devices | Block access (or wipe data) |
| Min OS version | Warn below your target, block well below it |
| Min app version | Block versions you know are broken or insecure |
| Offline grace period | Block access after 720 minutes offline, wipe data after 90 days |
| Max PIN attempts | Reset PIN after 5 attempts |
| Device threat level | Block above Low or Medium if you use Defender for Endpoint or another mobile threat defense app |
| Play Integrity verdict (Android) | Require basic and device integrity |
| Min patch version (Android) | A date a few months back, aligned with your compliance policy |
Screen capture on iOS¶
Since iOS 18.2, apps built with current Intune SDK versions block screen capture (and Apple's AI writing features) when Send org data to other apps is set to anything other than All apps. If you want to allow screen capture, deploy a managed apps app configuration policy with com.microsoft.intune.mam.screencapturecontrol set to Disabled.
Windows: app protection for Microsoft Edge¶
App protection also works on personal Windows devices, using Microsoft Edge. Users sign in to an Edge work profile; work data stays inside it.
- The device must not be enrolled in Intune or Entra joined to any tenant. Intune blocks app protection on managed devices, and settings stop applying if the device becomes managed later.
- Settings cover data transfer (clipboard, printing, receiving and sending data) and health checks (minimum app and OS versions, offline grace period, device threat level through Windows Security Center).
- Pair it with a Conditional Access policy for Windows browsers that requires app protection (or a compliant device for managed PCs). See Conditional Access.
- To stop users accidentally enrolling the whole device in MDM when they add their account, turn on Disable MDM enrollment when adding work or school account in Windows automatic enrollment settings.
How quickly policies apply¶
| User state | When the app checks again |
|---|---|
| Registered and receiving policy | Typically every 30 minutes while the app is in use |
| Not licensed, not targeted, or the app isn't in the policy | Every 12 hours |
| Tenant not set up for Intune | Every 24 hours |
Changes to an existing policy can take up to 8 hours to reach a signed-in user. Signing out of the app and back in speeds it up. Apps that haven't checked in for 90 days may be deregistered and re-register on next launch.
Selective wipe¶
To remove work data from a user's apps (for example when they leave, or lose a personal phone), go to Apps > App selective wipe > Create wipe request, and pick the user and device. Running apps check for wipe requests every 30 minutes and at sign-in.
Monitoring¶
Apps > Monitor > App protection status shows which users are targeted, their apps, policy status, last sync and, on Android, the device's security patch level. If a user shows Not checked in, they haven't opened the app with their work account since the policy applied.