8 min readNew
Employees want to read their mail, chats and files on their own iPhone or iPad as well. You do not want to take that device under full management, but you do want to protect the corporate data in Outlook, Teams and OneDrive. That is the typical Bring Your Own Device (BYOD) scenario.
In this blog post you read how to create an App Protection Policy for iOS/iPadOS with Mobile Application Management (MAM) in Microsoft Intune, which settings to choose in it and what the user notices.
With Mobile Application Management (MAM) you protect corporate data inside apps, instead of managing the whole device. You set the rules with an App Protection Policy. Such a policy targets the user’s identity and applies only when the app is used with a work or school account. Personal use of the same app stays outside it. To enforce that users reach corporate data only through protected apps, you combine the policy with Conditional Access.
This way you can, for example, require a PIN for corporate data, prevent that data from being copied to personal apps, and remove only the corporate data from an app, without removing the app itself.
An App Protection Policy works on devices that are enrolled in Intune and on devices that are not:
| Scenario | Description |
|---|---|
| MAM without device enrollment | The device is personal and not enrolled. Only the corporate data in protected apps falls under the policy. The user installs the apps from the App Store themselves. |
| MAM with device enrollment | The device is enrolled in Intune (MDM). MDM protects the device, for example with a passcode and compliance, and the App Protection Policy protects the data in the apps. On iOS this requires app configuration, see below. |
You can use both side by side. With filters in the assignment you give unmanaged devices a stricter policy than enrolled devices. On iOS, Intune sees a device as managed only when the app receives the values IntuneMAMUPN and IntuneMAMOID through app configuration. Intune sends those automatically to Excel, Outlook, PowerPoint, Teams and Word on enrolled devices; Microsoft is still expanding that list. For apps that are not (yet) on it, at the time of writing for example OneDrive, you set the values yourself with an app configuration policy. Without those values the policy sees the device as unmanaged, and the policy may even fail to reach the app or reach it incorrectly.
On the Apps page, choose under Target policy to which apps fall under the policy:
With Selected apps you decide exactly which apps take part:
On the Data protection page you decide what users may do with corporate data in the app. Important settings:
Click Next to go to Access requirements.
On the Access requirements page you decide how the user proves who they are:
💡 These settings are a trade-off between security and ease of use. The more often the app asks for the PIN, the safer, but also the more often the user is interrupted. Biometrics without an extra PIN after a timeout is often the most pleasant for the user; choose Require if your organization wants that extra check. The screenshot below is an example, not a recommended configuration.
Click Next to go to Conditional launch.
With Conditional launch you set requirements for the user and the device, each with an action when it is not met.
Click Next to go to Assignments.
An App Protection Policy only works once it is assigned to a group of users.
💡 It can take a while before the policy is active on existing devices. Microsoft recommends deploying the policy first and only then adding Conditional Access rules that require protected apps.
As soon as the policy becomes active on the device, the user gets a notification. The screenshots below are one example on iOS: there the app reports that the organization now protects the corporate data and asks to restart the app.
On first use with the work account, the app asks the user to set a PIN, and to use biometrics if that is allowed. On iOS, apps from the same publisher share one PIN, so Microsoft apps generally use the same PIN.
If cut, copy and paste are restricted to protected apps, the user cannot paste corporate data into an unmanaged app. In the example below, the unmanaged app shows a message instead of the text.
📚 All settings for iOS/iPadOS, with their default values, are in iOS/iPadOS App Protection Policy Settings on Microsoft Learn.
An App Protection Policy in Intune protects corporate data in the apps it applies to, such as Outlook, Teams and OneDrive, on personal iPhones and iPads, without you managing the device itself. To enforce that users reach the data only through those apps, you combine it with Conditional Access.