| name | intune-app-protection |
| description | Guidance for Microsoft Intune app protection policies (MAM) — protecting corporate data inside mobile apps with or without device enrollment. Covers MAM-WE for BYOD vs APP on managed devices, data-relocation controls (cut/copy/paste, Save As, encryption), app PIN/biometric and offline grace, selective wipe of corporate data, and pairing with Conditional Access grant control 'Require app protection policy'. WHEN: Intune app protection policy, app protection policy, APP, MAM, MAM-WE, MAM without enrollment, protect data in mobile apps, BYOD data protection, selective wipe, restrict copy paste, app-based Conditional Access, manage apps without enrollment, Intune SDK apps. DO NOT USE for full device management (use intune-device-mgmt) or disk encryption (use bitlocker-design). |
| license | MIT |
| metadata | {"author":"Microsoft","version":"0.1.0"} |
Microsoft Intune - App Protection Policies (MAM)
Intune app protection policies (APP / MAM) protect organisational data inside apps at
the application layer, with or without device enrollment. They make BYOD safe by isolating
corporate data inside managed apps and enabling selective wipe of org data without touching
personal content.
When to use
Protecting Microsoft 365 and Intune-SDK-enabled app data on mobile devices, especially
unmanaged / personal devices (MAM without enrollment, MAM-WE). Use this skill when full
device enrollment is undesirable or impractical.
Do not use this skill for full device management (intune-device-mgmt) or disk
encryption (bitlocker-design).
Pick the protection model
| Scenario | Model | Notes |
|---|
| BYOD - no enrollment | MAM without enrollment (MAM-WE) | Default for personal devices |
| Corporate-owned, managed | APP on managed devices | Layered on top of MDM |
| Mix of corporate + BYOD | Both | Same APP, different deployment scope |
| Frontline / shared device | App protection + Shared Device mode | Per-user data isolation |
| Strict regulated data | APP + Conditional Access app filter | CA-enforced gating |
Rule of thumb: if you want the user to keep their personal data and the device, but
the company to keep its data, MAM-WE. APP without CA enforcement is optional; APP with CA
"Require app protection policy" is enforced.
Approach
-
Choose the model and target audience — MAM-WE for BYOD, APP on managed devices for
corporate. Both target users and groups, not devices. Per platform: iOS/iPadOS and
Android.
Verify: APP assignment shows the right user groups; status report shows policy delivered
to the target population.
-
Data protection settings — Restrict cut/copy/paste to managed apps; prevent "Save As"
to personal locations; restrict backup to iCloud/Google Drive; require encryption of
org data at rest in the app.
Verify: testing on a personal device shows paste from Outlook → personal Notes is
blocked.
-
Access requirements — Require app PIN (6 digits min) or biometric to open managed
apps; set offline grace period (typically 12-48 hours); block jailbroken / rooted
devices; minimum OS version.
-
Selective wipe — Use "wipe corporate data only" to remove org data from the app while
leaving personal data intact. Critical for BYOD departures.
Verify: pilot wipe on a personal device removes Outlook/OneDrive corp data, keeps photos
and personal apps untouched.
-
Combine with Conditional Access for enforcement — APP alone doesn't gate sign-in.
Create a CA policy with grant control Require app protection policy for the target
cloud apps (Exchange Online, SharePoint, Teams). This is the enforcement.
Verify: CA What If on Exchange from an unprotected app = blocked.
-
App configuration — Pair APP with app configuration policies for managed app
settings (Outlook signature, allowed account types).
Guardrails
- MAM-WE protects data in supported apps only. Confirm the app is on the Intune-SDK /
approved-app list. An unsupported app = no protection.
- Communicate the user experience (PIN, restrictions) before rollout to reduce friction.
Users on BYOD will uninstall if surprised by a new PIN prompt.
- Combine with Conditional Access for enforcement; APP alone doesn't gate sign-in.
Without CA, users can use unmanaged Outlook and bypass APP.
- Offline grace period is a trade-off. Too short = users locked out on a flight; too
long = stale data stays on a lost device. 24-48 hours typical.
- Selective wipe is queued. Wipe initiates next time the user opens the app online. Not
instant - revoke sessions in parallel for high-risk departures.
- Don't run APP without app configuration. Default Outlook on BYOD allows personal
account; APP doesn't stop that. Configuration policy restricts to corp account only.
Common anti-patterns
- "Deploy APP, expect data protection" - Without CA enforcement users sign into the
unmanaged version of Outlook and bypass APP entirely.
- "Block jailbroken devices but don't communicate" - First-time users on rooted
devices = ticket storm. Communicate before enforcement.
- "No offline grace period" - First poor-signal day = mass lockout.
- "Same policy iOS and Android" - Platform-specific knobs (e.g. iOS managed open-in,
Android work profile interaction) need per-platform tuning.
- "Wipe = device wipe" on BYOD - Wipes personal data; legal exposure. Selective wipe
only on BYOD.
- "Skip app configuration policies" - Outlook on personal account = data leaks
outside scope of APP.
Example prompts
Create an Intune app protection policy for BYOD without enrollment (MAM-WE).Restrict copy/paste and enable selective wipe in mobile apps for iOS and Android.Set up Conditional Access "Require app protection policy" for Exchange Online and SharePoint.Configure Outlook app configuration policy alongside APP.Plan offline grace period and PIN requirements for our mobile workforce.Wipe corporate data from a departing contractor's personal phone without touching personal data.
Microsoft Learn
