- Platforms
- iOSAndroid
- Products
- IntuneEntra IDMicrosoft 365
- Result
- Company apps on personal phones get an app protection policy, and apps without one are blocked
Overview
Protect company data in Outlook and other apps on personal iPhones and Android phones with Intune app protection policies and Conditional Access, without enrolling the devices.
Microsoft Intune protects company data in apps on iOS and Android devices with app protection policies. This mobile application management (MAM) feature works with supported apps from Microsoft and partners, on devices that are enrolled in Intune or not enrolled at all. Protecting apps on devices that aren't enrolled is called MAM without enrollment (MAM-WE).
MAM-WE suits bring-your-own-device (BYOD) phones, where you only need to protect company data in the apps (for example, block copy and paste into personal apps) and not manage the whole device. Combine it with Microsoft Entra ID (formerly Azure AD) Conditional Access to require an app protection policy: if the app has no policy, access is blocked right after the user signs in.
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Microsoft Intune Plan 1 and Microsoft Entra ID P1 for each user (included in Microsoft 365 E3, E5 and Business Premium) | Licensing |
| Admin role | Application Manager or Intune Administrator in Intune; Conditional Access Administrator in Microsoft Entra ID | Intune rolesEntra roles |
| Intune | An app protection policy, for example Data Protection Framework Level 2, with a filter for unmanaged devices | FrameworkFilters |
| Apps that support app protection policies (Intune App SDK) | Protected apps | |
| Entra ID | A Conditional Access policy that requires an app protection policy | PolicyMigration |
| Devices | Personal iPhones and iPads with iOS/iPadOS 17 or later and Microsoft Authenticator; Android 10 or later with Company Portal | Supported platformsApp protection |
Configuration
Create the app protection policy first, then the Conditional Access policy that requires it.
| Step | Console | What you set |
|---|---|---|
| 3.1 | Intune | App protection policy (Data Protection Framework level) |
| 3.2 | Entra | Conditional Access: require an app protection policy |
Create the app protection policy
Intune admin center
The easiest way to start is the Data Protection Framework, which has three levels of recommended settings. I described how to import them in my other post:
- Level 1: enterprise basic data protection
- Level 2: enterprise enhanced data protection
- Level 3: enterprise high data protection
For apps on personal devices I use Level 2 with a few changes. In the Intune admin center (intune.microsoft.com) go to Apps > Protection > Create policy and choose iOS/iPadOS or Android (see Create an app protection policy):
In 2022 you targeted unmanaged devices with Target to apps on all device types: No and Device types: Unmanaged. Today you choose the apps under Target policy to (for example Core Microsoft Apps: Edge, Excel, Office, OneDrive, OneNote, Outlook, PowerPoint, SharePoint, Teams, To Do and Word) and add an assignment filter for unmanaged devices:
(app.deviceManagementType -eq "Unmanaged")
I assigned the policy to a group of users who may use company apps on personal devices. You can create a second policy for enrolled devices, with fewer restrictions, because those devices also get MDM policies.
Create the Conditional Access policy
Microsoft Entra admin center
Conditional Access can require an app protection policy before the app reaches company data. The device must be registered in Microsoft Entra ID through a broker app: Microsoft Authenticator on iOS, Company Portal (or Authenticator) on Android. If the broker app is missing, the user is asked to install it when signing in to a protected app.
In the Microsoft Entra admin center (entra.microsoft.com) go to Entra ID > Conditional Access > Create new policy from templates. The templates are no longer in preview (see Conditional Access templates):
- Target resources: All resources (formerly All cloud apps)
- Device platforms: iOS and Android
- Grant: Require app protection policy
- Exclude your emergency access (break glass) accounts, and start in Report-only mode
Important: in 2022 the template granted access with Require approved client app or Require app protection policy. The approved client app control was retired on June 30, 2026. Policies that use it are now read-only: they still work, but you can't create or edit them. Use Require app protection policy on its own (see Migrate from approved client app).
User Experience
The user adds a work account in Outlook on a personal iPhone.
The user installs Microsoft Outlook on a personal iPhone (iOS 15 in 2022) and adds the work account:
On iOS the user is sent to the App Store to install Microsoft Authenticator (the broker app) at the first sign-in:
The broker app registers the device in Microsoft Entra ID (not in Intune). Conditional Access needs this device record:
If the device isn’t registered, sign-in fails with: Client app is a MAM app, device is not registered and request is sent using a broker. Workplace join needs to be done to register the device before the app can be accessed. Install the broker app (Microsoft Authenticator on iOS, Company Portal on Android) and sign in to the app again. The broker registers the device in Microsoft Entra ID during sign-in. On Android, Company Portal must stay installed even though the device isn’t enrolled.
The app protection policy is applied; without it, access would be blocked with the error No application protection policies have been assigned. The policy asks for an app PIN. On iOS the PIN is shared between apps from the same publisher, such as Outlook, Teams and Edge:
