Most businesses treat Intune app protection policies as a BYOD tool: something you switch on for personal phones and forget about once a device is enrolled. That leaves a gap. An enrolled, compliant phone can still copy a client spreadsheet into a personal notes app or save an attachment to a consumer cloud account. This article explains why app protection belongs on managed devices too, and how to set it up without making staff miserable.
Why device management alone does not protect the data
Mobile device management (MDM) controls the device. It can require a passcode, push apps, enforce encryption and report compliance. What it does not do on its own is control what happens to company data once it is inside an app. On a fully enrolled iPhone, Outlook can still hand a PDF to any other app the user has installed unless something tells it not to.
App protection policies (often called MAM, for mobile application management) work at the app layer and follow the user’s work identity. They decide whether data can be copied, pasted, saved, printed or shared out of Microsoft 365 apps. Microsoft’s own guidance describes the two as complementary: MDM makes sure the device is protected, and app protection keeps organization data contained inside managed apps. When a user signs in with a personal account in the same app, the work restrictions do not apply, so personal use is left alone.
In the tenants I review, the most common pattern is a single app protection policy scoped to unmanaged devices only, with corporate phones getting nothing at the app layer. That made sense years ago when “managed” meant “trusted”. It does not hold up now that most data leaks are a user saving a file somewhere convenient, not a stolen device.
Two policies, two levels of trust
Because app protection targets users, a single policy can land on both enrolled and personal devices. You can also split them. When you create the policy, Intune lets you target by device management state using assignment filters, so you can run one policy for unmanaged devices and a separate one for Intune managed devices.
A sensible approach for a 20 to 500 person business:
Unmanaged (BYOD) policy: strict. Block saving org data to local or personal storage, block cut and paste to unmanaged apps, require an app PIN, block access on jailbroken or rooted devices.
Managed device policy: slightly relaxed. Allow saving to OneDrive and SharePoint, allow paste into other managed apps, rely on the device passcode instead of a separate app PIN, but still block data moving into unmanaged consumer apps.
The managed policy is where most of the value sits. Staff on company phones are usually the heaviest users of email and Teams on mobile, which makes them the most likely to move data around.
Settings that matter on managed devices
You do not need every setting. These are the ones I configure on managed iOS/iPadOS and Android devices, with the value I start from.
Setting
Managed device value
Why
Send org data to other apps
Policy managed apps
Keeps attachments and files inside Outlook, Teams, Word, Excel and other managed apps.
Receive data from other apps
All apps
Lets users attach photos and personal files to work email without friction.
Save copies of org data
Block, with OneDrive and SharePoint allowed
Stops “Save to Files” or personal cloud storage while keeping normal work saves.
Restrict cut, copy, and paste between other apps
Policy managed apps with paste in
Users can paste personal text into work apps, but not copy client data out.
Printing org data
Allow or block based on role
Many teams never print from a phone. Block it where that is true.
PIN for access
Not required (device passcode enforced by MDM)
Avoids double prompts on devices already locked by compliance policy.
Jailbroken/rooted devices (conditional launch)
Block access
A compromised OS undermines every other control.
Offline grace period
Block access after 720 minutes, wipe data after 90 days
Limits how long a lost device keeps cached work data.
Check the exact defaults in the iOS/iPadOS and Android settings references before you copy these. Wording shifts as Microsoft updates the admin center.
The iOS detail most deployments miss
On iOS/iPadOS, app protection only knows a device is “managed” if the app receives specific app configuration values. Microsoft documents that IntuneMAMUPN and IntuneMAMOID must be configured for MDM managed applications, and IntuneMAMDeviceID for third-party and line-of-business apps. Intune now sends these automatically to several Microsoft apps (Outlook, Teams, Word, Excel and PowerPoint) on enrolled devices, but not to everything.
If those values are missing, the app treats the device as unmanaged, and your managed policy either does not apply or the stricter BYOD policy lands instead. If staff on company iPhones complain that OneDrive saves are blocked when they should not be, this is usually why. The fix is an app configuration policy for managed devices that passes the values to each app you protect.
Android is simpler. On Android Enterprise, Intune detects management through the work profile or fully managed enrollment, so the managed policy applies without extra configuration.
Step by step: adding a managed-device policy
Sign in to the Microsoft Intune admin center and go to Apps > Protection > Create policy. Pick iOS/iPadOS or Android. Create a separate policy per platform.
On Apps, select the Microsoft 365 apps your users actually run: Outlook, Teams, OneDrive, Word, Excel, PowerPoint, Edge.
Configure Data protection using the table above as a starting point.
Configure Access requirements. On managed devices I usually leave the app PIN off and rely on the device passcode.
Configure Conditional launch: minimum OS version, jailbreak or root detection, offline grace period.
On Assignments, assign to your user group, then select Edit filter and include only Intune managed devices. Use the opposite filter on your BYOD policy.
For iOS/iPadOS, create an app configuration policy for managed devices that passes IntuneMAMUPN and IntuneMAMOID to each protected app that does not already receive them.
Pilot with IT and one business team for a week before widening the assignment.
Then back it with Conditional Access. A Microsoft Entra Conditional Access policy that grants access only when the app is covered by an app protection policy closes the loop, so a user cannot bypass the controls by signing in through the native mail app instead of Outlook.
Windows is part of the picture now
App protection is no longer just a mobile feature. Intune supports app protection for Microsoft Edge on Windows, mainly aimed at personal Windows devices, with controls like blocking cut, copy and paste, restricting downloads and printing, and checking device health through the Windows Security app. Microsoft Entra Conditional Access can require an app protection policy on Windows the same way it does on mobile.
For company-owned Windows laptops, device-level controls such as Microsoft Purview endpoint DLP and sensitivity labels are usually a better fit than Edge-only app protection. For contractors and staff using their own PC at home, Windows MAM is a practical middle ground between full enrollment and no control at all.
Licensing
App protection policies are part of Microsoft Intune Plan 1, which is included in Microsoft 365 Business Premium, Microsoft 365 E3 and Microsoft 365 E5. Requiring an app protection policy in Conditional Access needs Microsoft Entra ID P1, which those same plans include. If you are on Business Standard, you will need to add Intune and Entra ID P1, or move to Business Premium.
Frequently asked questions
Do app protection policies work on devices already enrolled in Intune?
Yes. Intune app protection policies apply to the user’s work identity, so they work on both enrolled and unenrolled devices. You can target separate policies by device management state so that managed devices get a lighter policy than personal ones.
Will app protection affect personal apps and personal data?
No. The restrictions apply only when the user is working with an organization account inside a managed app. Personal accounts, personal apps and personal photos are not touched, and a selective wipe removes only the work data.
Why is my managed iPhone getting the BYOD policy?
Usually because the app is not receiving the IntuneMAMUPN and IntuneMAMOID app configuration values, so it reports the device as unmanaged. Deploy an app configuration policy for managed devices that includes them.
Not sure whether your company phones are leaking data through unmanaged apps? Book a free Microsoft 365 security assessment and we will review your app protection and Conditional Access setup, or talk to us about an Intune health check.
Most businesses treat Intune app protection policies as a BYOD tool: something you switch on for personal phones and forget about once a device is enrolled. That leaves a gap. An enrolled, compliant phone can still copy a client spreadsheet into a personal notes app or save an attachment to a consumer cloud account. This article explains why app protection belongs on managed devices too, and how to set it up without making staff miserable.
Why device management alone does not protect the data
Mobile device management (MDM) controls the device. It can require a passcode, push apps, enforce encryption and report compliance. What it does not do on its own is control what happens to company data once it is inside an app. On a fully enrolled iPhone, Outlook can still hand a PDF to any other app the user has installed unless something tells it not to.
App protection policies (often called MAM, for mobile application management) work at the app layer and follow the user’s work identity. They decide whether data can be copied, pasted, saved, printed or shared out of Microsoft 365 apps. Microsoft’s own guidance describes the two as complementary: MDM makes sure the device is protected, and app protection keeps organization data contained inside managed apps. When a user signs in with a personal account in the same app, the work restrictions do not apply, so personal use is left alone.
In the tenants I review, the most common pattern is a single app protection policy scoped to unmanaged devices only, with corporate phones getting nothing at the app layer. That made sense years ago when “managed” meant “trusted”. It does not hold up now that most data leaks are a user saving a file somewhere convenient, not a stolen device.
Two policies, two levels of trust
Because app protection targets users, a single policy can land on both enrolled and personal devices. You can also split them. When you create the policy, Intune lets you target by device management state using assignment filters, so you can run one policy for unmanaged devices and a separate one for Intune managed devices.
A sensible approach for a 20 to 500 person business:
The managed policy is where most of the value sits. Staff on company phones are usually the heaviest users of email and Teams on mobile, which makes them the most likely to move data around.
Settings that matter on managed devices
You do not need every setting. These are the ones I configure on managed iOS/iPadOS and Android devices, with the value I start from.
Check the exact defaults in the iOS/iPadOS and Android settings references before you copy these. Wording shifts as Microsoft updates the admin center.
The iOS detail most deployments miss
On iOS/iPadOS, app protection only knows a device is “managed” if the app receives specific app configuration values. Microsoft documents that
IntuneMAMUPNandIntuneMAMOIDmust be configured for MDM managed applications, andIntuneMAMDeviceIDfor third-party and line-of-business apps. Intune now sends these automatically to several Microsoft apps (Outlook, Teams, Word, Excel and PowerPoint) on enrolled devices, but not to everything.If those values are missing, the app treats the device as unmanaged, and your managed policy either does not apply or the stricter BYOD policy lands instead. If staff on company iPhones complain that OneDrive saves are blocked when they should not be, this is usually why. The fix is an app configuration policy for managed devices that passes the values to each app you protect.
Android is simpler. On Android Enterprise, Intune detects management through the work profile or fully managed enrollment, so the managed policy applies without extra configuration.
Step by step: adding a managed-device policy
Apps > Protection > Create policy. Pick iOS/iPadOS or Android. Create a separate policy per platform.IntuneMAMUPNandIntuneMAMOIDto each protected app that does not already receive them.Then back it with Conditional Access. A Microsoft Entra Conditional Access policy that grants access only when the app is covered by an app protection policy closes the loop, so a user cannot bypass the controls by signing in through the native mail app instead of Outlook.
Windows is part of the picture now
App protection is no longer just a mobile feature. Intune supports app protection for Microsoft Edge on Windows, mainly aimed at personal Windows devices, with controls like blocking cut, copy and paste, restricting downloads and printing, and checking device health through the Windows Security app. Microsoft Entra Conditional Access can require an app protection policy on Windows the same way it does on mobile.
For company-owned Windows laptops, device-level controls such as Microsoft Purview endpoint DLP and sensitivity labels are usually a better fit than Edge-only app protection. For contractors and staff using their own PC at home, Windows MAM is a practical middle ground between full enrollment and no control at all.
Licensing
App protection policies are part of Microsoft Intune Plan 1, which is included in Microsoft 365 Business Premium, Microsoft 365 E3 and Microsoft 365 E5. Requiring an app protection policy in Conditional Access needs Microsoft Entra ID P1, which those same plans include. If you are on Business Standard, you will need to add Intune and Entra ID P1, or move to Business Premium.
Frequently asked questions
Do app protection policies work on devices already enrolled in Intune?
Yes. Intune app protection policies apply to the user’s work identity, so they work on both enrolled and unenrolled devices. You can target separate policies by device management state so that managed devices get a lighter policy than personal ones.
Will app protection affect personal apps and personal data?
No. The restrictions apply only when the user is working with an organization account inside a managed app. Personal accounts, personal apps and personal photos are not touched, and a selective wipe removes only the work data.
Why is my managed iPhone getting the BYOD policy?
Usually because the app is not receiving the
IntuneMAMUPNandIntuneMAMOIDapp configuration values, so it reports the device as unmanaged. Deploy an app configuration policy for managed devices that includes them.For the full list of options, see Microsoft’s guide to creating and assigning app protection policies. If you want to know how your current mobile setup compares, our iOS and iPadOS management and Android management services cover both layers, and our BYOD for Microsoft 365 work handles the personal-device side.
Not sure whether your company phones are leaking data through unmanaged apps? Book a free Microsoft 365 security assessment and we will review your app protection and Conditional Access setup, or talk to us about an Intune health check.