Intune app protection policies (APP) secure corporate data inside individual apps such as Outlook, Teams and OneDrive, without enrolling the whole device. The policy travels with the work account, so you can require a PIN, block copying into personal apps and wipe only company data, while the employee’s photos, messages and personal apps stay untouched. This guide covers what you need before you start, how to structure the policies, the mistakes that make them silently fail, and where regulated Canadian businesses need to add more than APP alone.
TL;DR
- App protection policies apply mobile application management (MAM) to apps on iOS, iPadOS and Android, and do not require device enrollment.
- Each user needs a Microsoft Entra ID account, an Intune license assigned to the user (a device-only license does not work) and membership in a security group the policy targets.
- Policies only protect data in a corporate context. Files saved to local storage as personal data can fall outside the policy, which is the most common surprise.
- Build three tiers (basic, enhanced, high), pilot on a small group, and verify on a real phone before you roll out to everyone.
- For healthcare, finance and other regulated work, pair APP with MFA, Conditional Access and audit logging. The policy alone is not a compliance program.
Table of Contents
- What app protection policies actually do
- What you need before you create a policy
- Structure your policies in three levels
- Step by step: building your first policy
- Why policies fail: the five problems we see most
- Pairing APP with Conditional Access and MFA
- Regulated industries: what APP does and does not cover
- Our perspective: where we see rollouts go wrong
- Getting help with the rollout
- FAQ
- Sources
What app protection policies actually do
An app protection policy does not manage the device. Enforcement lives inside the app, which is why the same policy works on a personal phone you will never enroll and on a company-owned handset. Microsoft describes the purpose as keeping an organization’s data contained in a managed app, and controlling how data is accessed and shared. In practice that means you can:
- Require a PIN or biometric check before a work app opens.
- Encrypt company data stored by the app.
- Block “Save As” to personal storage and restrict cut, copy and paste between managed and unmanaged apps.
- Block access from jailbroken or rooted devices, or from devices that fail integrity checks.
- Selectively wipe corporate data from the app when someone leaves, without touching personal content.
Policies cover iOS, iPadOS and Android, but Shared iPad devices and Android Enterprise dedicated devices are not supported. If your clinic reception uses a shared tablet, plan a different control for it.
This is the core difference between MAM and mobile device management (MDM). MDM controls the device: settings, certificates, full wipe. MAM controls the data inside apps. Most small and mid-sized businesses end up using both, MDM for company-owned devices and MAM for bring-your-own phones. If you are still defining the personal-device side of that split, our BYOD policy controls guide lays out the five controls auditors usually ask about. An outside view on how app-level management compares with full device management is in this mobile device management policy write-up.
What you need before you create a policy
Most failed rollouts trace back to prerequisites, not settings. Check these four first.
1. An Entra ID account for every user
Policies apply only when a person signs into an app with their corporate Microsoft Entra account. Someone using a personal Gmail in the same app gets no protection, and that is by design.
2. The right license
The user needs an Intune license assigned to them. Microsoft’s licensing documentation states that a device enrolled with a device license does not support app protection policies, nor Conditional Access or user-based management features. This catches businesses that bought device-only licensing for kiosks and then tried to protect email on the same fleet.
3. A security group that is actually targeted
Policies are assigned to user groups, not devices. Create a dedicated group such as “MAM-Pilot” first, then “MAM-AllStaff” later. Before you deploy, it helps to confirm eligibility, licenses and group membership on the admin side. A practical checklist for that kind of verification is in this Windows administration hardening guide.
4. Apps that support the Intune SDK
The app has to support Intune app protection at all. Microsoft’s own apps do, and many third-party line-of-business apps do too, but if an app has not integrated the SDK or been wrapped, no policy will apply. Test any non-Microsoft app before you promise protection for it.
Structure your policies in three levels
Microsoft’s framework organizes app protection into three levels: minimum, enhanced and high, and its data protection framework maps settings to each. Treat these as a starting point, not a mandate. A small accounting firm may apply level 2 to everyone and level 3 only to partners and anyone handling client tax files.
| Level | Intended for | Typical controls |
|---|---|---|
| 1: Basic | Everyone, minimal friction | PIN or biometric access, basic encryption, selective wipe, block jailbroken or rooted devices |
| 2: Enhanced | Most staff handling business data | Restrict data transfer to managed apps, restrict cut, copy and paste, stricter PIN rules, minimum OS and app versions |
| 3: High | Executives, finance, clinical or legal staff with sensitive records | Tighter data transfer limits, shorter offline grace periods, stronger PIN requirements, threat defense checks |
Level 1 is deliberately gentle. According to Microsoft, it gives PIN protection and basic encryption and runs selective wipe operations, and it introduces both IT and end users to the idea. That is the right place to start if you have never run APP before. Jumping straight to level 3 on day one generates helpdesk calls and teaches staff to look for workarounds.
Step by step: building your first policy
The exact portal labels change, so follow the current wording in the Intune admin center. The sequence stays the same.
- Create the pilot group. Ten to twenty people from different roles, including at least one Android and one iPhone user, and someone who travels.
- Create the policy. In the Intune admin center, go to Apps, then App protection policies, and create a policy for iOS/iPadOS and another for Android. Keeping platforms separate makes troubleshooting far easier.
- Select the apps. Start with the Microsoft 365 apps your staff actually use: Outlook, Teams, OneDrive, Word, Excel, PowerPoint. Add third-party apps only after testing.
- Configure data protection. Decide where corporate data may go. A common pattern is allowing transfer only to other policy-managed apps and blocking “Save As” to personal locations, while permitting saves to OneDrive for Business and SharePoint.
- Configure access requirements. Set a PIN or biometric requirement, and define how long the app may stay unlocked.
- Configure conditional launch. Block jailbroken or rooted devices, and set minimum operating system and app versions so outdated phones are blocked or warned.
- Assign to the pilot group. Target users, not devices.
- Validate on real phones. Do not trust the portal’s green checkmark. Test, then expand.
Before you go broad, run through Microsoft’s policy validation guidance. It points out something worth remembering: users rarely report problems with a data protection control, because a gap in protection is invisible until data leaks. Silence is not proof the policy works.
If you run the wider Intune rollout as well, the same pilot-first approach applies to device enrollment, and we cover it in our Intune device management playbook.
Why policies fail: the five problems we see most
The policy never reached the app
When users see an “App not set up” style error, Microsoft’s deployment troubleshooting flow starts with licensing, then the targeted security group. Policy delivery is also not instant, so a check made two minutes after assignment proves little. On a mobile device, opening the address about:intunehelp in Microsoft Edge shows which policy settings have actually arrived on the client, which settles the argument quickly.
Data was never classified as corporate
This is the most misunderstood behavior. Microsoft’s guidance on data transfer problems explains that policies trigger when users work with corporate accounts or managed storage locations such as OneDrive for Business. If an Office file is saved to the phone’s local storage instead of a managed location, the policy may treat it as personal data and not protect it. Staff assume the whole app is wrapped. It is not. The fix is partly technical (restrict save locations to OneDrive for Business and SharePoint Online) and partly training.
The managed account is sticky
In multi-identity apps like Outlook, only one work or school account can be managed by MAM at a time on a device. When someone cannot add a second corporate mailbox, or cannot sign in, the usual fix is to sign in with the account that established the original MAM enrollment, or to clear app data so the identity association resets. Consultants and executives who sit on several tenants hit this constantly.
Third-party apps ignore the policy
As noted above, an app that has not implemented the Intune SDK cannot enforce a policy. Check the app vendor before you build a workflow around it.
Windows MAM meets an already managed device
MAM for Windows is meant for unmanaged devices. Per the Windows app protection settings reference, applying it to a device that is already Entra ID joined or MDM enrolled means the policy is ignored. In hybrid environments, this is a frequent cause of “it works on one laptop but not another.” Decide per device whether it will be MDM-managed or MAM-only, and do not expect both on the same user and device.
For a deeper look at tracing problems, Microsoft documents how to review app protection logs by enabling Intune diagnostics on the mobile client.
Pairing APP with Conditional Access and MFA
An app protection policy decides what happens inside the app. It does not decide who gets to reach your mailbox from where. The two controls belong together: Conditional Access can require that users connect only through approved, policy-protected apps, so an employee cannot simply add the company mailbox to the phone’s native mail client and bypass everything you configured.
Two companion reads from our blog cover that half of the design:
- 10 core Conditional Access policies that prevent lockouts, including how to keep break-glass access.
- MFA for Microsoft 365, so a stolen password alone is not enough.
If staff reach company resources from home or on the road, the remote access policy guide ties these controls into a written standard.
Regulated industries: what APP does and does not cover
Healthcare administrators, accountants and legal offices often ask whether Intune app protection makes them compliant. It does not, and no single setting does. Microsoft’s own HIPAA guidance for Entra frames compliance as an organizational process rather than a checkbox. Entra ID and Intune supply technical safeguards: MFA to verify identity, Conditional Access to restrict data to approved apps, and automatic sign-out after a set period of inactivity. Administrators still need joiner, mover and leaver processes and audit logs to show the controls are used. HIPAA is a United States law, so Canadian practices should confirm which privacy rules apply to their data and province with their own counsel or privacy officer, and use the same technical controls to support them.
For a clinic, a sensible minimum looks like this:
- Level 2 or 3 app protection for any app that can open patient records or email containing them.
- Conditional Access requiring a protected app and MFA.
- A leaver checklist that includes selective wipe of the departing user’s work data the same day.
- Retained logs that show who accessed what and when.
To see how access controls fit a clinical environment more broadly, read what access controls do for healthcare data security and our 2026 guide to patient data protection tools. If your files live in SharePoint, our SharePoint security checklist covers the storage side that APP relies on.
Our perspective: where we see rollouts go wrong
We run Microsoft 365 and Intune environments for Canadian small and mid-sized businesses, and our approach is cybersecurity first. That shapes how we treat app protection policies: they are a containment control, not a perimeter.
The pattern we see is consistent. A business creates a policy, sees it assigned, and assumes the job is done. Months later, an employee who left still has a synced mailbox on a personal phone, or a spreadsheet of client data has been saved to local storage where the policy never classified it as corporate. Nobody noticed because a data protection control produces no complaints when it fails.
Our advice is blunt. Pilot with real users on real phones, verify with the client-side tools rather than the portal, restrict save locations to managed storage, and put the leaver process on the same checklist as the policy. Then tie it to Conditional Access so the policy cannot be sidestepped. If your business is in a regulated sector, document each control and who reviews the logs, because an auditor will ask for evidence, not intentions.
We also push back on over-tightening. A level 3 policy on every employee produces PIN fatigue and shadow IT. Match the tier to the data the person touches.
— 247techify Team
Getting help with the rollout
If you would rather not run this alone, we manage Microsoft 365 and Intune for Canadian businesses as part of our managed IT and cybersecurity services. Our Microsoft 365 support covers setup, security and day-to-day management, and our published business managed IT range is 1,099 to 2,499 CAD per month, detailed on the managed IT price index. Toronto-area teams can start from our managed IT services in Toronto page, or see the full cybersecurity services if you also want monitoring and response.
FAQ
Do app protection policies require device enrollment?
No. Microsoft designed app protection to work without enrolling the device in MDM, which is why it suits personal phones. The user still needs an Entra ID account and an Intune license assigned to them. On Android, much of the functionality is built into the Company Portal app, which must be present even though enrollment is not required.
Why is my app protection policy not applying?
Start with the basics: confirm the user’s license, then confirm they are in the targeted security group, and allow time for synchronization. Then check the app supports the Intune SDK and that the user is signed in with their corporate account. On a phone, about:intunehelp in Microsoft Edge shows whether the policy reached the app.
Can I use Intune MAM on a Windows laptop that is already Entra joined?
Not for that scenario. Windows MAM is intended for unmanaged devices, and a device already Entra ID joined or MDM enrolled ignores the MAM policy. Use device-level management for those laptops and reserve MAM for personal or unmanaged machines.
Does Intune app protection make us HIPAA compliant?
No. It provides technical safeguards that support access control requirements, alongside MFA and Conditional Access. Compliance also depends on processes such as joiner, mover and leaver handling, audit logs and documentation. Confirm your legal obligations with a qualified privacy or compliance professional.
Can a user have two work accounts in Outlook under MAM?
Only one work or school account can be managed by MAM at a time on a device in multi-identity apps like Outlook. If sign-in fails, try the original account that established MAM enrollment, or clear the app data to reset the association.
Sources
- App Protection Policies Overview, Microsoft Learn
- Microsoft Intune Licensing Plans and Options, Microsoft Learn
- Levels of protection and configuration in Microsoft Intune, Microsoft Learn
- Data Protection Framework Using App Protection Policies, Microsoft Learn
- Validate Your App Protection Policy Setup, Microsoft Learn
- Troubleshoot Microsoft Intune app protection policy deployment, Microsoft Learn
- Troubleshoot data transfer and Intune app protection policies, Microsoft Learn
- Troubleshoot user issues for Microsoft Intune app protection policies, Microsoft Learn
- App Protection Policy Settings for Windows, Microsoft Learn
- Review App Protection Policy Logs, Microsoft Learn
- Configure Microsoft Entra HIPAA access control safeguards, Microsoft Learn