App Protection Policies in Intune: MAM vs MDM Scenarios

Microsoft Intune supports two primary models of managing endpoint and application security:

• Mobile Device Management (MDM): A device-level approach that requires full Intune enrollment.
• Mobile Application Management (MAM): An app-level approach that protects corporate data without requiring device enrollment.

Intune uses App Protection Policies (APPs) to define and enforce app security rules. This includes data encryption, copy/paste and save controls, conditional app launch, and user authentication requirements for specific applications (primarily Microsoft 365 apps).

This guide outlines the steps to configure and apply Intune App Protection Policy for MAM-only (BYOD) and MDM-enrolled (corporate-owned) devices. It also covers how Intune supports the coexistence of both, where a single device may be MDM and MAM-managed to enable layered policy enforcement.

If you prefer to watch instead of read, check out our video on App Protection Policies in Intune: MAM vs MDM Scenarios.

Recommended deployment strategies:

Guide to Microsoft Intune App Protection Policy (APP)

This guide teaches you how to apply App Protection Policies (APPs) in Microsoft Intune for MAM-only and MDM-enrolled scenarios. It also explains Conditional Access integration, validation methods, and key deployment considerations.

General prerequisites:

• Microsoft Intune and Microsoft Entra ID (Azure AD) Premium P1 licenses
• Apps must support Intune SDK (e.g., Outlook, Teams, OneDrive).
• For MAM: No device enrollment is required.
• For MDM: Device must be enrolled in Intune.
• Access to Microsoft Intune Admin Center
• Users must be assigned to Microsoft Entra ID security groups targeted by the policy.

Applying app protection policies: MAM-only (for BYOD)

MAM-only policies protect organizational data inside apps without enrolling the device in MDM.

Use Cases: This is ideal for Bring Your Own Device (BYOD) users, where organizations want to secure corporate data inside apps without managing the entire device.

Prerequisites:

• Devices must support Intune SDK or be wrapped using the Intune App Wrapping Tool.
• Users must be licensed for Intune + Entra ID Premium P1/P2.

Step-by-step:

1. Open the Microsoft Intune admin center.
2. Navigate to Apps > App protection policies > Create policy.
3. Choose the platform: iOS/iPadOS/Android/Windows
4. Under Apps to target, select Microsoft and supported third-party apps.
5. Click Next, then configure app protection settings:
   • Data protection: Set how users can interact with data in the apps (including cut/copy/paste/save and encrypt data).
   • Access requirements: Set requirements users must meet to access apps (including PIN, biometric, or conditional launch).
   • Conditional launch: Set sign-in security requirements for your access protection policy (including block access or wipe data after an offline interval).
6. Click Next, then assign the policy to user groups (not devices) in the Assignments page. (Read #1 in ⚠️ Things to look out for.)
7. Click Next, review the settings, then click Create.
8. Monitor under Monitor > App protection status.

This policy will apply even if the device is unmanaged (MAM Without Enrollment or MAM-WE scenario).

Applying app protection policies: MDM-enrolled devices

Applying app protection policies on MDM-enrolled devices has the same steps as above, but it’s typically in combination with:

• Compliance policies
• Device configuration profiles
• Conditional access policies

This provides an extra layer of protection alongside device-level configurations.

Use Cases: Ideal for corporate-issued devices with full management.

Prerequisites:

• Devices must be enrolled in Intune MDM
• Users must be licensed for Microsoft Intune
• Targeted apps must support Intune App Protection Policies

Step-by-step:

1. Open the Microsoft Intune admin center.
2. Navigate to Apps > App protection policies > Create policy.
3. Choose platform: iOS/iPadOS/Android/Windows
4. On the Apps page, select Microsoft and supported third-party apps.
5. Click Next, then configure app protection settings:
   1. Data protection: Set how users can interact with data in the apps (including cut/copy/paste/save and encrypt app data).
   2. Access requirements: Set requirements users must meet to access apps (including PIN, biometric, or conditional launch).
   3. Conditional launch: Set sign-in security requirements for your access protection policy (including block access or wipe data after an offline interval).
6. Click Next, then assign the policy to user groups with MDM-enrolled devices. (Read #1 in ⚠️ Things to look out for.)
7. Click Next, review all settings, and click Create to deploy the policy.
8. Monitor under Monitor > App protection status.

What is the difference between MDM and MAM?

MDM policies control the device posture. Meanwhile, MAM policies further protect app-level data within managed apps.

Note: When MDM and MAM are deployed, MDM sets the baseline for device security, while MAM adds more granular protections at the app level. If their policies conflict, the device-level MDM policy takes precedence.

Enforcing access control based on app protection

Organizations can enforce app-based Conditional Access (CA) policies to ensure that only protected apps can access corporate data.

Use Cases: Use this to:

• Block access from unmanaged apps or devices
• Enforce app-level data compliance (MAM-only or hybrid)
• Implement Zero Trust security.

Prerequisites:

• Intune and Entra ID Premium P1/P2 licenses
• Valid Microsoft 365 user licensing
• Apps must be protected via an existing App Protection Policy

Step-by-step: (Read #2 in ⚠️ Things to look out for.)

1. Sign in to Microsoft Entra Admin Center.
2. Navigate to: Entra ID > Protection > Conditional Access > Policies > New Policy.
3. Under Assignments, select users or groups to target. (Read #1 in ⚠️ Things to look out for.)
4. Choose target apps (e.g., Exchange Online, SharePoint).
5. Under Access Controls > Grant:
   • Select the Require app protection policy.
   • Optional: Require MFA
6. Enable the policy and click Create.

These policies work in tandem with Intune App Protection Policies (APP).

You may also read How to Configure Conditional Access Policies in Azure AD.

Validation Method 1: Use PowerShell to query user/app compliance

PowerShell can be used with Graph API to retrieve policy assignments and evaluate enforcement status across devices and apps.

Use Cases: Use this to:

• Validate APP assignments across tenant users
• Audit which devices or users are MAM-managed
• Generate compliance reports for MSP or enterprise environments

Prerequisites:

• Admin rights with Intune Admin, Global Admin, or Security Reader roles
• The Microsoft Graph PowerShell SDK must be installed.

Here’s how:

1. Install Graph SDK (if not already):

Install-Module Microsoft.Graph -Scope CurrentUser

2. Connect to Microsoft Graph:

Connect-MgGraph -Scopes "DeviceManagementApps.Read.All","Policy.Read.All"

You will be prompted to sign in with an admin account.

3. List all app protection policies and their assignments:

Get-MgDeviceAppManagementTargetedManagedAppPolicy

4. Query specific user assignment:

Get-MgDeviceAppManagementManagedAppRegistration -UserId <[email protected]>

Note: You may export results to CSV using | Export-Csv –Path “filename.csv” for reporting.

Validation Method 2: Use CMD to validate MDM enrollment status

This method provides a quick snapshot of MDM enrollment and Entra ID join status.

Use Cases: Use this to:

• Confirm if a device is properly enrolled in Intune MDM
• Troubleshoot auto-enrollment failures

Prerequisites:

• You must be signed in as an administrator.

Here’s how:

1. Press Win + X and select Command Prompt (Admin) or Windows Terminal (Admin).
2. Run this command to verify device MDM enrollment:

dsregcmd /status

Look for:

• • MDMUrl: Confirms MDM endpoint
  • DeviceCompliancePolicyReceived: YES
  • WIPEnabled: YES (only if using Windows Information Protection)

The CMD utility doesn’t provide direct MAM indicators but helps validate MDM prerequisites.

⚠️ What to watch out for

Additional considerations

Get to know some of the platform limitations, user requirements, and how MAM and Conditional Access work in tandem when applying APP with Intune:

Supported apps

Mobile Application Management (MAM) policies apply only to supported apps:

• Apps that have been integrated with the Intune App SDK
• Apps that have been wrapped using the Intune App Wrapping Tool

User-based management

MAM is user-based, not device-based. This means users must have an Intune license assigned to their Microsoft Entra ID account.

Windows limitations

MAM support on Windows is currently limited to Microsoft Edge. For full device and app control, user MDM enrollment via Intune.

Access control

Conditional Access (CA) policies must be layered to restrict access based on app state and protection. Without CA, users may bypass protections by accessing corporate data through unmanaged apps.

Troubleshooting

Here are common problems and solutions you may encounter with Microsoft Intune App Protection Policies (APP) across MAM and MDM scenarios:

Policy not applying

Verify if the user is in the target group and using a supported app.

1. Open Intune Admin Center > Apps > App protection policies.
2. Open the affected policy and navigate to Assignments.
3. Confirm the user is part of an included Entra ID group.

Tip: You may refer to the Microsoft Intune protected apps list to confirm app compatibility.

App not protected

Check if the app is wrapped or has SDK support. How?

1. For public apps, you may refer to the Microsoft Intune protected apps list and search for the app name.
2. For custom LOB (Line-of-Business) apps, ask your app development team if the Intune App SDK has been added.
3. Confirm if the app was processed using the Intune App Wrapping Tool.

( Read Wrap Android apps with the Intune Wrapping Tool.)

MAM-WE fails

If MAM without enrollment is not working, confirm that the affected user has an Intune license.

1. Open Microsoft 365 Admin Center > Users > Select user > Licenses.
2. Check if the user has an Intune license assigned.

Then, confirm that the user is included in the user group assigned to the App Protection Policy. Verify that the policy targets the affected app and that the user is signed in to the app with the correct work or school account. Confirm also that the app and OS are supported and up to date, and that the required broker app is installed.

Access denied errors

Review Conditional Access and compliance state in Azure logs:

• Go to Azure Portal > Entra ID > Security > Conditional Access > Insights & Reporting. Then, filter by affected user, app, and failure.

To check the compliance state:

• Go to Intune Admin Center > Devices > Select device > Device compliance.
• Check the compliance state and last check-in time.

Diagnostics

Here is where to find logs:

• Intune console logs (iOS/Android)
• Company Portal logs
• Endpoint.microsoft.com > Monitor > App Protection Status

NinjaOne Services

NinjaOne enhances app-level and device-level protection through:

With these, IT teams and MSPs can manage and secure diverse device fleets regardless of management type.

Configure Intune App Protection Policy for BYOD and MDM-enrolled scenarios

App Protection Policies offer a flexible and powerful way to protect corporate data, whether or not the device is enrolled in a management platform. These policies empower MSPs and IT teams to enforce consistent app-level security across devices in both MAM-only (BYOD) and MDM-enrolled (corporate-owned) environments.

This guide provides clear steps for creating, configuring, and assigning APPs for both scenarios. It also includes practical tools for validating deployment through the registry, CMD, and GPO. Beyond that, you’ll find best practices for Conditional Access integration\ and how NinjaOne supports MSPs and IT teams to streamline policy enforcement at scale.

Related topics:

• MDM vs MAM: 8 Key Differences
• Exploring Enterprise Mobility Management (EMM)
• A Comprehensive Guide to Unified Endpoint Management
• How to Deploy Applications Using Microsoft Intune Admin Center
• Choosing the Right Software Deployment Tool: Intune vs. NinjaOne – A User’s Perspective