App Protection Policies in Intune: MAM vs MDM Scenarios. App protection policies are important for securing corporate data across modern endpoints. Let’s walk through how Microsoft Intune uses MAM and MDM to protect applications and devices in different deployment scenarios. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. Understanding MDM and MAM in Intune. Microsoft Intune supports two primary management models. Mobile Device Management, or MDM, provides full device-level control and requires enrollment into Intune. Mobile Application Management, or MAM, focuses only on protecting corporate data inside supported apps, without enrolling the device. MAM is commonly used for BYOD scenarios, while MDM is designed for corporate-owned hardware. Both models can use App Protection Policies, also called APPs. These policies define how apps handle corporate data, enforce encryption, control copy and paste behavior, restrict data sharing, and require authentication before corporate app data can be accessed. How App Protection Policies Work. Next, it helps to understand how APPs are applied. App Protection Policies are assigned to users, not devices. This means the same policy can protect corporate data within supported applications whether the device is enrolled in MDM or completely unmanaged. Policies include data protection rules, access requirements like PIN or biometrics, and conditional launch controls that can block access or wipe corporate app data when defined conditions are not met. For MAM-only deployments, these protections apply through the Intune App SDK or or apps prepared using the Intune App Wrapping Tool. MDM-Enrolled Devices and Layered Security. On the other hand, MDM-enrolled devices combine app protection with device compliance policies, configuration profiles, and Conditional Access. This layered approach allows organizations to enforce OS-level controls alongside app-level data protection. When both MDM and MAM are present, Intune prioritizes MDM enforcement. Conditional Access and Validation. After that, Conditional Access ties everything together. Access policies can require an app protection policy before users connect to services like Exchange Online or SharePoint Online. Administrators can validate enforcement using Microsoft Graph PowerShell, Windows registry checks where applicable, or commands like ds reg cmd to confirm MDM enrollment status. For more information, check out our official blog post on App Protection Policies in Intune, linked in the description below.