5.3MD-102Intermediate
Est: ~15 mins•Verified: 2026-08

Mobile Application Management (MAM): App Protection

Protect enterprise data on managed and unmanaged (BYOD) iOS and Android devices using Intune App Protection Policies (MAM-WE), encryption, and selective app wipe.

Tags:#MAM#App Protection#BYOD#Data Loss Prevention#Intune#MD-102
01

Overview

Mobile Application Management (MAM) via Microsoft Intune App Protection Policies (APP) safeguards corporate data at the application layer without requiring device enrollment (MAM without Enrollment / MAM-WE).

This is the cornerstone of modern BYOD (Bring Your Own Device) security:

  1. Application Sandbox Containerization: Corporate data stored in Microsoft 365 mobile apps (Outlook, Teams, OneDrive, Excel) is strictly isolated and encrypted at rest using an application-level key.
  2. Data Relocation Prevention (DLP): Restricts copy/paste, cut, and screen capture. Users can only share data between Policy-managed apps (e.g., copying text from corporate Outlook into corporate Word is allowed; pasting into WhatsApp, Gmail, or personal Notes is blocked).
  3. Access Requirements: Enforces an application-level corporate PIN or biometric authentication (Face ID / Fingerprint) before the user can view emails or chat messages.
  4. Selective App Wipe: Allows IT to remotely delete all corporate emails, chats, and cached files from an employee's personal device when they leave the organization, leaving their personal photos and messages untouched.

---

02

When to Use

Enrollment StateTarget ScenarioRecommended Security Baseline
MAM without Enrollment (BYOD)Personal iPhones and Android phonesStrict App Protection: Block copy/paste to personal apps, require PIN, block jailbroken/rooted devices.
MAM with MDM Enrollment (Corporate)Company-owned managed devicesCombined MDM device compliance + MAM app protection for defense-in-depth data leakage prevention.
Windows MAM (MAM for Windows)Personal Windows 11 laptops accessing corporate Edge/M365Enforces protected sessions in Microsoft Edge; blocks copy to local Notepad or USB drive.

---

03

Prerequisites

Tenant & Licensing Requirements:

  • Intune License: Microsoft 365 E3/E5, Business Premium, or standalone Intune Plan 1.
  • Microsoft Entra ID P1 / P2: To enforce Conditional Access requiring approved client apps or app protection policy.
  • Admin Role: Application Manager or Intune Administrator.

Client Requirements:

  • iOS/iPadOS: Requires iOS 16.0+ with Intune SDK integrated into targeted apps.
  • Android: Requires Android 9.0+ and the Microsoft Intune Company Portal app installed on device (acts as the local broker, no sign-in or MDM enrollment required).

---

04

Portal Path

TEXT
Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Apps
    ├── App protection policies
    │   └── Create policy > iOS/iPadOS or Android
    │       ├── Data protection (Cut/Copy/Paste, Save copy, Encryption)
    │       ├── Access requirements (PIN, Biometrics, Work credentials)
    │       └── Conditional launch (Max PIN attempts, Jailbreak detection)
    └── App selective wipe (Create wipe request by user or device)

---

05

Step-by-Step Implementation

Step 1: Create an iOS/iPadOS App Protection Policy

  1. Navigate to Intune Admin Center > Apps > App protection policies > Create policy > iOS/iPadOS.
  2. Name: MAM-iOS-CorporateData-Protection.
  3. Under Apps, set Target to apps on all device types: Yes (covers both unmanaged BYOD and MDM enrolled).
  4. Select Public apps: Select Microsoft Outlook, Microsoft Teams, OneDrive, Excel, Word, PowerPoint.

Step 2: Configure Data Protection Rules

  1. Under Data Transfer:
  • Send org data to other apps: Policy managed apps
  • Receive data from other apps: All apps
  • Restrict cut, copy, and paste between other apps: Policy managed apps with paste in (Allows pasting external data INTO corporate apps, but blocks corporate data FROM copying out).
  • Save copies of org data: Block (with exceptions only for OneDrive for Business and SharePoint).
  1. Under Encryption:
  • Encrypt org data: Require.

Step 3: Configure Access Requirements & Conditional Launch

  1. Access requirements:
  • PIN for access: Require | PIN type: Numeric (Minimum 6 digits).
  • Simple PIN: Block (e.g., 123456 or 111111).
  • Face ID / Touch ID instead of PIN: Allow.
  • Timeout (recheck access requirements after): 30 minutes.
  1. Conditional launch:
  • Max PIN attempts: 5 > Action: Reset PIN.
  • Jailbroken/rooted devices: Action: Block access.
  • Offline grace period: 72 hours > Action: Block access.
  • Offline wipe grace period: 90 days > Action: Wipe data.
  1. Assignments: Assign to group All Licensed Users.

Step 4: Pair with Conditional Access (Enforcement)

  1. Open Microsoft Entra Admin Center > Protection > Conditional Access.
  2. Create policy: Target Office 365 cloud app > Device platforms: iOS, Android.
  3. Under Grant: Select Require app protection policy (and Require approved client app).

---

06

PowerShell Automation

Check App Protection Policy Status via Microsoft Graph:

PowerShell
Connect-MgGraph -Scopes "DeviceManagementApps.Read.All"

# List active iOS and Android App Protection Policies
Get-MgDeviceAppManagementIosManagedAppProtection | 
    Select-Object displayName, allowedDataStorageLocations, allowedOutboundDataTransferDestinations, pinRequired

Get-MgDeviceAppManagementAndroidManagedAppProtection | 
    Select-Object displayName, allowedDataStorageLocations, isEncryptAppDataRequired, pinRequired

---

07

Microsoft Graph Automation

Trigger an App Selective Wipe for a Specific User:

PowerShell
Connect-MgGraph -Scopes "DeviceManagementApps.ReadWrite.All"

# When an employee departs, wipe corporate data from personal mobile devices
$WipeParams = @{
    userId = "john.doe@contoso.com"
}

New-MgDeviceAppManagementUserAppProtectionNotification -BodyParameter $WipeParams

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
Opening corporate Outlook on mobile prompts to create an Intune corporate PIN.
Attempting to copy text from corporate email and pasting into personal WhatsApp displays: *"Your organization's data cannot be pasted here"*.
Saving an attachment in Outlook blocks local phone storage; only OneDrive for Business appears.
Rooted / Jailbroken mobile phones are immediately blocked upon app launch.
Issuing an App Selective Wipe removes corporate data within minutes of network check-in.
09

Diagnostic Logs & Channels

Channel / ToolLog LocationPurpose
Intune MAM Diagnostic ConsoleIn Outlook / Edge: Navigate to edge://intunehelp or type about:intunehelpDisplays client-side MAM policy state, applied DLP rules, SDK version, and device ID.
Intune App Protection Status ReportIntune Admin Center > Apps > Monitor > App protection statusShows user check-in timestamps, MAM enrollment status, and policy conflict flags.
Company Portal Broker Log (Android)Company Portal > Settings > Send logsCaptures Android brokered authentication and token refresh diagnostics.

---

10

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
"Your organization has not given you access"User is not targeted in the MAM policy assignment, or user lacks an Intune license.Verify the user is a member of the assigned security group and has an active Intune license.
MAM policy not applying on AndroidThe Microsoft Intune Company Portal app is not installed on the Android phone.Install Intune Company Portal from Google Play Store (app is required as MAM broker).
Copy/Paste allowed unexpectedlyThe receiving app is also a policy-managed app under the same tenant container.Data transfer between two policy-managed apps (e.g., Outlook to Teams) is allowed by design.
Selective Wipe does not clear dataDevice is offline or in airplane mode.The wipe command queues in Intune and executes immediately once device regains internet access.

---

11

Production Best Practices

Production Best Practice

Use "Policy Managed Apps with Paste In":

When configuring data transfer, avoid setting Restrict cut, copy, paste to "Blocked". Set it to Policy managed apps with paste in. This allows users to paste personal notes, passwords, or external addresses INTO corporate email, while strictly preventing corporate data from leaking OUT.

Security Caution

Company Portal on Android is Mandatory:

On Android devices, the Intune Company Portal acts as the local encryption key vault and MAM policy broker. Educate BYOD users that while they do not need to log into the Company Portal, the app MUST remain installed.

---

12

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. MAM-WE Definition: App Protection Policies do NOT require MDM device enrollment; they manage the application sandbox directly.
  2. Android Broker Requirement: Android requires Intune Company Portal installed as broker. iOS uses the built-in Intune SDK and Microsoft Authenticator.
  3. Selective Wipe vs Full Wipe: Selective Wipe deletes only corporate data; it never wipes personal photos, personal email accounts, or system settings.

---

13

Official Documentation

PREVIOUS TOPIC5.2 Microsoft 365 Apps: Deployment & Update ChannelsNEXT TOPIC5.4 Microsoft Store & Windows Package Manager (WinGet)