Home › Guides › Devices & Intune
Intune App Protection for BYOD Phones: Protect Work Data Without Enrolling
Most small businesses don't want to enroll employees' personal phones, and most employees don't want them to. Intune app protection policies (sometimes called MAM, mobile application management) solve this. They protect company data inside Outlook, Teams, OneDrive and the other Microsoft apps, and leave the rest of the phone alone. Here's how to set them up for iPhone and Android, with the settings I'd start with and the Conditional Access rule that makes them stick.
What app protection does (and doesn't) do
- No enrollment needed. Microsoft says app protection policies can be used on devices that aren't enrolled in any mobile device management solution (App protection policies overview).
- Work data only. The policies apply only in a work context, so you can protect company data without touching personal data, according to the same page.
- Selective wipe. When someone leaves, you can remove company data from the managed apps without wiping the phone (Selective wipe).
- What it can't do: it doesn't manage the phone itself. You won't see the device's settings, other apps, or location. That's the point for BYOD, but it also means you can't push Wi-Fi profiles or require a device passcode the way enrollment can.
Before you start
- Licenses: Microsoft says users need an Intune license, a Microsoft Entra account, and membership in a security group that the policy targets. For the Outlook app, they also need an Exchange Online mailbox (App protection policies overview). Microsoft's Business Premium plan page lists Intune Plan 1 (Microsoft 365 Business Premium).
- A test group: create a security group, such as MAM-Pilot, with you and one willing colleague on each platform.
- Broker apps on the phone: for the Conditional Access rule below, Microsoft says iPhones need Microsoft Authenticator and Android phones need the Intune Company Portal app installed as the broker app (Conditional Access grant controls). On Android, Microsoft also says the Company Portal is required to receive app protection policies at all. Users install it; they don't have to enroll (App protection policies overview).
Step 1: Create the iPhone policy
Microsoft's steps (Create and assign app protection policies):
- In the Microsoft Intune admin center, go to Apps > Protection > Create policy and choose iOS/iPadOS.
- Basics: name it something clear, like MAM - iOS - Level 2.
- Apps: choose Core Microsoft Apps. Microsoft lists them as Edge, Excel, Office, OneDrive, OneNote, Outlook, PowerPoint, SharePoint, Teams, To Do and Word.
- Data protection, Access requirements and Conditional launch: use the settings in the next section.
- Assignments: assign it to your pilot group. App protection policies are assigned to user groups.
Then repeat for Android with the same choices.
Step 2: The settings I'd start with
Microsoft publishes a data protection framework with three levels. It describes Level 2 ("enterprise enhanced data protection") as accessible to most organizations without a large security staff, and Level 2 includes all the Level 1 settings (App protection policy data protection framework). I'd start every small business at Level 2. These are the settings from that framework that matter most:
| Setting | Microsoft's Level 2 value | What users notice |
|---|---|---|
| Back up org data | Block | Work data isn't included in iCloud or Android backups |
| Send org data to other apps | Policy managed apps | Can't open a work attachment in a personal app |
| Save copies of org data | Block, except OneDrive for Business, SharePoint and Photo Library | "Save as" only offers work storage |
| Restrict cut, copy, and paste between apps | Policy managed apps with paste in | Can paste into work apps, not out of them |
| Screen capture and Google Assistant (Android) | Block | Screenshots are blocked in work apps |
| Encrypt org data | Require (Level 1) | Nothing visible |
| PIN for access | Require, numeric, minimum length 4, biometrics allowed (Level 1) | A PIN or Face ID/fingerprint when opening work apps |
| Max PIN attempts | 5 / Reset PIN (Level 1) | Has to reset the app PIN after 5 wrong tries |
| Offline grace period | 10080 minutes / Block access (Level 1); 30 days / Wipe data (Level 2) | Work data is blocked after 7 days offline and wiped after 30 |
| Jailbroken/rooted devices | Block access (Level 1) | Work apps won't open on a jailbroken phone |
| Disabled account | Block access | A disabled user loses access in the apps |
| Min OS version | Block access below your chosen version | Has to update the phone |
For minimum OS version, Microsoft recommends matching the iOS versions Microsoft's apps support. They follow an "N-1" approach, where N is the current major iOS release (data protection framework). Check that page for its current Android guidance.
Step 3: Require app protection with Conditional Access
An app protection policy only protects the apps it covers. Without a Conditional Access rule, someone could still read mail in the phone's built-in mail app. Microsoft's template (Require app protection policy) is:
- Users: All users (or your pilot group first), excluding your emergency access accounts.
- Target resources: All resources.
- Conditions > Device platforms: Android and iOS.
- Grant: Require app protection policy.
- Enable policy: Report-only first.
Microsoft notes that the older Require approved client app grant is being retired and became read-only on June 30, 2026, so new policies should use only Require app protection policy (Migrate approved client app to app protection policy). Microsoft also says to deploy a separate policy that blocks access from unsupported or unknown device platforms alongside this one.
This needs Entra ID P1, which Business Premium includes (Microsoft Entra licensing). It fits alongside the rest of the Conditional Access starter policies. Microsoft also recommends applying app protection policies before you apply Conditional Access rules (Create and assign app protection policies).
Step 4: Test on a real phone
- On a pilot user's iPhone, install Outlook and Microsoft Authenticator, then sign in to Outlook with the work account. On Android, install Company Portal (don't enroll) and Outlook.
- Expect a notification that the policy now applies, then a prompt to set the app PIN (Create and assign app protection policies).
- Try to copy text from an email into a personal notes app. It should be blocked.
- Try the built-in mail app with the work account. With the Conditional Access rule on, it should be blocked.
- Check the sign-in logs while the rule is in report-only. Microsoft notes that report-only can show "Report-only: Failure" for this type of policy, which is expected if the client isn't protected.
When someone leaves
In the Intune admin center, go to Apps > App selective wipe > Create wipe request, then pick the user and device. This removes company data from the protected apps (Selective wipe). It belongs in your offboarding checklist. If you also manage company-owned PCs, see the Intune setup guide for a 10-person office.
Mistakes I'd avoid
- Turning on the Conditional Access rule for everyone before the app protection policies are assigned.
- Forgetting Android users need the Company Portal installed.
- Picking "All apps" when you only use Microsoft's apps. Core Microsoft Apps is easier to support.
- Skipping the pilot. One annoyed salesperson with a blocked phone is a cheap lesson; the whole company is not.
Sources
- App protection policies overview (Microsoft Learn)
- Create and assign app protection policies (Microsoft Learn)
- Data protection framework using app protection policies (Microsoft Learn)
- Wipe only corporate data from apps (Microsoft Learn)
- Require app protection policy (Microsoft Learn)
- Migrate approved client app to app protection policy (Microsoft Learn)
- Conditional Access grant controls (Microsoft Learn)
- Microsoft Entra licensing (Microsoft Learn)
- Microsoft 365 Business Premium (Microsoft)
Useful links for this guide: Microsoft's app protection data protection framework · app protection overview. These are ordinary links, not affiliate links.