Intune App Protection Policies & Conditional Access for BYOD

Modern hybrid workplaces require secure mobile access to corporate assets without forcing full Mobile Device Management (MDM) enrollment on user-owned or unmanaged endpoints. This document details the implementation of Microsoft Intune Mobile Application Management (MAM) paired with Entra ID Conditional Access. By applying a dedicated App Protection Policy, we enforce strict data loss prevention (DLP) controls directly at the application layer, preventing unauthorised data leakage via cut/copy/paste restrictions, and encrypted application containers for core productivity apps like Microsoft Outlook and OneDrive.

To enforce these application boundaries, Conditional Access policy acts as the gatekeeper. It evaluates login requests on Android devices and requires an active App Protection Policy before granting access to corporate resources. Entra ID verifies application compliance dynamically at authentication, while Intune locks down corporate data in transit, at rest, and between managed and unmanaged applications on the device.

To begin with, navigate to the Microsoft Intune admin center:

1. Select Apps > Protection (under Manage apps).
2. Click + Create policy and select Android.
3. Provide a descriptive policy name and description, then click Next

Under the Apps tab, set Target policy to as Selected apps, click + Select public apps, and search for Microsoft Outlook and Microsoft OneDrive.

Next under the Data protection tab, configure the Data Transfer settings to control how corporate data moves in and out of managed applications:

• Backup org data to Android backup services: Set to Block to prevent unencrypted cloud backups of company data.
• Send org data to other apps: Set to Policy managed apps to ensure data stays strictly within the managed container.
• Save copies of org data: Set to Block to stop users from saving work files locally on the device.
• Restrict cut, copy, and paste between other apps: Set to Policy managed apps with paste in to allow incoming data into work apps while blocking outbound copy/paste to unmanaged apps.
• Screen capture and Google Assistant: Set to Block to prevent screenshots of corporate data or leakage through device assistants.

Under the Encryption section, configure settings to ensure corporate data handled by protected apps is encrypted at rest:

• Encrypt org data: Set to Require to enforce app-level encryption on unmanaged BYOD devices.
• Encrypt org data on enrolled devices: Set to Require to maintain app-level encryption even if the device is MDM-enrolled.

In the Functionality section, we can configure these settings to further minimise data leakage:

• Printing org data: Set to Block to stop users from printing corporate emails and documents to untrusted printers.
• Restrict web content transfer with other apps: Set to Microsoft Edge to force all links within managed apps to open strictly inside the corporate Edge browser container.

Moving to step 4, on the Access requirements tab, we establish authentication controls to govern how users access corporate applications. By enforcing an app-level PIN, we ensure company data remains isolated and secure behind its own encrypted container, preventing unauthorised access even if the host device lacks a screen lock or is left unlocked.

• PIN for access: Set to Require to force users to enter an app-level PIN when accessing corporate data.
• PIN type: Set to Numeric with a minimum PIN length of 4 to keep authentication quick yet secured.
• Biometrics instead of PIN for access: Set to Allow so users can conveniently unlock apps using fingerprint or face identification, backed by a 30-minute inactivity timeout before requiring the PIN again.

On the Conditional launch tab, we set automated security enforcement rules. Think of this as an automated safeguard. If a device is lost, offline for too long, or compromised, Intune automatically revokes access or wipes sensitive corporate data without requiring manual IT intervention.

Get NullEsc’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

App conditions

• Max PIN attempts (5 -> Reset PIN): Forces a PIN reset after 5 consecutive failed login attempts to prevent brute-force access.
• Offline grace period (1440 minutes -> Block access): Requires the app to check in with Intune at least once every 24 hours to confirm policy compliance before blocking access.
• Offline grace period (90 days -> Wipe data): Automatically performs a selective wipe of corporate data if the device remains offline for 90 consecutive days.

Device conditions

• Jailbroken/rooted devices (Block access): Instantly blocks corporate app access if Intune detects that the operating system kernel or security controls have been compromised.
• Samsung Knox device attestation (Block access on supported devices): Leverages hardware-level attestation on Samsung devices to block access if system integrity checks fail.

Finally on the Assignments tab, we bring the policy into effect by targeting the intended scope of users. App Protection Policies are assigned to users rather than devices, ensuring Mobile Application Management (MAM) controls seamlessly follow the user’s corporate identity across any personal or work device they sign into.

Once assigned, we complete the setup on the Review + create tab and click Create to deploy the policy.

Enforcing App Protection with Conditional Access

While the App Protection Policy is now active, creating the MAM policy alone is only half the solution. Users could still bypass these app-level protections by accessing corporate data through standard unmanaged apps or web browsers. To close this gap and enforce an enterprise Zero Trust posture, we must configure a Conditional Access policy in Microsoft Entra ID requiring targeted users to use approved client apps and adhere to app protection policies during authentication.

In the Microsoft Entra admin center, we create a policy named Require-MAM-App-Android with the following scope:

• Assignments (Users): Include the Android Mobile Users security group.
• Target resources: Select All resources (formerly ‘All cloud apps’) to secure all cloud services.
• Conditions: Set Device platforms to include Android.
• Access controls (Grant): Select Require app protection policy to enforce MAM controls at sign-in.

With the Conditional Access policy in place, our configuration is complete. We now shift to end-user device testing on an Android BYOD endpoint to verify that MAM controls and authentication barriers are actively enforced.

For this to work on Android, the Intune Company Portal app simply needs to be installed on the personal device. The end user does not need to open or log into Company Portal. It runs quietly in the background as an authentication broker. When the employee signs into a corporate app like Outlook, Microsoft Entra ID automatically registers the device, applies our protection policies, and secures company data without taking over their personal phone.

User Onboarding and Registration

• Device Registration: When the user opens Outlook or OneDrive and signs in, Microsoft Entra ID prompts them to register their personal phone to establish a secure workplace connection without full MDM enrollment.
• Policy Evaluation: Microsoft Entra ID verifies the connection, checks device compatibility, and hands off the session to Intune to evaluate management policies.
• MAM Enforcement: Intune instantly detects the App Protection Policy requirement and forces the user to set a 4-digit PIN before granting access to corporate data.

In the Microsoft Entra admin center, the device appears as Microsoft Entra registered with MDM set to None. This means the endpoint is recognised for identity and app-protection purposes without being fully enrolled in device management.

To verify policy application in Intune, we can navigate to Apps > App protection policies and select the Android policy. The Overview blade confirms that the user has checked in successfully, with active policy enforcement reported across both Microsoft Outlook and Microsoft OneDrive.

To test copy/paste and screenshot restrictions, I copied text from inside Outlook and tried pasting it into a personal, unmanaged note app. Intune blocked the action instantly with the prompt: “Your organisation’s data cannot be pasted here.” I then tried taking a screenshot inside Outlook, which triggered a device-level block: “This app doesn’t allow screenshots.” This proves corporate data stays locked inside managed apps and can’t leak out or be captured.

This configuration demonstrates how to secure corporate data on personal Android devices (BYOD) using Microsoft Intune Application Protection Policies and Microsoft Entra Conditional Access. A similar approach also applies to iOS devices with minor platform-specific tweaks.

Thank you for reading.