📱 Lock It Down: How to Secure BYOD Mobile Access with Intune App Protection Policies (MAM)
🔐 A Practical Guide to Protecting iOS & Android Devices Without Enrollment
In a world where users check work email on their personal phones and join Teams meetings from the beach, managing mobile security isn’t optional — it’s mandatory. But forcing full device control (MDM) on personal phones? That’s a fast track to user revolt.
Enter Intune App Protection Policies (MAM) — the right tool for BYOD environments.
This guide will walk you through:
- Setting up App Protection Policies for iOS and Android
- Using Conditional Access to enforce them
- Blocking default email apps like Apple Mail or Samsung Email
- Best practices that don’t choke productivity
Let’s get your data protected — without managing the whole device.
✅ Step 1: What You Need
Before you begin:
- Microsoft Intune is set up and integrated with Entra ID
- Users are licensed for Intune (included in Microsoft 365 Business Premium, E3/E5, or EMS)
- You’re targeting Microsoft 365 apps only (Outlook, Teams, OneDrive, Word, etc.)
- You have at least an Entra P1 license to configure Conditional Access
🔐 Step 2: Create App Protection Policies for iOS and Android
You’ll create two separate policies: one for iOS/iPadOS and one for Android.
👉 Instructions (repeat per platform):
- Go to the Intune Admin Center
- Navigate to: Apps > App protection policies > + Create policy
- Select Platform (start with iOS/iPadOS)
- Name the policy (e.g.,
MAM-iOS-BYOD-Standard) - Click Next
🔧 Targeted Apps
Under Targeted apps:
- Click Select public apps
- Add:
- Microsoft Outlook
- Teams
- OneDrive
- Word, Excel, PowerPoint
- Microsoft Edge (for secure links)
- Click Next
🔒 Data Protection Settings
| Setting | Recommended |
|---|---|
| Backup org data to iTunes/iCloud | Block |
| Send org data to other apps | Policy managed apps |
| Receive data from other apps | All apps |
| Save copies of org data | Block |
| Restrict cut, copy, paste | Policy managed apps |
| Encrypt org data | Require |
🧠 Access Requirements
| Setting | Recommended |
|---|---|
| PIN for access | Require |
| Simple PIN | Block |
| Biometrics (Face ID/Fingerprint) | Allow |
| Recheck access after idle | 5 minutes |
| Offline grace period | 72 hours |
🚨 Conditional Launch Settings
| Condition | Action |
|---|---|
| Jailbroken/rooted | Block |
| Min OS version | iOS 16 / Android 12 |
| Wipe after device noncompliance | Yes |
Assign the policy to your BYOD user group and repeat the exact process for Android.
🛡️ Step 3: Enforce MAM with Conditional Access
App Protection Policies don’t mean anything if users can still access Exchange or SharePoint with unprotected apps. Lock it down with Conditional Access.
✅ Create CA Policy: Require App Protection
- Go to Microsoft Entra Admin Center
- Navigate to Protection > Conditional Access > + New Policy
- Name it:
Require App Protection on Mobile Devices
📋 Assignments
- Users: All users or specific BYOD group
- Cloud Apps: Microsoft 365 or individual apps (Exchange Online, SharePoint)
- Conditions:
- Device platforms: iOS, Android
- Client apps: Mobile apps and desktop clients (uncheck browser for now)
🛑 Access Controls
- Grant access only if App Protection Policy is applied
Click Create.
Now, if a user tries to access data from a mobile app without the MAM policy applied — they get blocked.
🚫 Step 4: Block Native Mail Apps (Apple Mail, Samsung Email)
Here’s the piece everyone forgets: native email apps don’t support MAM, so even with policies in place, your data’s exposed if users connect mail manually.
✅ Create CA Policy: Block Unmanaged Mobile Email Clients
- Back in Entra Admin Center, create another policy
- Name it:
Block Mobile Mail Clients (Non-Outlook)
📋 Assignments
- Users: Same as above
- Cloud App: Exchange Online only
- Conditions:
- Device platforms: iOS and Android
- Client apps: Mobile apps and desktop clients
🛑 Access Controls
- Grant access: Block
Optional:
Use filters to exclude Outlook for iOS/Android, if available in your org’s Entra conditions, or use an allow-only policy that explicitly requires Outlook mobile.
✅ Result
- Apple Mail and Samsung Email: Blocked
- Outlook mobile with MAM applied: Allowed and secured
- Users can’t sidestep your policies with their phone’s built-in apps
💡 Best Practices for Admins
- Start in report-only mode for CA policies if you’re unsure about impact
- Use dynamic groups (e.g., devices where enrollmentState = “notEnrolled”) to apply MAM policies only to BYOD
- Train users: explain how this protects their personal device from full IT control
- Monitor enforcement with Sign-In Logs in Entra ID to catch gaps
🔐 Final Thoughts
You don’t need full device management to lock down mobile access.
With App Protection Policies, Conditional Access, and blocking native apps, you get:
- Protection of corporate data
- Separation from personal apps
- A smoother BYOD experience that users won’t fight against
This is modern mobile security, the way it should be.