Intune – Application Protection Policies for enrolled devices

Recently, I worked on setting up enrollment policies for
Corporate devices in Microsoft Endpoint Manager (MEM aka Intune)
for a customer. As part of the setup, I wanted to apply Application Protection
Policies (APP aka MAM) for enrolled devices to add an additional layer of security and since the devices were
being enrolled in the MDM, I was not bothered about setting up things for BYOD
scenarios.

While the MEM setup and application of the policies is straight
forward for Android, for iOS\iPadOS, there is a bit more involved. I used the Company
Portal enrollment method, so I am going to be focusing on the requirements
for the same in this blog.

The configuration involves 3 things that need to be taken
into consideration –

1. Application configuration policy for iOS\iPadOS.

2. APP for Intune managed devices.

3. APP for unmanaged apps.

Let’s cover the first requirement –

For iOS/iPadOS and for the ‘Device type’ selection to be
enforced against Intune managed devices, additional app configuration
settings are required. These configurations will communicate to the APP service
that a particular app is managed.

One needs to add the configuration key IntuneMAMUPN
against a managed app to identify the enrolled user account for the sending policy
managed app when transferring data to an iOS managed app. The UPN
configuration works with the app protection policies you deploy from Intune.
Microsoft has documented this requirement pretty well and it can be found here.

After you add the configuration key, the policy should look
something like this.

You will need to do the same for all apps that you want
Intune to manage for APP. Please note, that this is only required for iOS\iPadOS
platform where devices are managed.

Once the above app configuration is place, you can then move
on to the next step for creating the APP policies.

It is important to establish the kind of Data Loss
Prevention (DLP) settings you want to configure based on the device
type. You can have one protection policy for unmanaged devices with strict data
loss prevention (DLP) controls, and a separate protection policy for MDM
managed devices, where the DLP controls may be a little more relaxed. In
my case I decided to use same settings for both MDM and MAM APP policies.

Here is what the MDM policy looks like.

Unlike in Android where a separate Work profile container is
created when enrolling through Company Portal method allowing Intune to
manage all the apps within the Work profile container, iOS\iPadOS does no such
thing if you are enrolling a device using Company Portal under device
enrollment. If a deployed app is already installed before enrollment, then Intune
considers it as an unmanaged app. In other words, for Intune to manage an app,
it must have been installed using the Company Portal.

Therefore, even when a
device is enrolled under MDM, you will need to deploy a separate APP policy to
manage the unmanaged apps for DLP. I created the following policy.

Once MDM & MAM APP policies are created, you can deploy both
to the same User\Device based group.

Once the policies are applied, you can verify for the status
of the policies in the APP protection status under Apps > Monitor.
You can see how different policies get applied based on the status of the application.

MDM enrolled device with a managed application installed
through Company Portal.

MDM enrolled device with an unmanaged app

While Microsoft has provided some excellent documentation on
the various requirements for APP for both managed and unmanaged apps, they are
easy to miss and can become overwhelming. I hope this blog can help the reader
understand the requirements and the process involved in setting up APP.

Until next time..