Manage and secure applications · Topic 4 of 5
App Protection Policies and Conditional Access
MD-102 app protection: plan MAM policies for managed and unmanaged BYOD devices, data transfer and PIN settings, conditional launch, and Conditional Access.
- 6 min
- APP targets users and apps and works on enrolled and unenrolled devices. It is the BYOD solution.
- Key settings: send and receive data, save copies, cut copy paste, PIN, override biometrics with PIN after timeout.
- Conditional launch defaults: 5 PIN attempts, offline grace 1440 minutes (block) and 90 days (wipe). Actions are Warn, Block, Wipe and Reset PIN.
What it is
App protection policies (APP), also called mobile application management (MAM) policies, protect company data inside apps, whether or not the device is enrolled. They control copy and paste, saving files, PINs and what happens when a device is jailbroken. Because they follow the user and the app, they are the main tool for personal (BYOD) devices. Conditional Access can then require that an app is protected before it opens company data.
How it works
How APP works
A policy targets users and apps and is created per platform (iOS/iPadOS, Android, and Windows for Edge). The app must support the Intune App SDK (Microsoft apps do). A policy applies to managed and unmanaged devices: if a device is also enrolled, you can choose to target only managed devices, only unmanaged ones, or all. The same user can have different policies on different devices.
Data protection settings
| Setting | Options and effect |
|---|---|
| Send org data to other apps | All apps, Policy managed apps, Policy managed apps with OS sharing (iOS), Policy managed apps with Open-in/Share filtering (iOS) or None |
| Receive data from other apps | All apps, policy managed apps, none |
| Save copies of org data | Block, or allow only certain locations such as OneDrive |
| Restrict cut, copy and paste between other apps | Blocked, policy managed apps, or with paste in |
| Sync policy managed app data with native apps | Blocks saving contacts to the phone's contacts app |
| Third party keyboards | Block (iOS) |
| Org data notifications | Block or limit content shown in notifications |
| Encrypt org data | On by default |
Microsoft's data protection framework has three levels. Level 1 (enterprise basic data protection) requires a PIN and a minimal set of controls. Level 2 (enhanced) adds data leakage limits, such as blocking backups and restricting transfers to managed apps. Level 3 (high) is for high risk data, with stronger PIN and device requirements.
Access requirements (PIN and credentials)
- PIN for access, with PIN type (numeric or passcode), simple PIN allowed or blocked, and a minimum PIN length.
- Biometrics instead of PIN, and Override biometrics with PIN after timeout, which asks for the PIN after a set time of inactivity, so Face ID works for short gaps.
- Recheck access requirements after (minutes), how long before the PIN or credentials are asked for again.
- Work or school account credentials to reauthenticate after a timeout.
Conditional launch
Conditional launch checks conditions each time the app starts, and takes an action: Warn, Block access, Wipe data or Reset PIN.
| Condition | Typical setting |
|---|---|
| Max PIN attempts | 5 by default, with the action Reset PIN or Wipe data |
| Offline grace period (block access) | 1440 minutes (24 hours) by default |
| Offline grace period (wipe data) | 90 days by default |
| Jailbroken or rooted devices | Block access or wipe |
| Min OS version, Min app version, Min patch version | Warn or block |
| Device model | Allow or block listed models |
| Max allowed device threat level | Uses a Mobile Threat Defense product, such as Defender |
| Disabled account | Block access |
The offline grace period counts time since the device last checked in with Intune, and short values below 30 minutes interrupt users.
Conditional Access for apps
In Microsoft Entra ID, grant controls for mobile apps include Require app protection policy. For Microsoft apps, the older Require approved client app grant has been retired (its retirement date was moved to June 30, 2026), so policies that used it must move to Require app protection policy, often using OR with the older control during the transition. For new policies, use only the app protection grant.
Cautions:
- Use app protection policy alone only for unmanaged devices. If you require it on MDM managed devices, you can block access to every app.
- Apply app protection policies before you turn on the Conditional Access rule.
- Test with report only mode, and use Conditional Access device filters to separate managed from unmanaged devices.
- Conditional Access allows or blocks sign in. APP then enforces in app controls.
Selective wipe
If a user leaves, or a device is lost, you can run a wipe for the app (a selective wipe) from Apps, App selective wipe. It removes only company data from managed apps and keeps personal data. A conditional launch wipe does the same automatically.
A worked scenario
A hospital lets staff read email on personal phones. The admin creates a Level 2 iOS and Android policy for Outlook, Teams and OneDrive: transfers only to policy managed apps, copy and paste restricted, a 6 digit PIN and a wipe after 90 days offline. She sets Max PIN attempts to 5 with the action Reset PIN. A Conditional Access policy for unmanaged devices requires app protection policy for Exchange Online. When a nurse leaves, the admin runs a selective wipe.
What to remember for the exam
- APP targets users and apps and works on enrolled and unenrolled devices. It is the BYOD solution.
- Key settings: send and receive data, save copies, cut copy paste, PIN, override biometrics with PIN after timeout.
- Conditional launch defaults: 5 PIN attempts, offline grace 1440 minutes (block) and 90 days (wipe). Actions are Warn, Block, Wipe and Reset PIN.
- The Require approved client app grant is retired, so use Require app protection policy.
- A selective wipe removes only company data from managed apps.
Requiring app protection on devices that are already MDM managed can block access to every app. Target unmanaged devices.
How the exam asks about this
- "Employees use personal phones for email, and company data must not move to other apps." An app protection policy with transfer limited to policy managed apps.
- "Ask for a PIN again after 30 minutes idle, but allow Face ID otherwise." Override biometrics with PIN after timeout.
- "After five wrong PINs, force a new PIN but keep data." Max PIN attempts with Reset PIN.
- "Only protected apps may open Exchange Online on unmanaged devices." Conditional Access requiring an app protection policy.
Common mistakes
Using MDM compliance for BYOD. APP is built for it.
Requiring app protection on managed devices. It can lock users out.
Short offline grace periods. Users are interrupted constantly.
Confusing selective wipe with a device wipe.
Check yourself
Which policy protects data in apps on unenrolled personal devices?
An app protection policy (MAM).
What does Override biometrics with PIN after timeout do?
Asks for the PIN after a set idle time while allowing biometrics for short gaps.
Which Conditional Access grant replaced Require approved client app?
Require app protection policy.
Topic 4 of 5 in Manage and secure applications
Test yourself on Manage and secure applications
The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.