intune app protection policies

Intune App Protection Policies: A Small Business Setup Guide

IT administrator configuring Intune app protection policy

Intune app protection policies are rules that keep your company data inside approved apps, such as Outlook, Teams and OneDrive, on phones and tablets. They work without taking over the device. That makes them the practical way to protect work data on personal phones. You create a policy in the Microsoft Intune admin center, choose the apps it covers, set the data and PIN rules, and assign it to a group of users. Microsoft describes these policies as a way to keep an organization's data contained in a managed app.

This guide explains what the policies do, how they differ from full device management, what each user needs before a policy applies, how to build one step by step, and what to do when someone sees the message "the app must be protected with an Intune policy." It is written for owners and office managers in small practices and firms, and for the people who support them.

Key Takeaways

App protection policies (also called MAM) control the data inside specific apps. They do not manage the whole device, so they suit employees' personal phones.
A policy only applies when the user has a Microsoft Entra account, an Intune license, membership in a targeted group, and is signed into the app with the work account.
Pair app protection policies with Conditional Access so people cannot reach company data through apps that have no protection.
Start with a small pilot group and selected apps, then widen the rollout once users know what to expect.
Policies are enforced only in the work context. Personal tasks and personal accounts in the same app are left alone.

What Intune app protection policies actually do
App protection (MAM) versus device management (MDM)
What each user needs before a policy applies
How to create and assign an app protection policy
Why you need Conditional Access alongside the policy
What users see, and what to tell them
Fixing "the app must be protected with an Intune policy"
Where this fits in a small-business security plan
Let us set this up for your office
FAQ
Sources

What Intune app protection policies actually do

An app protection policy (APP) sits inside the app, not on the phone. When someone opens a protected app with their work account, the policy decides what they can do with company data: whether a PIN is needed, whether they can copy text into a personal app, whether files can be saved to personal storage, and whether the data is encrypted.

Microsoft lists the core controls as requiring a PIN or fingerprint, restricting copy and paste, preventing saves to personal storage, and encrypting app data. The same page says the policies help stop company data leaking to consumer apps and services, and let you remove company data from an app without removing the app from the device.

For a dental practice, this might mean a hygienist can read schedule messages in Outlook on her own phone, but cannot paste patient details into a personal notes app. For a law firm, it might mean a paralegal can open a document in OneDrive, but cannot save it to a personal cloud folder.

Work context versus personal context

A common worry is that the company will see or restrict everything on an employee's phone. It will not. Microsoft states that policy settings are enforced only when people use the app in the work context. When someone uses the same app for a personal task, the policy does not affect them, and a newly created file is considered personal.

The mechanism behind this is multi-identity support. Per Microsoft's FAQ, it lets the Intune App SDK apply policies only to the work or school account signed into the app. If a personal account is also signed in, that data is untouched. This is worth explaining to your staff up front. It is usually the point that turns a hesitant employee into a willing participant.

App protection (MAM) versus device management (MDM)

There are two ways to protect company data on mobile devices, and they solve different problems.

	App protection policies (MAM)	Device enrollment (MDM)
What is managed	Company data inside specific apps	The whole device
Typical owner	Personal phone (BYOD)	Company-owned device
User gives up control of device	No	Yes
Enrollment required	No	Yes
Wi-Fi, VPN and certificate profiles	Not provisioned on unenrolled devices	Can be provisioned

Microsoft explains that enrollment and MDM mean taking management control of the entire device, while app protection manages only the data inside apps, so users keep control of their personal devices. It also notes that app protection manages apps that integrate with the Intune SDK or are wrapped with the Intune App Wrapping Tool, and that on unenrolled devices certificate profiles and company Wi-Fi and VPN settings are not provisioned.

The practical rule for a small business:

Company-owned phones and laptops: enroll them and enforce device compliance. Our guide to Intune device compliance covers that side.
Personal phones used for email, Teams or files: use app protection policies, with no enrollment needed.
Both: you can target app protection policies by device management state, so managed and unmanaged devices get different rules.

This is what people mean when they search for an Intune BYOD policy. In most small businesses, a BYOD policy in Intune is simply an app protection policy plus a Conditional Access rule, with a written acceptable-use policy that staff have signed.

What each user needs before a policy applies

Most "the policy isn't working" tickets come from a missing prerequisite. Microsoft's FAQ lists the baseline requirements for a user on an Intune-managed app:

A Microsoft Entra account
A Microsoft Intune license assigned to that account
Membership in a security group targeted by an app protection policy
That same policy targeting the specific app being used
Signing into the app with the Entra account

A few more points from Microsoft's documentation are worth keeping on a checklist:

Administrator side: the quickstart lists a Microsoft Intune subscription and the built-in Application Manager role as prerequisites for creating and assigning a policy. Microsoft's zero-trust guidance adds that these policies can be assigned to groups only, not to individual users, so plan your groups first.
Android: much of the app protection functionality lives in the Company Portal app. Microsoft says device enrollment is not required, but the Company Portal app is always required for app protection without enrollment.
Microsoft 365 apps: for Word, Excel or PowerPoint, the user needs a Microsoft 365 Apps for business or enterprise license linked to their Entra account, with a managed location set under the "Save copies of org data" setting, according to Microsoft's deployment troubleshooting guide.
Outlook: if the user is not assigned a policy, is not licensed for Intune, or the app is not in the policy, and access is set to require protection, the user cannot obtain an access token and cannot reach messaging data.

On iOS, a broker app such as Microsoft Authenticator must be installed, and on Android the Company Portal plays that role. Users do not need to sign into the broker app, as one practitioner walkthrough points out.

How to create and assign an app protection policy

The steps below follow Microsoft's create-and-deploy instructions. Menu names change from time to time, so check the current Microsoft page if a screen looks different.

Open the policy wizard. Sign in to the Microsoft Intune admin center, select Apps, then Protection, then Create policy. Choose iOS/iPadOS or Android. You need one policy per platform.
Basics. Give it a name that says who and what, for example "BYOD Mobile Staff iOS", and add a description.
Apps. Choose the policy scope: All Apps, Microsoft Apps, Core Microsoft Apps, or Selected apps.
Data protection. Set the data loss prevention controls: cut, copy and paste limits, and save-as restrictions.
Access requirements. Set PIN and credential requirements.
Conditional launch. Set sign-in security requirements that must be met before the app opens.
Assignments. Assign the policy to groups of users.
Review and create. Select Review + create, then Create.

Choosing settings for a small office

The wizard gives you many options, and defaults are not always right for your business. Here is how we think about the main decisions.

Scope. For a first rollout, pick selected apps (Outlook, Teams, OneDrive, and any line-of-business app staff really use) rather than every Microsoft app. A narrow scope is easier to test and to explain.

Copy and paste. The strictest option blocks sharing outside managed apps. A common middle path allows paste into other managed apps only. Match the setting to the work: a front-desk team that moves appointment details between apps needs different rules than a partner reading privileged email.

PIN and sign-in. Require an app PIN or biometric. If your staff already use multifactor authentication, make sure your PIN rules do not create a second frustrating prompt every few minutes. Our guide to starting MFA for Microsoft 365 explains the account-level protection that sits beside these app rules.

Save-as. Restrict saving company files to approved locations such as OneDrive and SharePoint. This is the control that keeps client files out of personal cloud storage.

A sensible rollout order

These are our recommendations for a small business, not Microsoft requirements:

Create a pilot security group of three to five people, including at least one skeptical user and one iPhone and one Android user.
Assign the policy to the pilot group only, with selected apps.
Run it for a couple of weeks and write down every complaint.
Adjust settings, then add the rest of the staff by group.
Only then add Conditional Access enforcement (see below).

If your Conditional Access setup allows it, running a new rule in report-only mode first shows who would be blocked before anyone is. Our Conditional Access playbook for small businesses walks through that phased approach.

Why you need Conditional Access alongside the policy

An app protection policy protects data once someone is inside a protected app. It does not, on its own, stop a person from setting up the company mailbox in a native mail app that has no protection at all. Security practitioners warn that relying on app protection without matching Conditional Access leaves exactly that bypass open.

The fix is a Conditional Access policy that requires an approved client app or an app protection policy for mobile access to Microsoft 365. Then the only way to reach company email on a phone is through an app your policy covers. Outlook's own documentation shows the same logic in practice: users without an applicable policy are blocked from obtaining access.

For firms handling regulated information, such as patient records or client files, this pairing is the difference between a policy that exists on paper and one that is enforced. Our Cybersecurity service covers both pieces together for small businesses.

Why you need Conditional Access alongside the policy

What users see, and what to tell them

When a user first opens a protected app with their work account, they sign in and then see a message that the app is protected by their organization. Microsoft's guidance for managed apps on Android says restrictions apply only when the app is used for work: signed in with a work account, opening work files in OneDrive, Teams or SharePoint, or using apps in the work profile area.

Before rollout, send staff a short note covering:

Which apps are covered and why.
That the company can remove work data from those apps if the phone is lost or the person leaves, but cannot see their photos, texts or personal apps.
That they will be asked to set a PIN.
Who to call if the app will not open.

That last point matters. A policy that is clear and supported gets used. One that arrives without explanation tends to get worked around.

Fixing "the app must be protected with an Intune policy"

This message tells the user that the app requires a policy and they have not met the conditions yet. Microsoft's troubleshooting page says the user must sign in with their work or school account, authenticating against Microsoft Entra ID, so the policy can apply.

If signing in does not clear it, work down this list:

Is the user signed in with the work account, not a personal one?
Does the account have an Intune license?
Is the user in the group the policy is assigned to, and does that policy include this specific app?
On Android, is Company Portal installed? On iOS, is the broker app (Microsoft Authenticator) installed?
For Word, Excel or PowerPoint, is a Microsoft 365 Apps license linked, with a managed save location configured?
Has enough time passed? Group changes and policy assignments can take a while to reach the device, so re-check after the user signs out and back in.

These checks mirror the requirements Microsoft lists, which is why a printed prerequisite checklist saves so many support calls.

Where this fits in a small-business security plan

App protection policies are one layer. A practical baseline for a small office also includes:

Multifactor authentication for every account.
Conditional Access rules that require protected apps on mobile.
Device compliance for company-owned machines.
Tested backups of Microsoft 365 and file data.
A written mobile and BYOD policy that staff have read.

USB and removable media are the desktop equivalent of the copy-and-paste problem on phones. If that is a concern for a HIPAA or CMMC environment, see our guide to an auditable USB device control policy. Guest and external access in Teams is another place where company data can slip out, covered in our piece on Teams guest access security.

Let us set this up for your office

If you would rather not build this yourself, Great Plains Networking helps small businesses in Norman, Moore and Oklahoma City put protected mobile access in place, from group design and policy settings to Conditional Access and staff communication. We explain each setting in plain language, and we work without long-term contracts.

A good first step is our 10-minute readiness audit, which is free and shows where your current setup stands. If your Microsoft 365 tenant needs wider attention, our Microsoft 365 Support and Managed IT Support pages describe how we handle licensing, security and day-to-day help.

FAQ

Do app protection policies require enrolling the phone in Intune?

No. App protection policies work on devices that are not enrolled, which is why they suit personal phones. Microsoft notes that on Android the Company Portal app is still required, and on iOS a broker app such as Microsoft Authenticator is needed.

Can the company see my personal data with an app protection policy?

The policy applies only to the work or school account signed into the app. Microsoft states that settings are enforced only in the work context, and that a personal account signed into the same app is untouched.

What license does a user need?

A user needs a Microsoft Entra account and a Microsoft Intune license assigned to that account, and must belong to a group targeted by the policy. For Word, Excel and PowerPoint, a Microsoft 365 Apps for business or enterprise license is also required.

Is an app protection policy enough by itself for BYOD?

It protects data inside covered apps, but users could still reach company mail through an unprotected app unless you add a Conditional Access rule that requires protected apps. Using both is the standard approach for BYOD in Microsoft 365.

Sources

Want help putting this into practice?

We'll audit your security, speed, and hardware in under an hour — no commitment, no sales pitch. Just a clear roadmap of what to fix and why.

Schedule Your Free Assessment

Intune App Protection Policies: A Small Business Setup Guide