Microsoft Intune App Protection Policies: Complete Technical Reference for Protected Apps & MAM Configuration

For the modern identity-centric perimeter, App Protection Policies (APP) are the definitive control plane for data governance. Unlike traditional MDM, which focuses on device state, APP operates at the application layer, ensuring corporate data remains encrypted and isolated regardless of whether the device is enrolled in Intune. This guide demystifies the MAM-WE (Mobile Application Management Without Enrollment) architecture and provides the technical depth required to manage complex mobile environments.

Advanced Settings Matrix

Not all apps are created equal. Advanced settings like Org Allowed Accounts and Non-Working Time require specific minimum versions to function. Refer to the table below for enterprise planning.

Automating Policy Assignment

Managing APP assignments via the UI is prone to human error. Use the Microsoft Graph API to ensure consistent application of policies across your production security groups.

# Assign an APP to a target Entra ID Group
POST https://graph.microsoft.com/beta/deviceAppManagement/iosManagedAppProtections/{id}/assign
{
  "assignments": [
    {
      "target": {
        "@odata.type": "#microsoft.graph.groupAssignmentTarget",
        "groupId": "a1b2c3d4-e5f6-7890-a1b2-c3d4e5f67890"
      }
    }
  ]
}

Enterprise Remediation Script

Use this script to audit your mobile fleet. It checks for the presence of the Intune broker and verifies the application version, which is the most common cause of "Policy not applied" tickets.

# PowerShell: Intune APP Compliance Audit
param(
    [string]$TargetUserPrincipalName
)

try {
    # Fetch App Protection Status via Graph
    $status = Get-MgDeviceAppManagementManagedAppPolicyDeploymentSummary -ManagedAppPolicyId "Your-Policy-ID"
    
    if ($status.DeployedUserCount -eq 0) {
        Write-Error "Policy not reaching target users."
        exit 1
    }
    
    Write-Host "Policy deployment healthy."
    exit 0
} catch {
    Write-Host "API Connection Failure"
    exit 1
}

Final Architecture Checklist