intune-app-protection
Skill179 starsChanged 5 months agoMITView on GitHub
Guidance for Microsoft Intune app protection policies (MAM) — protecting corporate data inside mobile apps with or without device enrollment. Covers MAM-WE for BYOD vs APP on managed devices, data-relocation controls (cut/copy/paste, Save As, encryption), app PIN/biometric and offline grace, selective wipe of corporate data, and pairing with Conditional Access grant control 'Require app protection policy'. WHEN: Intune app protection policy, app protection policy, APP, MAM, MAM-WE, MAM without enrollment, protect data in mobile apps, BYOD data protection, selective wipe, restrict copy paste, app-based Conditional Access, manage apps without enrollment, Intune SDK apps. DO NOT USE for full device management (use intune-device-mgmt) or disk encryption (use bitlocker-design).
We split this skill into the rules it gives an agent
2 rules. About 0 are common, 2 are distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈2
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 63
Create a CA policy with grant control Require app protection policy for the target cloud apps (Exchange Online, SharePoint, Teams).
- Distinctive: line 81
Don't run APP without app configuration: Default Outlook on BYOD allows personal account.
≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Microsoft Intune - App Protection Policies (MAM)
Intune app protection policies (APP / MAM) protect organisational data inside apps at the application layer, with or without device enrollment. They make BYOD safe by isolating corporate data inside managed apps and enabling selective wipe of org data without touching personal content.
When to use
Protecting Microsoft 365 and Intune-SDK-enabled app data on mobile devices, especially unmanaged / personal devices (MAM without enrollment, MAM-WE). Use this skill when full device enrollment is undesirable or impractical.
Do not use this skill for full device management (intune-device-mgmt) or disk
encryption (bitlocker-design).
Pick the protection model
| Scenario | Model | Notes |
| BYOD - no enrollment | MAM without enrollment (MAM-WE) | Default for personal devices |
| Corporate-owned, managed | APP on managed devices | Layered on top of MDM |
| Mix of corporate + BYOD | Both | Same APP, different deployment scope |
| Frontline / shared device | App protection + Shared Device mode | Per-user data isolation |
| Strict regulated data | APP + Conditional Access app filter | CA-enforced gating |
Rule of thumb: if you want the user to keep their personal data and the device, but the company to keep its data, MAM-WE. APP without CA enforcement is optional; APP with CA "Require app protection policy" is enforced.
Approach
- Choose the model and target audience — MAM-WE for BYOD, APP on managed devices for corporate. Both target users and groups, not devices. Per platform: iOS/iPadOS and Android. Verify: APP assignment shows the right user groups; status report shows policy delivered to the target population.
- Data protection settings — Restrict cut/copy/paste to managed apps; prevent "Save As" to personal locations; restrict backup to iCloud/Google Drive; require encryption of org data at rest in the app. Verify: testing on a personal device shows paste from Outlook → personal Notes is blocked.
- Access requirements — Require app PIN (6 digits min) or biometric to open managed apps; set offline grace period (typically 12-48 hours); block jailbroken / rooted devices; minimum OS version.
- Selective wipe — Use "wipe corporate data only" to remove org data from the app while leaving personal data intact. Critical for BYOD departures. Verify: pilot wipe on a personal device removes Outlook/OneDrive corp data, keeps photos and personal apps untouched.
- Combine with Conditional Access for enforcement — APP alone doesn't gate sign-in. Create a CA policy with grant control Require app protection policy for the target cloud apps (Exchange Online, SharePoint, Teams). This is the enforcement. Verify: CA What If on Exchange from an unprotected app = blocked.
- App configuration — Pair APP with app configuration policies for managed app settings (Outlook signature, allowed account types).
Guardrails
- MAM-WE protects data in supported apps only. Confirm the app is on the Intune-SDK / approved-app list. An unsupported app = no protection.
- Communicate the user experience (PIN, restrictions) before rollout to reduce friction. Users on BYOD will uninstall if surprised by a new PIN prompt.
- Combine with Conditional Access for enforcement; APP alone doesn't gate sign-in. Without CA, users can use unmanaged Outlook and bypass APP.
- Offline grace period is a trade-off. Too short = users locked out on a flight; too long = stale data stays on a lost device. 24-48 hours typical.
- Selective wipe is queued. Wipe initiates next time the user opens the app online. Not instant - revoke sessions in parallel for high-risk departures.
- Don't run APP without app configuration. Default Outlook on BYOD allows personal account; APP doesn't stop that. Configuration policy restricts to corp account only.
Common anti-patterns
- "Deploy APP, expect data protection" - Without CA enforcement users sign into the unmanaged version of Outlook and bypass APP entirely.
- "Block jailbroken devices but don't communicate" - First-time users on rooted devices = ticket storm. Communicate before enforcement.
- "No offline grace period" - First poor-signal day = mass lockout.
- "Same policy iOS and Android" - Platform-specific knobs (e.g. iOS managed open-in, Android work profile interaction) need per-platform tuning.
- "Wipe = device wipe" on BYOD - Wipes personal data; legal exposure. Selective wipe only on BYOD.
- "Skip app configuration policies" - Outlook on personal account = data leaks outside scope of APP.
Example prompts
Create an Intune app protection policy for BYOD without enrollment (MAM-WE).Restrict copy/paste and enable selective wipe in mobile apps for iOS and Android.Set up Conditional Access "Require app protection policy" for Exchange Online and SharePoint.Configure Outlook app configuration policy alongside APP.Plan offline grace period and PIN requirements for our mobile workforce.Wipe corporate data from a departing contractor's personal phone without touching personal data.
Microsoft Learn
- APP overview: https://learn.microsoft.com/intune/app-management/protection/overview
- APP settings - iOS: https://learn.microsoft.com/intune/app-management/protection/ref-settings-ios
- APP settings - Android: https://learn.microsoft.com/intune/app-management/protection/ref-settings-android
- MAM without enrollment: https://learn.microsoft.com/intune/app-management/protection/create-policy
- Supported apps: https://learn.microsoft.com/intune/app-management/ref-protected-apps
- CA - Require app protection policy: https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-grant
- Selective wipe: https://learn.microsoft.com/intune/app-management/protection/wipe-corporate-data
In this repository87 other files it gives its agents.
- agent-identity-governanceSkill
- api-security-designSkill
- azure-ai-content-safetySkill
- azure-app-service-securitySkill
- azure-arcSkill
- azure-bastion-jitSkill
- azure-confidential-computingSkill
- azure-ddos-protectionSkill
- azure-firewallSkill
- azure-key-vaultSkill
- azure-monitor-securitySkill
- azure-network-security-designSkill
- azure-pimSkill
- azure-policySkill
- azure-pricingSkill
- azure-role-selectorSkill
- azure-security-benchmarkSkill
- azure-site-recoverySkill
- azure-wafSkill
- bitlocker-designSkill
- cloud-app-security-postureSkill
- compliance-managerSkill
- compromise-recoverySkill
- conditional-access-mfaSkill
- copilot-for-m365-readinessSkill
- defender-easmSkill
- defender-for-apisSkill
- defender-for-businessSkill
- defender-for-cloud-aiSkill
- defender-for-cloud-appsSkill
- defender-for-cloud-hardeningSkill
- defender-for-containersSkill
- defender-for-endpointSkill
- defender-for-identitySkill
- defender-for-iotSkill
- defender-for-office-365Skill
- defender-for-serversSkill
- defender-for-storageSkill
- defender-tvmSkill
- defender-xdrSkill
- entra-external-idSkill
- entra-global-secure-accessSkill
- entra-id-governanceSkill
- entra-id-protectionSkill
- entra-idSkill
- entra-permissions-managementSkill
- entra-verified-idSkill
- entra-workload-identitySkill
- iac-securitySkill
- insider-risk-baselineSkill
- intune-device-mgmtSkill
- m365-govern-manageSkill
- m365-oversharingSkill
- macos-intune-baselineSkill
- microsoft-agent-365Skill
- microsoft-privaSkill
- passkeys-fido2Skill
- paw-designSkill
- pki-designSkill
- purview-advanced-dlpSkill
- The first 60 shown.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
Reviews can't be read right now.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.