# Implementing App Protection Policies (MAM)

> Chapter 13 of the Courseiva MD-102 curriculum — https://courseiva.com/learn/md-102/implementing-app-protection-policies

**Official objective:** 3.3 — Create and manage app protection policies for mobile devices

## Introduction

Exam objective 3.3 asks you to create and manage app protection policies for mobile devices. This section tackles App Protection Policies, also called Mobile Application Management (MAM). If you’ve ever worried about protecting company emails on an employee’s personal phone without taking over the entire device, MAM is the solution the MD-102 exam expects you to master.

## The Lunchbox Analogy

Your organisation issues you a sturdy lunchbox for company meals. This lunchbox is your work phone, and the meals inside are your business apps like Outlook and Teams. The lunchbox has a lock that only your employer’s key can open. 

Now, imagine you bring your own lunchbox from home for personal snacks. That’s your personal phone with personal apps like Instagram. The company lunchbox stays completely separate. App Protection Policies work like the rules your employer stamps on the company lunchbox: 'No sharing your sandwich with friends outside the company', 'Do not take the lunchbox lid off and hand the food to a stranger', and 'If the lunchbox gets stolen, all the food inside becomes inedible instantly.' 

You can still carry both lunchboxes in the same bag, but the company lunchbox’s rules apply only to its own food. The personal lunchbox’s snacks are untouched. This is exactly how MAM policies protect corporate data inside apps without managing the whole device. The policy follows the app, not the phone. Your personal Instagram pictures stay private because the rules only apply to the company’s apps.

## Core explanation

Mobile Application Management (MAM) is a set of policies that protect corporate data inside specific apps on a mobile device, without needing to manage the whole device. Think of it as a security guard that only watches the door of the office where the company data lives, ignoring the rest of the building. The device can be personal (BYOD — Bring Your Own Device) or corporate-owned, but MAM works the same way: it secures the data inside the managed app.

App Protection Policies (APP) are the rules you create in the Microsoft Intune admin centre. These policies apply to mobile apps like Microsoft Outlook, Teams, SharePoint, and Office mobile apps. When a user opens one of these apps with their work account, the policy kicks in. It does not apply to the same app when the user opens it with their personal account.

Why does MAM exist? Before MAM, IT had only two options: either manage the whole device with Mobile Device Management (MDM) or do nothing. MDM meant wiping the entire phone if someone left the company, even personal photos and contacts. MAM solves this by letting IT target only the corporate data inside managed apps. If an employee leaves, the company can wipe just the corporate data from those apps, leaving personal data untouched.

Here are the key components of MAM:

- **Policy settings**: You configure rules like 'Require PIN to access app', 'Block copy/paste between work and personal apps', 'Encrypt corporate data at rest', and 'Wipe corporate data after a number of failed attempts'.
- **Targeting**: Policies can target specific user groups, device platforms (iOS, Android), or app groups. For example, you might apply stricter rules to finance team members using Outlook on Android.
- **Conditional Launch**: You can set conditions like 'If the device is jailbroken or rooted, block access to the app' or 'If the minimum OS version is not met, allow access but warn the user'.
- **Multi-identity support**: Apps like Microsoft Outlook support multiple accounts. A user can have their work email and personal Gmail in the same Outlook app. The MAM policy applies only to the work account, not the personal one.

How does it work in practice? When a user signs into a managed app with their work credentials, the app checks with Microsoft Intune for any applicable policies. If a policy requires a PIN, the app prompts the user to set one. If the policy blocks sharing data with unmanaged apps, the user cannot copy text from a work email and paste it into a personal notes app. All these checks happen seamlessly in the background.

MAM does not replace MDM. They serve different purposes. MDM manages the whole device — installs certificates, enforces device encryption, wipes the device if lost. MAM manages the data inside apps. Many organisations use both: MDM for corporate-owned devices, MAM for BYOD scenarios. The MD-102 exam tests your ability to choose when to use each.

One crucial detail: MAM policies require a Microsoft Entra ID (formerly Azure AD) identity. The user must sign in with a work or school account that is syncronised from on-premises Active Directory or created directly in Entra ID. Without that identity, the policy cannot apply because Intune does not know who the user is.

To create an App Protection Policy, you navigate to the Microsoft Intune admin centre, select 'Apps', then 'App protection policies', and click 'Create policy'. You choose the platform (iOS or Android), give the policy a name, configure settings under the 'Data protection', 'Access requirements', and 'Conditional launch' sections, and then assign it to a user group. The policy takes effect the next time the user opens the managed app on their device.

The exam loves to test the difference between MAM and MDM, the settings available in App Protection Policies, and how policies behave with multi-identity apps. You should memorise the default values and know which settings are available for each platform.

## Real-world context

Let us walk through a realistic scenario. You are the IT administrator for a mid-sized company called 'GreenLeaf Consulting'. They have 150 employees, many of whom use personal iPhones and Android devices to check work email and Teams messages. The CEO has just read about a data breach at a competitor where an employee copied client data from a work email into a personal note-taking app, then lost their phone. The CEO wants to prevent this without forcing everyone to use company-issued phones.

Your first task is to open the Microsoft Intune admin centre. You go to 'Apps' > 'App protection policies' and click 'Create policy'. You choose iOS because most employees use iPhones. You name the policy 'GreenLeaf iOS Data Protection'. Under 'Data protection' settings, you configure:

- **Require app PIN**: Set to 'Require'. This forces users to enter a PIN every time they open Outlook or Teams with their work account.
- **Block copy/paste**: Set to 'Block between work and personal'. This means a user cannot copy a client name from a work email and paste it into WhatsApp or Apple Notes.
- **Encrypt corporate data**: Set to 'Require'. This encrypts the data stored locally by the managed app.
- **Wipe corporate data on device enrollment**: Set to 'Wipe'. If the user leaves the company, their corporate data is wiped from those apps.

Next, you configure 'Access requirements'. You require the PIN to be at least 6 digits. You set a grace period of 5 minutes after which the PIN is required again. You also set 'Block managed apps from running on jailbroken/rooted devices' — a crucial setting for security.

Then you configure 'Conditional launch'. You set a minimum OS version of iOS 17.0. If a user’s phone is on iOS 16.9, the app will open but show a warning. If the device is iOS 15 or lower, access is blocked.

Finally, you assign the policy to a user group called 'All Employees'. You also create a separate policy for the finance team that blocks 'Save as' to local storage, because they handle sensitive payroll data.

Now, consider what happens when an employee named Sarah opens Outlook on her personal iPhone. She signs in with sarah@greenleaf.com. The app contacts Intune and downloads the policy. Sarah is prompted to create a 6-digit PIN. She does. She reads a client email and tries to copy the client’s phone number. When she long-presses, the 'Copy' option is greyed out. She tries to save an attachment to her phone’s Files app — the option is missing. She is frustrated, but the CEO’s data is safe.

If Sarah leaves the company, you go to 'Apps' > 'App protection policies' and select 'Wipe corporate data'. This sends a signal to the managed apps on Sarah’s phone. When she opens Outlook next, the app deletes all corporate emails, contacts, and files within that app. Her personal photos and apps remain untouched.

This scenario shows you the step-by-step process an administrator actually follows: plan policies based on security needs, create them in Intune, assign to groups, and monitor compliance. The exam expects you to know not just the theory, but the exact settings and their effects.

## Exam focus

The MD-102 exam tests objective 3.3 primarily through multiple-choice questions and case studies. You will see questions that ask you to recommend the correct policy setting for a given scenario, identify the difference between MAM and MDM, or troubleshoot why a policy is not applying.

Here are the exact concepts the exam loves to test:

- **MAM vs MDM**: You will get a scenario describing a BYOD environment and a corporate environment. The trick is recognising that MAM applies to apps without device management, while MDM manages the whole device. A common trap is a question that says 'You need to ensure corporate data is encrypted on a personal device' — the answer is MAM because you cannot manage the device, but you can encrypt data within the app.
- **Multi-identity support**: The exam will ask which Microsoft apps support multi-identity. Outlook, Teams, SharePoint, OneNote, and Office mobile apps do. The trap is thinking all apps do — many third-party apps do not. The policy applies only to the work account within the app.
- **Policy settings by platform**: Some settings are only available on iOS, some only on Android. For example, 'Require app PIN' is available on both, but 'Block screenshots' is Android-only. The exam tests this distinction.
- **Conditional launch settings**: You will see questions about minimum OS version, maximum PIN attempts, and device health (jailbroken/rooted). Memorise the actions: 'Allow', 'Block', and 'Wipe'. The exam loves to ask: 'What happens if a device is jailbroken?' The answer: 'Access is blocked, and corporate data is wiped after the policy checks.'
- **Wiping corporate data**: The exam distinguishes between 'full wipe' (MDM — wipes the entire device) and 'selective wipe' (MAM — wipes only corporate data from managed apps). A question might say 'An employee leaves the company. You need to remove corporate data from their personal phone without affecting personal data.' The answer is a selective wipe via MAM.

Common traps on the exam:

- **Trap 1**: Confusing the terms 'App Protection Policy' with 'App Configuration Policy'. Remember: Protection policies secure data; Configuration policies pre-configure app settings (like server addresses). They are different.
- **Trap 2**: Assuming MAM requires the device to be enrolled in MDM. It does not. MAM can work standalone, even on unmanaged devices.
- **Trap 3**: Thinking that blocking copy/paste applies to all apps globally. It only applies between managed work accounts and unmanaged personal accounts within the same app, or between managed apps and unmanaged apps.
- **Trap 4**: Forgetting that Microsoft Entra ID is required. Without an Entra ID identity, the policy cannot target the user. The policy needs a user account that syncs with Entra ID.

The exam also tests your ability to prioritise actions. For example, if a device is jailbroken and the policy says 'Block access', but the user has 5 failed PIN attempts, the policy will first block access due to jailbreak. The trap is choosing 'wipe corporate data' first — the exam wants you to know that blocking takes precedence over wiping in the policy evaluation order.

To pass this section, create flashcards for each policy setting, its platform availability, and its effect. Practise with Microsoft Learn’s sandbox environment if you can, or use the free Intune documentation. Know the default values: for example, the default PIN length is 4, but you can change it. The exam will test whether you know you can customise this.

## Step by step

1. **Sign in to Microsoft Intune admin centre** — Open a web browser and navigate to https://intune.microsoft.com. Sign in with a Global Administrator or Intune Administrator account. This is the central console where all mobile management tasks happen.
2. **Navigate to App protection policies** — In the left-hand menu, select 'Apps', then 'App protection policies'. This opens the page where you can view, create, and manage all policies. You will see any existing policies listed here.
3. **Click 'Create policy' and choose platform** — Click the blue 'Create policy' button and choose either iOS/iPadOS or Android. The platform choice matters because some settings (like screenshot blocking) are only available on Android. You cannot apply an iOS policy to Android devices.
4. **Configure basic settings** — Give the policy a name (e.g., 'Corporate Data Protection iOS'). Add a description for other admins. Optionally, choose a platform-specific setting like 'Target to all app types' if you want to cover all Microsoft apps. This step defines the policy's identity.
5. **Set data protection rules** — Under 'Data protection', configure settings like 'Block copy/paste between work and personal', 'Require app PIN', and 'Encrypt corporate data'. Each setting controls how corporate data flows within and outside the managed app. For example, block copy/paste prevents data leakage.
6. **Configure access requirements** — Under 'Access requirements', set the PIN length, the grace period before reauthentication, and whether to block access on jailbroken or rooted devices. These settings control who can open the app and under what conditions.
7. **Set conditional launch conditions** — Under 'Conditional launch', configure conditions like minimum OS version, maximum PIN attempts, and device health. For each condition, choose an action: 'Allow', 'Block', or 'Wipe'. For example, if a device is jailbroken, set the action to 'Block' to prevent access.
8. **Assign the policy to user groups** — After configuring settings, click 'Next' to reach the 'Assignments' page. Select 'Include groups' and choose the Microsoft Entra ID user group (e.g., 'All Employees'). The policy takes effect when users in that group open a managed app. You can exclude groups as needed.
9. **Review and create the policy** — Review all settings on the final page. If everything looks correct, click 'Create'. The policy is now active. It may take a few minutes to propagate to devices. Users will see changes the next time they open the managed app.

## Comparisons

### Mobile Application Management (MAM) vs Mobile Device Management (MDM)

**Mobile Application Management (MAM):**
- Manages data inside specific apps only
- Can work on devices that are not enrolled (BYOD)
- Selective wipe removes only corporate data from apps

**Mobile Device Management (MDM):**
- Manages the entire device (apps, settings, passwords)
- Requires device enrollment and full management
- Full wipe erases all data on the device

### App Protection Policy (APP) vs App Configuration Policy (ACP)

**App Protection Policy (APP):**
- Focuses on data security (e.g., PIN, encryption, block copy)
- Enforces compliance rules on data access
- Available for both enrolled and unenrolled devices

**App Configuration Policy (ACP):**
- Focuses on pre-setting app behaviour (e.g., server URL, theme)
- Does not enforce security, only configuration
- Typically used with enrolled devices or managed apps

### Multi-identity app (Outlook) vs Single-identity app (Google Drive)

**Multi-identity app (Outlook):**
- Supports multiple accounts (work and personal) in one app
- MAM policy applies only to the work account
- Personal data in the same app remains private

**Single-identity app (Google Drive):**
- Usually supports only one account per app instance
- Cannot separate work and personal data within the same app
- Policy would apply to all data in the app if managed

### iOS App Protection Policy vs Android App Protection Policy

**iOS App Protection Policy:**
- Cannot block 'Save as' to cloud storage natively
- Cannot block screenshots (platform limitation)
- Supports Face ID and Touch ID for app PIN

**Android App Protection Policy:**
- Can block 'Save as' to local storage and cloud
- Can block screenshots using the Intune SDK
- Supports biometric PIN via device hardware

## Diagram

_This flowchart shows the process of creating an App Protection Policy in Intune, assigning it to a user group, and how it applies to the work account within a managed app to protect corporate data._

```mermaid
flowchart TD
    Admin[IT Admin] -->|Creates| Policy[App Protection Policy]
    Policy -->|Assigns to| Group[User Group in Entra ID]
    Group -->|User signs in| App[Managed App e.g. Outlook]
    App -->|Checks with| Intune[Microsoft Intune]
    Intune -->|Downloads policy| App
    App -->|Applies rules| WorkAccount[Work Account]
    WorkAccount -->|Protected| CorporateData[Corporate Data]
    style Policy fill:#f9f,stroke:#333,stroke-width:2px
    style WorkAccount fill:#bbf,stroke:#333,stroke-width:2px
    style CorporateData fill:#bfb,stroke:#333,stroke-width:2px
```

## Common misconceptions

- **Misconception:** MAM policies require the device to be enrolled in MDM to work. **Reality:** MAM works independently of MDM. You can apply app protection policies to devices that are not enrolled, such as personal BYOD phones. (Beginners often conflate MAM with MDM because both are managed from Intune. The word 'mobile' in MAM makes them think device management is required.)
- **Misconception:** If I block copy/paste in the policy, the user cannot copy any text in the app. **Reality:** The block only applies to copying data from a work account to a personal account or app. The user can still copy text within the work account, for example from one work email to another. (The policy name 'block copy/paste' sounds absolute. Users and beginners assume it disables all clipboard functionality, not realising it is context-aware.)
- **Misconception:** App Protection Policies can be applied to any app, including third-party apps like WhatsApp or Facebook. **Reality:** App Protection Policies only work with Microsoft apps that support Intune MAM and with specific third-party apps that have integrated the Intune SDK. WhatsApp and Facebook do not support MAM. (The word 'app' in the policy name is misleading. Beginners think IT can protect any app, but the policy requires the app to be MAM-aware.)
- **Misconception:** MAM policies replace the need for any device-level security. **Reality:** MAM supplements device security but does not replace it. For example, MAM cannot enforce device encryption or require a device passcode. Those require MDM or native OS settings. (Learners often see MAM as a simpler alternative to MDM and assume it covers all security needs, overlooking that MAM only secures data within managed apps.)
- **Misconception:** The policy applies to all accounts the user has in the managed app. **Reality:** The policy applies only to the work or school account that is managed by Intune. Personal accounts in the same app, like a personal Gmail in Outlook, are not affected. (Multi-identity is a nuanced concept. Beginners think 'the app is managed' means everything inside is managed, but MAM operates at the account level.)

## Key takeaways

- App Protection Policies (APP) protect corporate data inside managed apps without needing to manage the entire device.
- MAM policies work independently of Mobile Device Management (MDM) and can be used on both enrolled and unenrolled devices.
- Multi-identity apps like Outlook support both work and personal accounts, and MAM policies apply only to the work account.
- Key policy settings include requiring a PIN, blocking copy/paste between work and personal, encrypting corporate data, and wiping corporate data on unenrollment.
- Conditional launch settings allow you to block access to managed apps on jailbroken or rooted devices, or if the device OS version is too old.
- Wiping corporate data via MAM (selective wipe) removes only business data from managed apps, leaving personal data intact.
- Microsoft Entra ID is a prerequisite for MAM — policies target user identities, not device serial numbers.
- The MD-102 exam tests the differences between MAM and MDM, platform-specific settings, and the behaviour of policy actions like block, allow, and wipe.

## FAQ

**Does MAM require the user to have a Microsoft Intune license?**

Yes, each user who is targeted by an App Protection Policy must have an appropriate license, such as Microsoft 365 E3, E5, or a standalone Intune license. Without a license, the policy will not apply.

**Can I apply MAM policies to personal apps like WhatsApp?**

No, MAM policies only work with apps that have integrated the Microsoft Intune SDK. Most personal apps like WhatsApp have not done this. Only Microsoft apps and a few third-party apps that have partnered with Microsoft are supported.

**What happens if a user removes their work account from the managed app?**

When the work account is removed, the corporate data associated with that account is automatically deleted from the app. The policy no longer applies because there is no managed account present.

**Can I have different MAM policies for different departments?**

Yes, you can create multiple policies with different settings and assign them to different user groups. For example, stricter policies for finance and more lenient ones for marketing. The exam tests this scenario frequently.

**How do I wipe corporate data from an employee's personal phone if they leave?**

In the Intune admin centre, go to 'Apps' > 'App protection policies' and select the policy. Then click 'Wipe corporate data'. This sends a command to the managed apps on the user's device to remove all corporate data, leaving personal data intact.

**What is the difference between an App Protection Policy and an App Configuration Policy?**

An App Protection Policy secures data (e.g., require PIN, block copy/paste). An App Configuration Policy pre-sets app settings (e.g., server address, theme colour). They are often used together but serve different purposes.

## Check your understanding

1. **What is the primary difference between a selective wipe via MAM and a full wipe via MDM?**

   Answer: A selective wipe removes only corporate data from managed apps, leaving personal data intact. A full wipe resets the entire device to factory settings, removing all data.

2. **Can App Protection Policies be applied to an iPhone that is not enrolled in MDM?**

   Answer: Yes, MAM policies work on unenrolled devices. The policy applies to the managed app after the user signs in with a work account, regardless of whether the device is enrolled.

3. **Which Microsoft apps support multi-identity for MAM policies?**

   Answer: Outlook, Teams, SharePoint, OneNote, and the Office mobile apps support multi-identity, meaning a user can have both work and personal accounts in the same app with the policy applying only to the work account.

4. **What action does a conditional launch setting take if a device is jailbroken and the policy is set to 'Block'?**

   Answer: The managed app will be blocked from opening, and corporate data cannot be accessed. The user sees a notification that the app is not allowed on this device.

5. **What is the purpose of the 'Require app PIN' setting in an App Protection Policy?**

   Answer: It forces users to enter a numeric PIN each time they open the managed app with a work account, adding an extra layer of security to prevent unauthorised access to corporate data.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/md-102/implementing-app-protection-policies