> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/intune/app-configuration.md). # App Configuration {% hint style="info" %} This page is a branch of [Intune](/modules/secure/intune.md), covering the **App Configuration** policy category specifically. See that page first for how Templates, Baselines, and Policies relate to each other in general — everything below assumes that model. {% endhint %} App Configuration policies push predefined settings *into* a managed app — as opposed to App Protection, which restricts how data moves in and out of it. A common example is pre-populating a mail app with the user's Exchange server address, or toggling a managed browser's homepage, without the end user having to configure it themselves. {% hint style="warning" %} Augmentt ships **no built-in default templates** for App Configuration. There's nothing to deploy out-of-the-box here — document the configuration surface thoroughly so a customer understands what they can build, since Augmentt gives no starting point. {% endhint %} ## What this category controls App Configuration policies live under Graph `/deviceAppManagement/mobileAppConfigurations`, and Augmentt recognizes three platform shapes: | Platform | Graph `@odata.type` | | ----------------------------------------------- | ------------------------------------------------------ | | iOS/iPadOS (managed devices) | `#microsoft.graph.iosMobileAppConfiguration` | | Android (managed store app) | `#microsoft.graph.androidManagedStoreAppConfiguration` | | Targeted managed app (MAM, not device-enrolled) | `#microsoft.graph.targetedManagedAppConfiguration` | A policy always targets one specific app (by app ID/package ID), so the configuration schema you fill in depends on that app — Augmentt loads the app's own managed-configuration schema where available ("configuration designer"), and falls back to a raw JSON editor when it isn't. ## Configuration surface ### App behavior (cross-platform) * **Configuration settings format** — use the configuration designer (schema-driven form) or enter raw JSON directly. * **Connected apps enabled** — lets the app connect across work and personal profiles (corporate-owned work-profile devices only). * **Credential provider role** — allow the app to act as a credential provider (password autofill, passkeys, etc.): allowed / not configured. ### iOS/iPadOS settings * **iOS app configuration settings** — a Microsoft Graph `appConfigurationSettingItem` collection (key/type/value triples) for managed-device app configuration, editable individually (add iOS setting) or via the schema designer. ### Android settings * **Android payload** — Android Enterprise managed-configuration JSON payload (stored by Graph as a string), editable through the designer or the JSON editor for keys the designer doesn't expose. * **Profile applicability** — default, Android device owner, or Android work profile, controlling which Android management mode the configuration applies to. * **Permission overrides** — override how Android grants specific runtime permissions to the targeted app: auto-grant, auto-deny, or prompt, with a default action applied across the selected set. The permission picker covers the standard Android runtime permissions: calendar (read/write), camera, contacts (read/write), get accounts, location (fine/coarse/background), record audio, phone state, call phone, call log (read/write), add voicemail, use SIP, process outgoing calls, body sensors (including background), external storage (read/write), and post notifications. * **Advanced JSON** — a raw-JSON escape hatch for permission actions or payload keys not exposed in the picker/designer. ### Managed app (targeted managed app configuration / MAM) * **Custom settings** — free-form Graph `customSettings` key/value pairs delivered to policy-managed apps that aren't device-enrolled. * **Encoded settings XML** — Base64-encoded MDM-style app configuration XML, per Microsoft Graph, for apps that expect that format. ## Resolves posture check(s) {% hint style="warning" %} No default templates ship for this category, and Augmentt's `SECURE_CHECK_TYPES` / `COMPLIANCE_AUDIT.*` posture-check engine has no dedicated App Configuration check. This category is purely an app-behavior/provisioning tool rather than a security-hardening one, so it doesn't map cleanly to a compliance framework control the way Device Configuration or Compliance templates do. {% endhint %} ## Related pages * [Intune](/modules/secure/intune.md) * [App Protection](/modules/secure/intune/app-protection.md) * [Apps](/modules/secure/intune/apps.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/intune/app-configuration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.