> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/intune/app-protection.md). # App Protection {% hint style="info" %} This page is a branch of [Intune](/modules/secure/intune.md), covering the **App Protection** policy category specifically. See that page first for how Templates, Baselines, and Policies relate to each other in general — everything below assumes that model. {% endhint %} App Protection policies are Intune's Mobile Application Management (MAM) layer — data-protection rules applied to specific managed apps (Outlook, Teams, Edge, and so on) regardless of whether the device itself is enrolled in Intune. They control how "organization data" moves in and out of those apps: copy/paste, save-as, backup, and what happens if the device or app falls out of compliance. {% hint style="warning" %} Augmentt ships **no built-in default templates** for App Protection. Every App Protection template you see in Augmentt was either imported from a connected customer's tenant or built by your organization from scratch. This is a genuine gap relative to Device Configuration/Compliance/Deployment Profiles — document the configuration surface thoroughly when advising a customer here, since there's no Augmentt starting point to point them at. {% endhint %} ## What this category controls Augmentt supports four App Protection policy platforms, matching four distinct Microsoft Graph resource types under `/deviceAppManagement/`: | Platform | Graph `@odata.type` | | ------------------------------------------------ | -------------------------------------------------------- | | iOS/iPadOS | `#microsoft.graph.iosManagedAppProtection` | | Android | `#microsoft.graph.androidManagedAppProtection` | | Windows (MAM without enrollment) | `#microsoft.graph.windowsManagedAppProtection` | | Windows Information Protection (device-enrolled) | `#microsoft.graph.mdmWindowsInformationProtectionPolicy` | Each has its own settings shape, so a template is always scoped to exactly one platform. ## Configuration surface ### iOS and Android (mobile app protection / MAM) * **Data protection** * Receive data from other apps: all apps / policy-managed apps / none. * Send org data to other apps: same options. * Cut/copy/paste between apps: any destination, policy-managed apps (with or without paste-in), or blocked. * Block Save As for org data. * Block backups (iTunes/iCloud on iOS; Android backup services on Android). * Block screenshots in managed apps. * Block contact sync from managed apps to the device. * Require managed browser for web links, with a choice of managed browser (Microsoft Edge, or a custom browser package/protocol you specify). * **Access requirements** * Require a PIN to access work/school data, with PIN type (numeric or alphanumeric), minimum length, simple/sequential PIN blocking, maximum retry attempts before block or wipe, and required PIN reset interval. * Allow biometric unlock (Touch ID/Face ID) instead of PIN, with an option to override biometrics back to PIN after a period of inactivity. * Require work/school account credentials for access. * Require the device itself to meet a device-level compliance or app-protection policy. * Recheck access after a period offline, recheck when back online, and wipe org data after a longer offline period. * **Conditional launch / version enforcement** (block, warn, or wipe org data based on a threshold) * Minimum/maximum OS version. * Minimum app version. * Minimum required Intune SDK version. * Android-specific: minimum security patch level (recommended and required, `YYYY-MM-DD`). * Device threat level (via Mobile Threat Defense): not configured / secured / low / medium / high, each with a remediation action (block, wipe, or warn). * **App data encryption** * When to encrypt app data: use device settings, after device restart, or when the device is locked (with or without excepting currently-open files). * Android: option to disable app-level encryption when device-level encryption is already on. ### Windows (MAM without enrollment, and Windows Information Protection) * **Data protection** * Send org data to / receive data from: all apps, none. * Clipboard sharing scope: any destination and source, none, same-org destinations with any source, or same-org destinations and sources only. * Block printing org data from managed apps. * **Health checks / access** * Offline grace period before access is blocked, and before org data is wiped. * Minimum required Windows version and app version. * Mobile Threat Defense: maximum allowed device threat level and the remediation action if exceeded. * Action to take if the user can no longer sign in (account removed or disabled). * **Version enforcement** (block/warn/wipe) — separate minimum/maximum thresholds for Windows OS version, app version, and Intune SDK version, each with its own block/warn/wipe tier. * **Windows Information Protection specific** — enforcement mode (off; on with encrypt+audit only; on with encrypt+audit+prompt; on with encrypt+audit+block), corporate identity (primary domain), and whether the enterprise proxy server list / enterprise IP range list is authoritative (disabling network auto-detection). ## Resolves posture check(s) {% hint style="warning" %} No default templates ship for this category, so there is nothing pre-built to map to a posture check. Augmentt's `SECURE_CHECK_TYPES` / `COMPLIANCE_AUDIT.*` enum also has no dedicated App Protection / MAM check today. {% endhint %} If you're building an App Protection policy to satisfy a customer's security requirements, the settings above map most directly to Microsoft's own MAM baseline recommendations (PIN + encryption + managed-browser + conditional-launch enforcement) and to the "protected apps" side of a Conditional Access **App Protection Policy** grant control — see [Conditional Access](/modules/secure/conditional-access.md) for the Conditional Access side of that pairing. ## Related pages * [Intune](/modules/secure/intune.md) * [App Configuration](/modules/secure/intune/app-configuration.md) * [Apps](/modules/secure/intune/apps.md) * [Conditional Access](/modules/secure/conditional-access.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/intune/app-protection.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.