022: Conditional launch

Implementation Effort: Medium
User Impact: Medium

Overview

Conditional Launch in Microsoft Intune app protection policies is used to decide what happens when a protected app no longer meets a required security condition. Instead of trusting the app session indefinitely, Intune can warn the user, block access, or wipe the organization account data from the app when conditions such as device integrity, app version, OS version, or offline duration fall out of policy.

For Zero Trust, this matters because access to organizational data should remain continuously evaluated. Conditional Launch helps enforce that principle even on personally owned devices that are not fully enrolled in Intune, as long as the app supports Intune app protection.

Implementation Guidance

1. Start by identifying which users will use app protection without full device enrollment, such as BYOD mobile users.
2. In the Microsoft Intune admin center, create or update an app protection policy for Android and/or iOS/iPadOS.
3. Configure the Conditional launch section to evaluate conditions that materially affect data risk, such as:
   • Maximum offline grace period
   • Minimum app version
   • Minimum supported OS version
   • Rooted or jailbroken device detection
   • Threat signals when integrated with Microsoft Defender for Endpoint or another supported mobile threat defense partner
4. Prefer Block access before Wipe data for most conditions unless the risk is clearly high and your support process is ready.
5. Pair app protection policies with Microsoft Entra Conditional Access where appropriate, such as requiring an approved client app or app protection policy for Exchange Online and SharePoint Online.
6. Pilot with a small user group first. Verify user prompts, remediation messages, and selective wipe behavior before broad rollout.
7. Review Conditional Launch values at least quarterly so minimum versions and grace periods stay aligned to current support policy.

Good practice is to document which conditions are meant to protect confidentiality, which are meant to maintain app hygiene, and which trigger account-data wipe instead of a user-remediation flow.

Video Walkthrough

Reference

• App Protection Policies Overview - Microsoft Intune — Provides an overview of Intune app protection policies for managed apps.
• Android App Protection Policy Settings - Microsoft Intune — Details the available Intune app protection policy settings for Android devices.
• iOS/iPadOS App Protection Policy Settings - Microsoft Intune — Details the available Intune app protection settings for iOS and iPadOS apps.
• Data Protection Framework Using App Protection Policies - Microsoft Intune — Explains the Intune app data protection levels and framework used to secure corporate data in managed apps.