Skip to main content

029: App config settings

Implementation Effort: Medium
User Impact: Low to Medium

Overview​

App configuration policies in Microsoft Intune let you preconfigure supported apps with organization-specific settings such as account mode, data destinations, approved domains, network endpoints, or feature flags. They are distinct from app protection policies: app configuration tells the app how to behave, while app protection controls how work data is handled.

In a Zero Trust architecture, app configuration helps reduce user error and keeps app behavior aligned to the organization’s security and access model.

Implementation Guidance​

  1. Identify apps that support managed app configuration, especially Microsoft 365 mobile apps, Microsoft Edge, and third-party apps integrated with managed app configuration.
  2. Determine whether each app should receive configuration through:
    • Managed devices (for enrolled devices)
    • Managed apps (for app protection scenarios on unenrolled devices)
  3. Keep security-sensitive configuration values standardized. Examples include allowed accounts, approved sites, data destinations, and tenant-specific service endpoints.
  4. Assign configuration policies to the same user populations that receive the corresponding app protection or enrollment experience.
  5. Validate the actual in-app result. Do not assume a policy is working just because the Intune assignment succeeded.
  6. Coordinate app configuration with Conditional Access and app protection so all three layers support the same user journey.
  7. Maintain a per-app design record that lists the vendor-supported keys, expected behavior, and test evidence.

App configuration works best when you use the vendor’s documented keys and avoid one-off settings that no one retests after app updates.

Reference​