Skip to main content

105: App config settings

Implementation Effort: Low to Medium
User Impact: Low to Medium

Overview​

App configuration policies in Microsoft Intune let you preconfigure app behavior without rebuilding the application package. In a Zero Trust device strategy, app config helps standardize secure defaults such as allowed accounts, data movement restrictions inside supported apps, required service endpoints, and app-specific settings that reduce user error and speed deployment.

Implementation Guidance​

  1. Separate app configuration from app protection. App config tells the app how to behave; app protection defines how organizational data is protected inside the app. In most Microsoft 365 mobile scenarios, both controls are used together.
  2. Decide whether the configuration is for enrolled devices, managed apps, or both. Some settings are only available for device-enrolled app config policies, while others are designed for managed apps and work alongside app protection policies.
  3. Use vendor documentation to identify supported configuration keys. For Microsoft apps, review the documented Intune app configuration settings. For third-party apps, confirm whether the publisher supports managed app configuration or Android managed configurations.
  4. Target small pilot groups first and verify settings in the actual app experience. Pay attention to account restrictions, file-open behavior, data transfer prompts, startup screens, and whether settings apply only after the app restarts.
  5. Use naming standards and ownership metadata for policies so administrators can tell which settings are baseline, department specific, or temporary. This becomes important quickly when multiple app teams contribute policies.
  6. Review conflicts with platform configuration, app protection, or Conditional Access. For example, browser, data transfer, and account requirements should align across Intune, Entra, and the app itself.

Reference​