026: MAM Compliance and Conditional Access

Implementation Effort: Medium to High
User Impact: Medium

Overview

For mobile access, organizations often need to balance user productivity with data protection on devices they do not fully manage. Microsoft Intune app protection policies can protect data inside supported apps, while Microsoft Entra Conditional Access can require either a protected app experience or a compliant device depending on the resource and risk scenario.

Zero Trust requires that you choose the right control for the scenario instead of treating all mobile access the same.

Implementation Guidance

1. Separate your access patterns into clear scenarios:
   • BYOD / unmanaged: require app protection policy and supported client apps.
   • Corporate-owned or highly regulated: require device compliance in addition to app protection where needed.
2. In Microsoft Entra Conditional Access, use current controls such as:
   • Require app protection policy
   • Require approved client app where still appropriate for the targeted cloud app and client platform
   • Require device to be marked as compliant for managed-device scenarios
3. Do not describe app protection users as "compliant devices" unless an actual Intune compliance policy is being evaluated.
4. Align Exchange Online, SharePoint Online, and Teams access rules so the user experience is consistent.
5. Test with pilot users on both Android and iOS/iPadOS, including scenarios where the user signs in from a non-protected app.
6. Document break-glass and exception handling for executives, contractors, and support accounts.
7. Review sign-in logs, Conditional Access insights, and Intune app protection reports to validate that the intended policy path is being used.

A strong design explains not only what to require, but why one population gets app protection while another must use an enrolled and compliant device.

Video Walkthrough

Reference

• Migrate approved client app to application protection policy in Conditional Access - Microsoft Entra ID — Explains the Conditional Access grant control that combines approved client app and app protection policy requirements.
• App Protection Policies Overview - Microsoft Intune — Provides an overview of Intune app protection policies for managed apps.
• Device compliance policies in Microsoft Intune - Microsoft Intune — Explains how to design and manage device compliance policies in Intune.
• What is Microsoft Entra? - Microsoft Entra — Provides Zero Trust-oriented identity and device access guidance across the Microsoft Entra platform.