037: Conditional launch settings

Implementation Effort: Medium
User Impact: Medium

Overview

Conditional Launch settings in Microsoft Intune app protection policies define what should happen when the app, device, or environment no longer meets security expectations. They are a continuous-control mechanism for app-protected data and are especially useful in BYOD and mobile app management-only scenarios.

This topic should focus on design decisions, not just enumerate settings.

Implementation Guidance

1. Prioritize the conditions that create the biggest real-world risk in your environment:
   • Rooted or jailbroken device detection
   • Minimum operating system version
   • Minimum app version
   • Maximum offline grace period
   • Device integrity or threat posture signals where supported
2. For each condition, choose the response deliberately:
   • Warn when the user can reasonably remediate without immediate business interruption
   • Block access when the condition materially weakens security
   • Wipe data only when the risk is high enough to justify automatic removal of organizational account data from the app
3. Keep response choices consistent across similar user populations unless there is a documented reason to vary them.
4. Test policy outcomes on supported Android and iOS/iPadOS apps before production assignment.
5. Review minimum version values regularly so they do not become stale or impossible for users to satisfy.
6. Coordinate Conditional Launch with threat-defense tooling and Conditional Access so the device, app, and cloud layers reinforce one another.
7. Publish a remediation guide for users and support teams.

Conditional Launch should not be treated as a miscellaneous settings bucket. It is part of the organization’s ongoing access evaluation strategy.

Video Walkthrough

Reference

• App Protection Policies Overview - Microsoft Intune — Provides an overview of Intune app protection policies for managed apps.
• Android App Protection Policy Settings - Microsoft Intune — Details the available Intune app protection policy settings for Android devices.
• iOS/iPadOS App Protection Policy Settings - Microsoft Intune — Details the available Intune app protection settings for iOS and iPadOS apps.
• Data Protection Framework Using App Protection Policies - Microsoft Intune — Explains the Intune app data protection levels and framework used to secure corporate data in managed apps.