メインコンテンツへスキップ

076: App config settings

Implementation Effort: Medium
User Impact: Low to Medium

Overview​

App configuration policies in Microsoft Intune let administrators pre-populate settings inside supported mobile apps so users do not need to enter server names, tenant IDs, certificates, or other business settings manually. For Zero Trust, app configuration matters because it helps drive users into approved app experiences, points apps at trusted services, and reduces setup drift that can lead to insecure workarounds. On mobile platforms, distinguish between app configuration for managed apps (MAM/app protection scenarios) and app configuration for managed devices (MDM-enrolled scenarios).

Implementation Guidance​

  1. Inventory the apps you actually need to configure and confirm that each app supports Intune app configuration keys or a vendor-supplied schema.
  2. Choose the right delivery channel: use managed apps when you need settings in an app protection or unenrolled/BYOD scenario, and managed devices when the device is enrolled and you want device-scoped configuration.
  3. In the Microsoft Intune admin center, create an app configuration policy under Apps and use either the configuration designer or JSON/XML input exactly as documented by the app publisher.
  4. Target pilot groups first, and validate first-run experience, sign-in behavior, account bootstrap, data save locations, and any interaction with app protection policies.
  5. Pair app configuration with app protection policies, Conditional Access, and approved app assignments so users are guided into the intended secure app path.
  6. Document business-owned values such as service endpoints, allowed account types, save restrictions, and certificate dependencies so the policy can be maintained when the app changes versions.

Reference​