034: Review App config vs App protection policies

Implementation Effort: Medium
User Impact: Low to Medium

Overview

App configuration policies and app protection policies solve different problems in Microsoft Intune. App configuration tells supported apps how to behave. App protection controls how organizational data is accessed, transferred, and removed within supported apps. In most mature mobile deployments, both are used together.

For Zero Trust, the distinction matters because configuration without protection can leave data exposed, while protection without configuration can leave the app experience inconsistent or harder to support.

Implementation Guidance

1. Use app configuration when you need to prepopulate or enforce app settings such as account mode, tenant restrictions, approved domains, browser handoff, or feature toggles.
2. Use app protection when you need to protect work data inside supported apps through controls such as PIN, encryption, copy/paste restrictions, selective wipe, and Conditional Launch.
3. Use both together for most Microsoft 365 mobile app deployments.
4. For unenrolled BYOD scenarios, verify whether the configuration must be delivered to managed apps rather than only to managed devices.
5. Design and test by user journey, not by policy type. Example: tapping a SharePoint link from Outlook should open the expected app and keep the data inside the protected boundary.
6. Document per-app dependencies because some vendor apps support configuration, protection, both, or neither.
7. Review assignments so the same user population receives the full intended experience.

A concise decision rule is: configure the app so it behaves correctly, then protect the app so its data stays controlled.

Video Walkthrough

Reference

• App Configuration Policies for Microsoft Intune - Microsoft Intune — Introduces app configuration policies for managed apps and managed devices in Intune.
• App Protection Policies Overview - Microsoft Intune — Provides an overview of Intune app protection policies for managed apps.
• Configuration Policies for Intune App SDK Managed Apps - Microsoft Intune — Explains app configuration policies for apps managed through the Intune App SDK.