跳到主要內容

049: App config settings

Implementation Effort: Medium

User Impact: Low to Medium

Overview​

App configuration policies in Microsoft Intune let administrators preconfigure supported app settings so users do not have to manually enter server names, account behavior, allowed domains, or other work-specific values. In a Zero Trust device program, these policies reduce insecure defaults, improve consistency, and help ensure users access organizational resources only through approved app experiences.

Use app configuration together with app protection policies, compliance policies, and Conditional Access. App configuration sets how the app behaves; app protection governs how organizational data can be used within the app.

Implementation Guidance​

  1. Identify the delivery channel for each app. Use the managed device (MDM) channel for enrolled devices and the managed apps / MAM channel when you are protecting apps on personally owned or unenrolled devices.
  2. Gather vendor-supported configuration keys before creating the policy. For Microsoft apps, use the documented Intune settings format; for third-party apps, confirm whether the app expects key/value pairs, JSON, XML, or an app-specific schema.
  3. In the Microsoft Intune admin center, create an app configuration policy for the correct platform and app type, then target a pilot group first.
  4. Keep app configuration narrowly focused on user experience and connectivity settings. Do not treat it as a replacement for app protection policies, compliance policies, or Conditional Access.
  5. Document which settings are mandatory versus optional, and validate that they survive app updates, reinstallation, and first-run sign-in.
  6. Where possible, combine app configuration with managed app app-protection settings such as Restrict cut, copy, and paste, Save copies of org data, and approved data-transfer controls.

Reference​