Personal phones and work data: Intune app protection

Is this for you? We can set this up where it's genuinely needed. For most businesses, though, we focus on managing company laptops and computers. We don't recommend enrolling phones by default, because it rarely adds much and it complicates the setup.

What app protection does, and what it doesn't

App protection policies (Microsoft also calls this mobile application management, or MAM) work at the app level. Intune applies them only when the app is used with a work account. A personal Outlook account or personal OneDrive on the same phone is left alone.

What you can enforce in the work context:

• A PIN or biometric to open work data in the app.
• Encryption of work data held by the app.
• Limits on where work data can go: no saving to personal storage, no pasting into personal apps, links opened in Microsoft Edge.
• Selective wipe, which removes work data from the apps without touching the rest of the phone.

What it doesn't do, because the phone isn't managed: install apps (staff get them from the App Store or Google Play), or push Wi-Fi, VPN or certificate profiles.

Requirements: each user needs a Microsoft Entra account and an Intune licence, must be in a group the policy targets, and must sign in to the app with their work account. On Android, the Intune Company Portal app must be installed (enrolment isn't needed), and Microsoft 365 apps on Android require the device to be registered in Microsoft Entra ID.

Choose a protection level

Microsoft publishes a data protection framework with three levels. Level 1 is the minimum for any device used for work. Level 2 is what Microsoft recommends for most people who handle work data on a phone. Level 3 is for people handling highly sensitive data.

Level 2 also sets a minimum operating system version. Microsoft recommends matching the iOS and Android versions its own apps support. For most small businesses, Level 2 is the right target: it stops the easy leaks without getting in the way of normal work.

Target the policy at Microsoft's core apps: Edge, Excel, Office, OneDrive, OneNote, Outlook, PowerPoint, SharePoint, Teams, To Do and Word. Add any other apps your staff use for work, if they support app protection.

Personal phones and company phones

If you assign app protection to a user without saying which devices it applies to, it applies on both their personal phone and any enrolled company phone. Microsoft suggests targeting by device management state instead: set "Target to all app types" to No, then apply a stricter policy to unenrolled devices and a lighter one (or none) to enrolled devices that already have a device PIN enforced through compliance.

Make it stick with Conditional Access

App protection only protects data that is opened in a protected app. Without a Conditional Access rule, nothing stops someone signing in to work email from the phone's built-in mail app. Microsoft's documented policy:

1. Users: all users, excluding your emergency access accounts.
2. Target resources: all resources.
3. Conditions: device platforms Android and iOS.
4. Grant: Require app protection policy.
5. Start in report-only mode, then turn it on.

Older guidance paired this with "Require approved client app". Microsoft has retired that control: since 30 June 2026, policies using it are read-only, and Microsoft says new policies should use only "Require app protection policy". If your tenant has an older policy built on approved client apps, plan to replace it.

Two more notes from Microsoft. In report-only mode, the sign-in log can show "Report-only: Failure" for a sign-in that will in fact succeed once the policy is on, so don't read those entries too literally. And pair this policy with one that blocks unknown or unsupported device platforms, plus the block on legacy authentication from our Conditional Access baseline.

What staff will notice

• They install Outlook, Teams and OneDrive from the store and sign in with their work account. Android users also install the Company Portal app, without enrolling the phone.
• The first time they open work data, they set an app PIN. On iPhone, Microsoft's apps share one PIN; on Android, one PIN covers all protected apps.
• Pasting work text into a personal app, or saving a work attachment to personal storage, is refused.
• Their personal accounts, photos and apps work exactly as before. Nobody at work can see or wipe them.

When someone leaves or loses a phone

Create a selective wipe request in Intune (Apps > App selective wipe). The work data is removed the next time the app runs. Microsoft notes the user must open the app for the wipe to happen, and it can take up to 30 minutes after the request. Contacts that Outlook synced into the phone's own address book are removed too. A user-level wipe sends the wipe to every app on every device that person uses, and keeps sending it at each check-in until you take them off the list. Disabling the person's account in Entra, combined with the Level 2 "disabled account" setting, blocks access as well.

Pitfalls we see

• No Conditional Access policy, so the protections only apply to staff who happen to use the right apps.
• Apps that don't support app protection. Check before you promise a line-of-business app will work.
• Android phones without the Company Portal, which never receive the policy.
• A leftover OneDrive "global" policy from the OneDrive admin centre. Microsoft says any standard Intune app protection policy overrides it, and the OneDrive admin centre settings are no longer being updated.

How 365msp handles personal phones

Our Intune device management service centres on company laptops and computers, and we don't enrol phones by default. Where a client genuinely needs work data on personal phones protected, we can set up app protection as part of the same service, with the Conditional Access policy that enforces it.