5.4 App Protection, App Configuration, and Conditional Access

MD-102 Endpoint Administrator Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Exam Overview and MD-102 Study Strategy

Current Exam Facts Audience Profile and Endpoint Admin Mental Model Domain Map and Weighting Strategy Six-to-Ten-Week Study Plan and Readiness Checklist

2 Prepare Infrastructure for Devices

Microsoft Entra Device Identity and Grouping Intune Enrollment by Platform Compliance and Conditional Access Admin Roles, Windows Hello, Windows LAPS, and Local Groups

3 Deploy and Configure Managed Devices

3.1 Autopilot vs. Provisioning Packages 3.2 Autopilot Modes, ESP, and Naming 3.3 Windows 11 Upgrades and Windows 365 Cloud PCs 3.4 Configuration Profiles and Assignment Filters

4 Intune Suite, Remote Actions, and Operational Troubleshooting

4.1 Endpoint Privilege Management and Enterprise App Catalog 4.2 Advanced Analytics, Remote Help, Cloud PKI, and Tunnel for MAM 4.3 Remote Actions and Bulk Actions 4.4 Defender Intelligence, BitLocker Key Rotation, and KQL Device Query Troubleshooting

5 Manage Applications with Intune

5.1 App Deployment Decision Matrix and Packaging 5.2 Microsoft 365 Apps, Office Policies, ODT, OCT, and Admin Center 5.3 App Stores and Update Lifecycle 5.4 App Protection, App Configuration, and Conditional Access

6 Protect Devices, Manage Updates, and Final Review

6.1 Endpoint Security Policies and Security Baselines 6.2 Defender for Endpoint Integration and Onboarding 6.3 Update Rings, Feature Updates, Platform Updates, and Delivery Optimization 6.4 Final Seven-Day Review Plan and Mixed Scenario Priorities

5.4 App Protection, App Configuration, and Conditional Access

Key Takeaways Explain This Topic AI

App protection policies secure organizational data inside managed apps and can work on enrolled or unenrolled devices.

MAM without enrollment is best for BYOD users who need Outlook, Teams, OneDrive, or other protected apps without full device management.

Managed devices app configuration uses the MDM channel for apps deployed to enrolled devices; managed apps configuration uses the MAM channel for SDK-integrated or wrapped apps regardless of enrollment state.

App configuration prepopulates app settings such as server URLs or allowed accounts; app protection controls data movement, access requirements, and selective wipe.

Conditional Access can require an app protection policy so only protected client apps reach Microsoft 365 resources; the older Require approved client app grant moves to read-only on June 30, 2026.

Last updated: June 2026

Managed apps versus managed devices

A managed device is enrolled in Intune and managed through mobile device management (MDM). Intune can deploy configuration profiles, compliance policy, certificates, apps, remote actions, and device-level settings. Managed devices are the right choice for corporate-owned devices, kiosks, shared devices, and any scenario that requires device compliance evaluation.

A managed app is an app where Intune applies app protection policy or app configuration through the mobile application management (MAM) channel. The device might be enrolled in Intune, enrolled in another MDM, or not enrolled at all. Management is centered on the user's work identity and the protected app data, not the whole device. The single most important MD-102 distinction is: device-health requirements are a device decision (compliance + Conditional Access), while corporate-data-in-app requirements are an app decision (app protection).

Need Use this control Why

Require device encryption, OS version, or jailbreak/root state for access Compliance policy plus Conditional Access Device health is a device-level decision

Require a PIN before opening Outlook work data App protection policy Controls access inside the managed app

Block copy from an Outlook work account to personal apps App protection policy Controls data transfer between managed and unmanaged apps

Prepopulate an app with a server URL or tenant ID App configuration policy Delivers app settings so users do not type them manually

Protect personal phones without enrollment MAM without enrollment Secures work data in supported apps without full MDM

Remove only corporate data from an app Selective wipe / app protection Leaves personal apps and personal data intact

MAM without enrollment

Mobile Application Management (MAM) without enrollment is commonly used for personal or bring-your-own-device scenarios. Users install apps such as Outlook, Teams, Edge, Word, Excel, PowerPoint, or OneDrive from a public app store, sign in with their work account, and receive app-layer management. The organization protects work data without managing the entire device. This is the default answer for "protect corporate data on personal phones without enrolling them."

MAM without enrollment is not the right primary model for organization-owned shared devices or kiosks. Corporate-owned endpoints usually need Intune enrollment so you can apply device configuration, compliance, inventory, remote actions, and full app deployment.

App protection policies

App protection policies define how work data behaves inside supported apps. Common settings include an app PIN, biometric access, encryption of work data, block copy and paste to unmanaged apps, prevent Save As to personal storage, restrict web links to Microsoft Edge, conditional launch rules (such as minimum OS or offline grace period), and selective wipe of organizational data. Selective wipe is the mechanism that removes only corporate data from a managed app, leaving personal data intact.

A key exam phrase is managed app . In Intune, a managed app for app protection is a protected app that has an app protection policy applied. Public Microsoft apps commonly support this through the Intune App SDK . Line-of-business apps can be prepared with the Intune App SDK or the App Wrapping Tool so they can enforce app protection settings.

App configuration policies

App configuration is not the same as app protection. Configuration supplies settings to the app; protection controls access and data movement . Intune has two configuration delivery channels:

Configuration channel Enrollment requirement Use when

Managed devices Device is enrolled in Intune and the app is deployed through MDM You manage the device and want OS app configuration channels, such as iOS managed app configuration or Android Enterprise app configuration

Managed apps App supports the Intune SDK or wrapping and is usually paired with app protection You need configuration through the MAM channel, including on devices that are not enrolled

For example, an enrolled iPhone can receive Outlook configuration through Managed devices . A personal iPhone that is not enrolled can receive supported Outlook configuration through Managed apps if the user is targeted and the app supports the MAM channel.

Conditional Access for app protection

App protection policy alone controls the app after the policy is delivered. Conditional Access is what enforces access to cloud resources based on app and policy state. Microsoft Entra Conditional Access can require an app protection policy , commonly for iOS and Android access to Microsoft 365 resources, so only a protected client app reaches Exchange Online or SharePoint Online.

When testing Conditional Access, use report-only mode and exclude break-glass accounts. For modern app-protection designs, use the Require app protection policy grant. The older Require approved client app grant is being retired: Microsoft has confirmed it moves to a read-only state on June 30, 2026 (the retirement was originally planned for March 2026 and extended), after which admins can no longer create or edit policies that use it and an existing approved-client-app grant stops enforcing. New designs should use Require app protection policy , which provides equivalent data-loss protection plus additional benefits.

Exam decision pattern

If the scenario says protect corporate data in Outlook on personal phones without enrollment, choose app protection policy plus MAM without enrollment . If it says preconfigure Outlook with account or server settings, choose app configuration . If it says only compliant devices can access SharePoint, choose device compliance with Conditional Access . If it says only apps with Intune app protection can access Exchange Online from iOS and Android, choose Conditional Access with the Require app protection policy grant .