Forum Discussion
MAM policies are not directly applicable to Outlook for on-premises Exchange users.
Microsoft Intune App Protection (MAM) policies are not directly supported for Outlook when the mailbox is hosted on an on-premises Exchange environment.
According to my research, implementing Hybrid Modern Authentication (HMA) is the appropriate solution for applying Microsoft Intune MAM policies to users in an on-premises Exchange environment.
3 Replies
According to my research, implementing Hybrid Modern Authentication (HMA) is the appropriate solution for applying Microsoft Intune MAM policies to users in an on-premises Exchange environment.
Hi, yes, that is an important distinction. Intune MAM/App Protection Policies are strongest when Outlook is connecting to Exchange Online because the cloud identity, app, and mailbox controls all line up cleanly.
For on-prem Exchange, you usually need to control the access path instead:
1. Use Conditional Access where the authentication flow supports it.
2. Require approved apps and compliant devices where possible.
3. Use Exchange ActiveSync / mobile device access rules for legacy paths.
4. Consider Hybrid Modern Authentication if the environment supports it.
5. Move mailboxes to Exchange Online if MAM enforcement is a hard requirement.
So the short version is: MAM is not the right enforcement point for a pure on-prem mailbox. Device compliance, auth design, and the Exchange access method matter more.
That's correct. Intune App Protection (MAM) for Outlook is designed to work with supported cloud-based mailbox services, such as Exchange Online. If your users are on on-premises Exchange, you'll typically need to rely on other management approaches, or consider a hybrid or Exchange Online migration if MAM capabilities are a requirement.
