Forum Discussion
MAM policies are not directly applicable to Outlook for on-premises Exchange users.
According to my research, implementing Hybrid Modern Authentication (HMA) is the appropriate solution for applying Microsoft Intune MAM policies to users in an on-premises Exchange environment.
Hi, yes, that is an important distinction. Intune MAM/App Protection Policies are strongest when Outlook is connecting to Exchange Online because the cloud identity, app, and mailbox controls all line up cleanly.
For on-prem Exchange, you usually need to control the access path instead:
1. Use Conditional Access where the authentication flow supports it.
2. Require approved apps and compliant devices where possible.
3. Use Exchange ActiveSync / mobile device access rules for legacy paths.
4. Consider Hybrid Modern Authentication if the environment supports it.
5. Move mailboxes to Exchange Online if MAM enforcement is a hard requirement.
So the short version is: MAM is not the right enforcement point for a pure on-prem mailbox. Device compliance, auth design, and the Exchange access method matter more.