Forum Discussion
Intune - App protection policy to protect company data
Hi all,
I plan to configure and deploy App Protection policy for Android and iPhone mobile phones. I'm doing some study these days and trying to understand one thing:
I will confiture it for "all apps" and want to prevent users to copy organization data from their business account to their personal account - lets say, to prevent user to copy from Outlook company M365 email to personal GMAIL email.
I understand that I can prevent users from copying data from Outlook and linked company M365 email to - for example - GMAIL app with personal account linked as GMAIL app is not "managed app".
My question however is:
How do I prevent users to add their GMAIL account to Outlook? So that I can prevent the situation that a user will add his GMAIL mailbox to Outlook and then copy/paste data over from M365 email to GMAIL email - as both are in the managed app (outlook). Or what is the best practice for this situations?
10 Replies
Have a look at this: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/setup-with-modern-authentication#organization-allowed-accounts-mode
Organization allowed accounts is Microsoft's best practice of performing this
- May I ask you one more thing - with App protection policy, do I understand it properly that it will Enrol mobile phones to intune automatically when a user will trigger the policy? Or the policy will not have any effect on phone enrolment?
I am asking as I have been watching several trainings where it was mentioned that there are 3 ways of onboarding phones - and App protection policy was mentioned as kind of way to enroll phones. However, it has not been explained if it will really enrol phones to Intune or not- You can do a sort of enrollment from the App Protection Policy (APP). This is used for a pure Bring Your Own Device scenario. When the device is owned by the end user and not a Company Owned device. You can login from a Microsoft App and the APP policy is applied to the device without a MDM enrollment. If you like more info about this let me know..
------
Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.
If the post was useful in other ways, please consider giving it Like.
SebastiaanSmits cool... Thank you. Will test it soon but looks it is what I was looking for.
