Forum Discussion
Problems identifying managed iOS devices when using APP
Hello,
As the title says i am having a hard time getting this to work. We have been using APP for a long time, but it has not been necessary for us to have different policies for managed (we only use iOS) and unmanaged devices (all mobile device types). Now i want to remove APP from managed devices all together, and only enforce this on unmanaged devices (BYOD)
Please see attached image of how it is configured today. I also have an CA policy which requires APP when using MS apps, where i have added and "Filter for devices" exclude with following syntax:
device.enrollmentProfileName -contains "iOS standard profile" (which cover our enrollment profiles, both are fully managed)
When enrolling a managed device, APP still is enforced.
Does anyone have any tips? I wanted to try here before submitting a ticket to MS. As far as i have found out , the app.devicemanagmenttype is the only rule that can be used to filter managed devices when used with APP.
1 Reply
Your goal is APP only on unmanaged iOS while managed devices follow MDM, but a CA exclusion by enrollment-profile name still enforces APP. APP targets the user and determines management state inside the app; a CA device filter does not change that classification. In Intune APP Assignments, use a Managed apps filter for Device management type and target Unmanaged devices. For enrolled iOS, verify managed Microsoft apps receive required MAM identity values; third-party or line-of-business apps may also need the managed device identifier through app configuration. Use separate CA policies: require application protection for BYOD and a compliant device for the corporate-managed path. Stage both in report-only mode and inspect sign-in and App protection status. Test one user with both device types. If managed apps appear unmanaged, correct MAM configuration before changing CA. Do not remove the existing grant broadly until both paths work as intended.
