Forum Discussion

kdjones03's avatar
kdjones03
Brass Contributor
Jun 30, 2025

Windows App Application Protection Policy

I have been testing out an Intune MAM policy to restrict copy/paste and drive redirection to AVD session hosts based on the link here: https://learn.microsoft.com/en-us/windows-app/require-device-security-compliance-intune?tabs=web#related-contentHowever, I've run into problems (in two separate tenants) that have halted me from being able to test.

Setup

  • Intune App Protection Policy targeting Windows Devices & Microsoft Edge\
  • Conditional Access Policy enforcing App Protection Policy when users access 'Azure Virtual Desktop' target resource via https://windows.cloud.microsoft.com

Results

  • First
    • When signing into a user account targeted by the policy, they are prompted to Switch Edge Profile which signs in the user to a new Edge profile for 'Work or School Account'. 
    • The account has to sign in again. 
    • The account can access Windows App resources
    • When launching a desktop session, this authentication page pops up for an account "local@debugonly" 
  • Second
    • When signing into a user account targeted by the policy, they are prompted to Switch Edge Profile which signs in the user to a new Edge profile for 'Work or School Account'. 
    • The account has to sign in again. 
    • After sign in, the account loops with 'Switch Edge Profile' and gets stuck here

       

I'm curious if anyone has gotten this to work and what was your setup? Or if Microsoft or provide some assistance or if this is in the wrong forum, any help would be appreciated.

Azure Virtual Desktop
Conditional Access
intune
Mobile Application Management (MAM)
mobile device management (mdm)
Windows App

2 Replies

  • NoahHelp's avatar
    NoahHelp
    Tin Contributor
    Jul 21, 2026

    Do not attempt to sign in as `local@debugonly`; it is normally an internal hand-off page, not a user identity. Start with a Conditional Access policy that only requires the expected grant controls, confirm a successful AVD sign-in in Entra sign-in logs, and then add the App Protection requirement. That staged approach identifies which control introduces the Edge profile loop and preserves a working policy baseline.

  • Allan Solomon Mejia's avatar
    Allan Solomon Mejia
    Tin Contributor
    Jul 20, 2026

    Hi kdjones03,

    I haven't encountered this exact behavior, but it looks more like an authentication or Conditional Access loop than an issue with the App Protection Policy itself. A few things I'd check:

    • Confirm Microsoft Edge for Business is being used and that profile sign-in is working correctly.
    • Review your Conditional Access policies for conflicts, especially those requiring compliant devices or app protection.
    • Exclude the test account from other CA policies to rule out policy interactions.
    • Check the Microsoft Entra sign-in logs for the failed authentication or repeated "Switch Edge Profile" events, they usually point to the policy causing the loop.

    If you're following the Microsoft guidance, I'd also recommend validating the configuration against the official documentation and opening a support case if everything matches but the behavior persists. It could be a tenant-specific issue or product bug.