SOLVED

App Protection Policy is not applied

%3CLINGO-SUB%20id%3D%22lingo-sub-364188%22%20slang%3D%22en-US%22%3EApp%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-364188%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20everyone%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ei%20have%20the%20following%20constellation%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1.%20One%20App%20Protection%20Policy%20named%20%22iOS%20General%22%3C%2FP%3E%3CP%3E2.%20One%20App%20Protection%20Policy%20named%20%22iOS%20Outlook%20for%20managed%20devices%22%3C%2FP%3E%3CP%3E3.%20One%20App%20Protection%20Policy%20named%20%22iOS%20Outlook%20for%20unmanaged%20devices%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EConfiguration%3A%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E1.%20The%20following%20options%20are%20set%20for%20%22iOS%20General%3A%3C%2FP%3E%3CP%3ETarget%20to%20all%20app%20types%20-%26gt%3B%20yes%3C%2FP%3E%3CP%3ETargeted%20Apps%20-%26gt%3B%20all%20Apps%20in%20List%20except%20Outlook%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E2.%20The%20following%20options%20are%20set%20for%20%22iOS%20Outlook%20for%20managed%20devices%22%3C%2FP%3E%3CP%3ETarget%20to%20all%20app%20types%20-%26gt%3B%20no%20-%26gt%3B%20Apps%20on%20Intune%20managed%20devices%3C%2FP%3E%3CP%3ETargeted%20Apps%20-%26gt%3B%20Outlook%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E3.%20The%20following%20options%20are%20set%20for%20%22iOS%20Outlook%20for%20unmanaged%20devices%22%3C%2FP%3E%3CP%3ETarget%20to%20all%20app%20types%20-%26gt%3B%20no%20-%26gt%3B%20Apps%20on%20unmanaged%20devices%3C%2FP%3E%3CP%3ETargeted%20Apps%20-%26gt%3B%20Outlook%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EMy%20expectations%3A%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CEM%3E%3CSTRONG%3Eunmanaged%20Devices%3C%2FSTRONG%3E%3C%2FEM%3E%3C%2FP%3E%3COL%3E%3CLI%3EPolicy%20%22iOS%20General%22%20is%20applied%20for%20all%20Apps%2C%20except%20from%20the%20Outlook%20App.%3C%2FLI%3E%3CLI%3EThe%20Outlook%20App%20applies%20the%20Policy%20%22iOS%20Outlook%20for%20%3CSTRONG%3Eunmanaged%3C%2FSTRONG%3E%20devices%22%3C%2FLI%3E%3C%2FOL%3E%3CP%3E%3CEM%3E%3CSTRONG%3Emanaged%20Devices%3C%2FSTRONG%3E%3C%2FEM%3E%3C%2FP%3E%3COL%3E%3CLI%3EPolicy%20%22iOS%20General%22%20is%20applied%20for%20all%20Apps%2C%20except%20from%20the%20Outlook%20App.%3C%2FLI%3E%3CLI%3EThe%20Outlook%20App%20applies%20the%20Policy%20%22iOS%20Outlook%20for%20%3CSTRONG%3Emanaged%3C%2FSTRONG%3E%20devices%22%3C%2FLI%3E%3C%2FOL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EMy%20problems%3A%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3E1.%26nbsp%3B%3C%2FSTRONG%3Eunmanaged%20and%20managed%20devices%20are%20applying%20the%20%22general%22%20Policy.%20Very%20good.%3C%2FP%3E%3CP%3E%3CSTRONG%3E2.%3C%2FSTRONG%3E%20When%20it%20comes%20to%20the%20distinction%20between%20managed%20device%20-%26gt%3B%20Outlook%20%26amp%3B%20unmanaged%20device%20-%26gt%3B%20outlook%20the%20App%20Protection%20Policies%20are%20not%20properly%20applied.%3C%2FP%3E%3CP%3EThe%20policy%20%22iOS%20Outlook%20for%20unmanaged%20devices%22%20is%20applied%20every%20time.%20(Not%20as%20expected%20only%20on%20unmanaged%20devices!)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3Eadditional%20information%3A%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3EI'm%20using%20a%20group%20with%20static%20user%20assignment.%20All%20my%20test-users%20are%20member%20of%20this%20group.%3C%2FP%3E%3CP%3EEvery%20App%20Protection%20Policy%20is%20using%20this%20static%20group.%20(Policy%20-%26gt%3B%20Assignments%20-%26gt%3B%20Inlcude)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20very%20much%20in%20advance.%3C%2FP%3E%3CP%3EPatrick%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-364188%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMobile%20Device%20Management%20(MDM)%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-376770%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-376770%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F250456%22%20target%3D%22_blank%22%3E%40AndrewDawson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20experience%20a%20new%20problem.%3C%2FP%3E%3CP%3EIn%20my%20test%20scenario%20i%20had%20the%20setting%20%22only%20work%20and%20school%20accounts%22%20activated.%3C%2FP%3E%3CP%3EThe%20recognition%20if%20Outlook%20has%20to%20apply%20the%20managed%20or%20the%20unmanaged%20profile%20worked%20well.%3C%2FP%3E%3CP%3EWhen%20rolling%20out%20to%20a%20pilotgroup%20the%20users%20reported%2C%20that%20they%20lost%20their%20personal%20accounts%20inside%20Outlook.%20Okay%2C%20i%20can%20understand%20that.%20So%20what%20i've%20done%20is%20to%20disable%20%22only%20work%20and%20school%20accounts%22%2C%20so%20that%20the%20user%20are%20again%20enabled%20to%20use%20their%20personal%20accounts.%3C%2FP%3E%3CP%3EThe%20Problem%3A%20Now%20every%20device%20is%20is%20applying%20the%20unmanaged%20policy%20and%20nothing%20is%20working.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThats%20really%20annoying.%3C%2FP%3E%3CP%3EAny%20ideas%3F%3C%2FP%3E%3CP%3EBoth%20of%20the%20options%20are%20not%20satisfying%20me.%3C%2FP%3E%3CP%3E1.%20I%20need%20the%20ability%20for%20the%20users%20to%20be%20able%20to%20use%20their%20private%20accounts.%3C%2FP%3E%3CP%3E2.%26nbsp%3BI%20need%20to%20be%20able%20to%20distinguish%20wether%20the%20device%20is%20managed%20or%20unmanaged%2C%20so%20i%20can%20allow%20Contactsync%20in%20managed%20state.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-370099%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-370099%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F275686%22%20target%3D%22_blank%22%3E%40PatrickF11%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGreat...%26nbsp%3B%20Good%20luck!%26nbsp%3B%20Maybe%20I'll%20keep%20my%20ticket%20open%20until%20they%20fix%20that%2C%20too.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-370097%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-370097%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F275686%22%20target%3D%22_blank%22%3E%40PatrickF11%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20glad%20it's%20all%20working%20for%20you.%26nbsp%3B%20Sorry%20for%20throwing%20you%20off%20a%20little.%26nbsp%3B%20For%20me%2C%20there%20was%20an%20actual%20issue%20per%20the%20engineers%20at%20Microsoft.%26nbsp%3B%20They%20reproduced%20the%20issue%20multiple%20times.%26nbsp%3B%20They%20reported%20it%20working%20on%20Monday.%26nbsp%3B%20We%20still%20have%20issues%20with%20the%20UI%2C%20but%20that's%20getting%20fixed.%26nbsp%3B%20If%20you%20set%20it%20for%20other%20apps%2C%20the%20configuration%20key%20will%20be%20listed%20(it%20won't%20disappear).%26nbsp%3B%20Microsoft%20Graph%20seems%20like%20a%20quick%20way%20to%20get%20other%20info%2C%20too.%26nbsp%3B%20It's%20good%20stuff.%26nbsp%3B%20Have%20a%20good%20one.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-370096%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-370096%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ei%20opened%20a%20ticket%20and%20received%20a%20call%20from%20Microsoft%3A%3C%2FP%3E%3CP%3EThe%20current%20status%20is%2C%20that%20the%20microsoft%20support%20does'nt%20know%20why%20this%20happens%20exactly.%3C%2FP%3E%3CP%3EWhat%20we%20have%20already%20found%20out%20is%2C%20that%20other%20values%20doesn't%20have%20any%20problems.%3C%2FP%3E%3CP%3EFor%20example%20we've%20added%20another%20XML%20Value%20like%20%22userid%22%20as%20key%2C%20%22String%22%20as%20value%20type%20and%20%7B%7Buserid%7D%7D%20as%20configuration%20value.%3C%2FP%3E%3CP%3EWhen%20saving%20this%20and%20reloading%20the%20page%20everything%20is%20fine.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAt%20the%20moment%20i'm%20waiting%20for%20an%20answer%20of%20the%20next%20technician%20%3AD%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-370000%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-370000%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F275686%22%20target%3D%22_blank%22%3E%40PatrickF11%3C%2FA%3E%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20result%20will%20be%20the%20same%20as%20the%20Graph%20API%20call%20outlined%20by%20Marcelo.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESince%20the%20web%20interface%20effectively%20used%20the%20Graph%20API%20to%20make%20calls%20when%20load%20pages%20you%20can%20just%20monitor%20the%20browser%20network%20traffic.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EExample%3B%3C%2FSTRONG%3E%3C%2FP%3E%3CUL%3E%3CLI%3ENavigate%20to%20the%20'App%20configuration%20policies'%20page%3C%2FLI%3E%3CLI%3EPress%20F12%20to%20open%20DevTools%3C%2FLI%3E%3CLI%3EClick%20on%20Network%3C%2FLI%3E%3CLI%3EIn%20the%20browser%20windows%20click%20on%20the%20target%20appconfig%3C%2FLI%3E%3CLI%3EYou%20will%20see%20the%20loaded%20pages%20in%20DevTools%3C%2FLI%3E%3CLI%3ELocation%20the%20Graph%20API%20call%20that%20matches%20the%20content%20you%20are%20looking%20for%20%3CEM%3E(You%20will%20see%20'%3CA%20href%3D%22https%3A%2F%2Fgraph.microsoft.com%2Fbeta%2F%24metadata%23deviceAppManagement%2FmobileAppConfigurations%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgraph.microsoft.com%2Fbeta%2F%24metadata%23deviceAppManagement%2FmobileAppConfigurations%3C%2FA%3E...'%20in%20the%20response)%3C%2FEM%3E%3C%2FLI%3E%3CLI%3ECopy%20the%20response%20out%20to%20a%20text%20editor%20and%20review%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%3CEM%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F89279i336AAACE4C11979C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22devtools-appconfig.png%22%20title%3D%22devtools-appconfig.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FEM%3E%3C%2FP%3E%3CP%3E%3CEM%3E%3CSTRONG%3ENote%3A%3C%2FSTRONG%3E%26nbsp%3Byou%20will%20see%20a%20few%20connecting%20referring%20to%20the%20API%20as%20various%20resources%20will%20load%20long%20with%20the%20appconfig%20content%20(i.e.%20config%20assignment).%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20also%20a%20good%20method%20for%20understanding%20the%20Graph%20API%20and%20designing%20various%20automation%20processes.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20had%20expected%20the%26nbsp%3Bdisappearing%20input%20was%20due%20to%20the%20fact%20that%20it%20already%20existed%20based%20on%20the%20GUI%20selection%20and%20should%20%3CU%3E%3CSTRONG%3Enever%3C%2FSTRONG%3E%3C%2FU%3E%20exist%20twice%20due%20to%20potential%20conflicts%20in%20the%20configuration.%20%3CEM%3Ei.e.%20server-side%20was%20removing%20once%20detected.%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAfter%20some%20testing%20the%20additional%20config%20is%20accepted%20and%20saved%2C%20the%20config%20will%20not%20show%20as%20it%20is%20'represented'%20by%20the%20GUI%20control%20above.%3CEM%3E%26nbsp%3B%20%3CSTRONG%3EImportant%3A%3C%2FSTRONG%3E%20Microsoft%20should%20validate%20the%20config%20on%20save%20and%20prevent%20duplicate%20entries%20from%20being%20committed%26nbsp%3Brather%20than%20fix%20the%20UI%20to%20display%20the%20additional%20entries.%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%2CAndrew%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-369900%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-369900%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F88567%22%20target%3D%22_blank%22%3E%40Marcelo%20Carvalho%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20now%20are%20experiencing%20the%20same%20problem.%3C%2FP%3E%3CP%3EThe%26nbsp%3BIntuneMAMUPN%20Value%20is%20disappearing.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20will%20open%20a%20Ticket%20at%20MS%2C%20too.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EEdit%3A%20I%20just%20saw%20your%20second%20answer%20(Graph).%20This%20is%20really%20nice%20to%20know%2C%20thank%20you!%3C%2FP%3E%3CP%3EResult%3A%20All%20values%20are%20set%2C%20the%20GUI%20is%20just%20missing%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F250456%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3E%40AndrewDawson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhere%20did%20you%20see%20that%20in%20chrome%3F%3C%2FP%3E%3CP%3EWhen%20loading%20the%20page%20i%20can't%20see%20that.%3C%2FP%3E%3CP%3EAnyway%2C%20the%20%22graph%20way%22%20is%20really%20good%20for%20troubleshooting.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-369761%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-369761%22%20slang%3D%22en-US%22%3E%3CP%3EYa%2C%20it%20should%20be%20fixed%20in%201903.%26nbsp%3B%20Here%20a%20couple%20of%20steps%20on%20how%20to%20review%20that%20info%20in%20Microsoft%20Graph.%26nbsp%3B%20Microsoft%20engineer%20showed%20me.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3COL%3E%3CLI%3EGo%20to%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdeveloper.microsoft.com%2Fen-us%2Fgraph%2Fgraph-explorer%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdeveloper.microsoft.com%2Fen-us%2Fgraph%2Fgraph-explorer%3C%2FA%3E%3C%2FLI%3E%3CLI%3ESign%20In%20with%20Microsoft%3C%2FLI%3E%3CLI%3ESign%20in%20with%20your%20Global%20Admin%20account%3C%2FLI%3E%3CLI%3EClick%20on%20Modify%20permissions%3C%2FLI%3E%3CLI%3ESelect%20all%20the%20options%20that%20include%20%E2%80%9CDeviceManagement%E2%80%9D%20prefix%20(already%20consented%20in%20mine).%20You%20will%20be%20prompted%20to%20reauthenticate%20afterwards%3C%2FLI%3E%3CLI%3EChange%20to%20BETA%3C%2FLI%3E%3CLI%3EErase%20%E2%80%9Cme%E2%80%9D%20from%20the%20URL%20and%20add%20%E2%80%9CdeviceAppManagement%2FmobileAppConfigurations%E2%80%9D%3C%2FLI%3E%3CLI%3EClick%20on%20%E2%80%9CRun%20Query%E2%80%9D%20and%20it%20will%20show%20all%20the%20app%20configuration%20policies%20below.%3C%2FLI%3E%3CLI%3EYou%20should%20be%20able%20to%20find%20it%20by%20DisplayName%3C%2FLI%3E%3CLI%3EIt%20will%20show%20the%20configuration%20keys%20that%20were%20created%3C%2FLI%3E%3C%2FOL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20how%20I%20found%20out%20I%20had%203%20configuration%20keys%20and%20one%20of%20them%20was%20misspelled.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-369747%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-369747%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20had%20the%20same%20experience%20and%20pinned%20it%20down%20to%20the%20GUI%20already%20addressing%20this%20key%20in%20policy%2C%20since%20the%20policy%20already%20exists%20the%20key%20is%20removed%20and%20hidden%20from%20view.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELooking%20into%20the%20browser%20response%20when%20loading%20this%20config%20in%20chrome%20you%20see%20the%20Key%20already%20defined%3B%3C%2FP%3E%3CPRE%3E%22settings%22%3A%5B%3CSTRONG%3E%7B%22appConfigKey%22%3A%22IntuneMAMUPN%22%2C%22appConfigKeyType%22%3A%22stringType%22%2C%22appConfigKeyValue%22%3A%22%7B%7BUserPrincipalName%7D%7D%22%7D%3C%2FSTRONG%3E%2C%7B%22appConfigKey%22%3A%22com.microsoft.outlook.EmailProfile.EmailAddress%22%2C%22appConfigKeyType%22%3A%22stringType%22%2C%22appConfigKeyValue%22%3A%22%7B%7Buserprincipalname%7D%7D%22%7D%2C%7B%22appConfigKey%22%3A%22com.microsoft.outlook.EmailProfile.EmailUPN%22%2C%22appConfigKeyType%22%3A%22stringType%22%2C%22appConfigKeyValue%22%3A%22%7B%7Buserprincipalname%7D%7D%22%7D%2C%7B%22appConfigKey%22%3A%22com.microsoft.outlook.EmailProfile.AccountType%22%2C%22appConfigKeyType%22%3A%22stringType%22%2C%22appConfigKeyValue%22%3A%22ModernAuth%22%7D%2C%7B%22appConfigKey%22%3A%22com.microsoft.outlook.Mail.BlockExternalImagesEnabled.UserChangeAllowed%22%2C%22appConfigKeyType%22%3A%22booleanType%22%2C%22appConfigKeyValue%22%3A%22true%22%7D%2C%7B%22appConfigKey%22%3A%22IntuneMAMAllowedAccountsOnly%22%2C%22appConfigKeyType%22%3A%22stringType%22%2C%22appConfigKeyValue%22%3A%22Disabled%22%7D%5D%3C%2FPRE%3E%3CP%3E%3CSTRONG%3ENote%3A%3C%2FSTRONG%3E%20this%20is%20the%20same%20config%20from%20my%20previous%20screenshot.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%20%26nbsp%3BAndrew%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-369411%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-369411%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F275686%22%20target%3D%22_blank%22%3E%40PatrickF11%3C%2FA%3E%26nbsp%3Band%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F250456%22%20target%3D%22_blank%22%3E%40AndrewDawson%3C%2FA%3E%26nbsp%3B%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESorry%20for%20the%20late%20response.%26nbsp%3B%20Ya%2C%20I%20forgot%20to%20mention%20about%20the%20app%20configuration%20profile%20for%20iOS%20apps.%26nbsp%3B%20I%20was%20waiting%20on%20Microsoft%20on%20something.%26nbsp%3B%20In%20my%20environment%2C%20for%20Outlook%20app%2C%20the%20configuration%20key%20is%20disappearing%20from%20the%20UI.%26nbsp%3B%20They%20said%20that%20should%20be%20fixed%20in%201903.%26nbsp%3B%20In%20any%20case%2C%20I%20still%20got%20issues%2C%20but%20Patrick%20is%20all%20set.%26nbsp%3B%20Have%20a%20good%20one.%26nbsp%3B%20Thanks%20Andrew%20for%20the%20info.%26nbsp%3B%20Patrick%2C%20thanks%20for%20sharing.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMarcelo%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-369402%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-369402%22%20slang%3D%22en-US%22%3E%3CP%3ENow%20it's%20working%20really%20good%2C%20everything%20as%20expected.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EJust%20to%20outline%20my%20tests%3A%3C%2FP%3E%3COL%3E%3CLI%3EiPhone%20reset%20to%20factory%20defaults%3C%2FLI%3E%3CLI%3EOutlook%20App%20installation%3COL%3E%3CLI%3EI%20had%20to%20login%20by%20myself%3C%2FLI%3E%3CLI%3EWhen%20logged%20in%20the%20message%20%22your%20app%20is%20now%20protected%22%20appears%20-%26gt%3B%20restart%20of%20the%20app%3C%2FLI%3E%3CLI%3EUser%20have%20to%20set%20a%20PIN%3C%2FLI%3E%3C%2FOL%3E%3C%2FLI%3E%3CLI%3EOneDrive%20installation%3COL%3E%3CLI%3Ejust%20for%20testing.%3C%2FLI%3E%3C%2FOL%3E%3C%2FLI%3E%3CLI%3ETroubleshooting%3A%3COL%3E%3CLI%3EApp%20Protection%20Policy%20applied%20correctly%3A%3COL%3E%3CLI%3E%22Test%20-%20iOS%20unmanaged%20-%20Outlook%22%3COL%3E%3CLI%3Ee.g.%20the%20user%20can't%20sync%20the%20contacts.%3C%2FLI%3E%3C%2FOL%3E%3C%2FLI%3E%3CLI%3E%22Test%20-%20iOS%20-%20General%22%3COL%3E%3CLI%3EPolicy%20for%20all%20the%20other%20apps%2C%20independently%20of%20the%20management%20state.%3C%2FLI%3E%3C%2FOL%3E%3C%2FLI%3E%3C%2FOL%3E%3C%2FLI%3E%3C%2FOL%3E%3C%2FLI%3E%3CLI%3EEnrollment%20in%20companyportal-App%3COL%3E%3CLI%3EThe%20user%20account%20was%20found%2C%20because%20it%20has%20previously%20used%20in%20outlook.%20(i%20think%2C%20thats%20why.)%3C%2FLI%3E%3CLI%3EDevice%20enrollment%20took%20place.%3C%2FLI%3E%3C%2FOL%3E%3C%2FLI%3E%3CLI%3EStarting%20Outlook%20App%20again%3C%2FLI%3E%3CLI%3ETroubleshooting%3COL%3E%3CLI%3EApp%20Protection%20Policy%20applied%20correctly%3A%3COL%3E%3CLI%3E%22Test%20-%20iOS%20%3CSTRONG%3Emanaged%3C%2FSTRONG%3E-%20Outlook%22%3COL%3E%3CLI%3Ee.g.%20the%20user%20is%20now%20able%20to%20sync%20the%20contacts.%3C%2FLI%3E%3C%2FOL%3E%3C%2FLI%3E%3CLI%3E%22Test%20-%20iOS%20-%20General%22%3COL%3E%3CLI%3EPolicy%20for%20all%20the%20other%20apps%2C%20independently%20of%20the%20management%20state.%3C%2FLI%3E%3C%2FOL%3E%3C%2FLI%3E%3C%2FOL%3E%3C%2FLI%3E%3C%2FOL%3E%3C%2FLI%3E%3C%2FOL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20really%20happy%2C%20that%20this%20is%20working%20now.%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3CP%3EThank%20you%20all.%3C%2FP%3E%3CP%3EFeel%20free%20to%20continue%20discussing.%26nbsp%3BI%20will%20follow%20this%20thread%2C%20of%20course.%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EPatrick.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-369371%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-369371%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F215719%22%20target%3D%22_blank%22%3E%40Gary%20Cooper%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EReeeaaally%20strange.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOkay%2C%20adding%20the%20UPN%20is%20working%20now%20as%20I've%20described.%3C%2FP%3E%3CP%3EAt%20this%20moment%20I'm%20testing%20with%20an%20iOS%20device.%3C%2FP%3E%3CP%3E-%20Which%20Policy%20is%20applied%20when%20unmanaged%3F%3C%2FP%3E%3CP%3E-%20Which%20Policy%20is%20applied%20when%20this%20is%20unmanaged%20device%20is%20going%20into%20management%3F%3C%2FP%3E%3CP%3E-%20Is%20the%20non-managed%20policiy%20re-applied%2C%20when%20leaving%20the%20management%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'll%20write%20back%20in%20a%20few%20minutes%20(okay%20azure...%20perhabs%20in%20a%20few%20hours.)%20when%20testing%20is%20done.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-369365%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-369365%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F275686%22%20target%3D%22_blank%22%3E%40PatrickF11%3C%2FA%3E%20I've%20encountered%20the%20same%20issue%20with%20regard%20to%20trying%20to%20save%20the%20IntuneMAMUPN%20value.%20I%20raised%20a%20service%20ticket%20related%20to%20that%20issue%20but%2C%20interestingly%20after%20a%20short%20while%20the%20Intune%20App%20Protections%20started%20to%20apply%20correctly%20(I%20saw%20the%20apps%20in%20question%20perform%20their%20'restart'%20after%20prompting%20the%20user%20that%20they%20were%20being%20protected).%20Without%20having%20to%20do%20anything%20else%2C%20the%20App%20Protections%20are%20behaving%20properly%20now%20-%20applying%20to%20unmanaged%20devices%20correctly%20and%20a%20different%20less%20restrictive%20policy%20applying%20to%20managed%20devices.%20Two%20separate%20policies%2C%20one%20for%20unmanaged%20(applied%20only%20to%20unmanaged%20devices)%20and%20one%20for%20managed%20(applied%20only%20to%20managed%20devices).%20Due%20to%20a%20timings%20issue%20I%20ask%20Microsoft%20to%20close%20the%20ticket%20though%20before%20it%20had%20been%20investigated%20as%20I%20was%20spending%20too%20long%20with%20their%20engineers%20taking%20screen%20shots%20and%20trying%20to%20explain%20the%20issue%20-%20even%20directing%20them%20to%20the%20articles%20I'd%20used%20to%20perform%20the%20setup.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20me%2C%20at%20least%2C%20things%20seem%20to%20be%20working%20OK.%20I%20just%20needed%20to%20be%20patient.%20About%2018%20hours%20patient%2C%20before%20the%20settings%20took%20hold!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-369350%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-369350%22%20slang%3D%22en-US%22%3E%3CP%3Ehallelujah!%3C%2FP%3E%3CP%3EI'm%20**bleep**%20confused%20right%20now.%20%3AD%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1.%20I%20added%20an%20app%20configuration%20policy%20(as%20required).%3C%2FP%3E%3CP%3EDevice%20Enrollment%20Type%3A%20Managed%20devices%3CBR%20%2F%3EPlatform%3A%20iOS%3CBR%20%2F%3ERequired%20App%3A%20Microsoft%20Outlook%3C%2FP%3E%3CP%3EUse%20configuration%20designer%3CBR%20%2F%3EConfiguration%20Key%3A%20IntuneMAMUPN%3CBR%20%2F%3EValue%20Type%3A%20String%3CBR%20%2F%3EConfiguration%20Value%3A%20%7B%7BUserPrincipalName%7D%7D%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EResult%3A%20When%20clicking%20on%20save%2C%20the%20ConfigKey%20disappears%20after%20reopen%20the%20config.%3C%2FP%3E%3CP%3ESolution%3A%20After%20entering%20the%20ConfigKey%20%26amp%3B%20Value%20i%20have%20to%20click%20in%20an%20empty%20row%20and%20%3CSTRONG%3Ethen%26nbsp%3B%3C%2FSTRONG%3Eclick%20on%20save.%3C%2FP%3E%3CP%3EI'm%20getting%20crazy....%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20my%20iOS%20device%20is%20correctly%20using%20the%20desired%20App%20Protection%20Policy.%20(iOS%20Policy%20for%20managed%20device%2C%20which%20allow%20the%20user%20to%20export%20contacts%20in%20the%20native%20contacts%20app.)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F250456%22%20target%3D%22_blank%22%3E%40AndrewDawson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20didn't%20try%20out%20any%20app%20configuration%20policy%20before.%3C%2FP%3E%3CP%3ENow%20i'm%20using%20an%20policy%20as%20mentioned%20above%3A%20(%22Outlook%20-%20iOS%22)%3C%2FP%3E%3CP%3EI%20set%20the%20required%20value%26nbsp%3BIntuneMAMUPN%2C%20so%20that%20the%20APP%20is%20correctly%20beeing%20applied%20when%20device%20is%20managed.%3C%2FP%3E%3CP%3EAddiotionally%20i%20started%20using%20the%20%22configure%20email%20account%20settings%22%20just%20like%20you%20did%20in%20the%20provided%20screenshot.%3C%2FP%3E%3CP%3EI%20have%20a%20question%20about%20that%3A%20Why%20is%20it%20important%20to%20allow%20only%20work%20or%20school%20accounts%20inside%20the%20outlook%20App%3F%20(For%20this%20case)%3C%2FP%3E%3CP%3EI%20want%20my%20users%20to%20have%20the%20opportunity%20to%20use%20the%20outlook%20app%20also%20for%20their%20private%20accounts.%3C%2FP%3E%3CP%3E(To%20increase%20the%20acceptance%20of%20the%20app)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-369335%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-369335%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Patrik%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20will%20need%20to%20create%20an%20App%20Config%20policy%20for%20each%20application.%3C%2FP%3E%3CP%3EIntuneMAMUPN%26nbsp%3B%20%26nbsp%3BString%26nbsp%3B%20%26nbsp%3B%7B%7BUserPrincipalName%7D%7D%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-left%22%20style%3D%22width%3A%20569px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F89159i42850F956010A52A%2Fimage-dimensions%2F569x471%3Fv%3D1.0%22%20width%3D%22569%22%20height%3D%22471%22%20alt%3D%22outlook-appconfig.png%22%20title%3D%22outlook-appconfig.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3ENote%3A%3C%2FP%3E%3CUL%3E%3CLI%3EThe%20AppConfig%20Outlook%20GUI%20creates%20this%20setting%20when%20you%20select%20%22Allow%20only%20work%20or%20school%20accounts%22.%3C%2FLI%3E%3CLI%3ENot%20every%20Microsoft%20APP%20application%20accepts%26nbsp%3BIntuneMAMUPN%20in%20appconfig.%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20you%20said%20the%20App%20Protection%20Policy%20report%20will%20show%20pending%2Fapplied%20config%20on%20a%20device%2C%20you%20can%20also%20navigate%20to%20%3CSTRONG%3Eabout%3Aintunehelp%3C%2FSTRONG%3E%20on%20iOS%20managed%20browser%20and%20check%20the%20applied%20settings%20from%20the%20device%20directly.%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fapp-configuration-managed-browser%23how-to-access-to-managed-app-logs-using-the-managed-browser-on-ios%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fapp-configuration-managed-browser%23how-to-access-to-managed-app-logs-using-the-managed-browser-on-ios%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20also%20seen%20some%20recent%20issues%20with%20APP%20not%20applying%20correctly%20after%20changing%20profiles%2C%20I%20suspect%20I%20will%20just%20have%20to%20re-enrol%20the%20device.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%2CAndrew%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-369329%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-369329%22%20slang%3D%22en-US%22%3E%3CP%3EHello%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F250456%22%20target%3D%22_blank%22%3E%40AndrewDawson%3C%2FA%3E%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethank%20you%20for%20participating.%3C%2FP%3E%3CP%3EI%20know%20already%20the%20App%20protection%20status%20page.%20What%20i%20like%20to%20use%20is%20the%20Troubleshooting%20Tool%2C%20where%20i%20can%20select%20a%20user%20and%20see%20exactly%20what%20Policy%20would%20be%20applied.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20I%20still%20don't%20understand%3A%3C%2FP%3E%3CBLOCKQUOTE%3E%3CP%3E%3CSPAN%3E%22iOS%20has%20an%20additional%20requirement%20in%20order%20to%20mark%20the%20application%20on%20the%20device%20as%20managed.%22%3C%2FSPAN%3E%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3CP%3EI%20thought%20the%20App%20Protection%20Policy%20is%20based%20on%20the%20%3CSTRONG%3EDEVICE%3C%2FSTRONG%3E%20Management%20state%2C%20not%20if%20an%20app%20is%20in%20managed%20(installed%20through%20intune)%20or%20unmanaged%20(installed%20through%20regular%20appstore)%20mode.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EQuote%20from%20you%20link%3A%3C%2FP%3E%3CBLOCKQUOTE%3E%3CDIV%3E%3CSPAN%3EBecause%20Intune%20app%20protection%20policies%20target%20a%3CSTRONG%3E%20user%E2%80%99s%20identity%3C%2FSTRONG%3E%2C%20the%20protection%20settings%20for%20a%20user%20can%20apply%20to%3CSTRONG%3E%20both%20enrolled%3C%2FSTRONG%3E%20(MDM%20managed)%20and%20%3CSTRONG%3Enon-enrolled%20devices%3C%2FSTRONG%3E%20(no%20MDM).%3C%2FSPAN%3E%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3CBLOCKQUOTE%3E%3CP%3E%3CSPAN%3EYou%20can%20have%20one%20protection%20policy%20for%20un-managed%20devices%20in%20which%20strict%20data%20loss%20prevention%20(DLP)%20controls%20are%20in%20place%2C%20and%20a%20separate%20protection%20policy%20for%20MDM%20managed%20devices%2C%20where%20the%20DLP%20controls%20may%20be%20a%20little%20more%20relaxed.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3CP%3EThat's%20what%20i%20want%20to%20achive.%20I%20already%20have%20these%20different%20policies%20set%20up.%20(but%20not%20working%20for%20ios%20correctly%20%2C%20as%20you%20already%20know%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMore%20interesting%20is%20this%20quote%3A%3C%2FP%3E%3CBLOCKQUOTE%3E%3CP%3EFor%20iOS%2C%20additional%20app%20configuration%20settings%20are%20required%20to%20target%20APP%20settings%20to%20apps%20on%20Intune%20enrolled%20devices%3A%3C%2FP%3E%3CUL%3E%3CLI%3E%3CSTRONG%3EIntuneMAMUPN%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Emust%20be%20configured%20for%20all%20MDM%20managed%20applications.%20For%20more%20information%2C%20see%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fintune%2Fdata-transfer-between-apps-manage-ios%23configure-user-upn-setting-for-microsoft-intune-or-third-party-emm%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EHow%20to%20manage%20data%20transfer%20between%20iOS%20apps%20in%20Microsoft%20Intune%3C%2FA%3E.%3C%2FLI%3E%3CLI%3E%3CSTRONG%3EIntuneMAMDeviceID%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Emust%20be%20configured%20for%20all%20Third-party%20and%20LOB%20MDM%20managed%20applications.%20The%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EIntuneMAMDeviceID%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eshould%20be%20configured%20to%20the%20device%20ID%20token.%20For%20example%2C%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Ekey%3DIntuneMAMDeviceID%2C%20value%3D%7B%7BdeviceID%7D%7D.%20For%20more%20information%2C%20see%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fintune%2Fapp-configuration-policies-use-ios%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAdd%20app%20configuration%20policies%20for%20managed%20iOS%20devices%3C%2FA%3E.%3C%2FLI%3E%3CLI%3EIf%20only%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EIntuneMAMDeviceID%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eis%20configured%2C%20the%20Intune%20APP%20will%20consider%20the%20device%20as%20unmanaged.%3C%2FLI%3E%3C%2FUL%3E%3C%2FBLOCKQUOTE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20(%3CSTRONG%3Eadditional%20app%20configuration%20settings%20are%20required%20to%20target%20APP%20settings%20to%20apps%20on%20Intune%20enrolled%20devices)%3C%2FSTRONG%3E%20seems%20to%20be%20our%20problem.%20iOS%20needs%20additional%20settings%2C%20so%20that%20the%20APP%20recognizes%20the%20devices%20management%20state%20correctly.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAn%20advise%20from%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fdata-transfer-between-apps-manage-ios%23configure-user-upn-setting-for-microsoft-intune-or-third-party-emm%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Enext%3C%2FA%3E%20link%20is%3A%3C%2FP%3E%3CBLOCKQUOTE%3E%3CP%3E%3CSPAN%3EIn%20Intune%2C%20the%20App%20Configuration%20policy%20has%20to%20be%20for%20enrollment%20type%20%22Managed%20Devices%22.%20%3CSTRONG%3EAddicionally%2C%20the%20App%20needs%20to%20be%20either%20installed%20from%20the%20Intune%20Company%20Portal%20if%20set%20as%20available%20or%20pushed%20as%20required%20to%20the%20device.%3C%2FSTRONG%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3CP%3ESo%20thats%20what%20i%20don't%20think%20is%20logical%3A%3C%2FP%3E%3CP%3EiOS%3A%20The%20App%20itself%20must%20be%20managed%20to%20apply%20the%20correc%20policy%20(which%20should%20be%20used%20on%20%3CSTRONG%3EDEVICE%3C%2FSTRONG%3E%20Management%20state.%20(not%20app%20management%20state))%3C%2FP%3E%3CP%3EAndroid%3A%20Everything%20is%20working%20as%20expected.%20A%20managed%20device%20is%20using%20the%20%22APP%20for%20managed%20devices%22%20both%20for%20a%20%3CSTRONG%3Euser%20driven%3C%2FSTRONG%3E%20app%20installation%20and%20for%20a%20%3CSTRONG%3Eintune%20driven%3C%2FSTRONG%3E%20installation%20of%20an%20app.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20i'm%20going%20to%20read%20the%20docs%20and%20try%20to%20understand%20and%20implement%20the%20configuration%20correctly.%20(Wish%20me%20luck%20%3AD%3C%2Fimg%3E%20)%3C%2FP%3E%3CP%3EI%20will%20write%20down%20it%20here%20soon%20if%20anything%20happened.%20(expected%20or%20unexpected)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPatrick.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-365120%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-365120%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F275686%22%20target%3D%22_blank%22%3E%40PatrickF11%3C%2FA%3E%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F107576%22%20target%3D%22_blank%22%3E%40Marcelo%20Carvalho%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20had%20the%20same%20issue%20when%20I%20was%20initially%20setting%20up%20APP%2C%20iOS%20has%20an%20additional%20requirement%20in%20order%20to%20mark%20the%20application%20on%20the%20device%20as%20managed.%3C%2FP%3E%3CP%3E%3CSTRONG%3ELink%3A%26nbsp%3B%3C%2FSTRONG%3E%3CA%20title%3D%22app-protection-policies%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fapp-protection-policies%23target-app-protection-policies-based-on-device-management-state%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Etarget-app-protection-policies-based-on-device-management-state%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20validate%20the%20App%20Protection%20Status%20for%20each%20user%2Fapplication%20under%26nbsp%3B%3CSTRONG%3EClient%20apps%20-%20App%20protection%20status%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%2CAndrew%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-364638%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-364638%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20Marcelo%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CBLOCKQUOTE%3E%3CP%3E%3CSPAN%3EWith%20iOS%2C%20the%20settings%20don't%20change%20once%20the%20device%20is%20managed.%26nbsp%3B%20I%20think%20the%20Outlook%20app%20is%20still%20registered%20as%20unmanaged%20thus%20it%20applied%20the%20unmanaged%20policy.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3CP%3ESo%20you%20think%20the%20app%20managemend%20state%20is%20meant%20in%20the%20setting%20%22target%20to%20all%20app%20types%20-%26gt%3B%20no%20-%26gt%3B%20Apps%20on%20Intune%20managed%20devices%3F%3CBR%20%2F%3EWhen%20i'm%20reading%20the%20this%20in%20intune%20i%20think%20the%20device%20management%20state%20is%20meant%2C%20not%20the%20app%20management%20state.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20very%20much.%20(Thanks%20to%20eglockling%2C%20too.)%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-364631%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-364631%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20eglockling%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ein%20my%20understanding%20a%20%22default%22%20app%20protection%20policy%20should%20be%20applied%20to%20any%20app%20management%20state%2C%20isn't%20it%3F%3C%2FP%3E%3CP%3E(So%20even%2C%20when%20a%20user%20isn't%20using%20an%20intune%20managed%20device)%3C%2FP%3E%3CP%3ESo%20my%20default%20profile%20is%20set%20to%20%22target%20to%20all%20app%20types%20-%26gt%3B%20yes%22.%3C%2FP%3E%3CP%3E%3CSTRONG%3EMicrosoft%20explanation%3A%3C%2FSTRONG%3E%3C%2FP%3E%3CBLOCKQUOTE%3E%3CP%3E%3CEM%3EUse%20this%20option%20to%20target%20your%20policy%20to%20apps%20on%20devices%20of%20any%20management%20state.%3C%2FEM%3E%3C%2FP%3E%3CP%3E%3CEM%3EDuring%20policy%20conflict%20resolution%20this%20setting%20will%20be%20superseded%20if%20a%20user%20has%20policy%20targeted%20for%20a%20specific%20management%20state.%3C%2FEM%3E%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnyway%2C%20in%20my%20case%20i%20got%20the%20app%20via%20the%20%22required%22%20setting%20inside%20the%20app%20assignment.%3C%2FP%3E%3CP%3EWhen%20looking%20at%20%22all%20devices%20-%26gt%3B%20my%20iphone%20-%26gt%3B%20managed%20Apps%22%20i%20can%20see%20the%20Outlook%20app%20in%20there.%3C%2FP%3E%3CP%3ESo%20it%20is%20a%20managed%20app%20in%20this%20case.%20(the%20same%20on%20a%20second%20test%20iphone)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnother%20question%20regarding%20the%20setting%20%22target%20to%20all%20app%20types%22%3A%3C%2FP%3E%3CBLOCKQUOTE%3E%3CP%3E%3CEM%3E%22this%20setting%20will%20be%20superseded%20if%20a%20user%20has%20policy%20targeted%20for%20a%20specific%20management%20state.%22%3C%2FEM%3E%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3CP%3EWould%20it%20be%20better%20to%20have%20the%20general%20policy%20holding%20all%20apps%2C%20including%20outlook%3F%3C%2FP%3E%3CP%3EAnd%20second%3A%20Have%20an%20App%20Policy%20for%20Outlook%20on%20managed%20devices%20with%20some%20other%20%2F%20divergent%20settings%20than%20the%20general%20policy%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20whenever%20there%20is%20a%20user%20with%20a%20device%20with%20one%20of%20these%20apps%20connecting%20with%20his%20corporate%20account%2C%20this%20app%20is%20going%20to%20apply%20the%20default%20%2F%20general%20policy%20PLUS%20when%20the%20device%20is%20managed%20in%20intune%20the%20policy%20%22ios%20managed%22%20is%20going%20to%20override%20the%20lax%20setting%20of%20the%20general%20policy.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-364381%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-364381%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Patrick%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20just%20saw%20your%20post.%26nbsp%3B%20I%20have%20a%20similar%20issue%20with%20iOS%20app%20protection%20policy.%26nbsp%3B%20I%20have%20one%20set%20of%20policies%20for%20iOS%20devices%20and%20one%20for%20Android%20devices.%26nbsp%3B%20Policies%20work%20fine%20with%20Android%20when%20enrolling%20and%20unenrolling.%26nbsp%3B%20With%20iOS%2C%20the%20settings%20don't%20change%20once%20the%20device%20is%20managed.%26nbsp%3B%20I%20think%20the%20Outlook%20app%20is%20still%20registered%20as%20unmanaged%20thus%20it%20applied%20the%20unmanaged%20policy.%26nbsp%3B%20I%20have%20had%20a%20premier%20support%20ticket%20for%20about%203%20weeks%20now.%26nbsp%3B%20I%20have%20been%20out%20of%20the%20country%20with%20limited%20access.%26nbsp%3B%20Sorry%20for%20the%20delay%20on%20this.%26nbsp%3B%20Anyway%2C%20the%20last%20status%20I%20got%20said%20that%20this%20is%20a%20bug.%26nbsp%3B%20There%20hasn't%20been%20a%20fixed%20issued%20as%20of%20last%20week.%26nbsp%3B%20Usually%2C%20I%20would%20say%2C%20submit%20a%20ticket%20since%20it%20could%20be%20something%20different%20for%20your%20environment%2C%20but%20you%20may%20need%20to%20wait%20it%20out%20a%20little%20longer.%26nbsp%3B%20Support%20hasn't%20given%20me%20any%20documentation%20or%20article%20on%20the%20issue.%26nbsp%3B%20In%20any%20case%2C%20as%20soon%20as%20I%20hear%20something%2C%20I%20will%20reply%20back.%3C%2FP%3E%3CP%3EHave%20a%20good%20one.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMarcelo%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-364205%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-364205%22%20slang%3D%22en-US%22%3E%3CP%3EHow%20is%20Outlook%20being%20distributed%3F%20Is%20it%20set%20as%20required%20or%20advertised%20from%20Company%20Portal%3F%20When%20you%20check%20device%20management%20in%20iOS%20Settings%2C%20is%20the%20app%20listed%20as%20managed%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-469765%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-469765%22%20slang%3D%22en-US%22%3E%3CP%3EJust%20a%20short%20response%2C%20because%20of%20a%20new%20Techcommunity%20Account.%20%3A)%3C%2Fimg%3E%20%5BIgnore%20me%5D%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-469773%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Protection%20Policy%20is%20not%20applied%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-469773%22%20slang%3D%22en-US%22%3EBecause%20of%20a%20new%20techcommunity%20account%2C%20this%20is%20just%20a%20short%20response%20to%20follow%20up%20the%20thread.%20%3A)%3C%2Fimg%3E%3C%2FLINGO-BODY%3E
Highlighted
Deleted
Not applicable

Hi everyone,

 

i have the following constellation:

 

1. One App Protection Policy named "iOS General"

2. One App Protection Policy named "iOS Outlook for managed devices"

3. One App Protection Policy named "iOS Outlook for unmanaged devices"

 

Configuration:

1. The following options are set for "iOS General:

Target to all app types -> yes

Targeted Apps -> all Apps in List except Outlook

 

2. The following options are set for "iOS Outlook for managed devices"

Target to all app types -> no -> Apps on Intune managed devices

Targeted Apps -> Outlook

 

3. The following options are set for "iOS Outlook for unmanaged devices"

Target to all app types -> no -> Apps on unmanaged devices

Targeted Apps -> Outlook

 

My expectations:

unmanaged Devices

  1. Policy "iOS General" is applied for all Apps, except from the Outlook App.
  2. The Outlook App applies the Policy "iOS Outlook for unmanaged devices"

managed Devices

  1. Policy "iOS General" is applied for all Apps, except from the Outlook App.
  2. The Outlook App applies the Policy "iOS Outlook for managed devices"

 

My problems:

1. unmanaged and managed devices are applying the "general" Policy. Very good.

2. When it comes to the distinction between managed device -> Outlook & unmanaged device -> outlook the App Protection Policies are not properly applied.

The policy "iOS Outlook for unmanaged devices" is applied every time. (Not as expected only on unmanaged devices!)

 

additional information:

I'm using a group with static user assignment. All my test-users are member of this group.

Every App Protection Policy is using this static group. (Policy -> Assignments -> Inlcude)

 

 

Thank you very much in advance.

Patrick :)

22 Replies
Highlighted

@AndrewDawson 

 

I experience a new problem.

In my test scenario i had the setting "only work and school accounts" activated.

The recognition if Outlook has to apply the managed or the unmanaged profile worked well.

When rolling out to a pilotgroup the users reported, that they lost their personal accounts inside Outlook. Okay, i can understand that. So what i've done is to disable "only work and school accounts", so that the user are again enabled to use their personal accounts.

The Problem: Now every device is is applying the unmanaged policy and nothing is working.

 

Thats really annoying.

Any ideas?

Both of the options are not satisfying me.

1. I need the ability for the users to be able to use their private accounts.

2. I need to be able to distinguish wether the device is managed or unmanaged, so i can allow Contactsync in managed state.

Highlighted

Just a short response, because of a new Techcommunity Account. :) [Ignore me]

Highlighted
Because of a new techcommunity account, this is just a short response to follow up the thread. :)