Teams Mobile App with Conditional Access and App Protection Policy

[Christopher Lee]

According to the Conditional Access doc Require App Protection Policy , "Microsoft Teams... do not support the Require app protection policy grant.  If you require these apps to work, please use the Require approved apps grant exclusively."

This does not mean that an App Protection Policy cannot be applied to Teams mobile app, but rather that Conditional Access cannot use it as a control to guarantee access from a mobile device has a managed app being used.  This presents a potential security risk in that data within the Teams mobile app could be extracted to non-managed apps, such as the Files app within iOS.

With the heavy dependency and promotion of Teams today, what are ways to allow the use of the Teams mobile app while also preventing data from being extracted to uncontrolled locations/services?  Assuming device enrollment is not being considered for BYOD and that a MAM-only approach is desired, what options would that leave?  Curious for other perspectives or opinions on this scenario.

[#2]

This is a big holdup for MAM-WE adoption. Sure, you could exclude Teams from the policy but then you have to make changes to the App Protection policy to allow it to become useful and interact with other managed apps and in the process create a giant hole in the entire structure. Teams is a primary collaboration tool for a lot of organizations and this will absolutely keep organizations from adopting MAM-WE.

[#3]

Looks like this will be available on 31 July 2021. See copy of Message center post.

Microsoft Teams: Require app protection policy conditional access grant
MC266463 · Published 2 Jul 2021

Message Summary
This release of app protection policy based Conditional Access in Microsoft Teams will help protect your organizational data on devices your employees use by ensuring that only users with Intune app protection policy can access Microsoft 365 services from Teams.

This message is associated with Microsoft 365 Roadmap ID 87773

When this will happen:

Teams support for app protection policy based Conditional Access will be available as of July 31, 2021This is rolling out default off and this change will not impact your organization if you do not enable require app protection policy grant in your Conditional Access policies.

If you enable require app protection policy grant, access to Teams will be restricted to only users who have app protection policies applied on their account.

What you need to do to prepare:

Please familiarize yourself with the App protection policy based Conditional Access.

Learn more:

Grant controls in Conditional Access policy - Azure Active Directory | Microsoft Docs
App-based Conditional Access with Intune - Microsoft Intune | Microsoft Docs
App protection policies with Conditional Access - Azure Active Directory | Microsoft Docs