Android Enterprise security configuration framework app configuration policies

As part of the Android Enterprise security configuration framework, you must properly set app configuration policies for Android Enterprise devices.

Android Enterprise personally-owned/corporate-owned work profile devices are designed to isolate work and personal data from one another. Android Enterprise fully managed devices are designed work or school data only. So, Microsoft apps deployed on these devices must be configured to disallow personal accounts.

Disallow personal accounts for Microsoft apps on Android Enterprise devices

1. Add the apps to Managed Google Play. For more information, see Add Managed Google Play apps to Android Enterprise devices with Intune.

2. Create a policy for each Managed Google Play app as described in Add app configuration policies for managed Android Enterprise devices.

3. Create the following single key in each policy:

   Key	Values
   com.microsoft.intune.mam.AllowedAccountUPNs	One or more; delimited UPNs. Only account(s) allowed are the managed user account(s) defined by this key. For Intune enrolled devices, the {{userprincipalname}} token may be used to represent the enrolled user account.

Next steps

Apply Android Enterprise personally-owned/corporate-owned work profile security settings or Android Enterprise fully managed security settings.