Device Type Targeting - Not understanding.

Question

I cannot seem to wrap my head around the device type filtering for App protection policies.

The goal is to create two App protection policies - one for Intune enrolled devices and one for personal devices that are not enrolled.

I created two Managed app filters for iOS devices:

iOS - Managed Device Apps
(app.deviceManagementType -eq "Managed") and (app.deviceModel -contains "iPhone") or (app.deviceModel -contains "iPad")

iOS - Unmanaged Device Apps
(app.deviceManagementType -eq "Unmanaged") and (app.deviceModel -contains "iPhone") or (app.deviceModel -contains "iPad")

I created an App configuration policy for iOS Managed apps for iOS devices to enable the IntuneMAMUPN {{UserPrincipalName}} in the General configuration settings.

I created two iOS app protection policies:

IOS Managed Devices policy
iOS Unmanaged Devices policy

I used the filters above, but I don't think the filters do much. In the App monitoring - nothing ever shows Managed.

Maybe I am just completing confusing how this works.

Should the app protection policies apply to just unmanaged devices? DO I use app configuration policies for each MS app individually selecting Managed devices. I feel like I am close to understanding, but 100% there. When I do the validate for the filters, my iPhone that is enrolled, does not show up. My unmanaged iPad does for both filters.

Answer 1

@Matt Dillon, Thanks for posting in Q&A. For your scenario, we have created two app protection policies and each needs to add related filter as below to apply to different device type.

IOS Managed Devices policy Filter: iOS - Managed Device Apps

iOS Unmanaged Devices policy Filter: iOS - Unmanaged Device Apps

For the filters you create, I think it has some issue. We can create "Managed apps", choose Platform as iOS/iPadOS, then only set (app.deviceManagementType -eq "Managed") and (app.deviceManagementType -eq "Unmanaged") in the rules.

Meanwhile, based as I know, an app protection policy is required with IntuneMAMUPN for managed devices. This applies for any setting that requires enrolled devices as well. Therefore, we need to create an app configuration policy for Managed devices and assign to the same user group as the app protection policy.

https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-ios

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Here is the filter I created for Unmanaged Device apps. I guess my question and confusion comes from the results of this filter. I have both my iPad and iPhone show up for each.

Answer 3

I finally figured these out. Here is a summary:

• Create Conditional Access Policies to require MFA, Require app protection policies for apps on mobile devices, and to restrict native email from getting Exchange mail.
• Create Managed apps for iOS and Android. Make them required on All Enrolled Devices.
• Create Filters:
  • Android - Managed Device Apps

        - use filter deviceManagementType = Android Enterprise
    

    • Android - Unmanaged Device Apps

            - use filter deviceManagementType = Unmanaged
      

      • iOS Managed Device Apps

                 - use filter deviceManagementType = Managed
        

        • iOS Unmanaged Device Apps

                      - use filter deviceManagementType = Unmanaged
          

The managed device filters should only result with Required Apps pushed out to Enrolled devices, and the unmanaged apps will be everything else. So if you have an enrolled device and you require Word, Word will be a managed app. If on the same device , you install Excel, it will be considered an unmanaged app.

• Set up your app protection policies as you see fit. To demo this out, I created secure policies requiring an 8 digit PIN for unmanaged device apps and no copying allowed and no PIN and copying allowed for managed device apps.
• When assigning - use the Managed and Unmanaged filters you created above. i.e. - iOS Managed Device Policy gets filtered to IOS Managed Device Apps and so on and so forth.

For iOS Managed devices only, create separate App Config policies for each app. i.e. - if you are requiring Word, Outlook, Teams, and One Drive, then make an app confi polciy for each app. https://learn.microsoft.com/en-us/mem/intune/apps/data-transfer-between-apps-manage-ios#configure-user-upn-setting-for-microsoft-intune-or-third-party-emm

For each ap config, simply add IntuneMAMUPN, String, {{UserPrincipalName}} and IntuneMAMOID, String, and {{userid}} in the configuration. Assign to All users.

if you are testing this out and have access to an Android and iOS device, try the Android first as it will be easier to understand. iOS seems to hold on to old settings longer. I found that they eventually work, but its better to wipe all msft apps off your iOS device first, reboot, and then install Word only. Authenticator should be forced to install. Once you validate the unmanaged device app policies, sign in to Company Portal to enroll in Intune. Uninstall Word and let it reinstall from Company Portal and you will have a better time.

Hope this helps.