App protection policy settings for Windows
This article describes app protection policy (APP) settings for Windows. The policy settings that are described can be configured for an app protection policy on the Settings pane in the Intune admin center when you make a new policy.
You can enable protected MAM access to org data via Microsoft Edge on personal Windows devices. This capability is known as Windows MAM and provides functionality using Intune Application Configuration Policies (ACP), Intune Application Protection Policies (APP), Windows Security Center client threat defense, and Application Protection Conditional Access. For more information about Windows MAM, see Data protection for Windows MAM, Create an MTD app protection policy for Windows, and Configure Microsoft Edge for Windows with Intune.
There are two categories of app protection policy settings for Windows:
Important
Intune MAM on Windows supports unmanaged devices. If a device is already managed, then Intune MAM enrollment will be blocked and APP settings will not be applied. If a device becomes managed after MAM enrollment, APP settings will no longer be applied.
Data protection
The Data protection settings impact the org data and context. As the admin, you can control the movement of data into and out of the context of org protection. The org context is defined by documents, services, and sites accessed by the specified org account. The following policy settings help control external data received into the org context and org data sent out of the org context.
Data Transfer
Setting | How to use | Default value |
---|---|---|
Receive data from | Select one of the following options to specify the sources org users can receive data from:
|
All sources |
Send org data to | Select one of the following options to specify the destinations org users can send data to:
|
All destinations |
Allow cut, copy, and paste for | Select one of the following options to specify the sources and destinations org users can cut or copy or paste org data:
|
Any destination and any source |
Functionality
Setting | How to use | Default value |
---|---|---|
Printing Org data | Select Block to prevent printing of org data. Select Allow to permit printing of org data. Personal or unmanaged data is not affected. | Allow |
Health Checks
Set the health check conditions for your app protection policy. Select a Setting and enter the Value that users must meet to access your org data. Then select the Action you want to take if users do not meet your conditionals. In some cases, multiple actions can be configured for a single setting. For more information, see Health Check Actions.
App conditions
Configure the following health check settings to verify the application configuration before allowing access to org accounts and data.
Note
The term policy-managed app refers to apps that are configured with app protection policies.
Setting | How to use | Default value |
---|---|---|
Offline grace period | The number of minutes that policy-managed app can run offline. Specify the time (in minutes) before the access requirements for the app are rechecked. Actions include:
|
Block access (minutes): 720 minutes (12 hours) Wipe data (days): 90 days |
Min app version | Specify a value for the minimum application version value. Actions include:
This entry can appear multiple times, with each instance supporting a different action. This policy setting supports matching Windows app bundle version formats (major.minor or major.minor.patch). |
No default value |
Min SDK version | Specify a minimum value for the Intune SDK version. Actions include:
|
No default value |
Disabled account | Specify an automated action if the Microsoft Entra account for the user is disabled. Admin may specify only one Action. There is no value to set for this setting. Actions include:
|
No default value |
Device conditions
Configure the following health check settings to verify the device configuration before allowing access to org accounts and data. Similar device based settings can be configured for enrolled devices. Learn more about configuring device compliance settings for enrolled devices.
Setting | How to use | Default value |
---|---|---|
Min OS version | Specify a minimum Windows operating system to use this app. Actions include:
This policy setting format supports either major.minor, major.minor.build, major.minor.build.revision. |
|
Max OS version | Specify a maximum Windows operating system to use this app. Actions include:
This entry can appear multiple times, with each instance supporting a different action. This policy setting format supports either major.minor, major.minor.build, major.minor.build.revision. |
|
Max allowed device threat level | App protection policies can take advantage of the Intune-MTD connector. Specify a maximum threat level acceptable to use this app. Threats are determined by your chosen Mobile Threat Defense (MTD) vendor app on the end user device. Specify either Secured, Low, Medium, or High. Secured requires no threats on the device and is the most restrictive configurable value, while High essentially requires an active Intune-to-MTD connection. Actions include:
For more information on using this setting, see Enable MTD for unenrolled devices. |
Additional information
For more information about APP for Windows devices, see the following resources:
प्रतिक्रिया
https://aka.ms/ContentUserFeedback.
जल्द आ रहा है: 2024 के दौरान हम सामग्री के लिए फीडबैक तंत्र के रूप में GitHub मुद्दों को चरणबद्ध तरीके से समाप्त कर देंगे और इसे एक नई फीडबैक प्रणाली से बदल देंगे. अधिक जानकारी के लिए, देखें:के लिए प्रतिक्रिया सबमिट करें और देखें