Full Guide: Secure BYOD Phones Using Intune App-Only (MAM) Policies
- Hanna Korotka
- 6 hours ago
- 4 min read
Why Secure BYOD Phones Matter
Remote staff love the freedom of using their own phones; security teams fear the leaks that freedom can create. Good news: you can secure BYOD phones without enrolling the whole device or wiping family photos. All you need is one Intune Mobile App Management (MAM) policy and a matching Conditional Access rule that forces users into protected Microsoft 365 apps only.
Below is an end-to-end playbook—tested in real customer environments—that turns unmanaged iPhones and Androids into safe business tools in under an hour.
Prerequisites
Microsoft Intune licence (Microsoft 365 Business Premium, EMS E3/E5, or similar) to create App Protection Policies.
Microsoft Entra ID P1 for Conditional Access.
1 – Map your data-protection goals
Microsoft groups every Intune App Protection Policy into three stacked tiers:
Enterprise basic (Level 1) – Adds an app-specific PIN, encryption, and selective wipe; Android phones must pass hardware attestation. Perfect for low-risk users and a painless pilot.
Enterprise enhanced (Level 2) – Blocks copy/paste to personal apps, stops "save to device", and refuses to run on out-of-date OS versions. This is the sweet spot for most staff who handle everyday business data.
Enterprise high (Level 3) – Tightens everything: longer PINs, shorter offline grace, screen-capture blocks, and Mobile Threat Defense hooks. Reserve it for executives or anyone working with highly sensitive data.
Pick the level that matches your risk tolerance, then replicate Microsoft’s recommended settings when you create the policy; you can always tighten or relax later.
2 – Build the Intune App Protection Policy
Sign in to the Microsoft Intune admin center.
Select Apps > Protection. This selection opens the Protection details, where you create new policies and edit existing policies.
Select Create and select either iOS/iPadOS or Android. The Create policy pane is displayed.
On the Basics page, add Name and Description.
Click Next to display the Apps page. Click Select public apps, search for Outlook, Teams, OneDrive (and any other Microsoft 365 apps you use), then Select. These are the only apps that will receive the policy.
Adjust policy setting (Data protection, Access requirements, Conditional launch).
The Assignments page allows you to assign the app protection policy to groups of users. You must apply the policy to a group of users to have the policy take effect.
Click Next: Review + create to review the values and settings you entered for this app protection policy.
When you're done, click Create to create the app protection policy in Intune.
3 – Create a Conditional Access rule that funnels users into protected apps
Your App Protection Policy only works if users actually open Outlook, Teams, OneDrive and other Microsoft 365 apps. A single Conditional Access (CA) policy makes sure of that by allowing mobile access only through “approved” apps that carry your MAM settings.
Open the Microsoft Entra admin portal and go to Identity > Protection > Conditional Access > Policies > + New policy.
Name the policy.
Assign users and exclude break-glass accounts so you’re never locked out.
Under Target resources > Resources (formerly cloud apps) > Include, select All resources (formerly 'All cloud apps').
Under Conditions > Device platforms, set Configure to Yes.
Under Include, Select device platforms.
Choose Android and iOS.
Select Done.
Under Access controls > Grant, select Grant access.
Select Require approved client app and Require app protection policy
For multiple controls select Require one of the selected controls
Confirm your settings and set Enable policy to Report-only or On.
Select Create to create and enable your policy.
What your users will see — step-by-step
iOS (iPhone & iPad)
Open the App Store. Search for and download the Outlook app (or other Microsoft app like Teams).
Open Outlook.
If the app recognizes your work account, tap Add Account.
If it doesn’t, type your name@yourdomain.com address first, then tap Add Account.
Enter your password and tap Sign In.
Depending on your company’s settings, you might also be asked to approve with Microsoft Authenticator or a text/phone code.
If you see a prompt to Register the device, tap Register.
This verifies your identity so the organization can validate the phone.
When Outlook asks to add another account, choose Maybe Later.
Tap Skip (or swipe) through the feature tips.
Outlook will display: “Your organization is now protecting its data in this app. You need to restart the app to continue”. Tap OK.
Close and reopen Outlook.
When prompted, set a PIN (or use Face ID/Touch ID if allowed).
You’re all set—corporate mail is now protected by your company’s Intune App Protection Policy.
Android
Open the Google Play Store. Search for and download the Outlook app (or other Microsoft app like Teams).
Open the Outlook app.
Once opened you should receive a message that tells you to install the Intune Company Portal app
For App Protection policies to work they need a broker app. On Android this can either be the Authenticator App or the Company Portal. On IOS, just the Authenticator App is required.
Click the Get the app link which will take you to the download location for the Intune Company Portal app in the Play Store. Install the app. Once the Intune Company Portal is installed return to Outlook and sign-in again by clicking on Add Account. This time you will be asked to register your device. Click Register.
Once the registration of the device is complete the App Protection policy will kick in and you will be presented with this screen which is where the PIN policy will now be enforced. Click Continue to set a 4-digit PIN and click OK.
After setting the PIN you’ll finally be taken to your Inbox!
With a single App Protection Policy plus Conditional Access, you secure BYOD phones while respecting employee privacy and slashing help-desk load. No full device enrollment, no tug-of-war over personal data—just safe, sandboxed corporate apps.
How PlexHosted Can Help
As a Microsoft-certified MSSP, PlexHosted can:
Design your BYOD policy set in a one-day workshop.
Automate roll-out with step-by-step user comms.
Monitor policy health and Secure Score for ongoing compliance.
Sound useful? Let’s talk. Grab a 30-minute call on our calendar and we’ll walk through your current mobile posture, highlight quick wins, and show how Intune MAM can be live inside a week—no strings attached.