🎯 Intune Course · Module 5 of 7
App Management & App Protection Policies
📂 Course: Intune & Endpoint Management
📦 Module: 5 of 7
🎯 Exam: MD-102
⏱ Read time: ~24 min
📦 Module: 5 of 7
🎯 Exam: MD-102
⏱ Read time: ~24 min
MD-102 Exam Alignment
MD-102
- Know the four app assignment types: Required (force install), Available (user can install from Company Portal), Uninstall (force remove), Available without enrolment (for MAM-WE scenarios)
- Know that Win32 apps require packaging with the IntuneWinAppUtil.exe tool before upload — this creates a .intunewin file that Intune can deploy via the Management Extension agent
- Know that App Protection Policies (MAM) work WITHOUT device enrolment (MAM-WE) — they protect corporate data in managed apps on personal iOS/Android devices without any MDM management
- Know key MAM settings: block copy/paste between managed and unmanaged apps, require PIN to open managed apps, prevent saving corporate data to personal storage, prevent screenshots in managed apps
Exam Tip: App Protection Policies apply at the APP level — they control data flow between managed apps and restrict how corporate data can leave the managed app boundary. They do NOT manage the device. The apps must be Intune-enlightened (Microsoft apps like Outlook, Teams, Word, OneDrive) or wrapped with the Intune App SDK/Wrapping Tool to receive MAM policies.
Intune app management covers two distinct areas: deploying apps to enrolled devices (MDM-based app deployment) and protecting corporate data within apps on managed or unmanaged devices (MAM/App Protection Policies). Understanding both and when each applies is essential for the MD-102 exam and for real-world endpoint management, where you need to serve both corporate device and BYOD scenarios.
📱 App Types in Intune
| App Type | Description | Platforms |
|---|---|---|
| Microsoft Store app | Apps from the Microsoft Store (new Store integration). Automatically updated by the Store. Simplest to add — just search and select. | Windows |
| Line-of-Business (LOB) | Your own packaged app (.msi, .appx, .ipa, .apk). Upload the installer directly. Limited to smaller apps; no automatic update mechanism. | All platforms |
| Win32 app | Complex Windows applications (EXE/MSI with dependencies). Package with IntuneWinAppUtil.exe into .intunewin format. Supports install/uninstall commands, detection rules, requirements, dependencies, and supersedence. | Windows |
| Web app / Web link | URL shortcut that appears in Company Portal. No actual app install. Good for SaaS apps or internal web tools. | All platforms |
| Microsoft 365 Apps | Office suite (Word, Excel, Outlook, Teams etc.) deployed directly by Intune with channel and update configuration. No installer file needed. | Windows, macOS |
| App from managed Google Play | Apps from managed Google Play store for Android Enterprise devices. Google Play integration required. | Android |
| iOS store app / VPP app | App Store apps (purchased via Apple Volume Purchase Program / Apple Business Manager for volume licensing). | iOS/iPadOS |
🚀 App Deployment Intent
| Intent | Behaviour | User Can Uninstall? |
|---|---|---|
| Required | Intune automatically installs the app on all targeted devices/users without any user interaction. If the user uninstalls it, Intune reinstalls it at next sync. | No (Intune reinstalls) |
| Available | App appears in the Company Portal — user can choose to install it. Not forced. Useful for optional productivity tools. | Yes |
| Uninstall | Intune removes the app from targeted devices. Useful for retiring a software package organisation-wide. | N/A (force removed) |
| Available without enrollment | App visible in Company Portal web for users without enrolled devices (MAM-WE scenario). User downloads from store; MAM policy then applies to it. | Yes |
📦 Win32 App Deployment
Win32 is the most powerful and commonly used app type for enterprise Windows applications. The process requires packaging the app before upload:
# Step 1: Download the packaging tool
IntuneWinAppUtil.exe -c “C:\Source\MyApp” -s “MyAppSetup.exe” -o “C:\Output”
# This creates MyAppSetup.intunewin — upload this to Intune
# -c = source folder, -s = setup file, -o = output folder
| Win32 App Setting | Description |
|---|---|
| Install command | Command line to silently install (e.g., MyAppSetup.exe /S /quiet or msiexec /i MyApp.msi /qn) |
| Uninstall command | Command to silently remove the app |
| Detection rules | How Intune knows the app is installed: check for a file path, registry key, MSI product code, or a custom PowerShell script that returns 0 for installed |
| Requirements | Minimum OS version, disk space, RAM, architecture (x64/x86), or a custom PowerShell check the device must meet before install begins |
| Dependencies | Other Intune apps that must be installed first (e.g., .NET Framework before a business app). Intune installs dependencies automatically. |
| Supersedence | Replace an older version of an app with this new one — Intune uninstalls the old version and installs the new one automatically |
🛡️ App Protection Policies (MAM)
App Protection Policies (APPs) protect corporate data within apps — without needing to manage the device. They are primarily used for BYOD scenarios on iOS and Android where employees use personal phones to access work data.
💡 MAM with Enrolment vs MAM without Enrolment
- MAM-WE (without enrolment): App protection on a personal, unmanaged device. The device is never enrolled in Intune — only the apps receive the policy. This is the primary BYOD protection mechanism.
- MAM with MDM enrolment: App protection on a device that IS enrolled. Provides double coverage — both device-level MDM management AND app-level data protection.
⚙️ Key App Protection Policy Settings
| Category | Setting | What It Controls |
|---|---|---|
| Data Transfer | Send org data to other apps | Restrict which apps can receive corporate data from managed app. Options: All apps, Policy managed apps only, None |
| Receive data from other apps | Restrict which apps can send data INTO the managed app | |
| Save copies of org data | Block / Allow saving company files to personal storage (OneDrive Personal, iCloud, Google Drive personal) | |
| Access | PIN required for access | Require a numeric or biometric PIN before opening the managed app |
| Block screen capture | Prevent screenshots of corporate content within managed apps (Android enforcement only; iOS limits due to OS restrictions) | |
| Conditional Launch | Minimum OS version | Block access if the device OS is below the required version |
| Jailbroken/rooted devices | Block or wipe managed app data on jailbroken/rooted devices |
What Counts as a “Policy Managed App”?
- Microsoft first-party apps (Outlook, Teams, Word, Excel, PowerPoint, OneNote, OneDrive, Edge) — all natively support MAM via the Intune App SDK built in
- Third-party apps built with the Intune App SDK — ISVs can integrate the SDK; check the Intune App Protection Partners list
- Apps wrapped with the Intune App Wrapping Tool — for in-house LOB apps; adds MAM capabilities without code changes (iOS and Android)
💡 Best Practices
- Deploy Microsoft 365 Apps to Windows devices using the Microsoft 365 Apps deployment type in Intune rather than uploading an MSI — this gives you Click-to-Run deployment with update channel configuration and automatic update management
- For App Protection Policies, set data transfer to “Policy managed apps only” — this ensures corporate data in Outlook cannot be pasted into a personal Gmail app or saved to personal iCloud, while still allowing seamless data flow between managed Microsoft apps
- Use Win32 app supersedence when updating enterprise apps — it automatically handles the uninstall of the old version before installing the new one, preventing version conflicts
🎓 Interview Q&A
Q: An employee’s personal Android phone has Outlook and Teams installed with Intune App Protection Policies applied (MAM-WE). The employee attempts to copy content from the Outlook email to their personal Gmail app. What happens, and why?
The copy/paste action is blocked. The App Protection Policy is configured with “Send org data to other apps: Policy managed apps only.” This means data within Outlook (a policy-managed app) can only be shared or pasted to other policy-managed apps (like Teams, Word, or OneDrive). Gmail is not a policy-managed app — it doesn’t have the Intune App SDK. The OS-level clipboard is intercepted by the MAM policy, and the paste into Gmail either shows a blank paste or an error message. The employee can still use Gmail for personal email — MAM only restricts corporate data from leaving managed app boundaries, not personal data or app usage.
🎯 MD-102 Mock Test
Module 5 — App Management & App Protection Policies
5 questions · Pass mark: 70%
Q1 OF 5
An admin assigns a Microsoft Teams app to a user group with “Required” intent. A user uninstalls Teams from their enrolled Windows device. What happens at the next Intune sync?
✅ C. With Required intent, Intune treats the app as a mandatory component of the device’s configuration. If the user uninstalls it, at the next sync Intune detects the app is missing and reinstalls it automatically. The user cannot permanently remove a Required app while their device is enrolled. If an app genuinely shouldn’t be on a device, change the assignment to Uninstall or change the group membership.
Q2 OF 5
What tool must be used to prepare a complex Windows EXE application for Win32 app deployment in Intune?
✅ A. IntuneWinAppUtil.exe (the Microsoft Win32 Content Prep Tool) converts the application source files into the .intunewin format that Intune requires for Win32 app uploads. The App Wrapping Tool (C) is used for adding MAM capabilities to LOB mobile apps, not for Win32 packaging.
Q3 OF 5
An organisation wants to protect corporate data in Outlook on employees’ personal iPhones without enrolling the devices in Intune MDM. Which solution achieves this?
✅ B. App Protection Policies (MAM without enrolment / MAM-WE) are specifically designed for this scenario. The employee’s personal iPhone is never enrolled in Intune MDM. The user downloads Outlook from the App Store and signs in with their work account. Intune automatically delivers the App Protection Policy to Outlook via the Intune App SDK — restricting data transfer, requiring a PIN, blocking save-to-personal-storage, etc. The employee’s personal data and other apps are completely untouched.
Q4 OF 5
An App Protection Policy is configured with “Send org data to other apps: Policy managed apps only.” An employee tries to attach a file from a corporate OneDrive location (in Outlook) to a personal WhatsApp message. What happens?
✅ D. With “Send org data to other apps: Policy managed apps only,” corporate data within a managed app (Outlook) cannot be sent to any app that is not a policy-managed app. WhatsApp does not have the Intune App SDK — so sharing is blocked. Corporate data can still flow between Outlook, Teams, Word, and other policy-managed apps freely.
Q5 OF 5
What is the purpose of Win32 app “Supersedence” in Intune?
✅ C. Win32 app Supersedence defines that the current app (new version) replaces a previous app (old version) in Intune. Intune automatically uninstalls the superseded (old) app from the device and installs the superseding (new) app. Dependencies (D) are different — they’re prerequisites that must be installed first.
🔒
Module locked — Complete Module 4 first.