Microsoft Intune App Protection for Windows (MAM for Windows)

In this brief tutorial, I'll be keeping it light and breezy, discussing:

The What: MAM for Windows in plain English.
The Wow: Its slick features and how they’re a game-changer.
The How: Quick guide to set it up without breaking a sweat.

It's Windows security and data protection done right!

0:00 What's the problem?
1:24 What's the solution?
2:15 Create a policy for Windows
4:00 Create a CA policy to enforce MAM for Windows
6:00 Test it out
8:11 Conclusion?

[cfizz]

My CAP is blocking me from accessing teams online and it's stating I don't have a app protection policy. If you can only define EDGE in the app protection policy, how did you get it to work?

[QuintenMarais]

Hi Dean, A unique requirement I am facing, We have a CA policy applied to Windows devices, when accessing the Outlook app it will require BYOD devices to be enrolled and compliant to a compliance policy.. But, when the same user accesses OWA on a internet cafe machine, only a App protection policy needs to apply to that session .. the issue I am facing is that, both the App and OWA reports as a "Browser" to the CA policy.

[lasolution]

Thank you, very interesting! Now, I am not sure why I would still use "App Enforced Restrction"...

[sXRaider]

Hi Dean, very nice tutorial! Just a question: what are the dynamic rules for the 'Personal Device Users ' EntraID Group?

[AutoNagri]

Hi..
After trying all the steps.. i am getting an error code of 53003.
Test id not able to login chrome browser as per policy APP but getting an error in edge browser.

[samv]

nice one, what is the roadmap for this? Will this only support the browser based scenario or will it extend to the fat apps ?

[asdf]

The issue I am facing is that the work account gets registered under the local laptop work or school account after the MAM app protection policy for MS Edge is applied locally on the personal Windows laptop. Because of this, the user is able to login to local Teams, OneNote, Onedrive apps under the work account, but these applications cannot prevent copy and paste of information including files to other external applications. The app protection policy does work for the Office products within the Edge browser. How can I prevent the user from logging in to company O365 environment from the locally installed Teams, OneNote, Onedrive applications from the personal Windows laptop but allow all company O365 apps/data from MS Edge where the app protection policy works?

[leklektv]

Can we enforce a policy wherein end user could not install any software and prompt to have admin rights to install or block them when they try to install non compliance software. Thank you!

[cyphernz]

What about preventing a user from using the Outlook App on a personal device?

[danzirulez]

tried screenshotting? wonder if that works

[lasolution]

Do you need to enable WIP in Automatic Enrollment?

[joblearn]

what licnses i need to enable to be able to use MAM>

[i_m_veer_singh]

Hi Dean, I have more than 50 corporate iPad which are not under any vendor ABM or MDM and they all needs to be enrolled under our ABM. Is there any way to bulk enrol the devices under the ABM instead of manually doing it one by one using the Apple Configurator? I am using Intune as a MDM solution. Please suggest. Thanks

[skoul]

I'm trying to add Edge app for windows MAM but it says "Can't find any apps". Do you know anything about it?

[Mkt]

For the policy to take effect, does this require that the user be signed into the Edge browser with work profile/creds?