App configuration policies in Intune for iOS and Android: managed devices vs managed apps

App configuration policies preconfigure mobile apps, so users open Outlook, Edge or Teams and find them already set up with the work account and your settings. Intune offers two kinds, Managed devices and Managed apps, and picking the wrong one is an easy way to make sure a setting never arrives. In this post I'll explain both channels, build a policy for each, and show how to prove what the app actually received.

How it works#

Both kinds are created under Apps › Configuration › Create in the Microsoft Intune admin center, but they travel differently:

Keys and values are defined by the app's developer, not by Intune, so the vendor's documentation is the source for what each app supports. Managed apps check for configuration every 30 minutes when the user also has an app protection policy, and every 720 minutes without one.

Prerequisites#

• For managed devices: the device is enrolled and the app is assigned through Intune. App configuration policies apply to MDM-managed apps only; they can't configure apps delivered through declarative device management.
• For managed apps: the app supports the Intune App SDK, and Android devices run Android 10.0 or later.
• The keys for each app. Microsoft publishes them for Outlook, Edge, Teams and the Microsoft 365 app.

Step-by-step#

1. iOS/iPadOS: allow only the work account#

Create a Managed devices policy, choose platform iOS/iPadOS and pick the targeted app (for example Outlook). With Use configuration designer, add these keys as strings:

The app then accepts only the enrolled user's account and removes or blocks others. Microsoft lists minimum versions for the apps that honor this, including Outlook, Edge, Teams, OneDrive, OneNote, the Office apps and Copilot. To also require the work account before the app receives organization data from other managed apps, add IntuneMAMRequireAccounts set to Enabled. That needs an app protection policy with Receive data from other apps set to All apps with incoming Org data.

Configuration keys are case sensitive, and value types are Integer, Real, String or Boolean. If you prefer Enter XML data, paste a property list. These tokens are supported:

<dict>
  <key>userprincipalname</key><string>{{userprincipalname}}</string>
  <key>mail</key><string>{{mail}}</string>
  <key>partialupn</key><string>{{partialupn}}</string>
  <key>userid</key><string>{{userid}}</string>
  <key>deviceid</key><string>{{deviceid}}</string>
  <key>serialnumber</key><string>{{serialnumber}}</string>
  <key>IsSupervised</key><string>{{IsSupervised}}</string>
</dict>

The full list also includes {{accountid}}, {{username}}, {{serialnumberlast4digits}}, {{udidlast4digits}}, {{aaddeviceid}} and {{OnPremisesSamAccountName}}. Don't use double braces for anything other than tokens. Intune checks that the XML is well formed, not that the app understands it.

2. Android Enterprise: pick the enrollment type first#

Create a Managed devices policy for Android Enterprise and choose the profile type: All Profile Types, Fully Managed, Dedicated, and Corporate-Owned Work Profile Only, or Personally-Owned Work Profile Only. Only the last two let you link a certificate profile, so don't pick All Profile Types if the app uses certificate-based authentication. Then select a Managed Google Play app that supports configuration and use the configuration designer or JSON. The same policy can preset runtime permissions (Prompt, Auto grant, Auto deny), although from Android 12 several sensitive permissions, such as camera and location, can't be auto-granted on corporate-owned work profile or dedicated devices. Android uses its own keys for allowed accounts, listed in Microsoft's Android app configuration documentation.

3. Any device: a managed apps policy#

Create a Managed apps policy, pick the apps (for example Edge on iOS and Android) and add general settings as name and value pairs, such as com.microsoft.intune.mam.managedbrowser.homepage or com.microsoft.intune.mam.managedbrowser.bookmarks with Outlook Web|https://outlook.office.com. Assign it to user groups that also have an app protection policy, so it's picked up on the 30-minute cycle.

Verify#

• Admin center: the policy's overview shows status by device and by user. For managed devices, open Devices › All devices, select the device and then App configuration to see every assigned policy and its state.
• iOS/iPadOS logs: in Edge, open about:intunehelp, select Get Started and Share Logs, then search IntuneMAMDiagnostics.txt for ApplicationConfiguration (managed apps) or AppConfig (managed devices).
• Android logs: copy OMADMLog_0 from Android\data\com.microsoft.windowsintune.companyportal\Files over USB and search for AppConfigHelper. A good result lists your keys:

INFO AppConfigHelper ... Returning app config JSON [ {"ApplicationConfiguration": [ {"Name":"IntuneMAMUPN","Value":"adele@contoso.com"}, ...

If the log shows your value and the app still ignores it, the issue is in how the app handles the key, so check with the app's developer.

Tips & gotchas#

• One owner per key. Don't set the same key in a managed devices and a managed apps policy for the same users; if you must, check the logs to see which value the app received.
• Users can win. Some settings respect the user's choice. Outlook's Focused Inbox setting, for example, can be changed by the user despite your policy.
• Android LOB updates. When you update a directly deployed Android line-of-business app, policies for the old version don't follow it. Create and assign a policy for the new version.
• Dedicated devices have no user. Gmail or Nine configuration on a dedicated device fails because Intune can't resolve a user.
• Company Portal on userless ADE devices. The one-time Company Portal configuration that gives devices enrolled without user affinity a user can show STATE Policy Error, and it stops reporting success once applied. That's expected; unassign it after it has applied.

References#

• App configuration policies for Microsoft Intune
• Add app configuration policies for managed iOS/iPadOS devices
• Add app configuration policies for managed Android Enterprise devices