Intune app protection for Windows (MAM in Edge): setup, Conditional Access and errors

Intune app protection for Windows (MAM for Windows) lets people use Microsoft Edge on a personal PC to reach Microsoft 365, with your data protection rules applied only to the Edge work profile. When one piece is out of line, users get stuck in sign-in prompts, protection never applies, or managed PCs lose browser access. In this post I'll walk through the prerequisites, the Conditional Access policy, health checks, and the fixes for the prompts users actually report.

Symptoms#

• Users opening Outlook on the web or SharePoint get the prompt below, with a Switch Edge profile button, and it keeps coming back.
• The user finished the flow and saw You're all set, but Edge still asks them to sign in with their work account.
• On some PCs, Edge never offers the profile switch.
• Access works in Edge, but the copy, download or print restrictions you configured don't apply.
• After you enabled the policy, users on corporate, MDM-enrolled PCs lose browser access to Microsoft 365.
• Chrome or Firefox on a personal PC is blocked. That's by design: the policy allows Edge and blocks other browsers.

The prompt users see in Edge:

To access your service, app, or website, you might need to sign in to Microsoft Edge using username@domain.com or register your device with organization if you're already signed in.

Why it happens#

MAM for Windows combines an app protection policy for Edge, a device health signal from Windows Security Center, and Conditional Access that requires the app protection policy. Most failures come down to one of these:

• Your tenant manages the device. App protection for Windows is for PCs your tenant doesn't manage, which now includes PCs managed by another tenant, such as a contractor's company laptop. If your tenant already manages the PC through MDM, MAM enrollment is blocked; if it gets enrolled later, the app protection settings stop applying. A user who answers Yes to the device management option during sign-in enrolls the PC in MDM instead of MAM.
• Conditional Access targets the wrong devices. With the app protection control alone, or with Require all the selected controls, the policy can't evaluate the app on MDM-managed devices and blocks them, so it must be scoped to unmanaged devices only.
• The Edge account isn't MAM-enrolled. Microsoft documents a known issue: a pre-existing, unregistered work account in Edge, or a sign-in that skipped registration on the heads-up page, leaves the account not enrolled. Choosing this app only on that page has a similar effect.
• Prerequisites are missing. The policy applies to Edge on Windows 11, and on Windows 10 20H2 or later with KB5031445. Edge must be on the Stable or Extended Stable channel (Microsoft's Edge MAM guidance lists version 147 or later). You need Intune licences, plus Microsoft Entra ID P1 or P2 for Conditional Access.
• Endpoint DLP is on. With device-level Endpoint DLP enabled, app protection policies can't be applied to the Edge work profile and profile switching isn't offered, unless the tenant that manages the device sets the Edge policy MAMWithDeviceDLPEnabled (through Intune from Edge 148, or with Group Policy or the registry on Edge 147).
• A Defender for Cloud Apps DLP policy wins. From Edge 149, an applicable Defender for Cloud Apps DLP policy takes precedence over app protection: Conditional Access still applies, but the Defender for Cloud Apps policy is enforced instead, so adjust it if you need different behaviour.
• Timing. Enrollment may still be processing, or it expired, or the user doesn't meet your health checks.

How to fix it#

1. Confirm the device qualifies#

• Check the Windows build with winver. On Windows 10, confirm KB5031445 or a later cumulative update is installed.
• Open edge://settings/help to confirm the Edge version (147 or later) and channel.
• In Settings › Accounts › Access work or school, admins treat an organization connection with an Info button as the quick sign that the PC is MDM-enrolled; confirm it in the Intune admin center. If your tenant manages it, use MDM plus compliance on that device instead, or unenroll it if it's genuinely personal; PCs managed by another tenant are supported.
• Open edge://edge-dlp-internals: on the Feature Status page, a Provider Name of Endpoint DLP with Provider State Available means device-level Endpoint DLP is on.
• The sign-in prompt offers to register the device, so after a successful MAM sign-in dsregcmd /status, run as the user, should show WorkplaceJoined : YES.

2. Build Conditional Access the documented way#

1. In the Microsoft Entra admin center, go to Entra ID › Conditional Access › Policies and create a policy.
2. Include All users and exclude your emergency access accounts.
3. Under Target resources, include Office 365.
4. Set Device platforms to Windows only and Client apps to Browser only.
5. Under Grant, select Require app protection policy and Require device to be marked as compliant, with Require one of the selected controls. Managed PCs pass on compliance, personal PCs pass through MAM.
6. Start in Report-only, review the results, then switch to On. Add a separate policy that blocks unknown or unsupported device platforms.

To test before enforcing, see Conditional Access What If and report-only mode.

3. Assign an app protection policy for Edge to the same users#

In the Microsoft Intune admin center, go to Apps › Protection, create a Windows policy, and select Microsoft Edge as the app. Configure data protection (clipboard, downloads, printing) and health checks, then assign it to the same users as the Conditional Access policy. A user covered by Conditional Access but not by an app protection policy can't satisfy the grant and keeps seeing the prompt.

4. Connect Windows Security Center for device health#

To gate access on device health, go to Tenant administration › Connectors and tokens › Mobile Threat Defense and add the Windows Security Center connector. Then add a device threat level condition to the health checks in your app protection policy, with Block access or Wipe data as the action. The connector is only supported on Windows 11 build 22631 (23H2) or later, so don't expect a health verdict from older builds. For partner connectors, see Mobile Threat Defense connectors in Intune.

5. Reset the user's Edge sign-in#

1. In Edge, remove the work profile or account that was added outside the prompt. Warn the user that this deletes that profile's local browsing data.
2. Browse to a protected site and select Switch Edge profile when prompted.
3. When Windows offers to remember the account, select Yes. This registers the device and starts MAM enrollment. Don't choose this app only.
4. If a device management (MDM enrollment) option appears, select No.
5. Wait for You're all set, give it a few minutes, then retry in a new tab.

Verify the fix#

• The user reaches Outlook on the web and SharePoint in the Edge work profile without further prompts.
• In the Microsoft Entra sign-in logs, the user's sign-in from Edge on Windows shows your policy as Success on the Conditional Access tab, while another browser on the same PC is blocked.
• A restriction you configured, such as pasting org data into a personal app, behaves as the policy says.

Prevent it next time#

• Use MAM for personal PCs and MDM plus compliance for corporate PCs, and let the "one of the selected controls" grant handle both.
• Pilot with a small group in report-only mode before enforcing.
• Tell users to answer No to the device management option. Microsoft documents a preview property that hides that screen during this flow.
• Related guides: app protection on Outlook mobile and AADSTS53000 and AADSTS53003 blocks.

References#

• Data protection for Windows MAM (Microsoft Learn)
• Require an app protection policy on Windows devices (Microsoft Learn)
• Protect corporate data in Microsoft Edge using Intune App Protection (Microsoft Learn)