Common Conditional Access policy: Require approved client apps or app protection policy

  • How-to

People regularly use their mobile devices for both personal and work tasks. While making sure staff can be productive, organizations also want to prevent data loss from applications on devices they may not manage fully.

With Conditional Access, organizations can restrict access to approved (modern authentication capable) client apps with Intune app protection policies. For older client apps that may not support app protection policies, administrators can restrict access to approved client apps.

Warning

App protection policies are supported on iOS and Android where applications meet specific requirements. App protection policies are supported on Windows in preview for the Microsoft Edge browser only. Not all applications that are supported as approved applications or support application protection policies. For a list of some common client apps, see App protection policy requirement. If your application is not listed there, contact the application developer. In order to require approved client apps or to enforce app protection policies for iOS and Android devices, these devices must first register in Microsoft Entra ID.

Note

"Require one of the selected controls" under grant controls is like an OR clause. This is used within policy to enable users to utilize apps that support either the Require app protection policy or Require approved client app grant controls. Require app protection policy is enforced when the app supports that grant control.

For more information about the benefits of using app protection policies, see the article App protection policies overview.

The following policies are put in to Report-only mode to start so administrators can determine the impact they'll have on existing users. When administrators are comfortable that the policies apply as they intend, they can switch to On or stage the deployment by adding specific groups and excluding others.

Prerequisites

None

Require approved client apps or app protection policy with mobile devices.

The following steps help create a Conditional Access policy requiring an approved client app or an app protection policy when using an iOS/iPadOS or Android device. This policy prevents the use of Exchange ActiveSync clients using basic authentication on mobile devices. This policy works in tandem with an app protection policy created in Microsoft Intune.

Organizations can choose to deploy this policy using the following steps or using the Conditional Access templates.

  1. Sign in to the Azure portal as a Conditional Access Administrator, Security Administrator, or Global Administrator.

  2. Browse to Microsoft Entra ID > Security > Conditional Access. Select Create New policy.

  3. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.

  4. Under Assignments, select Users or workload identities.

    1. Under Include, select All users.
    2. Under Exclude, select Users and groups and exclude at least one account to prevent yourself from being locked out. If you don't exclude any accounts, you can't create the policy.

  5. Under Target resources > Cloud apps > Include, select All cloud apps.

  6. Under Conditions > Device platforms, set Configure to Yes.

    1. Under Include, Select device platforms.
    2. Choose Android and iOS.
    3. Select Done.

  7. Under Access controls > Grant, select Grant access.

    1. Select Require approved client app and Require app protection policy
    2. For multiple controls select Require one of the selected controls

  8. Confirm your settings and set Enable policy to Report-only.

  9. Select Create to create to enable your policy.

    After administrators confirm the settings using report-only mode, they can move the Enable policy toggle from Report-only to On.

    Tip

    Organizations should also deploy a policy that blocks access from unsupported or unknown device platforms along with this policy.

Block Exchange ActiveSync on all devices

This policy blocks all Exchange ActiveSync clients using basic authentication from connecting to Exchange Online.

  1. Sign in to the Azure portal as a Conditional Access Administrator, Security Administrator, or Global Administrator.

  2. Browse to Microsoft Entra ID > Security > Conditional Access.

  3. Select Create new policy.

  4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.

  5. Under Assignments, select Users or workload identities.

    1. Under Include, select All users.
    2. Under Exclude, select Users and groups and exclude at least one account to prevent yourself from being locked out. If you don't exclude any accounts, you can't create the policy.
    3. Select Done.

  6. Under Target resources > Cloud apps > Include, select Select apps.

    1. Select Office 365 Exchange Online.
    2. Select Select.

  7. Under Conditions > Client apps, set Configure to Yes.

    1. Uncheck all options except Exchange ActiveSync clients.
    2. Select Done.

  8. Under Access controls > Grant, select Grant access.

    1. Select Require app protection policy

  9. Confirm your settings and set Enable policy to Report-only.

  10. Select Create to create to enable your policy.

    After administrators confirm the settings using report-only mode, they can move the Enable policy toggle from Report-only to On.

Related content