Microsoft certification badges banner
Headshot of Michael Korting

Blog

Microsoft 365 • Security • Compliance

2026-07-23 • Intune • App Protection Policies • Conditional Access • GCC High • BYOD

Deploying Microsoft Intune MAM for Outlook and Teams in GCC High

A phased approach to securing mobile access without requiring device enrollment.

Background

During a recent GCC High migration project, the organization wanted to improve security for personal mobile devices accessing Microsoft 365 while avoiding disruption to unmanaged Windows endpoints. Like many regulated organizations, the long-term goal was full Intune enrollment and device compliance. However, requiring enrollment immediately would have created unnecessary friction during the migration phase.

The solution was to implement Microsoft Intune Mobile Application Management (MAM) using App Protection Policies combined with Conditional Access. This approach protects corporate data inside Microsoft applications while allowing users to continue using their personal phones and tablets.

Important: At the time of writing, all Conditional Access policies remain in Report-only mode and are assigned to an isolated pilot group while validation activities continue.

Project Objectives

  • Allow Outlook Mobile access on iOS and Android.
  • Allow Teams Mobile access on iOS and Android.
  • Protect corporate data with App Protection Policies.
  • Avoid requiring Intune enrollment.
  • Block OWA access from mobile browsers.
  • Block SharePoint Online and OneDrive browser access from mobile devices.
  • Leave unmanaged Windows devices unaffected during the migration.
  • Use a phased deployment methodology with minimal production risk.

Why MAM Before Enrollment?

Although full Intune enrollment remains the long-term objective, requiring enrollment during a GCC High migration can introduce unnecessary user friction. By starting with MAM, organizations can immediately protect corporate data within Microsoft applications while building toward a broader device management strategy over time.

Solution Architecture

Personal Device
      |
 Outlook Mobile
      |
App Protection Policy
      |
Conditional Access
      |
 Exchange Online

Personal Device
      |
  Teams Mobile
      |
App Protection Policy
      |
Conditional Access
      |
 Microsoft Teams

Mobile Browser
      |
Conditional Access
      |
    Blocked

The Five Policies

  1. iOS/iPadOS App Protection Policy
  2. Android App Protection Policy
  3. Conditional Access Policy – Require App Protection Policy for Exchange, Teams, and SharePoint Online
  4. Conditional Access Policy – Block Browser Access to Exchange Online from iOS and Android devices
  5. Conditional Access Policy – Block Browser Access to SharePoint Online from iOS and Android devices

App Protection Policy Configuration

Protected Applications

  • Microsoft Outlook
  • Microsoft Teams
  • Microsoft OneDrive

Data Protection Controls

  • Restrict corporate data transfer to policy-managed applications.
  • Block saving corporate files to personal locations.
  • Block backup of organizational data.
  • Restrict copy and paste operations to managed applications.
  • Prevent organizational data from being shared with unmanaged applications.
  • Require authentication before application access.

Access Requirements

  • Require application PIN.
  • Allow biometric authentication.
  • Require work account authentication.
  • Configure offline access limits to protect stale corporate data.

Conditional Access Strategy

Rather than immediately enforcing enrollment or device compliance requirements, Conditional Access was used to drive users toward approved Microsoft mobile applications.

Policy 1 – Outlook and Teams Mobile Protection

This policy targets Exchange, Teams, and SharePoint Online and requires users connecting from iOS or Android devices to satisfy App Protection Policy requirements.

  • Outlook, Teams, and OneDrive Mobile will be permitted when App Protection Policy requirements are satisfied.
  • Protected application controls are enforced.
  • Device enrollment is not required.

Policies 2 and 3 – Blocking Mobile Browser Access

  • OWA access from Safari and Chrome is blocked.
  • SharePoint Online browser access is blocked.
  • OneDrive browser access is blocked.
  • Pilot testing confirmed Outlook Mobile and Teams Mobile continued to function as expected.

Pilot Deployment Methodology

All five policies were assigned to a dedicated security group named MAM Group. The group is currently isolated for validation testing.

Additionally, every Conditional Access policy was configured in Report-only mode, allowing impact analysis prior to enforcement.

Validation Activities

  • Review Conditional Access Insights and Reporting.
  • Monitor Report-only policy results.
  • Validate Outlook Mobile access.
  • Validate Teams Mobile access.
  • Confirm browser-based Exchange Online access is identified correctly.
  • Confirm SharePoint Online browser traffic is being evaluated as expected.
  • Review sign-in logs for unexpected application behavior.

Recommended Rollout Process

  1. Create App Protection Policies.
  2. Create Conditional Access policies in Report-only mode.
  3. Assign policies to an empty pilot group.
  4. Add IT administrators and stakeholders.
  5. Review report-only logs for at least one week.
  6. Expand pilot membership gradually.
  7. Move policies from Report-only to On.
  8. Communicate changes to affected users.
  9. Monitor sign-in logs during rollout.

Lessons Learned

  • Teams and SharePoint dependencies should always be validated together.
  • Browser blocking is often safer than broad workload blocking.
  • Report-only mode frequently reveals unexpected authentication patterns.
  • Pilot groups dramatically reduce implementation risk.
  • MAM delivers meaningful protection long before device enrollment is complete.

MAM provides an excellent bridge between completely unmanaged access and fully managed devices. Organizations can improve protection of corporate data immediately while buying time to complete larger enrollment, compliance, and device management initiatives.

What's Next?

The next phase of the project includes expanding the pilot population, evaluating sign-in telemetry, and determining the appropriate timeline for broader enforcement. Future work may include device compliance policies, enrollment strategies, and additional Conditional Access protections as the organization's Zero Trust roadmap evolves.

Final Thoughts

Mobile Application Management is frequently overlooked because many organizations jump directly into device compliance discussions. In reality, MAM often provides one of the quickest paths to meaningful risk reduction while maintaining a positive user experience during major cloud migrations.

← Back to Blog