What does App Protection (MAM): Devicie - Android Enterprise Basic Data Protection offer?

• Select "Block" to prevent this app from backing up work or school data to the Android Backup Service.
• Select "Allow" to allow this app to back up work or school data.

• Policy managed apps: Allow transfer only to other policy-managed apps.
• All apps: Allow transfer to any app.
• None: Don't allow data transfer to any app, including other policy-managed apps.

• Choose "Block" to disable the use of the Save As option in this app.
• Choose "Allow" if you want to allow the use of Save As. When set to Block, you can configure the setting Allow user to save copies to selected services.

Users can save to the selected services:

• OneDrive for Business
• SharePoint
• Photo Library
• Box
• Local Storage

All other services not listed will be blocked.

When a user selects a hyperlinked phone number in an app, a dialer app will open with the phone number prepopulated and ready to call. For this setting, choose how to handle this type of content transfer when it is initiated from a policy-managed app:

• None, do not transfer this data between apps: Don't transfer communication data when a phone number is detected.
• A specific dialer app: Allow a specific dialer app to initiate contact when a phone number is detected.
• Any policy-managed dialer app: Allow any policy managed dialer app to initiate contact when a phone number is detected.
• Any dialer app: Allow any dialer app to be used to initiate contact when a phone number is detected.

When a user selects a hyperlinked messaging link in an app, a messaging app will open with the phone number prepopulated and ready to send.

Select the following type of content transfer from a policy-managed app:

• None, do not transfer this data between apps: Don't transfer communication data when a phone number is detected.
• A specific messaging app: Allow a specific messaging app to be used to initiate contact when a phone number is detected.
• Any policy-managed messaging app: Allow any policy-managed messaging app to be used to initiate contact when a phone number is detected.
• Any messaging app: Allow any messaging app to be used to initiate contact when a phone number is detected.

• Policy managed apps: Allow transfer only from other policy-managed apps.
• All apps: Allow data transfer from any app.
• None: Don't allow data transfer from any app, including other policy-managed apps.

Select "Block" to disable the use of the Open option or other options to share data between accounts in this app. Select "Allow" if you want to allow the use of Open.

When set to Block you can configure the Allow user to open data from selected services to specify which services are allowed for Org data locations.

• This setting is only configurable when the setting Receive data from other apps is set to Policy managed apps.
• This setting will be "Allow" when the setting Receive data from other apps is set to All apps.
• This setting will be "Block" with no allowed service locations when the setting Receive data from other apps is set to None.
• The following apps support this setting:
  • OneDrive 11.45.3 or later.
  • Outlook for iOS 4.60.0 or later.
  • Teams for iOS 3.17.0 or later.

Select the application storage services that users can open data from. All other services are blocked.

Selecting no services will prevent users from opening data from external locations.

• The following apps support this setting:
  • OneDrive for Business
  • SharePoint Online
  • Camera
  • Photo Library

Select the following:

• Blocked: Don't allow cut, copy, and paste actions between this app and any other app.
• Policy managed apps: Allow cut, copy, and paste actions between this app and other policy-managed apps.
• Policy managed with paste in: Allow cut or copy between this app and other policy-managed apps. Allow data from any app to be pasted into this app.
• Any app: No restrictions for cut, copy, and paste to and from this app.

Enter the number of characters that to cut or copy from Org data and accounts. 

Note: Requires Intune Company Portal version 5.0.4364.0 or later

Select "Block" to block screen capture and block Google Assistant accessing org data on the device when using this app. Selecting Block will also blur the App-switcher preview image when using this app with a work or school account.

Note: Google Assistant may be accessible to users for scenarios that don't access org data.

Select Require and then specify a list of approved keyboards for this policy.
Users who aren't using an approved keyboard receive a prompt to download and install an approved keyboard before they can use the protected app.

Note: This setting requires the app to have the Intune SDK for Android version 6.2.0 or later.

This option is available when you select Require for the previous option. Choose Select to manage the list of keyboards and input methods that can be used with apps protected by this policy. You can add additional keyboards to the list, and remove any of the default options. You must have at least one approved keyboard to save the setting. Over time, Microsoft may add additional keyboards to the list for new App Protection Policies, which will require administrators to review and update existing policies as needed.

To add a keyboard, specify:

• Name: A friendly name that that identifies the keyboard, and is visible to the user.
• Package ID: The Package ID of the app in the Google Play store. For example, if the URL for the app in the Play store is https://play.google.com/store/details?id=com.contoskeyboard.android.prod, then the Package ID is com.contosokeyboard.android.prod. This package ID is presented to the user as a simple link to download the keyboard from Google Play.

Select "Require", to enable encryption of work or school data in this app. 

Note: Android uses 256-bit AES encryption scheme securely encrypt app data. Data is encrypted synchronously during file I/O tasks. Content on the device storage is always encrypted and can only be opened by apps that support Intune's app protection policies and have policy assigned.

New files will be encrypted with 256-bit keys. Any existing 128-bit encrypted files will undergo a migration attempt to 256-bit keys, but the process is not guaranteed. Files encrypted with 128-bit keys will remain readable.

• Select "Require" to enforce encrypting org data with Intune app layer encryption on all devices.
• Select "Not required" to not enforce encrypting org data with Intune app layer encryption on enrolled devices.

Select "Block" to prevent policy managed apps from saving data to the device's native apps (Contacts, Calendar and widgets) and to prevent the use of add-ins within the policy managed apps.

If you choose Allow, the policy managed app can save data to the native apps or use add-ins, if those features are supported and enabled within the policy managed app.

Note: When you perform a selective wipe to remove work, or school data from the app, data synced directly from the policy managed app to the native app is removed. Any data synced from the native app to another external source won't be wiped.

• Select "Block" to prevent the app from printing work or school data.
• Select "Allow" users will be able to export and print all Org data.

Select how web content (http/https links) is opened from policy-managed applications.

• Any app: Allow web links in any app.
• Intune Managed Browser: Allow web content to open only in the Intune Managed Browser. This browser is a policy-managed browser.
• Microsoft Edge: Allow web content to open only in the Microsoft Edge. This browser is a policy-managed browser.
• Unmanaged browser: Allow web content to open only in the unmanaged browser defined by Unmanaged browser protocol setting. The web content will be unmanaged in the target browser.

Note: Requires Intune Company Portal version 5.0.4415.0 or later.

For Policy-managed browsers:

On Android, your end users can choose from other policy-managed apps that support http/https links if neither Intune Managed Browser nor Microsoft Edge is installed.

• If a policy-managed browser is required but not installed, your end users will be prompted to install the Microsoft Edge.
• If a policy-managed browser is required, Android App Links are managed by the Allow app to transfer data to other apps policy setting.

For Policy-managed Microsoft Edge:

The Microsoft Edge browser for mobile devices (iOS/iPadOS and Android) supports Intune app protection policies. Users who sign in with their corporate Microsoft Entra accounts in the Microsoft Edge browser application will be protected by Intune. The Microsoft Edge browser integrates the APP SDK and supports all of its data protection policies, with the exception of preventing:

• Save-as: The Microsoft Edge browser doesn't allow a user to add direct, in-app connections to cloud storage providers (such as OneDrive).
• Contact sync: The Microsoft Edge browser doesn't save to native contact lists.

Enter the application ID for a single browser. Web content (http/https links) from policy managed applications will open in the specified browser. The web content will be unmanaged in the target browser.

Enter the application name for browser associated with the Unmanaged Browser ID. This name will be displayed to users if the specified browser is not installed.

Specify how Org data is shared via OS notifications for Org accounts. This policy setting will impact the local device and any connected devices such as wearables and smart speakers.

The following additional controls to customise behaviour:

• • Blocked: Don't share notifications.
    If not supported by the application, notifications will be allowed.
  • Block org Data: Don't share Org data in notifications, for example.
    "You have new mail"; "You have a meeting".
    If not supported by the application, notifications will be allowed.
  • Allow: Shares Org data in the notifications.

Note: This setting requires the following app support:

• Outlook for Android 4.0.95 or later
• Teams for Android 1416/1.0.0.2020092202 or later

Allow connection to VPN when app is launch

Select "Require" this will require a PIN to use this app. The user is prompted to set up this PIN the first time they run the app in a work or school context. The PIN is applied when working either online or offline.

You can configure the PIN strength using the settings available under the PIN for access section.

• Select "Allow" to allow users to use simple PIN sequences like 1234, 1111, abcd or aaaa.
• Select "Block" to prevent them from using simple sequences. Simple sequences are checked in 3 character sliding windows. Examples PIN with 1235 or 1112 wouldn't be accepted as PIN set by the end user, but 1122 would be allowed.

Select "Require" to override the use of biometrics with PIN when a change in biometrics is detected.

Select "Yes" to require users to change their app PIN after a set period of time, in days.

If "Yes" is selected, then configure the number of days before the PIN reset is required.

This setting specifies the number of previous PINs that Intune will maintain. Any new PINs must be different from those that Intune is maintaining.

Select "Not required" to disable the app PIN when a device lock is detected on an enrolled device with Company Portal configured.

This setting specifies the number of tries the user has to successfully enter their PIN before the configured action is taken.  

The following actions include:

• Reset PIN: The user must reset their PIN.
• Wipe data: The user account that is associated with the application is wiped from the device.
• Note: The default value is 5.

This setting specifies the time (in minutes) before the access requirements for the app are rechecked.

The following actions include:

• Block access (minutes): The number of minutes that policy-managed apps can run offline. Specify the time (in minutes) before the access requirements for the app are rechecked. 
  
  • Note: The default value is 720 minutes (12 hours)
    
    
• Wipe data (days): The number of days of running offline, the app will require the user to connect to the network and reauthenticate. If the user successfully authenticates, they can continue to access their data and the offline interval will reset. If the user fails to authenticate, the app will perform a selective wipe of the users' account and data. 
  • Note: The default value is 90 days

This setting specifies a value for the minimum application version value.

The following actions include:

• Warn: The user sees a notification if the app version on the device doesn't meet the requirement. This notification can be dismissed.
• Block access: The user is blocked from access if the app version on the device doesn't meet the requirement.
• Wipe data: The user account that is associated with the application is wiped from the device.

There is no value to set for this setting.

The following actions include:

Block access: When we have confirmed the user has been disabled in Microsoft Entra ID, the app blocks access to work or school data.
Wipe data: When we have confirmed the user has been disabled in Microsoft Entra ID, the app will perform a selective wipe of the users' account and data