You have a Microsoft 365 subscription that includes Microsoft Intune. You create a new Android app protection policy named Policy1 that prevents…

The core issue is that an unmanaged application is accessing corporate email, bypassing the data protection settings defined in the Intune App Protection Policy (APP). An APP only applies to managed applications, such as Microsoft Outlook. To prevent unmanaged apps from accessing corporate resources like Exchange Online, a Conditional Access (CA) policy is required. By creating a CA policy that targets Exchange Online and requires either an "approved client app" or an "app protection policy," you can effectively block access from any non-approved email clients, forcing users to use managed apps like Outlook which are subject to Policy1.

B. Create a compliance policy.

A compliance policy evaluates the health and security posture of the device itself (e.g., OS version, encryption), not which applications are used to access cloud services.

C. Modify the Data protection settings of Policy1.

Policy1 is an App Protection Policy that already applies to Microsoft apps. Modifying its settings will not affect unmanaged applications that are not targeted by the policy.

D. Modify the assignments of Policy1.

Changing the user or group assignments for Policy1 does not extend its control to unmanaged applications; it only changes which users' managed apps are affected by the policy.

---

1. Microsoft Learn. (2024). Conditional Access: Grant.

Section: "Require approved client app"

Content: This section explicitly states that this grant control can be used to require that access attempts to selected cloud apps are made from a client app that is on the list of approved apps. This is the mechanism to block unmanaged clients from accessing services like Exchange Online.

Section: "Require app protection policy"

Content: This section details how Conditional Access can require a client app to have Intune app protection policies applied before granting access

which forces the use of managed apps.

2. Microsoft Learn. (2023). App protection policies overview.

Section: "How you can protect app data"

Content: This document clarifies that App Protection Policies are rules that "ensure an organization's data remains safe or contained in a managed app." This confirms that the policies do not apply to unmanaged apps

explaining why modifying Policy1 is ineffective.

3. Microsoft Learn. (2024). Use compliance policies to set rules for devices you manage with Intune.

Section: "What are device compliance policies?"

Content: This source explains that compliance policies define rules for devices to be considered compliant (e.g.

requiring a PIN or encryption). It clarifies that compliance is a device-level state

which is then often used as a condition in a Conditional Access policy

but it does not directly control app access.