| title | description | keywords | author | ms.author | manager | ms.date | ms.topic | ms.service | ms.localizationpriority | ms.technology | ms.assetid | ms.reviewer | ms.suite | search.appverid | ms.custom | ms.collection |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
iOS apps with app protection policies |
This topic describes what to expect when your iOS app is managed by app protection policies. |
lenewsad |
lanewsad |
dougeby |
02/15/2018 |
conceptual |
microsoft-intune |
high |
b57e6525-b57c-4cb4-a84c-9f70ba1e8e19 |
andcerat |
ems |
MET150 |
intune-classic |
M365-identity-device-management |
[!INCLUDE both-portals]
This topic describes the user experience when using apps that have app protection policies applied. App protection policies are applied only when apps are used in the work context; for example, when the user is accessing apps with a work account or accessing files that are stored in a company OneDrive for business location.
If the device is not enrolled in Intune, the user is asked to restart the app when they first use it. A restart is required so that app protection polices can be applied to the app.
For devices that are enrolled for management in Intune, the user sees a message that their app is now managed.
Apps that support multi-identity let you use different accounts (work and personal) to access the same apps, while app protection policies are applied only when the apps are used in the work context.
For example, the user gets a PIN prompt when accessing work data. For the Outlook app, the user is prompted for a PIN when they launch the app. For the OneDrive app, the user is prompted for a pin when they type in the work account. For Microsoft Word, PowerPoint, and Excel, the user is prompted for a pin when they access documents that are stored in the company OneDrive for Business location.
- Learn more about the apps that support app protection and multi-identity with Intune.
App protection polices are only applied in the work context. Therefore, the app might behave differently depending on whether the context is work or personal.
Multi-identity applications allow users to add multiple accounts. Intune APP supports only one managed account. Intune APP does not limit the number of unmanaged accounts.
When there is a managed account in an application:
- If a user attempts to add a second managed account, the user is asked to select which managed account to use. The other account is removed.
- If the IT admin adds policy to a second existing account, the user is asked to select which managed account to use. The other account is removed.
Read the following example scenario to get a deeper understanding of how multiple user accounts are treated.
User A works for two companies—Company X and Company Y. User A has a work account for each company, and both use Intune to deploy app protection policies. Company X deploys app protection policies before Company Y. The account that's associated with Company X gets the app protection policy first. If you want the user account that's associated with Company Y to be managed by the app protection policies, you must remove the user account that's associated with Company X and add the user account that's associated with Company Y.
If you are using an iOS device, when you try to add a second work account on that device, you might see a blocking message. The accounts are displayed, and then you can choose the account you want to remove.
What to expect when your Android app is managed by app protection policies