{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/", "slug": "dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider", "url": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/" }, "title": "Check how app protection classifies devices managed by another provider", "summary": "Can a device managed by a third-party mobility provider fall into the unmanaged category for Intune app protection?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:31:54+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 197, "potentially_affected": "Use this review when Intune app-protection assignments depend on device management state. Document the platform, management provider and app configuration used to communicate management state.", "dse_recommendation": "DSE recommends naming assignment populations according to the app-protection classification actually used.", "primary_source": { "name": "Create and Deploy App Protection Policies - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/app-management/protection/create-policy", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For Android app protection, Microsoft classifies devices as unmanaged when Intune MDM management is not detected, including devices managed by third-party MDM vendors. For iOS/iPadOS, the unmanaged category includes devices where the Intune or third-party management solution does not pass IntuneMAMUPN. Microsoft also states that configuring only IntuneMAMDeviceID leaves the iOS device considered unmanaged by app protection. Microsoft Learn.

\n

Applicability

\n

Use this review when Intune app-protection assignments depend on device management state. Document the platform, management provider and app configuration used to communicate management state.

\n

DSE recommendation

\n

DSE recommends naming assignment populations according to the app-protection classification actually used. Map third-party-managed devices explicitly in the policy design, and review iOS application configuration with the mobility owner. Avoid using an organizational label such as corporate-managed as the sole evidence for selecting a protection branch.

\n

Verification

\n

Test representative devices from each provider and platform with an approved account. Check the delivered app configuration and protection behavior against the intended assignment. Retain the platform, provider, configuration values and observed outcome. Resolve unexpected classification before relaxing a policy intended for the unmanaged population.

\n

Official references

\n

Microsoft Learn: How to Create and Assign App Protection Policies. Source reviewed September 17, 2026.

", "content_text": "Source facts\nFor Android app protection, Microsoft classifies devices as unmanaged when Intune MDM management is not detected, including devices managed by third-party MDM vendors. For iOS/iPadOS, the unmanaged category includes devices where the Intune or third-party management solution does not pass IntuneMAMUPN. Microsoft also states that configuring only IntuneMAMDeviceID leaves the iOS device considered unmanaged by app protection. Microsoft Learn.\nApplicability\nUse this review when Intune app-protection assignments depend on device management state. Document the platform, management provider and app configuration used to communicate management state.\nDSE recommendation\nDSE recommends naming assignment populations according to the app-protection classification actually used. Map third-party-managed devices explicitly in the policy design, and review iOS application configuration with the mobility owner. Avoid using an organizational label such as corporate-managed as the sole evidence for selecting a protection branch.\nVerification\nTest representative devices from each provider and platform with an approved account. Check the delivered app configuration and protection behavior against the intended assignment. Retain the platform, provider, configuration values and observed outcome. Resolve unexpected classification before relaxing a policy intended for the unmanaged population.\nOfficial references\nMicrosoft Learn: How to Create and Assign App Protection Policies. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nFor Android app protection, Microsoft classifies devices as unmanaged when Intune MDM management is not detected, including devices managed by third-party MDM vendors. For iOS/iPadOS, the unmanaged category includes devices where the Intune or third-party management solution does not pass IntuneMAMUPN. Microsoft also states that configuring only IntuneMAMDeviceID leaves the iOS device considered unmanaged by app protection. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/app-management/protection/create-policy).\n\n## Applicability\n\nUse this review when Intune app-protection assignments depend on device management state. Document the platform, management provider and app configuration used to communicate management state.\n\n## DSE recommendation\n\nDSE recommends naming assignment populations according to the app-protection classification actually used. Map third-party-managed devices explicitly in the policy design, and review iOS application configuration with the mobility owner. Avoid using an organizational label such as corporate-managed as the sole evidence for selecting a protection branch.\n\n## Verification\n\nTest representative devices from each provider and platform with an approved account. Check the delivered app configuration and protection behavior against the intended assignment. Retain the platform, provider, configuration values and observed outcome. Resolve unexpected classification before relaxing a policy intended for the unmanaged population.\n\n## Official references\n\n[Microsoft Learn: How to Create and Assign App Protection Policies](https://learn.microsoft.com/en-us/intune/app-management/protection/create-policy). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/", "url": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check how app protection classifies devices managed by another provider", "item": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/", "url": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/", "headline": "Check how app protection classifies devices managed by another provider", "description": "Can a device managed by a third-party mobility provider fall into the unmanaged category for Intune app protection?", "abstract": "Can a device managed by a third-party mobility provider fall into the unmanaged category for Intune app protection?", "articleBody": "Source facts\nFor Android app protection, Microsoft classifies devices as unmanaged when Intune MDM management is not detected, including devices managed by third-party MDM vendors. For iOS/iPadOS, the unmanaged category includes devices where the Intune or third-party management solution does not pass IntuneMAMUPN. Microsoft also states that configuring only IntuneMAMDeviceID leaves the iOS device considered unmanaged by app protection. Microsoft Learn.\nApplicability\nUse this review when Intune app-protection assignments depend on device management state. Document the platform, management provider and app configuration used to communicate management state.\nDSE recommendation\nDSE recommends naming assignment populations according to the app-protection classification actually used. Map third-party-managed devices explicitly in the policy design, and review iOS application configuration with the mobility owner. Avoid using an organizational label such as corporate-managed as the sole evidence for selecting a protection branch.\nVerification\nTest representative devices from each provider and platform with an approved account. Check the delivered app configuration and protection behavior against the intended assignment. Retain the platform, provider, configuration values and observed outcome. Resolve unexpected classification before relaxing a policy intended for the unmanaged population.\nOfficial references\nMicrosoft Learn: How to Create and Assign App Protection Policies. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:31:54+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check how app protection classifies devices managed by another provider" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 197, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create and Deploy App Protection Policies - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/app-management/protection/create-policy" } } ] } }