Test iOS app sign-in at the incoming-data boundary

Source facts

For enrolled iOS/iPadOS devices, IntuneMAMRequireAccounts can require sign-in to the configured work or school account when a targeted Microsoft app receives organization data. The source explicitly limits this sign-in requirement to incoming organization data.

The app needs Intune APP SDK for iOS 12.3.3 or later and an assigned app protection policy. That policy’s Receive data from other apps setting must be All apps with incoming Org data. Microsoft Learn.

Applicability

Identify the recipient app, its SDK support, configured account, and the source of the proposed data transfer. Review the managed-device configuration and protection policy together. Keep account-allowlisting requirements separate from the question of when incoming data requires sign-in.

DSE recommendation

DSE recommends designing a transfer-specific acceptance test before assigning this setting broadly. Agree which account should receive the material and which policy should govern it. Have the application owner review the actual workflow rather than treating a successful app launch as evidence that the incoming-data requirement has been exercised.

Verification

Use a nonsensitive organization-owned test document in an approved managed-to-managed transfer. Compare signed-in and signed-out recipient states and verify the account and protection behavior observed on receipt. Record app and policy versions and the transfer origin. If no transfer occurred, label the test incomplete instead of concluding that the sign-in gate failed.

Official references

Microsoft Learn: Add App Configuration Policies for Managed iOS/iPadOS Devices. Source retrieved September 9, 2026.