# Check how app protection classifies devices managed by another provider

> Can a device managed by a third-party mobility provider fall into the unmanaged category for Intune app protection?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:31:54+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Can a device managed by a third-party mobility provider fall into the unmanaged category for Intune app protection?

## Potentially affected

Use this review when Intune app-protection assignments depend on device management state. Document the platform, management provider and app configuration used to communicate management state.

## DSE recommendation

DSE recommends naming assignment populations according to the app-protection classification actually used.

## Article

## Source facts

For Android app protection, Microsoft classifies devices as unmanaged when Intune MDM management is not detected, including devices managed by third-party MDM vendors. For iOS/iPadOS, the unmanaged category includes devices where the Intune or third-party management solution does not pass IntuneMAMUPN. Microsoft also states that configuring only IntuneMAMDeviceID leaves the iOS device considered unmanaged by app protection. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/app-management/protection/create-policy).

## Applicability

Use this review when Intune app-protection assignments depend on device management state. Document the platform, management provider and app configuration used to communicate management state.

## DSE recommendation

DSE recommends naming assignment populations according to the app-protection classification actually used. Map third-party-managed devices explicitly in the policy design, and review iOS application configuration with the mobility owner. Avoid using an organizational label such as corporate-managed as the sole evidence for selecting a protection branch.

## Verification

Test representative devices from each provider and platform with an approved account. Check the delivered app configuration and protection behavior against the intended assignment. Retain the platform, provider, configuration values and observed outcome. Resolve unexpected classification before relaxing a policy intended for the unmanaged population.

## Official references

[Microsoft Learn: How to Create and Assign App Protection Policies](https://learn.microsoft.com/en-us/intune/app-management/protection/create-policy). Source reviewed September 17, 2026.

## Primary reference

- Name: Create and Deploy App Protection Policies - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/app-management/protection/create-policy
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check how app protection classifies devices managed by another provider,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-186-check-how-app-protection-classifies-devices-managed-by-another-provider/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.