Check how app protection classifies devices managed by another provider

Source facts

For Android app protection, Microsoft classifies devices as unmanaged when Intune MDM management is not detected, including devices managed by third-party MDM vendors. For iOS/iPadOS, the unmanaged category includes devices where the Intune or third-party management solution does not pass IntuneMAMUPN. Microsoft also states that configuring only IntuneMAMDeviceID leaves the iOS device considered unmanaged by app protection. Microsoft Learn.

Applicability

Use this review when Intune app-protection assignments depend on device management state. Document the platform, management provider and app configuration used to communicate management state.

DSE recommendation

DSE recommends naming assignment populations according to the app-protection classification actually used. Map third-party-managed devices explicitly in the policy design, and review iOS application configuration with the mobility owner. Avoid using an organizational label such as corporate-managed as the sole evidence for selecting a protection branch.

Verification

Test representative devices from each provider and platform with an approved account. Check the delivered app configuration and protection behavior against the intended assignment. Retain the platform, provider, configuration values and observed outcome. Resolve unexpected classification before relaxing a policy intended for the unmanaged population.

Official references

Microsoft Learn: How to Create and Assign App Protection Policies. Source reviewed September 17, 2026.