Pieter,

As it involves Intune and Azure AD, for this you need licenses. That means you should purchase an EMS license (instead of separate an Intune and AZure AD license).

Regards,

Peter

Depending on Android version and/ or vendor there might be a settings ‘Use one lock’. Set to enabled it uses one lock for the work profile and device screen. Might be located under Accounts or in the separate Work profile settings section.

I would still recommend to use a CA policy to enforce the use of an Approved app or enforce the APP like described in the article. If you don`t require that, the user is able to use third-party apps to access the mailbox and the App Protection policy isn`t enforced of such a third-party app.
And on iOS the broker app (Microsoft Authenticator) is still needed, referencing this article https://docs.microsoft.com/en-us/mem/intune/protect/app-based-conditional-access-intune

Regards,

Peter

Also note, the only reason your device is AAD registered and the only reason you had to have the device registered with the Company Portal App (or Authenticator app on iOS) is because you are using the CA policy. This would largely only be good if you plan to push MDM level controls instead of MAM controls down to all devices. I would avoid this if you don’t want to enforce the use of the broker app for BYOD.

From Microsoft:
“In order to leverage this grant control, Conditional Access requires that the device be registered in Azure Active Directory which requires the use of a broker app. The broker app can be either the Microsoft Authenticator for iOS, or the Microsoft Company portal for Android devices. If a broker app is not installed on the device when the user attempts to authenticate, the user gets redirected to the app store to install the broker app.”

“- Apps for app protection policy support the Intune mobile application management feature with policy protection.”
” – The Require app protection policy requirements:
Only supports the iOS and Android for device platform condition.
A broker app is required to register the device. On iOS, the broker app is Microsoft Authenticator and on Android, it is Intune Company Portal app.”

Its actually based on OS. iOS doesn’t require the Intune Company Portal app and the controls are fully within the apps. On android, MAM policies will require the Intune Company Portal – but an important note is you don’t need to login to the portal app at all, it just needs to be on the device – the apps use it on the backend as the broker for Android. Logging into the portal app is only necessary in regards to full MDM and device policies.

CA is really not necessary for the experience described above, if you apply MAM correctly you will force a pin, or secure the data regardless of a CA policy. This article is also missing that iOS MAM policies do not have an option for blocking screen capture.

Directly from Microsoft on Android:
“The Company Portal app is required for all apps that are associated with app protection policies on Android devices.

For devices that are not enrolled in Intune, the Company Portal app must be installed on the device. However, the user does not have to launch or sign into the Company Portal app before they can use apps that are managed by app protection policies.

The Company Portal app is a way for Intune to share data in a secure location. Therefore, the Company Portal app is a requirement for all apps that are associated with app protection policies, even if the device is not enrolled in Intune.”

Directly from Microsoft on iOS
“If the device is not enrolled in Intune, the user is asked to restart the app when they first use it. A restart is required so that app protection policies can be applied to the app.

For devices that are enrolled for management in Intune, the user sees a message that their app is now managed.”

You get this user experience when you set Require approved client app and/ or Require app protection policy in a CA policy. If you don`t use such a CA policy, users can still bypass the APP.
And yes the device is AAD Registered.