This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 21%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERL%3C/text%3E%3C/svg%3E)
We are testing Intune MDM and MAM.
First target is Android device.
We want to limit mobile device to access O365 resources with Intune enrolled device and approved apps by conditional access.
For privacy, we allow BYOD android device with work profile.
As Intune can push apps as managed apps, but user can also install apps.
My question is what is the difference between using the managed apps and user installed apps?
If there is any advantage on using managed apps over user installed apps, how to restrict users to access O365 resources by Managed apps only?
Thanks.
what is the difference between using the managed apps and user installed apps?
At a technical level, nothing. Apps in the "work profile" are exactly as implied, managed by the org and can have their data wiped and are subject to APP policies. Apps in the "personal profile" are not. Thus, this is mainly a privacy and control mechanism.
how to restrict users to access O365 resources by Managed apps only?
Conditional access accounts for the different profiles so as long as the CA profile requires the device to be managed, then only apps in the "work profile" will meet this criterion. In many (but not all) respects, it's almost like have two separate devices.
@roy lee Thanks for posting in our Q&A.
Jason has explained it very clearly and I just add some information about Conditional access policy. App-based conditional access policy will make sure only managed apps can access O365 resources. We can read the following article as a reference:
https://learn.microsoft.com/en-us/mem/intune/protect/app-based-conditional-access-intune
Hope it will help.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
@Jason Sandys and @Lu Dai-MSFT
Thanks, you are right. When try to use the apps in personal profile, it prompt and ask to register the device.
In some case like in China without google service, can I still protect company data by app policy and require approved clients in conditional access without enroll in Intune?
@roy lee App protection policy can be deployed to unenrolled devices. In fact, conditional access is a feature in Azure AD. The requirement of the conditional access is that the device is registered in Azure AD.
The requirement of conditional access is the device is registered in AAD?
I am thinking of setup the conditional access with grant permission, require approved client app, require app protection policy.
The requirement of conditional access is the device is registered in AAD?
No. Nothing about the device itself needs to be known for CA itself. Some of the conditions you specify in your CA policy may require the device to be AAD registered, but CA itself does not.
For some grant access, Conditional Access requires that the device is registered in Azure Active Directory, which requires the use of a broker app. More details we can read the following article as a reference.
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-grant#grant-access