Protecting Corporate Data on Unmanaged Devices with Intune App Protection

Your sales rep checks customer emails from her personal iPhone while waiting at the airport. Your contractor downloads project files to his home laptop. Your office manager reviews invoices on her tablet during lunch.

None of these devices belong to you. You didn’t configure them. You don’t manage them. You have no idea what other apps are installed, whether the operating system is current, or if basic security practices are followed. But your customer data, financial records, and confidential business information are sitting on those devices right now.

This is the reality of modern work: remote teams, hybrid schedules, contractors, and the simple expectation that people can work from anywhere. The flexibility is real. So are the risks. The good news is that you can protect corporate data on those devices without taking control of the devices themselves, and the tool most Canadian businesses already own to do it is Microsoft Intune.

The short version: Intune App Protection Policies (also called Mobile Application Management, or MAM) secure corporate data inside individual apps like Outlook, Teams, and OneDrive, without enrolling or managing the whole device. You control the data, not the phone. That is what makes it the right fit for BYOD, personal devices, and contractor access.

The problem with devices you don’t control

When employees and contractors access corporate resources from personal devices, you lose visibility into what happens to that data. An employee might copy customer contact lists into a personal note-taking app. Project files could be saved to a personal cloud storage account. Sensitive emails might be forwarded to personal addresses for “convenience.” None of this requires malicious intent. People just work the way that feels natural, and the technology doesn’t enforce any boundaries.

The risks compound quickly:

• Corporate data gets copied to personal apps and cloud storage you can’t see or control
• Sensitive information remains on devices long after employees or contractors leave
• Lost or stolen phones and laptops expose business data to unknown parties
• IT has no visibility into how corporate information is accessed, shared, or stored

Traditional device management (MDM) doesn’t solve this in personal-device scenarios. You can’t reasonably demand full control over someone’s personal phone. Employees and contractors won’t accept it, and it raises legitimate privacy concerns. Requiring full enrollment usually means people work around the policy instead of complying with it. The answer isn’t managing devices. It’s managing data.

What are Intune App Protection Policies?

Intune App Protection Policies protect corporate data within applications rather than requiring control of the entire device. They apply directly to approved business apps such as Outlook, Microsoft Teams, OneDrive, and the Microsoft 365 apps. Think of it as a secure container inside those apps: when someone opens Outlook on their personal device, corporate data stays inside the protected application, and the security controls apply to the business app, not the whole phone or laptop.

Crucially, App Protection Policies work independent of device enrollment. The device never has to be enrolled in Intune management for the policy to take effect, which is exactly what makes personal and BYOD devices workable. Business data stays in business apps, personal data stays personal, and the device owner’s privacy is respected because you are not touching their photos, personal email, or other apps.

What can Intune App Protection actually control?

When implemented properly, App Protection Policies address the specific risks that personal-device access creates. There are four capability areas that matter most.

1. Data leakage prevention

The foundation is keeping corporate data from leaving approved apps. You can block copy and paste of corporate content into personal apps, restrict “Save As” to approved corporate locations only, and prevent sharing through unmanaged applications. The data simply can’t leave the secure container through normal use.

2. App-level security and authentication

App Protection enforces security at the application level, so corporate data stays protected even if the device itself is unlocked or shared. You can require an app-specific PIN or biometric to open business apps, automatically lock apps after a period of inactivity, and block access from rooted or jailbroken devices. Someone who picks up an unlocked phone still can’t get into Outlook or Teams without meeting the app’s own requirements.

3. Identity-based access and Conditional Access

Combined with Microsoft Entra ID, App Protection Policies get stronger through Conditional Access. Access decisions are based on user identity, authentication strength, and sign-in risk, not device ownership alone. You can require multi-factor authentication, allow corporate data to open only in protected apps, and block high-risk or suspicious sign-in attempts. This layered model aligns directly with Zero Trust principles: verify explicitly, and never assume a device is trusted just because it connected.

4. Selective wipe of corporate data

When access should end, you can remove only the corporate data from the protected apps. A selective wipe clears business data from managed apps while leaving personal data, photos, and apps completely untouched. If a contractor’s engagement concludes, an employee leaves, or a device goes missing, you pull the company data and nothing else. This is the single most valuable capability for BYOD and contractor scenarios, because it lets you offboard cleanly without ever owning the device.

MAM vs full device management: which do you need?

App Protection (MAM) and full device management (MDM) are not competitors; they solve different problems. Use MDM for company-owned devices you can fully control. Use MAM App Protection for personal and unmanaged devices where you only need to protect the data.

Why App Protection is ideal for BYOD and contractors

The personal-device challenge becomes especially acute with contractors, consultants, and temporary workers. They need access to corporate systems to do their jobs, but full device management is rarely practical or appropriate. Contractors often work for multiple clients at once, so enrolling their device in your management system creates conflicts. Temporary workers may only need access for weeks. The overhead of enrollment, and the complications of removing it later, simply don’t make sense.

App Protection Policies provide the middle path. Contractors get the access they need through protected apps, your corporate data stays secured, and when the engagement ends you remove the business data without touching anything else on their device. It also simplifies compliance: when your agreements require protecting client data, you can demonstrate that controls exist regardless of who owns the hardware. The protection travels with the data, not the device.

Getting App Protection right

App Protection Policies are powerful, but the details decide whether they actually protect you. Policies that are too loose leave gaps; policies that are too aggressive frustrate users until they find workarounds. In practice, a handful of misconfigurations show up again and again:

• Data transfer left open to “All apps” instead of “Policy managed apps,” so corporate data can still flow into personal apps despite the policy being “on.”
• App Protection deployed without app-based Conditional Access. This is the big one. The policy protects data inside the managed app, but nothing forces users into that app in the first place, so they reach corporate data through the mobile browser or an unmanaged mail client and bypass the whole thing.
• Browser access left unrestricted. Data opened in Safari or Chrome sits outside the app container. Unless you route it through a managed browser like Edge, mobile web is a common blind spot.
• Copy and paste left at “Any app” rather than restricted to managed apps, which quietly reopens the leak the policy was meant to close.
• PIN and timeout settings tuned so aggressively that users hunt for workarounds. Over-tightening undermines a policy as surely as leaving it loose.

The right configuration balances real protection against day-to-day usability, and it should be reviewed as Microsoft adds settings and as your workforce changes.

At BALANCED+ we design and manage these policies as part of our managed cybersecurity and Microsoft 365 management services, tuning App Protection, Conditional Access, and Purview together so corporate data stays secure on every device without slowing your team down. If personal and contractor devices are touching your business data today, that is worth a conversation. Get in touch and we will review your current setup.

Sources

• App protection policies overview, Microsoft Intune (Microsoft Learn), 2026
• Mobile Application Management (MAM) for unenrolled devices, Microsoft Intune (Microsoft Learn), 2026
• Data protection framework using app protection policies, Microsoft Intune (Microsoft Learn), 2026
• Implement App Protection Policies (Zero Trust), Microsoft Learn, 2026
• Frequently asked questions about MAM and app protection, Microsoft Intune (Microsoft Learn), 2026