Block Unmanaged App Email Access with Intune

MD-102 By islever Editorial Last updated

Plan and implement app protection and app configuration policies

Short answer

A Create a Conditional Access policy to require approved apps for email access.

Question

You have a Microsoft 365 subscription that includes Microsoft Intune. You create a new Android app protection policy named Policy1 that prevents screen captures in all Microsoft apps. You discover that an unmanaged email client installed on Android devices can still capture screens. You need to ensure that users can only use Microsoft apps to access email. What should you do?
  1. Create a Conditional Access policy. Correct Answer
  2. Create a compliance policy.
  3. Modify the Data protection settings of Policy1.
  4. Modify the assignments of Policy1.

Key Takeaways

App protection policies only apply to managed apps; Conditional Access is required to block unmanaged apps from accessing corporate data like email.

This scenario tests enforcing corporate email access through managed Microsoft apps on Android devices. The page establishes that Conditional Access is the correct solution to block unmanaged clients from accessing data.

Common mistake: Choosing to modify the app protection policy assignments or settings, which fails because app protection policies cannot restrict unmanaged apps that are not targeted by the policy.

Expert Analysis

Why the Answer Is Correct

Creating a Conditional Access policy allows administrators to enforce that corporate data, such as email, can only be accessed through approved applications. By configuring a Conditional Access policy to require an approved client app (like Outlook), you effectively block unmanaged email clients from connecting to Exchange Online. This directly addresses the requirement to ensure users only use Microsoft apps for email access.

Why the Other Options Are Wrong

Modifying the assignments or data protection settings of Policy1 will not prevent the unmanaged email client from accessing email or capturing screens, because App Protection Policies only apply to apps that are managed or targeted by Intune. A compliance policy evaluates device health but does not directly block unmanaged apps from accessing corporate data at the application level.

Community Comment Notes

Commenters agree that Conditional Access is the logical choice to "block access from anything not approved," as servL noted. Frank_2022 highlighted that a Conditional Access policy can "require users to use an Intune-managed app" to access email services, which indirectly solves the screen capture issue by eliminating the unmanaged client.

Official Reference

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/app-protection-based-conditional-access

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked to block unmanaged apps from accessing corporate data, look for Conditional Access as the solution. App protection policies only protect data within managed apps and cannot restrict unmanaged apps.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Frank_2022 👍 4 Answered A
    Creating a Conditional Access policy, you can enforce the use of Microsoft apps for email access. You can configure the policy to require users to use an Intune-managed app (like Outlook Mobile) to access email services. This will prevent users from using unmanaged email clients and indirectly address the screen capture issue.
  2. servL 👍 3
    Conditional Access seems the most logical. ie, block access from anything not approved. Assignments refers to who(users/devices) the policy applies to, so it can't be D.
  3. Daniel_G 👍 2 Answered A
    Modifying whom the policy is assigned to, assignments, does not effect the outcome.
  4. jdr002 👍 3 Answered A
    Should be CA.
  5. oopspruu 👍 1 Answered A
    CAP is the right answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide