'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Using Microsoft 365 App Protection for Desktop Apps on Personal Devices
Question details
Users want to know if Conditional Access and Windows app protection policies can secure company data when volunteers use Microsoft 365 desktop applications (like Microsoft Publisher) on personal devices.
- Product
- Microsoft 365 Business Premium
- Device & OS
- Windows
- Scenario
- Securing organizational data on volunteers' personal unmanaged devices using Conditional Access and Intune app protection policies.
- Observed behavior
- Windows app protection policies primarily support Microsoft Edge for web access, leaving unsupported desktop apps like Microsoft Publisher unable to be natively protected or accessed via a web version.
Before configuring app protection policies, ensure you have an active Microsoft 365 Business Premium license and administrative access to the Microsoft Endpoint Manager admin center.
Configure Intune App Protection Policies for Supported Apps
Use Intune App Protection Policies (MAM) to protect organizational data on personal devices without requiring full device enrollment.
Intune app protection policies can restrict data transfer, enforce access requirements like a PIN, and require encryption on personal devices. However, for Windows environments, app protection currently primarily supports Microsoft Edge for secure web access to Office for the Web.
Sign in to the Microsoft Endpoint Manager admin center (Intune) with your administrator credentials.
Navigate to Apps > App protection policies and click Create policy. Select the appropriate policy type (e.g., Windows Information Protection) for your environment.
Add supported applications, such as Microsoft Edge, to the protected apps list. This ensures organizational data accessed through the browser is managed.
Set up data protection and access settings, such as restricting copy/paste between work and personal apps, requiring a PIN, or blocking saving to personal storage.
Address Limitations with Microsoft Publisher
Understand the support limitations of App Protection with desktop applications like Microsoft Publisher and find alternative workflows.
Looking for a Lightweight and Compatible Office Alternative?
If managing complex Microsoft 365 Conditional Access policies and dealing with heavy, unsupported desktop apps is slowing down your volunteer team, consider WPS Office. It provides a lightweight, highly compatible alternative for viewing and editing standard documents across all personal devices.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer for Windows, Mac, or Linux.
- 2. Install on Personal Devices: Have volunteers run the lightweight installer on their personal devices with standard permissions.
- 3. Open and Edit Documents: Launch WPS Office and seamlessly open standard Office formats (.docx, .xlsx, .pptx) to continue working efficiently.
Frequently Asked Questions
Does Windows App Protection support Microsoft Publisher?
No, Microsoft Publisher is currently not supported for Windows App Protection policies, and it does not offer a web-based version for secure browser access.
Can I prevent users from copying company data to personal apps?
Yes, using Intune App Protection Policies, you can restrict data transfer actions like copy, paste, and 'save as' between managed organizational applications and unmanaged personal apps.
What browser should be used for Conditional Access app protection on personal Windows devices?
Microsoft Edge is the officially supported browser for securely accessing organizational data via Office for the Web when utilizing Windows app protection policies.
Do volunteers need to fully enroll their personal devices to use app protection?
No, Intune App Protection Policies (MAM) can be applied to specific applications to secure company data without requiring full Mobile Device Management (MDM) enrollment, keeping personal and work data separate.
