How to apply an Intune app protection policy for specific devices

Question

We have a large number of shared desk phones running Android version 9 (latest version from the vendor). Any of our users can login into the shared devices, to complicate matters we also have a BYO Intune app protection policy applied to all users that prohibits devices from running such a low version of Android. I have been looking at creating a 2nd policy App protection policy for the desk phones and then look to exclude them from the main policy, to do this I have created a Dynamic AAD group that is auto populated when these devices register in AAD. however the documentation for Intune states that App protection policies apply only to user accounts and not dynamic resource groups. so I'm a bit stuck. Other than having a group that we populate manually when a user wants to use shared desk phone or not running app protection, does any one have an automated approach to resolve this issue ? Thanks in advance!

Answer 1

Have you considered using Device filters for the assignments instead? You can create a filter for desk phones and exclude it from your APP assignment. Maybe this can help - https://rahuljindalmyit.blogspot.com/2021/06/a-pinch-of-settings-catalog-dash-of.html

Answer 2

@Nick Stewart, Thanks for posting in Q&A. Just as you know, App protection policy can only assign to user group. To prevent the Intune app protection policy which prohibits devices from running a low version on these shared devices. You can check if the filter in Intune can filter these devices. For app protection policy, it uses managed app type.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/filters#restrictions

For managed app properties, I find one named deviceManagementType with a value "Corporate-owned dedicated devices with Azure AD Shared mode". If these shared devices are enrolled with this. We can choose this as a filter to avoid your app protection policy to apply to these devices.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/filters-device-properties#managed-app-properties

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Hello, did you find a solution? i'm facing the same problem.

Would be great to know.