| Name | +Value | +
| Basics | +|
| Name | +Android - OIB - App Protection - U - BYOD L2+ - v2.0 | +
| Description | ++ |
| Policy type | +App protection policy | +
| Platform supported | +Android | +
| Created | +28 October 2026 15:35:17 | +
| Last modified | +03 November 2026 11:37:16 | +
| Scope tags | +Default | +
| Name | +Value | +
| Apps | +|
| Management type | +Target to all app types | +
| Public apps list | +Microsoft AzureCortana Microsoft Dynamics 365 for phones Field Service (Dynamics 365) Dynamics 365 Sales Microsoft Dynamics 365 for tablets Microsoft Designer Microsoft Dragon Copilot Microsoft Invoicing Microsoft Edge Power Automate Azure Information Protection Microsoft Launcher Microsoft Loop Microsoft Kaizala Power Apps Microsoft Connections Microsoft Excel Skype for Business Microsoft Copilot Microsoft Copilot Microsoft Copilot Microsoft Lens Microsoft OneNote Microsoft Outlook Microsoft PowerPoint Microsoft Word Outlook Groups Microsoft Planner Microsoft Power BI Windows App Microsoft Defender Endpoint Microsoft SharePoint Microsoft OneDrive Microsoft Teams Microsoft To-Do Microsoft Whiteboard Work Folders Microsoft 365 Admin Viva Engage Microsoft StaffHub |
+
| Custom apps | +Not configured | +
| Data protection | +|
| Data Transfer | +|
| Backup org data to Android backup services | +Block | +
| Send org data to other apps | +Policy managed apps | +
| Select apps to exempt | +Not configured | +
| Save copies of org data | +Block | +
| Allow user to save copies to selected services | +OneDrive for Business;SharePoint | +
| Transfer telecommunication data to | +Any dialer app | +
| Dialer App Package ID | +Not configured | +
| Dialer App Name | +Not configured | +
| Receive data from other apps | +All Apps | +
| Open data into Org documents | +Allow | +
| Allow users to open data from selected services | +OneDrive for Business;SharePoint;Camera | +
| Restrict cut, copy, and paste between other apps | +Policy managed apps with paste in | +
| Cut and copy character limit for any app | +0 | +
| Screen capture and Google Assistant | +Block | +
| Approved keyboards | +Not required | +
| Select keyboards to approve | +Not configured | +
| Encryption | +|
| Encrypt org data | +Require | +
| Encrypt org data on enrolled devices | +Require | +
| Functionality | +|
| Sync policy managed app data with native apps or add-ins | +Allow | +
| Printing org data | +Block | +
| Restrict web content transfer with other apps | +Microsoft Edge | +
| Unmanaged Browser ID | +Not configured | +
| Unmanaged Browser Name | +Not configured | +
| Org data notifications | +Block org Data | +
| Access requirements | +|
| PIN for access | +Require | +
| PIN type | +Numeric | +
| Simple PIN | +Block | +
| Select minimum PIN length | +6 | +
| Fingerprint instead of PIN for access (Android 6.0+) | +Allow | +
| Override biometrics with PINÂ after timeout | +Require | +
| Timeout (minutes of inactivity) | +P1D | +
| Biometrics instead of PIN for access | +Allow | +
| PIN reset after number of days | +No | +
| Number of days | +PT0S | +
| Select number of previous PIN values to maintain | +0 | +
| App PIN when device PIN is set | +Require | +
| Work or school account credentials for access | +Not required | +
| Recheck the access requirements after (minutes of inactivity) | +PT30M | +
| Conditional launch | +|
| Conditional launch | +Max PIN attempts | 5 | Reset PIN Offline grace period | 10080 | Block access (minutes) Offline grace period | 30 | Wipe data (days) Disabled account | | Block access Jailbroken/rooted devices | | Wipe data |
+
| Name | +Value | +
| Basics | +|
| Name | +iOS - OIB - App Protection - U - BYOD L2+ - v2.0 | +
| Description | ++ |
| Policy type | +App protection policy | +
| Platform supported | +iOS/iPadOS | +
| Created | +28 October 2026 15:26:01 | +
| Last modified | +03 November 2026 11:37:46 | +
| Scope tags | +Default | +
| Name | +Value | +
| Apps | +|
| Management type | +Target to all app types | +
| Public apps list | +ClipchampMicrosoft Azure Cortana Microsoft Designer Microsoft Dynamics 365 Microsoft Invoicing Microsoft Dynamics 365 for phones Field Service (Dynamics 365) Dynamics 365 Sales Outlook Groups Microsoft Loop Skype for Business Microsoft Kaizala Microsoft Power Apps Microsoft Edge Microsoft 365 Admin Microsoft Connections Microsoft Excel Microsoft Outlook Microsoft PowerPoint Microsoft Word Microsoft Lens Microsoft Copilot Microsoft OneNote Microsoft Planner Microsoft Power BI Power Automate Microsoft Dragon Copilot Windows App Azure Information Protection Microsoft Defender Endpoint Microsoft SharePoint Microsoft StaffHub Microsoft OneDrive Microsoft Teams Microsoft To-Do Microsoft Whiteboard Work Folders Vera for Intune Viva Engage |
+
| Custom apps | +Not configured | +
| Data protection | +|
| Data Transfer | +|
| Backup org data to iTunes and iCloud backups | +Block | +
| Send org data to other apps | +Policy managed apps with Open-In/Share filtering | +
| Select apps to exempt | +Default;skype;app-settings;calshow;itms;itmss;itms-apps;itms-appss;itms-services; | +
| Save copies of org data | +Block | +
| Allow user to save copies to selected services | +OneDrive for Business;SharePoint | +
| Transfer telecommunication data to | +Any dialer app | +
| Dialer App URL Scheme | +Not configured | +
| Receive data from other apps | +All Apps | +
| Open data into Org documents | +Allow | +
| Allow users to open data from selected services | +OneDrive for Business;SharePoint;Camera | +
| Restrict cut, copy, and paste between other apps | +Policy managed apps with paste in | +
| Cut and copy character limit for any app | +0 | +
| Third party keyboards | +Allow | +
| Encryption | +|
| Encrypt org data | +Require | +
| Functionality | +|
| Sync policy managed app data with native apps or add-ins | +Allow | +
| Printing org data | +Block | +
| Restrict web content transfer with other apps | +Microsoft Edge | +
| Unmanaged browser protocol | +Not configured | +
| Org data notifications | +Block org Data | +
| Access requirements | +|
| PIN for access | +Require | +
| PIN type | +Numeric | +
| Simple PIN | +Block | +
| Select minimum PIN length | +6 | +
| Fingerprint instead of PIN for access (Android 6.0+) | +Allow | +
| Override biometrics with PINÂ after timeout | +Require | +
| Timeout (minutes of inactivity) | +P1D | +
| Face ID instead of PIN for access (iOS 11+/iPadOS) | +Allow | +
| PIN reset after number of days | +No | +
| Number of days | +PT0S | +
| App PIN when device PIN is set | +Require | +
| Work or school account credentials for access | +Not required | +
| Recheck the access requirements after (minutes of inactivity) | +PT30M | +
| Conditional launch | +|
| Conditional launch | +Max PIN attempts | 5 | Reset PIN Offline grace period | 10080 | Block access (minutes) Offline grace period | 30 | Wipe data (days) Disabled account | | Block access Jailbroken/rooted devices | | Wipe data |
+