App protection policies are the go-to option for BYOD — they secure company data inside specific apps without requiring the employee to enroll their entire personal device.

Steps

1. In the Intune admin center, go to Apps > App protection policies > Create Policy, and choose iOS/iPadOS or Android.
2. Select the apps to protect — commonly Outlook, Teams, and OneDrive.
3. Under Data protection, configure rules such as blocking cut/copy/paste of company data into unmanaged apps, blocking "Save As" to personal storage, and requiring managed apps to back up data through approved services only.
4. Under Access requirements, set a PIN or biometric requirement to open managed apps, and how long the app can be used offline before re-checking.
5. Under Conditional launch, set actions for risk conditions — e.g. wipe company data automatically after a set number of failed PIN attempts, or if the device is found to be jailbroken/rooted.
6. Assign the policy to a user group and click Create.

Common Questions

Do I need device enrollment for this to work?

No — that's the main advantage of app protection policies. They apply based on the app and the user's identity, not device enrollment, which is exactly why they're the standard approach for personal devices.

What happens if an employee leaves the company?

IT can perform a selective wipe that removes company data from the protected apps only, leaving the employee's personal apps, photos, and data untouched.