App Configuration: Managed Apps & Managed Devices
App configuration policies push settings to apps automatically — email server addresses, default URLs, feature toggles — so users don't have to configure anything manually.
What are app configuration policies?
Think of app configuration like pre-setting a rental car’s GPS destination before the driver picks it up.
Instead of the driver manually entering the address, searching for the right route, and choosing settings — everything’s ready when they get in. App configuration policies do the same for apps: pre-fill the email server address, set the default homepage in the browser, enable specific features — all automatically when the app opens for the first time.
Two delivery channels
| Feature | Managed Devices | Managed Apps |
|---|---|---|
| Device enrollment required | Yes — MDM enrolled | No — works on unenrolled BYOD |
| Delivery mechanism | MDM channel (device-level) | MAM channel (app-level) |
| Supported platforms | iOS, Android, Windows (limited) | iOS, Android |
| Configuration format | XML or key-value pairs via MDM | Key-value pairs via Intune App SDK |
| Best for | Corporate-owned devices with full management | BYOD devices with app protection policies |
| Works with | Any MDM-managed app | Apps integrated with Intune App SDK/App Wrapping Tool |
When to use which
| Scenario | Channel |
|---|---|
| Corporate iPhone enrolled in Intune — configure Outlook email account | Managed Devices |
| Personal Android phone (not enrolled) — configure Outlook email account | Managed Apps |
| Corporate Windows laptop — configure Edge browser homepage | Managed Devices (or Intune config profile) |
| Any device — configure a LOB app with specific backend URL | Managed Apps (if app supports it) |
Common app configuration scenarios
Outlook email configuration
The most common use case — auto-configure Outlook so users don’t manually enter server settings:
| Key | Value | Purpose |
|---|---|---|
com.microsoft.outlook.EmailProfile.EmailAccountName | User display name | Shows in account list |
com.microsoft.outlook.EmailProfile.EmailAddress | User email (use token: {{mail}}) | Pre-fills email address |
com.microsoft.outlook.EmailProfile.EmailUPN | User UPN (use token: {{userprincipalname}}) | Authentication identity |
com.microsoft.outlook.EmailProfile.ServerAuthentication | ModernAuthentication | Use modern auth (not basic) |
Token replacement
Intune supports dynamic tokens that are replaced with user-specific values:
| Token | Replaced With |
|---|---|
{{userprincipalname}} | User’s UPN (e.g., sam@tuisolutions.com) |
{{mail}} | User’s email address |
{{partialupn}} | UPN prefix (e.g., “sam” from sam@tuisolutions.com) |
{{AccountId}} | Intune account ID |
{{deviceid}} | Intune device ID |
{{userid}} | Intune user ID |
Sam uses tokens to create a single configuration policy that auto-configures Outlook for all 500 Tui Solutions users — each user gets their own email address populated automatically.
Edge browser configuration
| Key | Value | Purpose |
|---|---|---|
com.microsoft.intune.mam.managedbrowser.homepage | https://intranet.tuisolutions.com | Set default homepage |
com.microsoft.intune.mam.managedbrowser.bookmarks | JSON array of bookmarks | Pre-load company bookmarks |
Exam tip: managed apps vs managed devices confusion
The exam tests whether you know which channel to use:
- If the device is enrolled → you can use either channel, but Managed Devices is preferred (more reliable delivery, supports XML)
- If the device is NOT enrolled (BYOD) → you MUST use Managed Apps channel (MDM channel requires enrollment)
- If both are configured for the same app → Managed Devices takes priority on enrolled devices
Common trap: “An admin configures an app configuration policy using the Managed Devices channel for a BYOD phone.” This won’t work — BYOD isn’t enrolled, so the MDM channel can’t deliver the config.
Deep dive: apps that support configuration
Not every app supports app configuration. The app must be built with one of:
- Intune App SDK — embedded in the app code (most Microsoft apps: Outlook, Teams, Edge, OneDrive)
- App Wrapping Tool — wraps an existing app with Intune management layer
- Android Enterprise managed configurations — standard Android feature, supported by many apps (Zoom, Chrome, etc.)
- iOS managed app configuration — Apple’s MDM standard for delivering key-value pairs
Check the app’s documentation to see which configuration keys are supported. Microsoft publishes configuration keys for all their apps.
🎬 Video walkthrough
Flashcards
Knowledge Check
Sam creates an app configuration policy to auto-configure Outlook email for all Tui Solutions employees. He uses the Managed Devices channel. It works on corporate laptops but not on a contractor's personal phone (Entra Registered, not MDM enrolled). Why?
Riko wants Outlook on all devices at Pixel & Co to automatically configure with each user's email address — without creating individual policies for each of the 80 users. What should she use?
Next up: Endpoint Security: Antivirus, Firewall & Encryption — the first line of defense for your managed devices.