> ## Content Index
> Fetch the complete content index at: https://www.myronhelgering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# First Look at Mobile Application Management (MAM) for Windows
- URL: https://www.myronhelgering.com/first-look-at-mam-for-windows/
- Published: 2023-07-13T07:49:59.000Z
- Updated: 2026-10-17T11:07:16.000Z
- Author: Myron Helgering
- Tags: Blog Posts, Blog Series: Unmanaged Devices, Microsoft Intune

***Update: Microsoft has moved this feature from Public Preview to General Availability. I'll update this post once new features or changes are introduced.***

Recently, on July 7th, 2023, Microsoft [announced](https://techcommunity.microsoft.com/t5/microsoft-intune-blog/what-s-new-in-microsoft-intune-2306-june-edition/ba-p/3852597) the long-awaited Mobile Application Management (MAM) for Windows. Now that it has entered Public Preview, it allows us to play around with its capabilities.

Mobile Application Management enables us to apply policies to corporate applications such as Outlook, Microsoft Teams, or other Office or third-party apps. These policies allow us to protect company data and prevent leakage to personal devices. This feature is especially useful in Bring Your Own Device scenarios as you will not need to manage the device fully with Microsoft Intune.

MAM has been available on Android and iOS for some time. However, its introduction to Windows is a welcome surprise, especially as its predecessor, Windows Information Protection (WIP), will be [discontinued](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/announcing-the-sunset-of-windows-information-protection-wip/ba-p/3579282) in future Windows versions.

Until now, when it came to personal devices, our closest solution was to enforce limited web-only access with [conditional access](https://www.myronhelgering.com/configure-limited-access-for-unmanaged-devices-with-conditional-access/) or [session policies](https://www.myronhelgering.com/how-to-use-microsoft-defender-for-cloud-apps-to-configure-limited-web-only-access-for-unmanaged-devices/), which offers comparable features to WIP, but its experience, in my opinion, is lacking.

In this blog post, we will take a first look at the configuration and user experience of MAM for Windows.

**Please remember that this post was written during the public preview experience; some things might have changed slightly.**

The post will cover the following sections:

- [Prerequisites](#prerequisites)
- [Mobile Threat Defense connector](#mobile-threat-defense-connector)
- [Configure Application Protection policy](#configure-application-protection-policy)
- [Enforce MAM with Conditional Access](#enforce-mam-for-windows-with-conditional-access)
- [User Experience](#user-experience)
- [Conclusion](#conclusion)

## Prerequisites

To configure Mobile Application Management for Windows, you will need to meet a few requirements. 

- Up-to-date versions of Windows 11 22H2 and Microsoft Edge
- Users must have a Microsoft Intune license assigned
- MAM for Windows only supports unmanaged devices, unlike MAM for Android and iOS.

However, keep in mind that these requirements may change as new features become available. 

## Mobile Threat Defense connector

First, we will need to go to the tenant administration section of Microsoft Intune and add the Mobile Threat Defense (MTD) connector. This connector will seamlessly integrate with Microsoft Intune to help us detect local health threats, so we can block access from compromised or vulnerable devices. Once the device is enrolled in MAM, the connector should be automatically enabled in both the portal and the device.

![Enable Mobile Threat Defense connector for MAM for Windows](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/mobile-threat-defense-connector.png)

## Configure Application Protection policy

Next, let's go through the Application Protection policy configuration together.

Unfortunately, we will notice right away that we can only manage the Microsoft Edge app. I already knew this, but I hope we'll see other Microsoft apps soon.

![MAM for Windows policy add edge app](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/mam-policy-add-edge-app.png)

On the second page, we can configure the data protection restrictions, which allow us to;

- Specify whether the managed app can **receive** data from **all sources** or **no sources**.
- Specify whether organizational data can be sent to **all destinations** or **no destinations**.
- Allow cut, copy, and paste actions to **any destination** or **no destination**.
- **Allow** or **block** the printing of organizational data.

The available options are currently minimal but will most likely be improved upon soon.

![MAM for Windows data protection settings](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/mam-data-protection-settings.png)

Lastly, we can set specific health check conditions and define actions based on whether those conditions are met or not. For instance, you can configure conditions such as a disabled account, maximum offline grace period, or minimum OS versions. Depending on these conditions, you can issue a warning, block access, or wipe the organizational data.

As an example, we have configured the policy to block access when the medium device threat level is reached. We will see how this action plays out later on.

![MAM for Windows Health Checks](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/mam-health-checks.png)

## Enforce MAM for Windows with Conditional Access

Finally, we need to configure the following conditional access policy as the last step. This policy will enforce the app protection policy we created earlier, ensuring that users cannot access the resources without being protected by Mobile Application Management (MAM).

![Conditional Access Policy for MAM on Windows](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/connditional-access-policy-for-mam-on-windows.png)

## User Experience

Let's sign into our personal Windows device that is not joined to Azure AD or managed by Microsoft Intune and does not have an active Azure AD registration yet.

Next, we'll proceed by signing into the Microsoft 365 portal.

![Switch Edge Profile notification](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/switch-edge-profile-notification.png)

Okay, let's create a new Microsoft Edge profile and sign in with our corporate account.

![Join Windows Device to MAM](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/join-windows-device-to-mam.png)

After registering the device with Entra ID and enabling Mobile Application Management (MAM), we can now sign in to the Microsoft 365 portal. Let's test if the MAM policies are being enforced.

![Copy data out of word document](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/copy-data-out-of-word-document.png)

![Downloading word document](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/downloading-word-document.png)

![Print email](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/print-email.png)

Alright, we've seen how it can protect data in Microsoft 365\. But since MAM's primary purpose is to protect data on the application level, let's see what it can do outside of the Microsoft 365 environment.

![Copy text out of google](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/copy-text-out-of-google.png)

![Print news article](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/print-news-article.png)

![download spotify app](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/download-spotify-app.png)

That was great stuff. Our corporate Microsoft Edge profile ensures that our actions are isolated and data is not leaked outside the profile

**Keep in mind that users can still use their personal Microsoft Edge profiles without any restrictions.**

Alright, to wrap things up, let's do something we shouldn't try at home.

![Turn off AV](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/turn-off-av.png)

![Sign-in with AV off](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/sign-in-with-av-off.png)

Once we re-enable the real-time protection and click the recheck button, we immediately regain access to the corporate app data.

## Conclusion

Currently, the features of MAM for Windows are very similar to what we can already do with [session policies in Microsoft Defender for Cloud Apps](https://www.myronhelgering.com/how-to-use-microsoft-defender-for-cloud-apps-to-configure-limited-web-only-access-for-unmanaged-devices/). However, I am looking forward to the future of MAM for Windows. It has so much potential because we can not only prevent data leakage but, more importantly, provide secure access for BYOD devices without actually managing them. 

I am looking forward to the introduction of new features, particularly the support for other apps besides Microsoft Edge, such as the MS Office suite. Additionally, it would be great to have the ability to enable copy/pasting between corporate apps and prevent screenshots.

If any significant features or changes are introduced to Mobile Application Management, I'll update this post.

***I'll update this post once new features or changes are introduced.***

# A first look at MAM for Windows