Create and Associate a Mobile Application Management policy in ConfigMgr 2012 R2 SP1

For your Managed and Wrapped Apps in a ConfigMgr 2012 R2 SP1 hybrid scenario with Microsoft Intune, there’s a new functionality that now lets you associate a Mobile Application Management (MAM) policy to restrict cut, copy and paste for instance. With this new capability you’re now in control of managing how data can be restricted in your organization and can easier bring your apps into compliance with your organization’s security policies.
A Mobile Application Management policy can be associated with a Managed App in ConfigMgr 2012 R2 SP1 (and ConfigMgr 2012 SP2). Unlike from Configuration Baselines, you do not deploy the MAM policies to collections, instead you associate the MAM policy with your Managed App once you deploy it. It’s worth noticing that you can only associate one MAM policy with each deployment of the Managed App, so if your security policies state that you need to have different policy settings per e.g. department, you’d have to create multiple deployments. In this post I’ll walk you through the steps of creating a Mobile Application Management policy, and give you some further information on how to use them.

Overview

• Policy types
• Policy restrictions and support
• Create and deploy a MAM policy

Policy Types

There are currently two Mobile Application Management policy types that you can choose from when creating a Mobile Application Management policy. A policy type is used for specifying what configuration and restrictions the policy holds. As more and more functionality is added to the Intune App SDK and the Intune service, I’d suspect more types will be added and provide additional configuration settings. The two current policy types are:

• General – This policy type gives you the functionality to modify the behavior of Managed or Wrapped Apps to ensure compliance and security requirements within your organization.
• Managed Browser – This policy type lets you modify the functionality of the Intune Managed Browser app, that manage the browsing experience for users. You can control what web sites users can access and how the content within the browser are opened.

Policy restrictions and support

In order to associate a Mobile Application Management policy to your app, the app needs to be of a specific type:

• Managed App – A Managed App has the Intune App SDK capabilities built into it, and therefor it supports MAM policies
• Wrapped App – A Wrapped App is a custom Line-of-Business (LOB) app that has been wrapped using either Intune App Wrapping Tool for iOS or Android giving it support for MAM policies

If you want to know how a custom Android LOB app can be wrapped, check out this blog post I’ve recently created:
How to wrap Android Line of Business apps with Intune App Wrapping Tool
Another thing to consider when creating Mobile Application Management policies is the supported platforms:

• A device running Android 4.0 or newer
• A device running iOS 7.0 or newer

When you create a Mobile Application policy, you’re given the option to select what platform the policy is intended for in addition to the policy type. The options you have is iOS and Android. Below is a table showing the restrictions available by platform for a General policy type:

iOS

Android

If you need to know more about the different restrictions and policy settings in detail, check out Step 3 in the documentation below:
https://technet.microsoft.com/en-us/library/dn878026.aspx

Create and deploy a MAM policy

Now that you know a bit more about what a Mobile Application Management policy is and what it can provide in terms of restriction and ensuring security compliance, let’s create one and associate it with a deployment of an app. In this demonstration I’ve created a Wrapped App called Notepad 1.4.0.7 that I will be associating the Mobile Application Management policy with.

Create Mobile Application Management policy

1. Open the ConfigMgr console and to go Software Library – Application Management.
2. Right click on Application Management Policies and click Create Application Management Policy.

3. On the General page, name the policy appropriately. For instance I like to give all objects a prefix, in this case MAM, followed by the name of the app it’s gonna be associated with. If necessary you could also add the specific department that the policy is intended for. Click Next.

4. On the Policy Type page, select the platform your app supports and the policy type that you want to create. Click Next.

5. On the platform specific page, configure in accordance with your organizations security requirements in order to ensure compliance. When ready, click Next.

6. On the Summary page, click Next.

7. Click Close on the Completion page.

Associate Mobile Application Management policy with a Deployment

1. Locate your app that you want to deploy to a specific collection of users and right-click on the app and select Deploy.

2. On the General page, browse and select a user collection that you want target this deployment with. Click Next.

3. On the Content page, make sure that the \\manage.microsoft.com Distribution Point is added if your app has any source content (custom Wrapped Apps has, not apps that are links pointing to either Google Play or the App Store). Click Next.

4. On the Deployment Settings, Scheduling, User Experience and Alerts pages, configure accordingly for the purpose of your deployment. Click Next.
5. On the Application Management page, select the Mobile Application Management policy that you previously created och click Next.

6. On the Summary page, click Next.

7. And finally on the Completion page, click Close.
That’s all, you have now created a Mobile Application Management policy and associated it with a deployment of an app. I hope this helps!