MAM for Windows protects corporate data on personal PCs without enrollment

One situation comes up in my projects again and again. Contractors and external users need access to company data in Microsoft 365, but you can't manage their personal Windows devices with Intune, and you shouldn't try. That's where MAM for Windows, meaning app protection policies for Windows, fits in. It's a practical option for securing data access, and people often overlook it. Users work in a protected Edge browser profile, the company data stays under control, and the personal device remains private.

MAM for Windows keeps corporate data inside a protected Edge profile

Users on personal PCs, or PCs managed by another organisation, reach corporate data through a protected Edge profile. The device doesn't need to be enrolled in Intune. In Intune you configure app protection policies for Windows that target this Edge profile, and they can be quite granular. That lets you restrict copy/paste, downloads, printing and other ways data could leave. In my experience this works particularly well for contractors and temporary staff. They can get their work done, and IT never has to touch their private machine.

App protection policies and Conditional Access work together

The key is to pair an Intune app protection policy (Intune → Apps → App protection policies → Create policy → Windows) with Conditional Access. The app protection policy enforces protected sessions in Edge, can run health checks through Defender if you want, and blocks risky actions. In Conditional Access you add a rule that grants browser access to Exchange, SharePoint or Teams on Windows only when an app protection policy is applied. Here is the flow:

flowchart TD
    user["User launches Edge profile"] --> ca["Conditional Access checks app protection policy"]
    ca --> mam["MAM policy enforces actions & access"]
    mam --> health["Defender checks device health"]
    health --> access["Access to company data"]
    mam --> restrict["Restricted actions (e.g. block download)"]

Figure: How Windows MAM controls data access through Conditional Access and Edge

With this sequence you actually control the data, even on personal PCs that nobody manages.

The setup is quick but users need a heads-up

Start by creating a Windows app protection policy in Intune and assigning it to the right audience, usually a group of external or guest users. Set the data protection options to block downloads, printing or the clipboard, whatever your case requires. Then go to Conditional Access (Entra portal → Protection → Conditional Access → New policy) and choose the grant control “Require app protection policy for browser access on Windows” for your key cloud apps. Microsoft's setup guide for this Conditional Access policy is worth keeping open while you work.

For users, this feels quite different from the familiar mobile MAM scenario. They have to sign in to a protected Edge profile that is separate from their personal browser. Some people find the switching between profiles clumsy, particularly when they handle business and personal content side by side. Tell users beforehand that copying, printing or downloads may be blocked depending on the policy. That saves you a fair number of support calls.

Practical tip: Target the policies with dedicated Entra ID groups, preferably dynamic ones based on user type or department. That way you don't end up restricting regular employees by accident.

Defender health checks add compliance without full device control

The Defender integration is a real plus. App protection policies for MAM for Windows can now require device health checks before they grant access to data, for example up-to-date AV definitions or the status of Defender process and network protection. Contractors often bring laptops that nobody really looks after, so this closes a big gap. Together with Conditional Access, you get a minimum level of device security without managing the whole device. Microsoft's guide to MAM for Windows has more of the technical detail.

If you've worked with mobile app protection policies, a lot of this will look familiar. Windows has its own quirks, though, mainly around downloads and file storage. Files go into an enterprise container, and that container is wiped when the user signs out.

MAM for Windows suits external staff and partner scenarios

This model fits external staff, contractors and project teams very well. It works anywhere device enrollment isn't realistic but you still can't compromise on data protection. I've also used it as a bridge in M&A, joint ventures and partner setups. You'll need suitable licences (Microsoft 365 Business Premium, E3/E5 or equivalent) plus Intune. Getting the group targeting right matters a lot here.

If you're starting with Conditional Access from scratch, have a look at my post Conditional Access in Microsoft Entra ID: The First Policies Every Tenant Needs.

MAM for Windows has become my default for BYOD control

MAM for Windows doesn't solve every problem. Still, it's now the first thing I reach for with BYOD headaches, especially when privacy concerns make full device management a non-starter. In many of the tenants I work with, it's the standard approach for contractors and other unmanaged access. If you want to stop data leaks without taking over people's devices, app protection policies for Windows are the right tool.