CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection

Policy conditions

Users

All users

Exclusion

Excludes privileged roles

Apps

00000002-0000-0ff1-ce00-000000000000, 00000003-0000-0ff1-ce00-000000000000

Platforms

android, iOS

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('3002ab9e-d1fe-4e56-b84f-e81dd54b8a59')",
  "@odata.editLink": "identity/conditionalAccess/policies('3002ab9e-d1fe-4e56-b84f-e81dd54b8a59')",
  "templateId": null,
  "displayName": "CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "all"
    ],
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "00000002-0000-0ff1-ce00-000000000000",
        "00000003-0000-0ff1-ce00-000000000000"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [
        "All"
      ],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "a8e55fcf-f8ed-43c2-bb4f-0c62edd62963",
        "2802b872-ccfb-4b29-a9a9-459808dfb11b"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [
        "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
        "c4e39bd9-1100-46d3-8c65-fb160da0071f",
        "b0f54661-2d74-4c50-afa3-1ec803f12efe",
        "158c047a-c907-4556-b7ef-446551a6b5f7",
        "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
        "29232cdf-9323-42fd-ade2-1d097af3e4de",
        "62e90394-69f5-4237-9190-012177145e10",
        "729827e3-9c14-49f7-bb1b-9608f156bbb8",
        "966707d0-3269-4727-9be2-8c3a10f19b9d",
        "e8611ab8-c189-46e8-94e1-60213ab1f814",
        "7be44c8a-adaf-4e2a-84d6-ab2649e08a13",
        "194ae4cb-b126-40b2-bd5b-6091b380977d",
        "f28a1f50-f6e7-4571-818b-6a12f2af6b6c",
        "fe930be7-5e62-47db-91af-98c3a49a38b1",
        "f2ef992c-3afb-46b9-b7cf-a126ee74c451",
        "3a2c62db-5318-420d-8d74-23affee5d9d5"
      ],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "platforms": {
      "@odata.type": "#microsoft.graph.conditionalAccessPlatforms",
      "includePlatforms@odata.type": "#Collection(microsoft.graph.conditionalAccessDevicePlatform)",
      "includePlatforms": [
        "android",
        "iOS"
      ],
      "excludePlatforms@odata.type": "#Collection(microsoft.graph.conditionalAccessDevicePlatform)",
      "excludePlatforms": []
    }
  },
  "grantControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessGrantControls",
    "operator": "OR",
    "builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)",
    "builtInControls": [
      "compliantApplication"
    ],
    "customAuthenticationFactors@odata.type": "#Collection(String)",
    "customAuthenticationFactors": [],
    "termsOfUse@odata.type": "#Collection(String)",
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('3002ab9e-d1fe-4e56-b84f-e81dd54b8a59')/grantControls/authenticationStrength/$entity",
    "authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('3002ab9e-d1fe-4e56-b84f-e81dd54b8a59')/grantControls/authenticationStrength/$ref",
    "authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('3002ab9e-d1fe-4e56-b84f-e81dd54b8a59')/grantControls/authenticationStrength",
    "authenticationStrength": null
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('3002ab9e-d1fe-4e56-b84f-e81dd54b8a59')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection policy requires an app protection policy before iOS and Android devices can reach Exchange Online and SharePoint Online. It applies to all users, with a long list of admin roles excluded, and means email and files on mobile are only reachable through apps governed by Intune app protection. Corporate data stays encrypted and contained within the app, so if a phone is lost or an employee leaves, you can wipe the work data without touching anything personal."
}