Hello,
I came across this thread yesterday with the same question and think I have now solved the problem. So I will post my provisional solution here. My solution is to distribute a configuration policy via Intune that uses email as a template and has the following settings:
Email server: outlook.office365.com
Account name: Managed Account
User name attribute from Microsoft Entra ID:
User principal name
Email address from Microsoft Entra ID: Primary SMTP address
Authentication method: User name and password
SSL: Enable
OAuth: Enable
Exchange data to synchronize: Calendar and contacts only
Allow users to change synchronization settings: No
I simply used the official Microsoft documentation here, which is a bit older but still works.
This distributes the email profile without allowing users to edit or delete it.
The other important setting concerns the Conditional Access Policy.
The conditional access rule blocks logins to unmanaged applications. The following settings were configured for this purpose:
- Target resource: All resources
- Excluded: Office 365, Apple Internet Accounts, Microsoft Intune, Microsoft Intune Enrollment
- Conditions:
- Device platforms: Android/iOS
Access controls: Grant access -> App protection policy required.
The app protection policy is very standard, so I don't think I need to go into any further detail here. The only important thing here is that all "Microsoft apps" are specified under Public Apps.
And now I'll explain why the CA has to be set up the way I did. At first, I did not exclude O365, and logging in to Apple Internet Accounts still did not work (despite the exception) because the login redirects to Exchange Online, which in turn requires the app protection policy. The app protection policy is still required, but the O365 apps are no longer enforced by the CA rule. It is still applied, however.
These settings now prevent Apple Mail from using the SMTP address in the distributed mail profile. The good thing is that this setting can no longer be edited by users, and no further profiles with the same SMTP address can be created.
I haven't been able to test everything yet, but the basic Microsoft apps work fine and the Apple calendar and contacts sync perfectly.