Unable to assign app protection policy to user

The error Application needs to enforce Intune protection policies (sign-in error 53005) indicates that Conditional Access is requiring an Intune app protection policy (MAM), but from Entra/Intune’s perspective the app/user/device combination is not correctly targeted or fully enrolled for app protection.

From the provided context, the following points are relevant:

1. App protection policies must be user-targeted and app-aware
   • App protection policies must be assigned to user groups, not device groups.
   • The targeted apps must use the Intune App SDK; otherwise, app protection policies may not work correctly.
   • If the app does not support the Require app protection policy control, Conditional Access will block access.

   “The Intune app protection policy must be assigned to user groups and not device groups.”
   “When you configure Intune app protection policies, the targeted apps must use Intune App SDK. Otherwise, app protection policies may not work correctly.”
   “If an app doesn't support Require app protection policy, end users trying to access resources from that app are blocked.”

   So one likely cause of the 53005 failure is that either:
   • The user is not actually in the included user group for the app protection policy (or is in an excluded group), or
   • The app being used is not an Intune-managed app that supports app protection policies.
2. Verify app protection policy assignment and status for the user
   Use the Intune admin center to confirm that the user is correctly targeted and that the app protection policy is active for that user:
   1. Sign in to the Microsoft Intune admin center.
   2. Go to Apps > Monitor > App protection status, then select the User status tile for Android.
   3. Select Select user, search for the affected user, and review the details. Note it can take up to 24 hours for a newly targeted user to appear.
   4. Confirm the user is in the correct user group used for the app protection policy assignment:
      • Groups > All groups → select the group used for the app protection policy → Members.
      • Ensure the user is not in any excluded group for that policy.
3. Ensure Conditional Access is configured for “Require approved client app” OR “Require app protection policy”
   When migrating from “Require approved client app” to “Require app protection policy”, the recommended pattern is to configure the grant controls as one of the selected controls, not all:
   • In the Conditional Access policy:
     • Under Access controls > Grant → Grant access.
     • Select Require approved client app and Require app protection policy.
     • Under For multiple controls, select Require one of the selected controls.
   This ensures that if the app is an approved client app but does not yet support app protection policies, users are not unnecessarily blocked.
4. “Incomplete user enrollment” and supported device state
   The context does not provide a list of supported Android models/OS versions for Intune enrollment. It does, however, highlight that:
   • App protection policies are supported for personally-owned work profile devices on Android Enterprise.
   • The device must be in a supported management state for app protection to apply correctly.

   “If the affected device uses Android Enterprise, only personally-owned work profiles will support app protection policies.”

   The “Incomplete user enrollment” status suggests that the user’s device is not fully enrolled or not in the expected management state (for example, work profile not fully created or user sign-in not completed). Until the enrollment is complete and the app receives the Intune MAM configuration (such as IntuneMAMUPN/IntuneMAMDeviceID where applicable), Conditional Access will treat the app as not enforcing protection policies and return 53005. In this scenario, the likely causes are:
   • Enrollment flow was interrupted or not completed on the Android 13 device.
   • The device is not in a supported Android Enterprise work profile configuration for app protection.
   • The app in use is not correctly receiving MAM configuration due to the incomplete enrollment.
   The remediation is to:
   • Ensure the user completes the full Intune enrollment / work profile setup on the device.
   • Confirm the device is using a supported Android Enterprise mode (personally-owned work profile for MAM).
   • After enrollment completes, re-check the user’s App protection status and retry sign-in.
5. Supported models and OS versions
   The provided context does not include a supported device matrix (specific Android models and OS versions) for Intune enrollment. Only general conditions are given (for example, Android Enterprise personally-owned work profiles for app protection). For a specific model such as “Infinity” on Android 13, the key requirement from the context is that it must support the required Android Enterprise mode and Intune app protection, and that enrollment must complete successfully.

References:

• Migrate approved client app to application protection policy in Conditional Access
• Require approved client apps or app protection policy
• Troubleshooting app protection policy deployment in Intune
• How to Create and Assign App Protection Policies