How is it that Microsoft Intune cannot filter properly?

The App protection status report evaluates App Protection Policies assigned to a user. If a user has a single APP that targets multiple Microsoft 365 apps, such as Outlook, Word, Excel, and Edge, the report can list all of those associated apps for that user once they check in.

When you select App contains Outlook, Intune is effectively filtering for users/records where Outlook is present in the policy evaluation. It does not then remove the other co-targeted apps from that user's results. So seeing Teams, Excel, Edge, and Word underneath a result that was filtered on Outlook is expected behavior for this particular monitoring view.

So UI makes a user/policy-level filter look like a row-level App filter. If you expect App contains Outlook to mean "show me only rows where App = Outlook," the behavior is indeed misleading.

If you need a Outlook-only view, first check Apps > App protection policies and look at which apps are included in the policy. If Outlook is bundled with the other Microsoft 365 apps, Intune will report those apps as part of that user's APP evaluation.

If you need to isolate Outlook specifically, one option is to create an App Protection Policy dedicated to Outlook rather than grouping Outlook with the other applications. That gives you a cleaner way to identify users associated with that particular APP.

For more precise reporting, particularly if you need application-level rather than user/policy-level data, you can also look at the underlying Intune reporting data through Microsoft Graph or export the available report data. That gives you considerably more control than the App protection status UI.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin