Windows BYOD Edge MAM enrollment blocked by Conditional Access policy requiring compliant devices

Chitranjan Singh 0 Reputation points
2026-09-01T05:36:02.5466667+00:00

We are implementing a Windows BYOD solution using Microsoft Intune App Protection Policies (MAM) for Microsoft Edge and Conditional Access.

Expected behavior

  • Approved users in the BYOD Users group should be able to access Microsoft 365 resources from personal Windows devices through a protected Microsoft Edge work profile.
  • Outlook Desktop, Teams Desktop, OneDrive Sync, and other desktop applications should be restricted on unmanaged devices.

Issue

When the Conditional Access policy below is enabled:
Policy: Block BYOD Desktop Apps Policy

Client Apps:

  • Mobile apps and desktop clients

Grant Control:

  • Require device to be marked as compliant

users are unable to complete Microsoft Edge MAM enrollment using:
edge://mam-enrollment-page/?freType=newProfile

and receive the message:
This application contains sensitive information and can only be
accessed from devices or client applications that meet the
organization's management compliance policy.

Question
what is the Microsoft-recommended method to:

  1. Allow Microsoft Edge MAM enrollment on unmanaged BYOD Windows devices.
  2. Require App Protection Policy for Edge.
  3. Block Outlook Desktop, Teams Desktop, OneDrive Sync, and other desktop clients on the same unmanaged devices without interfering with Edge MAM onboarding.
Microsoft Security | Intune | Configuration
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-09-01T05:36:28.2766667+00:00

    The recommended method is to separate browser access for Edge from desktop client access, and use Require App Protection policy for Edge instead of Require device to be marked as compliant.

    1. Create a Conditional Access policy for browser access on Windows BYOD:
      • Users or agents (Preview): target the BYOD Users group
      • Target resources: Office 365 or the protected resources
      • Conditions → Client apps: Browser
      • Conditions → Device platforms: Windows
      • Grant: Require App Protection policy
      This is the documented pattern for allowing Microsoft Edge on personal Windows devices while blocking other web browsers from connecting to Microsoft 365 endpoints.
    2. Create an Intune App Protection policy for Windows:
      • In Intune admin center, go to Apps → Protection → Create → Windows
      • Under Apps, select Microsoft Edge
      • Configure the required data protection settings
      • Assign the policy to the same BYOD Users group targeted by the Conditional Access browser policy
    3. Do not require Require compliant device for the Edge MAM onboarding flow on unmanaged Windows devices.
      • A policy that targets Mobile apps and desktop clients and grants Require device to be marked as compliant can block MAM enrollment.
      • The documented guidance for Windows app protection specifically marks Require compliant device as not supported for this scenario because users will be blocked from MAM enrollment.
    4. For the user sign-in flow in Edge on BYOD Windows:
      • Users sign in to the protected site in Edge
      • Select Switch Edge profile if prompted
      • Select Yes when Windows offers to remember the account and sign in to apps, websites, and services
      • If the MDM enrollment prompt appears, select No. Selecting Yes enrolls the device in MDM, not MAM, and can interfere with the intended BYOD MAM flow.
    5. To block Outlook Desktop, Teams Desktop, OneDrive Sync, and other desktop clients on unmanaged devices without breaking Edge onboarding:
      • Keep a separate Conditional Access policy for Mobile apps and desktop clients
      • Apply Require device to be marked as compliant there
      • Do not use that control as the mechanism for Edge browser access on unmanaged Windows devices

    This achieves the design goal:

    • Edge on unmanaged Windows BYOD: allowed through Require App Protection policy with Edge MAM
    • Desktop clients on unmanaged devices: blocked by the separate Mobile apps and desktop clients + Require compliant device policy

    If users still get prompted after the You're all set page, the documented causes include:

    • MAM enrollment is still processing
    • This app only was selected on the heads-up page
    • enrollment expired or the user is not compliant with organizational requirements
    • a preexisting unregistered Edge account/profile is blocking proper MAM enrollment

    In that case, wait a few minutes and retry in a new tab, or have the administrator verify that Intune MAM policies are applying correctly.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.