Outlook mobile policies and app protection
By Emil Björk · Microsoft ecosystem consultant, Gothenburg
How to govern Outlook mobile on iOS and Android — app protection policies, security settings, and feature controls.
3 min read
Share as imagePNG
Outlook for iOS and Android is by far the most-used mobile app for Microsoft 365 email — and for many users, the place they spend most of their workday. Governing it well matters both for security and user experience.
Outlook mobile is protected by Intune app protection policies as part of mobile device security; Conditional Access can require the managed app, and a lost phone is handled per remote wipe with Intune.
App protection policies (MAM-WE)
The headline control: Intune App Protection Policies apply to Outlook mobile on personal and corporate devices alike. Without enrolling the device in MDM, IT can:
- Require a PIN or biometric to open the app.
- Encrypt corporate data stored by Outlook.
- Block copy/paste from Outlook to personal apps.
- Block screenshots in some scenarios.
- Force "open in" managed apps — attachments open in Word / Excel / PowerPoint with their own MAM policies, not in third-party apps.
- Conditional launch — block sign-in if the device is jailbroken, OS is below minimum, or app is older than minimum.
- Remote wipe of corporate data inside Outlook without touching the personal device.
A typical baseline: PIN required, encryption on, no copy-paste to personal apps, no save to local files, screenshots blocked, conditional launch on jailbreak. Most users don't notice the restrictions in normal use; the security uplift is significant.
Outlook-specific mobile configuration
Beyond MAM, Outlook has its own configurable settings:
- Focused Inbox on / off / user-choice.
- Notification settings — Focused-only notifications, all-mail notifications, or custom.
- Email signatures — corporate signature pushed via cloud signatures.
- Calendar settings — default reminder times, work hours.
- External-account restrictions — block adding personal Gmail / iCloud accounts to the same Outlook instance.
- Biometric unlock behaviour.
Configured in Intune → Apps → App configuration policies, with the app type set to Microsoft Outlook.
Conditional Access integration
The Conditional Access policy that ties this all together:
For users accessing Office 365 from iOS or Android, require:
With this policy in place, the only path to corporate email on a personal phone is Outlook with MAM. iOS native Mail can't sign in (it doesn't support MAM); third-party email clients can't sign in either.
Account-restriction options
For organisations with strong BYOD posture, the multi-account behaviour of Outlook mobile matters:
- Restrict to organisational accounts only — prevent users adding personal Gmail accounts to the same app instance.
- Force corporate account as primary — when both work and personal accounts exist.
These prevent data leakage scenarios where users accidentally compose a work email from their personal account or vice versa.
Common pitfalls
- Native iOS Mail confusion — some users prefer it; the right answer is to block it via Conditional Access while making Outlook genuinely good for them.
- Push notification expectations — over-aggressive notification policies cause users to disable notifications entirely.
- Authenticator app dependency — Outlook mobile relies on the Authenticator app for some MFA scenarios; ensure both are deployed together.
- Personal Microsoft accounts — block them on the work app instance if BYOD posture requires.
For Microsoft 365 customers serious about mobile security, Outlook + Intune App Protection + Conditional Access is the standard pattern. Setup is moderate; operational benefit is durable.
Was this useful?
Spot something wrong or want a topic covered? Send it through the contact form.