How to enforce usage of email apps on Android with Microsoft Intune

In this post, I will show you how to enforce usage of email apps to access Office 365 email. My testing is done with OnePlus 5, I can’t be sure if all Android model behave in the same way.

• Scenario 1: Allow use any email clients, redirect install Microsoft Intune Company Portal app, and enforce enroll device to Intune.
• Scenario 2: Allow setup any email client but block sync emails, enforce/redirect use Outlook app. When setup email in Outlook, redirect install Microsoft Intune Company Portal app, and enforce enroll device to Intune.
• Scenario 3: Allow usage of Android native email client only, redirect install Microsoft Intune Company Portal app, and enforce enroll device to Intune, block anything else.

Requirement:

• Office 365 licenses
• EMS or Intune licenses
• Android device.
• Device compliance policy configured.

Scenario 1: Allow use any email clients, enforce enroll device to Intune.

In this scenario, users can setup any email clients to access Office 365 email. User will receive an email redirecting them to download Microsoft Intune Company Portal, then guide them to enroll the device to Intune.

This conditional policy will require the device to be marked as compliant. When the device is not enrolled to Intune (device is not compliant), Intune Conditional Access leverages Exchange ActiveSync to quarantine these legacy clients and sends an email into their inbox indicating that the they need to install Microsoft Intune Company Portal app and enroll their device in order to access Exchange mail and other resources.

1. Go to Azure Portal : https://portal.azure.com/
2. Go to Intune and create new Conditional Access Policy
   
3. Fill information as bellow:
   Name: CA – Allow Email Basic and Modern Auth. requried enrolled (Android)
   Assignments – Users and groups: choose user groups that you wish to assign this policy
   Assignments – Cloud apps: Select apps – Office 365 Exchange Online
   Assignments – Conditions: Client apps (preview) – Modern authentication clients, Exchange ActiveSync clients, other clients
   Access controls – Grant: Grant access – Required device to be marked as compliant

   

   

   

    

   

4. Enable policy

Scenario 2: Allow setup email but block sync emails, enforce/redirect use Outlook, enforce enroll device to Intune.

In this scenario, users can allow setup Android native email client for Office 365 email. The user will receive an email and will be redirected to download Outlook. When the user setup Outlook, it will enforce the download of the Microsoft Intune Company portal app and guide the user to enroll the device to Intune. The user will not be able to use Android native email client to sync Office 365 emails.

This conditional access policy will require the device to use an approved client app and be marked as compliant, in this case the approved email app is Outlook. If user is using other email client than outlook to access Office 365 Exchange Online, it will enforce usage of  Outlook app and will not allow to sync email. Intune Conditional Access leverages Exchange ActiveSync to quarantine these unapproved clients and sends an email into their inbox indicating that the they need to install Outlook app and enroll their device to access Exchange mail and other resources.

Configuration are quite similar as “Scenario 1: allow both Android native email client or Outlook”, only changes are:

Name: CA – Required Modern Auth. email client and enrolled (Android)
Access controls – Grant: Grant access – Require device to be marked as compliant
Access controls – Grant: Grant access – Require approved client app
For multiple controls: Require all the selected controls

Scenario 3: Allow usage of only Android native email client, block anything else.

In this scenario, users can setup Android native email client to access Office 365 email. User will receive an email redirecting them to download Microsoft Intune Company Portal, then guide them to enroll the device to Intune. User cannot access Office 365 email from any other method than native email client with basic authentication.

We will need to create two Conditional Access policies, one for allow Exchange ActiveSync basic authentication, another one for block modern authentication client and other clients.

Conditional Access Policy for allow Exchange ActiveSync basic authentication

Configuration are quite similar as “Scenario 1: allow both Android native email client or Outlook”, only changes are:

Name: CA – Allow Email Basic Auth. requried enrolled (Android)
Assignments – Conditions: Client apps (preview) – Exchange ActiveSync clients
Access controls – Grant: Grant access – Require device to be marked as compliant

Conditional Access Policy for block modern authentication clients and other clients

Configuration are quite similar as “Scenario 1: allow both Android native email client or Outlook”, only changes are:

Name: CA – Block modern Auth. and other emai clients (Android)
Assignments – Conditions: Client apps (preview) – Modern authentication clients, Other clients
Access controls – Grant: Block access

NOTES:

If you have already setup your native email client before you created the Exchange ActiveSync basic authentication Conditional Access policy, you might have to wait 5-6 hours for those settings to apply. At the moment when I was writing this, I couldn’t find a working solution for this matter.

(3541)

Zeng Yinghua

Sandy has been working in the IT industry since 2009. Primarily dealing with SCCM, MDT, Group Policy, software packaging, workstation problem solving. Sandy currently works for a large Finnish company with several thousand endpoints. In 2016, Sandy founded the http://thesccm.com blog and is now a guest blogger on SCConfigMgr.