Deployment guide: Mobile Application Management (MAM) for unenrolled devices in Microsoft Intune

MAM for unenrolled devices uses app configuration profiles to deploy or configure apps on devices without enrolling the device. When combined with app protection policies, you can protect data within an app.

MAM for unenrolled devices is commonly used for personal or bring your own devices (BYOD). Or, used for enrolled devices that need extra security. MAM is an option for users who don't enroll their personal devices, but still need access to organization email, Teams meetings, and more.

MAM is available on the following platforms:

This article provides recommendations on when to use MAM. It also includes an overview of the administrator and user tasks. For more specific information on MAM, go to:

This guide is a living thing. So, be sure to add or update existing tips and guidance you've found helpful.

Before you begin

For an overview, including any Intune-specific prerequisites, see Deployment guidance: Enroll devices in Microsoft Intune.

MAM

Use for personal or bring your own devices (BYOD). Or, use on organization-owned devices that need specific app configuration, or extra app security.

Feature Use this enrollment option when
You want to configure specific apps, and control access to these apps, such as Outlook or Microsoft Teams. ✅
Devices are personal or BYOD. ✅
You have new or existing devices. ✅
Need to manage a few devices, or a large number of devices (bulk enrollment). ✅
Devices are associated with a single user. ✅
Devices are managed by another MDM provider. ✅
You use the device enrollment manager (DEM) account. ✅
Devices are owned by the organization or school. ❌

MAM administrator tasks

This task list provides an overview. For more specific information, see Microsoft Intune app management.