Adding an app protection policy

We have now configured policies for our corporate-owned devices to keep them secured and managed, but what about devices owned by users who want to access their email and other corporate apps on their personal devices? One option is to block this completely, but for most, that is not ideal, and we will just end up with a much larger list of corporate devices to purchase and manage.

Another option is to do nothing and let them add the apps completely unmanaged, but from a data protection perspective, this is a security concern as you have no control over your corporate data.

For this, we can use app protection policies and enroll devices into Mobile Application Management (MAM) instead of Mobile Device Management (MDM). Both can be used for additional security, but this would be unusual as it will add extra steps for the users on their devices, and we can assume a managed device is secure at the device layer. We do not want users fully enrolling...