Conditional Access requires approved apps on mobile devices

​

What this check verifies

Microsoft Entra Conditional Access policies can require that only approved client apps or apps with app protection policies are used on iOS and Android devices. This ensures corporate data on mobile platforms is accessed only through managed or protected applications.

​

Risk

Without requiring approved or protected client apps on mobile platforms, users can access corporate data through unmanaged applications that lack security controls. This increases the risk of data leakage, unauthorized data sharing, and exposure of sensitive information on personal or compromised mobile devices.

​

Recommendation

Enforce Conditional Access policies requiring app protection policies or approved client apps on iOS and Android devices. Prefer app protection policies over approved client apps, as the approved client app grant control is retiring June 30, 2026. Regularly review policies to ensure mobile access is restricted to managed applications.

​

Remediation

Dashboard steps

1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
2. Expand Protection > Conditional Access and select Policies.
3. Select New policy.
4. Under Users, include All users.
5. Under Target resources, include All cloud apps.
6. Under Conditions > Device platforms, select Android and iOS.
7. Under Grant, select Require app protection policy (preferred) or Require approved client app.
8. Set the operator to OR.
9. Enable the policy and click Create.

​

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-policy-approved-app-or-app-protection
• https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_approved_client_app_required_for_mobile. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks