This post will go into how you can use Intune preview in the Azure Portal to set a Conditional Access policy to require iOS and Android users to use the Outlook app, rather than the native iOS mail and Android mail applications. It will also show the user experience for a user using an iOS device and an Android device. To use the Outlook app once the policy has applied, the iOS device needs the Microsoft Authenticator app installed, and Android users need the Company Portal app installed.
In portal.azure.com click on More Services then search for Intune and click on Intune App Protection (you can click the Star to pin it to your list)
Intune App Protection
Now click on Exchange Online under Conditional Access.
Exchange Online – Conditional Access
Click on Allowed Apps, I have selected Allow apps that support Intune app policies
Allowed apps – Conditional Access, Exchange Online
Restricted Groups is where you will choose who to deploy the policy to. In Azure Active Directory, I have created a group called Intune which has my users in there with an Intune license assigned. Its a good idea to deploy this to some test users first, and not to a group with all your users in there.
Restricted user groups – Conditional Access, Exchange Online
On an Android device, I have updated the gmail application to support Office 365. I have added my account. When I check the inbox I can see an email saying that the IT department requires me to use the Outlook app.
On an iOS device, the user experience is very similar. When using the iOS native mail application, as soon as you check the inbox you will see a very similar email stating again that you require to use the Outlook app for Exchange Online.
Like I was saying earlier in the post, for Android you need the Company Portal App, and for iOS you need the Microsoft Authenticator App to register the devices in Azure AD (not enroll, only register). On an Android device, if you do not have the Company Portal app, you will see the following screen
Android – Company Portal app required
And this is the user experience for iOS without the Microsoft Authenticator app
Once the apps are installed you can then login to Exchange Online using the Outlook app.
My company is forcing this now. Is there anyway to BYPASS this? Having 2 calendar apps to see if I’m available is asinine.
LikeLike
If an admin has set the CA policy to require you to use Outlook then you can’t bypass it and use the native mail app. That’s the point of the CA policy (unless they assign it to a group that you are not a member of)
LikeLike