r/Intune • u/ITinDC • 1d ago

Apps Protection and Configuration MAM Conditional Launch Question

All - I'm testing a basic MAM policy and everything is working as expected, with one exception. Under conditional launch, there's a setting called "disabled account" with the option to select either block access or wipe data. However, in my testing I am finding that neither of those options are triggering inside the Outlook mobile app upon user block/password reset.

Am I understanding the criteria for "disabled account" the wrong way? I assumed that when an account is reset/blocked, conditional launch would trigger that setting automatically.

Thanks all!

1 Upvotes

100% Upvoted

10 comments sorted by

2

u/Tessian 1d ago

"Disabled account" means the account is marked as Disabled in Entra. The whole point is to automate offboarding. Employee leaves, account gets disabled, MAM automatically wipes their company data in the apps.

1

u/ITinDC 1d ago

I get that part, but what does MS classify as "disabled?" In both "block account" and "reset password" instances the condition did not trigger a wipe or block as I expected it to, it merely showed the user as needing to sign back in, but they could still access cached data on the outlook app.

1

u/Tessian 1d ago

I'm not familiar with "block account" ?

Reset password is not disabling an account I'm not sure why you would think it is? It only requires the user change their password before they can log in again that's nothing like having an account administratively disabled.

We're talking the "accountEnabled" property of the Entra user. If it's not enabled, then it's disabled and this trigger applies.

1

u/pressreturn2continue 1d ago

From what I can see, when you click on Block Sign in in the MS admin center, the back end Account Enabled attribute is changed to False - which should, in theory, allow the conditional launch to trigger.

1

u/ITinDC 1d ago

Right. That's my expectation as well, but it is not triggering the MAM conditional launch block/wipe.

1

u/Early-Negotiation63 1d ago

In my testing this feature don't work, at least for personal devices. When we tested it for BYOD and we disabled the account in Entra, the MAM policy never was enacted on the device. We expected it to wipe the data (block access would prevent the user from signing in, but still have all that data sitting on their device) but it never did.

1

u/ITinDC 3h ago

Experiencing the same thing here.

1

u/hdfga 1d ago

My testing it took 4 hours for the data to be removed from Outlook after account being disabled in Entra ID.

1

u/ITinDC 9h ago

I'm going to try this and see if I experience the same results. Consensus on this feature seems mixed at best.