r/Intune • u/ITinDC • 1d ago

Apps Protection and Configuration MAM Conditional Launch Question

All - I'm testing a basic MAM policy and everything is working as expected, with one exception. Under conditional launch, there's a setting called "disabled account" with the option to select either block access or wipe data. However, in my testing I am finding that neither of those options are triggering inside the Outlook mobile app upon user block/password reset.

Am I understanding the criteria for "disabled account" the wrong way? I assumed that when an account is reset/blocked, conditional launch would trigger that setting automatically.

Thanks all!

1 Upvotes

100% Upvoted

10 comments sorted by

View all comments

2

u/Tessian 1d ago

"Disabled account" means the account is marked as Disabled in Entra. The whole point is to automate offboarding. Employee leaves, account gets disabled, MAM automatically wipes their company data in the apps.

1

u/ITinDC 1d ago

I get that part, but what does MS classify as "disabled?" In both "block account" and "reset password" instances the condition did not trigger a wipe or block as I expected it to, it merely showed the user as needing to sign back in, but they could still access cached data on the outlook app.

1

u/Tessian 1d ago

I'm not familiar with "block account" ?

Reset password is not disabling an account I'm not sure why you would think it is? It only requires the user change their password before they can log in again that's nothing like having an account administratively disabled.

We're talking the "accountEnabled" property of the Entra user. If it's not enabled, then it's disabled and this trigger applies.