Intune multiple managed accounts: what admins need to know
Intune's MMA feature, rolling out in June 2026, lets users hold multiple MAM accounts in one app. Here's what admins managing external access need to know.
A contractor signs into Teams with a second work account and gets prompted to remove the first: one managed account per app, per publisher, until now. Microsoft’s Multiple Managed Accounts (MMA) removes that limit in supported apps, each account governed by its own app protection policy. Announced via MC1290818 (April 24, 2026), rolling out June through early July 2026. No admin toggle, no enablement step: it activates automatically wherever the app and OS version support it.
For MAM vs. full MDM enrollment, see Unmanaged Devices with Intune.
Key Takeaways
- MMA allows multiple MAM-managed accounts in one app, each with its own app protection policy enforced independently
- Currently: Microsoft Teams on iOS/iPadOS v8.10.0+ only. Android and other apps not yet supported, no date announced
- Mixed-view apps (Outlook-style) always apply the most restrictive policy of all active accounts, unconditionally, even with only one managed account present
- B2B guests still need Cross-Tenant Access Settings (CTAS) for MAM-based Conditional Access to reach them; MMA doesn’t change that requirement
- No admin toggle exists. The only indirect control is iOS’s
IntuneMAMAllowedAccountsOnly, which disables MMA by restricting the app to one account
Who this actually hits
Consultants with accounts in two tenants, embedded partner/vendor staff, and parallel-running post-merger accounts, exactly the “porous edge” organizations with frequent external access. MMA solves the outbound case cleanly: a partner adds your tenant’s account as MAM-only alongside their own employer’s managed account, no device enrollment or surrendered control required.
It does not solve the inbound B2B guest case. A guest account living in your tenant still can’t be reached by MAM-based Conditional Access without CTAS inbound trust configured (device registration for “Require app protection policy” only works against the guest’s home tenant). Without CTAS, use device-compliance-based CA for guests instead; that’s a separate control layer MMA doesn’t touch. Microsoft’s multitenant guidance.
Segmented vs. mixed view
| Segmented view (e.g. Teams) | Mixed view (e.g. Outlook) | |
|---|---|---|
| Data display | One account at a time, user switches manually | Multiple accounts combined (unified inbox/calendar) |
| Policy applied | Active account’s own policy | Most restrictive policy of all active accounts, always |
| Copy/paste, screenshots | Follow the active account’s setting | Fully disabled, unconditionally |
The mixed-view lockdown isn’t a bug: it closes the exfiltration path that letting the more permissive policy win would create. Expect helpdesk tickets once users hit it unexpectedly.
Microsoft Learn: Multiple Managed Accounts · App Protection Policies overview
Do this before MMA reaches your tenant
- Audit App Protection Policies for
IntuneMAMAllowedAccountsOnlyor “Allow org accounts only” on iOS, both silently disable MMA - Confirm Teams-using contractors/partner staff are on iOS v8.10.0+; older versions won’t see the feature
- Brief your helpdesk on mixed-view lockdown before the complaints start
- For B2B guests, configure CTAS inbound trust or keep them on device-compliance-based CA; MMA won’t fix guest access on its own
Frequently asked questions
Does MMA work on Android today? No. Teams on iOS/iPadOS v8.10.0+ only; Android and other apps are planned with no release date (Microsoft Learn, 2026).
Can I apply our MAM policy to a B2B guest user? Not without CTAS inbound trust configured. Without it, exclude guests from MAM-based CA and use device-compliance-based CA instead.
Can I stop users adding a second managed account in an app? No per-tenant filtering exists. On iOS only, IntuneMAMAllowedAccountsOnly disables MMA entirely for that app. No Android equivalent is documented.