Require approved client app is retired on June 30: migrate now
Require approved client app is deprecated June 30. After that date, existing policies stop enforcing. Here is what to configure before the deadline.
If you have a Conditional Access policy with “Require approved client app” as its grant, it stops enforcing on June 30, 2026. The policy stays visible and shows as enabled; the grant condition just stops being evaluated. Access it used to restrict becomes unrestricted, with no error or alert.
Key Takeaways
- “Require approved client app” is deprecated June 30: already grayed out, unavailable for new policies
- Existing enabled policies keep enforcing until the deadline but can’t be modified
- Replacement grant: Require app protection policy — checks Intune App Protection Policy status instead of a fixed Microsoft app list
- Needs: App Protection Policies configured in Intune + Microsoft Authenticator or Company Portal as broker on every device
- After June 30: no error, no alert, just silently unrestricted access where you expected a block
Old grant vs. replacement
| Require approved client app | Require app protection policy | |
|---|---|---|
| App list | Fixed by Microsoft | Your configured apps |
| Device enrollment required | No | No |
| Data handling control | None | Full (PIN, copy-paste, wipe) |
| Platforms | iOS, Android | iOS, Android, Windows (Edge only) |
| Broker app required | Yes | Yes |
| Status from June 30 | Deprecated | Current (replacement) |
App Protection Policies work at the app layer, not the device: no enrollment needed, just a managed app. The most common migration failure isn’t the policy, it’s the broker. Without Microsoft Authenticator (iOS) or Company Portal (Android, also required for policy delivery) present on the device, Intune can’t verify compliance and the sign-in is silently blocked, even with Outlook or Teams fully installed. Per-platform setup: iOS, Android, Windows. Background on the device-vs-app distinction: Intune MDM vs MAM.
Migrate before June 30
- Configure Intune App Protection Policies for every platform in scope, assigned (not report-only)
- Verify the broker app (Authenticator/Company Portal) is present on every in-scope device, before the new CA policy goes live
- Create new CA policies with Require app protection policy, same users/apps/conditions as today’s; pilot in report-only mode first
- Disable the old policies once the new ones are validated; delete after June 30
Frequently asked questions
What happens to my existing policy after June 30? It stays in the portal, shows as enabled, and keeps looking healthy. The grant condition just stops evaluating, no alert, no automatic disablement, no sign-in log failure to flag it.
My users are on BYOD without Intune enrollment. Does this still work? Yes. App Protection Policies apply at the app layer, no device enrollment required, which is the core advantage over MDM for BYOD.
Can I run both grants in the same CA policy? No. Separate policies. Run the new one in report-only mode alongside the old one during the transition.