Skip to main content

Introduction

A React Native module wrapping the Microsoft Intune App SDK, so an IT administrator in any customer tenant can enforce App Protection Policies on your app — without managing the employee’s phone.

How it works​

Microsoft Intune service
Administrator authors an App Protection Policy and targets it at your app.
cloud
3
App registers the work identity
app registers, device does not enroll
4
Policy returned to that app only
personal, unenrolled phone
Your app
contains Intune App SDK
5SDK enforces: PIN on launch, no copy out, no screenshots
protected boundary — encloses this app only
1
2
Broker app
Authenticator / Company Portal — holds work identity, returns token
personal apps — untouched, outside the boundary
1  Employee signs in with their work account; the app hands sign-in to the broker.
2  Broker returns a token proving who they are.
3  App registers that identity with Intune. This is enrollment of the app — the device does not enroll.
4  Service returns the policy the administrator targeted at this app.
5  SDK enforces it inside the app: PIN on launch, no copy out, no screenshots.
The boundary encloses one app. The phone is the employee's own, unenrolled, and nothing in this flow changes that.

What a policy controls​

PIN on launch
Conditional launch shows the PIN screen in front of the app before any company data is on screen.
Copy out blocked
Text copied inside the app cannot be pasted into a personal app. Paste in still works.
stopped at boundary
Screenshot blocked
Android blocks the capture; iOS marks the screen so the capture is dropped by the SDK.
Your appmanaged
Enter your PIN
Required by your organisation
policy boundary
Save is directional
Work storage — allowed
Personal storage — blocked
The same action is permitted or refused depending on where the data lands. That contrast is the whole idea.
Managed browser required
Links open in Edge under policy, not in the employee’s default browser.
Nothing here reaches outside the dashed boundary. Personal photos, messages and apps are not in scope of any of these controls.
The restriction is directional, not total. Nothing here reaches outside the boundary.

A native module wrapping the Microsoft Intune App SDK for iOS and Android, so a React Native app can be managed by Intune App Protection Policies (also called MAM policies).

Once integrated, an IT administrator in any customer tenant can target your app from their Intune console and enforce:

  • App-level PIN or biometric unlock
  • Copy/paste restrictions between managed and unmanaged apps
  • Screenshot blocking
  • Save-as and open-from restrictions
  • Encryption of app data at rest
  • Selective wipe — corporate data removed, personal data untouched
  • Conditional launch rules — minimum OS, jailbreak/root detection, offline grace period

The device does not need to be enrolled in Intune for any of this. That is the point of MAM.

What this is not​

This library cannot do device management (MDM), and no amount of configuration will change that — the SDK runs inside your app's sandbox:

Inspect or route device network traffic❌ Customer's MDM + VPN profile
Per-app VPN❌ Customer pushes the profile; your app only needs to be targetable
Full device wipe, device passcode, disk encryption❌ Customer's MDM
Manage other apps, kiosk mode, device inventory❌ Customer's MDM
App-level PIN, copy/paste, screenshots, selective wipe✅ This library

If someone asks whether this gives them "Intune device control", the answer is no. It makes your app a first-class Intune-managed app; their MDM handles the device.

Licensing — read before installing​

This library is MIT licensed. The Microsoft Intune App SDK is not, and is not included here.

The SDK binaries are downloaded at install time from Microsoft's own repositories by scripts/fetch-sdks. They are never committed to this repository and never published in the npm package. Microsoft's licence terms apply to them, they are separate from this library's licence, and you are responsible for reviewing and accepting them:

See NOTICE for the full statement.