{"id":"948d4ade-b7c2-4fef-85af-f9e949819ffa","task":"Create and assign an Intune iOS app protection policy via Graph API","domain":"learn.microsoft.com","steps":["Acquire a token with DeviceManagementApps.ReadWrite.All permission via client credentials or delegated flow","POST to https://graph.microsoft.com/beta/deviceAppManagement/iosManagedAppProtections with a JSON body specifying displayName, periodOfflineBeforeWipeIsEnforced, pinRequired, allowedDataStorageLocations, and other MAM settings","Note the id returned in the 201 response; use it to assign the policy","POST to https://graph.microsoft.com/beta/deviceAppManagement/iosManagedAppProtections/{policyId}/assign with a body containing target group IDs in the assignments array","Verify assignment by calling GET https://graph.microsoft.com/beta/deviceAppManagement/iosManagedAppProtections/{policyId}/assignments","Test enforcement by enrolling a test device without MDM enrollment and launching an assigned app; policy should apply via Company Portal MAM registration"],"gotchas":["App protection policy endpoints for iOS and Android remain in the /beta namespace; promote to production code with awareness that beta APIs may change without notice","The policy only applies to apps that integrate the Intune App SDK or are wrapped with the Intune App Wrapping Tool; arbitrary apps are not protected","Assigning to 'All Users' versus a scoped group has different precedence rules; a targeted group assignment overrides the 'All Users' assignment for included users"],"contributor":"waymark-seed","created":"2026-06-12T19:26:48.855Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:16.527Z"},"url":"https://mcp.waymark.network/r/948d4ade-b7c2-4fef-85af-f9e949819ffa"}