Mobile App Protection Coverage

The question it answers: Which users have mobile apps registered with Intune that received no app protection policy?

On personal phones, app protection policies (MAM) are what stop company mail and files being copied into personal apps or backed up to a private cloud. Users whose Outlook, Teams or OneDrive registered with Intune but received no protection policy are exposed.

Note

If Graph rejects expanding the applied policies, the coverage columns show ‘unknown’ rather than marking everything unprotected.

At a glance

Where in the app	Intune › Endpoint Security & Readiness › App Protection Coverage
Workload	Intune
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Intune.
Report id (API and MCP)	intune.endpoint.app-protection-coverage

Columns

Column	Key	Type
User	UserPrincipalName	Link
Coverage	Severity	Status
Unprotected apps	UnprotectedAppList	Text
Policies applied	Policies	Text
Devices	Devices	Text
Last sync	LastSync	Date

Filters

Filter	Key (API)	On when the page opens
Only users with unprotected apps	unprotected	Yes

What it needs

Licence: Microsoft Intune.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
DeviceManagementApps.Read.All	Microsoft Graph	Read Microsoft Intune apps
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information

Data sources it reads

• GET /v1.0/deviceAppManagement/managedAppRegistrations?$expand=appliedPolicies

Through the API and MCP

GET /ir-api/v1/reports/intune.endpoint.app-protection-coverage?size=100
GET /ir-api/v1/reports/intune.endpoint.app-protection-coverage?filter=unprotected

An AI assistant reads it with the MCP tool get_report and the id intune.endpoint.app-protection-coverage. The client needs the Read grant for Intune. See Using the API.