Replace Require Approved Client App with the App Protection Policy Grant

Since June 30, 2026, every Conditional Access policy that uses Require approved client app is read-only: it still enforces while enabled, but you can't edit it, so you can no longer add Require app protection policy to it. To migrate, list the affected policies, make sure Intune app protection policies cover the users and apps involved, create a replacement policy with the same assignments and the Require app protection policy grant in report-only mode, and once the sign-in logs look right, turn the new policy on and disable the old one.

Who this is for and what you will have at the end

This guide is for Microsoft Entra and Intune administrators who protect Microsoft 365 on iOS and Android with mobile application management (MAM), often on personal devices that aren't enrolled, and who still have policies built on the approved client app grant.

At the end you will have:

• An inventory of every policy that still uses the retired grant.
• Intune app protection policies assigned to everyone the new Conditional Access policy will cover.
• Replacement policies validated in report-only mode.
• The old policies disabled, and later deleted, without a gap in protection.

What changed and what it means

Microsoft first announced the retirement for March 2026, then extended it to June 30, 2026. On that date the control and any policy that includes it moved to a read-only state:

Microsoft's migration documentation says existing policies continue to be enforced as long as they remain enabled, so don't assume the old policies stopped doing anything. They still block users, and you can't fix them in place.

The two grants check different things:

The new grant is stricter in a useful way: an app passes only if your app protection policy actually reached it for that user, not just because the app is capable of supporting one.

Prerequisites

• Licensing: Microsoft Entra ID P1 (or Microsoft 365 Business Premium) for Conditional Access, and Microsoft Intune for app protection policies.
• Roles: at least Conditional Access Administrator in Microsoft Entra, and an Intune role that can create app protection policies.
• Emergency access: at least one break-glass account to exclude from the new policy. Microsoft's procedure for an all-users policy requires excluding at least one account so you can't lock yourself out.
• PowerShell (optional): the Microsoft Graph PowerShell SDK with the Policy.Read.All permission for the inventory.

Step 1: Find the policies that use the retired grant

In the Graph API, the approved client app grant appears as approvedApplication in grantControls.builtInControls, and the app protection grant as compliantApplication. The operator value shows whether controls are combined with AND or OR.

Connect-MgGraph -Scopes 'Policy.Read.All'
 
Get-MgIdentityConditionalAccessPolicy -All |
    Where-Object { $_.GrantControls.BuiltInControls -contains 'approvedApplication' } |
    Select-Object DisplayName, State, Id,
        @{ Name = 'Controls'; Expression = { $_.GrantControls.BuiltInControls -join ', ' } },
        @{ Name = 'Operator'; Expression = { $_.GrantControls.Operator } } |
    Format-Table -AutoSize

Sort the results into three cases:

Because you will recreate each policy by hand, save its full definition first:

Get-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId '<policy-id>' |
    ConvertTo-Json -Depth 10 |
    Out-File '.\ca-policy-backup.json'

Note the users and groups, exclusions, target resources, device platforms, client app types, locations and session controls. The replacement should match all of them except the grant.

Step 2: Make sure app protection policies cover everyone

The new grant only passes when an app protection policy has been applied to the app for that user. Microsoft advises applying app protection policies to devices before applying Conditional Access rules, because it can take time for them to reach existing devices.

1. In the Microsoft Intune admin center, go to Apps > Protection.
2. Check the existing iOS/iPadOS and Android policies. If none exist, select Create policy and choose iOS/iPadOS or Android.
3. On Apps, set Target policy to Core Microsoft Apps (Edge, Excel, Office, OneDrive, OneNote, Outlook, PowerPoint, SharePoint, Teams, To Do and Word), Microsoft Apps, All Apps or Selected apps.
4. Configure Data protection, Access requirements and Conditional launch.
5. On Assignments, assign the policy to user groups. App protection policies target users, so the groups must include everyone the Conditional Access policy will cover.

Compare the apps your users actually sign in with against the list of apps that support the app protection grant. Microsoft's list includes Microsoft Edge, Excel, Loop, Office, OneDrive, OneNote, Outlook, Planner, Power BI, PowerPoint, SharePoint, Teams, To Do, Word, Viva Engage and the Windows App, plus partner apps such as Adobe Acrobat Reader. Kaizala, Skype for Business and Visio don't support it, and an OR between the two grants doesn't help them. Find out whether anyone still depends on those apps on mobile before you switch.

Step 3: Create the replacement policy in report-only mode

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Browse to Entra ID > Conditional Access > Policies and select New policy.
3. Name it clearly, for example CA-Mobile-RequireAppProtection.
4. Under Assignments > Users or workload identities, include the same users as the old policy (for a broad policy, All users) and exclude your break-glass accounts and any exclusions the old policy had.
5. Under Target resources > Resources > Include, select the same resources as the old policy, or All resources for a broad policy.
6. Under Conditions > Device platforms, set Configure to Yes, include Android and iOS, and select Done. Recreate any other conditions the old policy used. If you don't configure Client apps, a new policy applies to all client app types.
7. Under Access controls > Grant, select Grant access, then Require app protection policy. If the old policy combined the grant with other controls, add them and keep Require all the selected controls.
8. Set Enable policy to Report-only and select Create.

Step 4: Validate the results

Leave the policy in report-only mode long enough to capture normal mobile usage, then review:

• Sign-in logs: open mobile sign-ins in the Microsoft Entra sign-in logs and check the Report-only tab for your new policy.
• Policy impact: the policy's impact view shows a snapshot of interactive sign-ins over the past 24 hours, 7 days or 1 month.
• Conditional Access insights and reporting workbook: compares report-only and enforced results side by side, if you send sign-in logs to a Log Analytics workspace.

Read the results like this:

Step 5: Cut over and clean up

All Conditional Access policies that apply to a sign-in must be satisfied. While the old and new policies are both on, a sign-in needs an approved client app and an app protection policy, which the core Microsoft apps with an assigned app protection policy satisfy.

1. Set the new policy's Enable policy to On.
2. Check sign-ins from a few pilot users on iOS and Android.
3. Open the old policy and set it to Off. Disabling is still allowed for read-only policies.
4. Keep the disabled policy for a short rollback window, then delete it. Policies that include the retired grant can't be edited, so a deleted one can't be recreated; your JSON backup is your record.

Repeat for each policy from Step 1. App protection is one control within a broader access model; for how it fits alongside device compliance and network controls, see Zero Trust enterprise remote access architecture.

Troubleshooting

Checklist

• Every policy with approvedApplication listed and backed up to JSON.
• App protection policies for iOS/iPadOS and Android assigned to all affected users, with time to apply before cut-over.
• Use of Kaizala, Skype for Business and Visio on mobile checked.
• Replacement policies created with matching assignments and conditions, break-glass accounts excluded, and Require app protection policy as the grant.
• Report-only results reviewed in sign-in logs or policy impact.
• New policies on, old policies off, then deleted after the rollback window.
• Android users aware they need Company Portal.

References

• Migrate approved client app to application protection policy in Conditional Access
• Configure grant controls in Conditional Access
• Conditional Access policy insights: report-only mode
• Building a Conditional Access policy
• Microsoft Entra Conditional Access overview and licensing
• Create and deploy app protection policies
• conditionalAccessGrantControls resource type
• Get-MgIdentityConditionalAccessPolicy
• Microsoft Entra authentication and authorization error codes