You are the Microsoft 365 administrator for a company. All staff must use Microsoft Outlook to access corporate email. When users access Outlook on mobile devices, they must use a PIN to open the appl

Device compliance policies define rules that a device must meet (e.g., OS version, encryption) to be considered compliant, but they do not enforce app-level controls like requiring a PIN to open a specific application.

Device configuration policies manage device-level settings such as Wi-Fi profiles, VPN, and restrictions, but they do not provide app-specific access controls like enforcing a PIN to launch Outlook.

App Protection Policies (APP) in Microsoft Intune allow administrators to enforce access requirements at the application level, such as requiring a PIN to open a specific app like Outlook, regardless of whether the device is enrolled in MDM. This policy targets the app itself rather than the device, making it the correct choice for enforcing a PIN specifically when opening Outlook on mobile devices.

App configuration policies deliver configuration settings (e.g., server URLs, account settings) to managed apps, but they are not designed to enforce security requirements like requiring a PIN to open an application.