The Mobile Access Runbook: Company Portal, Work Profile and the Copy-Paste Block

Sign-in: alex@contoso.com, Outlook web
Device info: Device ID 11111111-1111-1111-1111-111111111111
Report-only tab: Not applied
Result: Allowed

Sign-in: alex@contoso.com, Outlook web
Device info: Device ID (blank)
Report-only tab: Failure
Result: Blocked, error 53003

Tenant: contoso.com · Tenant ID: 00000000-0000-0000-0000-000000000000 · Pilot user: Maya Chen (maya.chen@contoso.com) · Last updated: 27 Oct 2026

Goal: Microsoft 365 works on Android and iPhone only after the phone is set up in Company Portal (Android: work profile). Company data cannot be copied out of the Office apps or the work profile into personal apps.

Sanitization note: every identifier in this post is fictional. The tenant is contoso.com, the tenant ID is a zeroed placeholder GUID, the pilot user is "Maya Chen", and all device IDs are placeholders. If you adapt this runbook, replace every one of them with your own values.

Do the steps in order. Assign everything to the pilot group only. Every Conditional Access policy starts in Report-only.

---

What blocks what

---

Step 1. Preparation (one time)

1. Pilot group. Entra > Groups > New group > Security > MDM-Pilot-Users > add Maya only.
2. Break-glass account. Make sure the cloud-only emergency Global Admin exists. It is excluded from every Conditional Access policy below.
3. Unassigned devices count as non-compliant. Intune > Devices > Compliance > Compliance policy settings > Mark devices with no compliance policy assigned as: Not compliant > Save.
4. Android: Managed Google Play. Intune > Devices > Android > Android enrollment > Managed Google Play > I agree > Launch Google to connect now. Sign in with an IT-owned Google account (not a personal one). Status must show Setup.
5. iOS: Apple MDM Push certificate. Intune > Devices > iOS/iPadOS > iOS/iPadOS enrollment > Apple MDM Push certificate:
   1. Download the CSR.
   2. Create the certificate at Apple's push certificates portal with an IT-owned Apple ID. Write down which Apple ID you used.
   3. Upload the .pem file and enter the Apple ID.
   4. Add a calendar reminder: the certificate expires after one year and must be renewed with the same Apple ID.

---

Step 2. Enrollment restrictions

Intune > Devices > Enrollment > Device platform restrictions

Android

1. Android tab > Create restriction. Name: contoso - Android - Work profile only.
2. Android Enterprise (work profile): Allow. Personally owned: Allow.
3. Android device administrator: Block.
4. Assign to MDM-Pilot-Users > Create.

iOS

1. iOS/iPadOS tab > Create restriction. Name: contoso - iOS - Allow enrollment.
2. Platform: Allow. Personally owned: Allow (set Block if only company iPhones may enroll).
3. Assign to MDM-Pilot-Users > Create.

Device limit: Device limit restrictions > Create > limit 3 per user > assign to the group.

Later, when all users are in scope, also edit the Default platform restriction so device administrator is blocked for everyone.

---

Step 3. Android: block copy between work and personal profile

Intune > Devices > Android > Configuration > Create > New policy

• Platform: Android Enterprise
• Profile type: Templates > Device restrictions under Personally-Owned Work Profile
• Name: contoso - Android - Work profile data separation

Work profile settings:

Password / Work profile password: require a work-profile PIN (6 digits minimum), or rely on the device PIN in the compliance policy.

Assign to MDM-Pilot-Users > Create.

---

Step 4. iOS: block company files opening in personal apps

Intune > Devices > iOS/iPadOS > Configuration > Create > New policy > Templates > Device restrictions Name: contoso - iOS - Managed data

App Store, Doc Viewing, Gaming:

Assign to MDM-Pilot-Users > Create.

These settings only apply to apps Intune installed as managed (Step 5). Apps the user installed themselves are unmanaged.

---

Step 5. Required apps

Android (Apps > Android > Add > Managed Google Play app): approve and add Microsoft Outlook, Microsoft Teams, Microsoft OneDrive, Microsoft Edge, Microsoft Word, Excel, PowerPoint, and Microsoft Authenticator. Assign each as Required to MDM-Pilot-Users. They install into the work profile automatically.

iOS (Apps > iOS/iPadOS > Add > iOS store app): add the same apps plus Microsoft Authenticator (required on iPhone: it passes the device identity to Outlook and Teams). Assign as Required to MDM-Pilot-Users.

If the user already installed Outlook from the App Store, Intune asks the user to let it take over management. Tell them to tap Manage when prompted.

---

Step 6. iOS: single sign-on extension (needed for Safari/Edge)

Intune > Devices > iOS/iPadOS > Configuration > Create > Templates > Device features

• Name: contoso - iOS - Enterprise SSO
• Single sign-on app extension > SSO app extension type: Microsoft Entra ID
• Assign to MDM-Pilot-Users > Create.

Without it, the browser on an enrolled iPhone sends no device identity and is blocked.

---

Step 7. Compliance policies

Intune > Devices > Compliance > Create policy

Android: Platform Android Enterprise > Profile Personally-owned work profile. Name contoso - Android - Compliance.

iOS: Platform iOS/iPadOS. Name contoso - iOS - Compliance.

Assign both to MDM-Pilot-Users.

---

Step 8. App protection policies (copy-paste block inside Office apps)

Intune > Apps > Protection > Create policy. Make one for Android and one for iOS/iPadOS with the same values.

Apps: Target all app types > Selected public apps: Outlook, Teams, OneDrive, Edge, Word, Excel, PowerPoint, SharePoint, Microsoft 365 (Office).

Data protection:

"Policy managed apps with paste in" means: text can be pasted into Outlook from anywhere, but text copied from Outlook can only be pasted into other company apps.

Access requirements:

Conditional launch:

Assign to MDM-Pilot-Users > Create.

---

Step 9. Conditional Access policy 1: require a managed phone

Entra > Protection > Conditional Access > Policies > New policy Name: contoso - Mobile - Require compliant device

Do not forget the Intune exclusions. Without them, an unenrolled phone cannot enroll, because Company Portal itself gets blocked.

---

Step 10. Conditional Access policy 2: Android work profile only

This blocks personal-side Android apps and phones enrolled the old way, even during a compliance grace period.

Name: contoso - Android - Block outside work profile

---

Step 11. Check the pilot user's existing per-user rule

Her rule contoso - Maya-Chen - Blocked Other Devices still applies, and a sign-in must pass every policy.

• Her Pixel 8 (<entra-device-id>) is already in her rule, so it passes.
• Any new phone she enrolls stays blocked by her rule until its Entra Device ID is added.

Choose one:

• Keep IT approval per phone: leave her rule as is and add new phone IDs (see the per-device section of the internal mobile runbook).
• Let compliance decide on phones: edit her rule > Device platforms > Include Windows and macOS only. Phones are then governed by Steps 9–10.

While editing, also add Microsoft Intune Enrollment and Microsoft Intune to her rule's excluded resources and add the break-glass exclusion. The exported policy has neither.

---

Step 12. Enroll the pilot phone (with the user)

Android

1. Play Store > install Intune Company Portal > sign in with maya.chen@contoso.com.
2. Tap Begin > accept > the phone creates the work profile. Set the work PIN if asked.
3. Wait for the work apps (briefcase icon). Open work Outlook and sign in.
4. Company Portal > Devices > this phone > Check status > Compliant.

iPhone

1. App Store > install Intune Company Portal and Microsoft Authenticator.
2. Company Portal > sign in > Begin > Download profile.
3. Settings > Profile Downloaded > Install. Then Settings > General > VPN & Device Management to confirm it is installed.
4. Back in Company Portal > finish > wait for Compliant. Accept the prompts to let Intune manage Outlook and Teams.
5. Authenticator > add the work account.

---

Step 13. Test in Report-only

Entra > Monitoring > Sign-in logs > filter User = Maya > open each entry > Report-only tab.

Copy-paste tests (these work as soon as Steps 3, 4 and 8 reach the phone, even with Conditional Access still in Report-only):

---

Step 14. Switch On and roll out

1. When every row in Step 13 is right, open each policy > Enable policy: On > Save.
2. Revoke Maya's sessions so old phone sign-ins stop: Entra > Users > Maya > Revoke sessions.
3. Retest one allowed and one blocked case.
4. Roll out: add users to MDM-Pilot-Users one at a time, ask them to do Step 12, check their sign-in logs.
5. When everyone is in, you can change Steps 9–10 from the group to All users (keep the break-glass and Global Administrator exclusions) and assign the Intune policies to All users.

Rollback: set the Conditional Access policy to Off (takes effect within minutes). App protection policies can be unassigned without touching access.

---

Step 15. Troubleshooting

---

The one-paragraph version

Enroll first (Company Portal / work profile), then gate access on compliance with Conditional Access in Report-only, then lock the data itself with app protection and work-profile restrictions so copy, paste, save and share only ever move between company apps. Test everything while the policies only report, flip them On once every row passes, and roll out one user at a time. Every name, ID and device in this post is a placeholder — swap in your own tenant, pilot user and device IDs before you touch production.