Merge pull request #19322 from c-demello/patch-77

Enhance app protection policy settings for iOS

Author: nicholasswhite

intune/intune-service/apps/app-protection-policy-settings-ios.md

@@ -51,7 +51,7 @@ There are three categories of policy settings: *Data relocation*, *Access requir
 ### Functionality
 | Setting | How to use | Default value |
 |------|----------|-------|
-|  **Sync policy managed app data with native apps or add-ins** | Choose Block to prevent policy managed apps from saving data to the device's native apps (Contacts, Calendar and widgets) and to prevent the use of add-ins within the policy managed apps. If not supported by the application, saving data to native apps and using add-ins will be allowed.  <br><br>If you choose Allow, the policy managed app can save data to the native apps or use add-ins, if those features are supported and enabled within the policy managed app.<br><br>Applications might provide more controls to customize the data sync behavior to specific native apps or not honor this control. <br><br>**Note**: When you perform a selective wipe to remove work, or school data from the app, data synced directly from the policy managed app to the native app is removed. Any data synced from the native app to another external source isn't wiped. <br><br>**Note**: *The following apps support this feature: <ul><li>Outlook for iOS see [Deploying Outlook for iOS and Android app configuration settings](/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-configuration-with-microsoft-intune)</li>*</ul>  | **Allow**  |
+|  **Sync policy managed app data with native apps or add-ins** | Choose Block to prevent policy managed apps from saving data to the device's native apps (Contacts, Calendar and widgets) and to prevent the use of add-ins within the policy managed apps. If not supported by the application, saving data to native apps and using add-ins will be allowed.  <br><br>If you choose Allow, the policy managed app can save data to the native apps or use add-ins, if those features are supported and enabled within the policy managed app.<br><br>Applications might provide more controls to customize the data sync behavior to specific native apps or not honor this control. <br><br>**Note**: When you perform a selective wipe to remove work, or school data from the app, data synced directly from the policy managed app to the native app is removed. Any data synced from the native app to another external source isn't wiped. <br><br>**Note**: The following apps support this feature: <ul><li>Outlook for iOS see [Deploying Outlook for iOS and Android app configuration settings](/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-configuration-with-microsoft-intune)</li><li>Microsoft Word, Excel and PowerPoint for iOS 2.100.829.3 or later. </li></ul>  | **Allow**  |
 | **Printing Org data** | Select **Block** to prevent the app from printing work or school data. If you leave this setting to **Allow**, the default value, users are able to export and print all Org data.  | **Allow**  |
 | **Restrict web content transfer with other apps** | Specify how web content (http/https links) is opened from policy-managed applications. Choose from: <ul><li>**Any app**: Allow web links in any app.</li><li>**Microsoft Edge**: Allow web content to open only in the Microsoft Edge. This browser is a policy-managed browser.</li><li>**Unmanaged browser**: Allow web content to open only in the unmanaged browser defined by **Unmanaged browser protocol** setting. The web content is unmanaged in the target browser.<br>**Note**: Requires app to have Intune SDK version 11.0.9 or later.</li></ul> If you're using Intune to manage your devices, see [Manage Internet access using managed browser policies with Microsoft Intune](manage-microsoft-edge.md).<br><br>If a policy-managed browser is required but isn't installed, a prompt appears for users to install Microsoft Edge.<p>If a policy-managed browser is required, iOS/iPadOS Universal Links are managed by the **Send Org data to other apps** policy setting. <p>**Intune device enrollment**<br>If you're using Intune to manage your devices, see Manage Internet access using managed browser policies with Microsoft Intune. <p>**Policy-managed Microsoft Edge**<br>The Microsoft Edge browser for mobile devices (iOS/iPadOS and Android) supports Intune app protection policies. Users who sign in with their corporate Microsoft Entra accounts in the Microsoft Edge browser application is protected by Intune. The Microsoft Edge browser integrates the Intune SDK and supports all of its data protection policies, except for preventing:<br><ul><li>**Save-as**: The Microsoft Edge browser doesn't allow a user to add direct, in-app connections to cloud storage providers (such as OneDrive).</li><li>**Contact sync**: The Microsoft Edge browser doesn't save to native contact lists.</li></ul><br>**Note**: *The Intune SDK can't determine if a target app is a browser. On iOS/iPadOS devices, no other managed browser apps are allowed.*    | **Not configured**  |
 |<ul>**Unmanaged Browser Protocol** | Enter the protocol for a *single* unmanaged browser. Web content (http/https links) from policy managed applications open in any app that supports this protocol. The web content is unmanaged in the target browser. <br><br>Use this feature only when you need to share protected content with a specific browser that Intune app protection policies don't enable. You must contact your browser vendor to determine the protocol supported by your desired browser.<br><br>**Note**: *Include only the protocol prefix. If your browser requires links of the form `mybrowser://www.microsoft.com`, enter `mybrowser`.*<br>Links are translated as:<br><ul><li>`http://www.microsoft.com` > `mybrowser://www.microsoft.com`</li><li>`https://www.microsoft.com` > `mybrowsers://www.microsoft.com`</li></ul> | **Blank**  |