Today app protection policies (APP) and app configuration policies (ACP) are scoped by platform, user group and applications only. Starting in Intune’s May (2305) release, APP and ACP will support assignment filters for both enrolled and unenrolled devices to allow granularity in app policy assignment. Filters will allow flexibility when assigning Intune policies and apps, and this new capability will enable IT admins to do things like:

1. Target APP and managed apps ACP based on device OS version
2. Target APP and managed apps ACP to specific device models or device manufacturers
3. Target different managed apps ACP based on device management type, including unmanaged devices

[How this will affect your organization:]

Your existing policies will stay as is, however, we recommend you move your policies to filters with MAM to use the assignment granularity it provides.

There are a few other changes in the admin center and when using Microsoft Graph API:

1. For APP, the device management type targeting in the “Apps” tab will move to assignment filters.
2. When creating a new policy or editing an existing policy, you will need to create an assignment filter to target by device management type.
3. APP and ACP reporting will be updated to reflect this change.
4. Intune will block the Graph API “Target to apps on all device types” and “Device Types”.
5. For Assignment Filters, you will now be able to create “Managed app” assignment filter types. These apply to both APP and managed apps ACP.

[What you need to do to prepare:]

Update your scripts and IT admin user guides. You will see banners/changes in the admin center and updated documentation as this new functionality rolls out and you may want to move to a more granular policy assignment.