May 28, 2015 Android App Protection Policies Application Management Intune Intune App Wrapper Tool How to wrap Android Line of Business apps with Intune App Wrapping Tool Microsoft recently released the Microsoft Intune App Wrapping Tool for Android that allows you to take your Line of Business (LOB) apps and make them managed. However, there are occasions where an application you need is not made by Microsoft, is not in the Mac App Store, and is not supported by the Intune line of business App Wrapping Tool. Before we get into the details, it’s important that you understand the supportability of the process we are about to discuss. Intune is a unified endpoint management tool that offers a number of helpful mobility management functions, such as mobile device enrollment, mobile app wrapping and app protection. IT professionals must understand the benefits and use cases for these Intune app management controls and features before they try to deploy them across an organization. Windows application size is capped at 8 GB per app. Convert the Win32 app content. Use the Microsoft Win32 Content Prep Tool to pre-process Windows classic (Win32) apps. The tool converts application installation files into the.intunewin format. The tool also detects some of the attributes that Intune requires to determine the application.
-->
You can enable your apps to use app protection policies by using either the Intune App Wrapping Tool or the Intune App SDK. Use this information to learn about these two methods and when to use them.
Intune App Wrapping Tool
The App Wrapping Tool is used primarily for internal line-of-business (LOB) apps. The tool is a command-line application that creates a wrapper around the app, which then allows the app to be managed by an Intune app protection policy. When protecting an app provided by an independent software vendor (ISV) it's important to clarify if the ISV will still support the wrapped app.
You don't need the source code to use the tool, but you do need signing credentials. For more about signing credentials, see the Intune blog. For the App Wrapping Tool documentation, see Android App Wrapping Tool and iOS App Wrapping Tool.
The App Wrapping Tool does not support apps in the Apple App Store or Google Play Store. It also doesn't support certain features that require developer integration (see the following feature comparison table).
For more information about the App Wrapping Tool for app protection policies on devices that are not enrolled in Intune, see Protect line-of-business apps and data on devices not enrolled in Microsoft Intune.
Important
Intune regularly releases updates to the Intune App Wrapping Tool. Regularly check the Intune App Wrapping Tool repositories for updates and incorporate into your software development release cycle to ensure your apps support the latest App Protection Policy settings.
Reasons to use the App Wrapping Tool
- Your app does not have built-in data protection features
- Your app is deployed internally
- You don't have access to the app's source code
- You didn't develop the app
- Your app has minimal user authentication experiences
Supported app development platforms
| App Wrapping Tool | Xamarin | Cordova |
|---|---|---|
| iOS | Yes | Yes |
| Android | No - use the Intune App SDK Xamarin Bindings. | Yes |
Intune App SDK
The App SDK is designed mainly for customers who have apps in the Apple App Store or Google Play Store, and want to be able to manage the apps with Intune. However, any app can take advantage of integrating the SDK, even line-of-business apps.
To learn more about the SDK, see the Overview. To get started with the SDK, see Getting Started With the Microsoft Intune App SDK.
Reasons to use the SDK
- Your app does not have built-in data protection features
- Your app is deployed on a public app store such as Google Play or Apple's App Store
- You are an app developer and have the technical background to use the SDK
- Your app has other SDK integrations
- Your app is frequently updated
Supported app development platforms
| Intune App SDK | Xamarin | Cordova |
|---|---|---|
| iOS | Yes – use the Intune App SDK Xamarin Bindings. | No |
| Android | Yes - use the Intune App SDK Xamarin Bindings. | No |
Not using an app development platform listed above?
The Intune SDK development team actively tests and maintains support for apps built with the native Android, iOS (Obj-C, Swift), Xamarin, and Xamarin.Forms platforms. While some customers have had success with Intune SDK integration with other platforms such as React Native and NativeScript, we do not provide explicit guidance or plugins for app developers using anything other than our supported platforms.
Feature comparison
This table lists the settings that are enabled if an app uses the App SDK or the App Wrapping Tool. Some features require app developers to apply some logic outside of basic integration with the Intune SDK, and as such, are not enabled if the app uses the App Wrapping Tool.
Intune App Wrapping Tool For Android Download
| Feature | App SDK | App Wrapping Tool |
|---|---|---|
| Restrict web content to display in a corporate managed browser | X | X |
| Prevent Android, iTunes, or iCloud backups | X | X |
| Allow app to transfer data to other apps | X | X |
| Allow app to receive data from other apps | X | X |
| Restrict cut, copy, and paste with other apps | X | X |
| Specify the number of characters that may be cut or copied from a managed app | X | X |
| Require simple PIN for access | X | X |
| Specify the number of attempts before PIN reset | X | X |
| Allow fingerprint instead of PIN | X | X |
| Allow facial recognition instead of PIN (iOS only) | X | X |
| Require corporate credentials for access | X | X |
| Set a PIN expiry | X | X |
| Block managed apps from running on jailbroken or rooted devices | X | X |
| Encrypt app data | X | X |
| Recheck the access requirements after a specified number of minutes | X | X |
| Specify the offline grace period | X | X |
| Block screen capture (Android only) | X | X |
| Support for MAM without device enrollment | X | X |
| Full Wipe of app data | X | X |
| Selective Wipe of work and school data in Multi-Identity scenarios Note: For iOS/iPadOS, when the management profile is removed, the app is also removed. | X | |
| Prevent 'Save as' | X | |
| Targeted Application Configuration (or app config through the 'MAM channel') | X | X |
| Support for Multi-Identity | X | |
| Customizable Style | X | |
| On-demand application VPN connections with Citrix mVPN | X | X |
| Disable contact sync | X | X |
| Disable printing | X | X |
| Require minimum app version | X | X |
| Require minimum operating system | X | X |
| Require minimum Android security patch version (Android only) | X | X |
| Require minimum Intune SDK for iOS (iOS only) | X | X |
| SafetyNet device attestation (Android only) | X | X |
| Threat scan on apps (Android only) | X | X |
| Require maximum Mobile Threat Defense vendor device risk level | X | |
| Configure app notification content for organization accounts | X | X |
| Require use of approved keyboards (Android only) | X | X |
| Require app protection policy (Conditional Access) | X |
Intune App Wrapping Tool For Mac
Next steps
To learn more about app protection policies and Intune, see the following topics:
Intune App Wrapping Tool Windows
- Android app wrapping tool
- iOS app wrapping tool