iOS Outlook and Teams Multiple Managed Accounts MAM available
A long-awaited feature has now become available, as highlighted in the “What’s new in Intune” update for the week of July 13. This update introduces support for Multiple Managed Accounts (MMA) in app protection (MAM) apps. Currently, this capability is limited to iOS.
The following sections explain what MMA is and outline some of the issues that have encountered will added multiple managed accounts. It is important to note that, according to the Microsoft documentation, this feature is still being rolled out gradually.
Multiple Managed Accounts (MMA)
With the Multiple Managed Accounts (MMA) feature, it is now possible to add more than one MAM-protected account to supported applications. This has been a long-requested capability and represents a major improvement. Before MMA support, only a single MAM-protected account could be added to a protected app. When an additional account was added, a notification appeared requiring the removal of one account because only one managed account was allowed.
Enable MMA, Supported Accounts and Apps
Within the tenant or Intune, MMA does not require any additional configuration. Support is built into compatible applications. At the time of writing, this feature is still being rolled out, so it may not yet be available in every tenant.
Currently, only iOS is supported with the following apps and versions:
- Microsoft Teams v8.10.0 or later
- Microsoft Outlook v5.2626.0 or later
The following account configurations are supported for MMA:
- Multiple MAM accounts
- One account with MDM + MAM and one account with MAM (multiple MDM + MAM accounts are not supported)
Apps that support MMA handle managed accounts in the following two ways:
- Segmented view: Teams
Apps show data for one account at a time. This view, and therefore app enforcement restrictions, are triggered when switching between accounts and views. - Mixed view: Outlook
Apps show data for multiple accounts in a shared view. Policy enforcement for app access and conditional launch is applied when the app opens, and the policies for each account are evaluated independently.
The Microsoft document also stated an importance notice for the Mixed view:
Mixed views always enforce a full lockdown (most restrictive behavior), regardless of individual account policies. In a mixed view, cut, copy, and paste are fully blocked (including within the app view), screen capture and screenshots are blocked, and other data protection controls default to the most restrictive behavior. This applies even if a single managed account policy would otherwise allow these actions.
User Experience in Teams
The user experience in Teams is straightforward. When the tenant supports MMA and a compatible client is used, a second account can be added in the Teams application, prompting the user to enter the corresponding credentials.
Once the account is added, it becomes possible to switch between accounts in the app. This screen also showcases the Segmented View in action.
When switching between accounts, the app restrictions configured at the tenant level will automatically apply. In the screenshot below, one organization allows screen capture while the other does not. This demonstrates that, with a segmented view, the in-app experience can differ based on the app restrictions defined for each tenant.
User experience Outlook
During testing, several issues were encountered with Outlook, The first issue was that Outlook did not allow adding an additional account. These accounts were the same ones used for Teams, and the Outlook app itself was a supported version.
Removing the existing account from Outlook resolved this issue, after which it was possible to add multiple MMA accounts.
In the app it is possible to switch between accounts, and this also shows a difference in behavior. For one account it is possible to take a screenshot of the inbox, while for the other account this is not allowed, exactly as expected. The difference compared to the Teams and Outlook apps is that in Outlook it is only possible to take screenshots of mailbox folders such as Inbox or Sent Items. When navigating to the overview or the settings, taking screenshots is blocked.
Outlook problems
As mentioned above, some issues were encountered with Outlook due to different App Protection settings in the tenant. When the inactivity time interval was reached, a prompt appeared to enter credentials for the other Outlook account. After entering these credentials, error messages were displayed and the mailbox could not be opened resulting into removal of the mailbox in Outlook. Disabling the setting that required Work or school account credentials for access resolved these issues.
Recap
With MMA support now available for Outlook and Teams on iOS, it is now possible to use multiple MAM-protected accounts within the supported apps. Teams offers a clearly separated experience, applying the appropriate policies when switching between accounts, while Outlook uses a combined view where the most restrictive protection settings are enforced.
In testing, Teams behaved as expected, but Outlook presented some issues when adding accounts and with certain App Protection settings. After removing the existing account and adjusting the credential requirement setting, multiple managed accounts could be used successfully.
As the feature is still being rolled out, availability and behavior may vary by tenant and app version.