The three control systems
- MDM (enrolled device): Intune owns the device; Teams is just an app on a compliant machine. Strongest posture, employee-phone politics.
- MAM / App Protection Policies (unenrolled, BYOD): policy wraps THE APP — PIN to open, no copy-paste to personal apps, no save-to-device, selective wipe of corp data only. The pragmatic BYOD default.
- Conditional Access: the gate that FORCES one of the above — 'require compliant device or approved client app with protection policy' is the standard pattern; without CA enforcement, MAM is a suggestion.
Behaviour ownership map: PIN prompt on open = MAM. Screenshot blocked = MAM (Android) / MDM restrictions. Can't sign in at all = CA (check which grant failed in sign-in logs). Attachments won't open in personal apps = MAM data-transfer rules. Notifications previewing less on mobile = app settings + MAM's 'org data in notifications' control.
Teams-mobile-specific realities
- Incoming calls vs OS: Teams calls surface via OS calling frameworks (CallKit et al.) — 'missed calls on mobile' triages battery optimisation and notification permissions BEFORE tenant config.
- The wipe that isn't: MAM selective wipe removes org data from the app — users report 'Teams logged me out and cleared itself' after offboarding automation runs; that's the system working.
- Quiet hours (
TeamsMobilityPolicy— in your scan — plus user settings) and frontline shift-based access controls decide after-hours behaviour; know the policy before fielding the works-council question.
What to watch (proofs)
- Which system blocked a user: Entra sign-in logs (CA grant failures name the missing control) then Intune's App protection status report (MAM check-in state per user/app) — the two reports, read in that order, end the finger-pointing.
- MAM policy reach: Intune > Apps > App protection policies > user status — protected vs unprotected Teams installs; the unprotected list is the CA gap list.
- Mobility policy truth:
Get-CsTeamsMobilityPolicy | fl(nightly scan) — cellular-use and mobile feature stances per instance. - The BYOD acceptance test: unenrolled phone + correct account → PIN prompt, blocked paste to personal notes, working calls — one scripted walkthrough per policy change.