Skip to content

Microsoft Intune App Protection for Iristick.Teams

Iristick.Teams has the Microsoft Intune App SDK built into both the Android and the iOS app, from version 2.3.9 onwards. That means you can apply Intune app protection policies to Iristick.Teams the same way you do for Outlook or the Microsoft Teams app, and you can require them in Conditional Access before anyone signs in.

The practical result is that fieldworkers can use their own phones without enrolling them in your MDM. The company data inside Iristick.Teams stays under your policy, and the rest of the phone stays personal.

Why app protection instead of device enrollment

Many fieldworkers carry a personal phone, and many of them refuse to enroll it, because enrollment gives the company control over the whole device. App protection, also called MAM (mobile application management), solves that by managing the app instead of the phone. Your policy applies inside Iristick.Teams only, and a selective wipe removes the company data from the app without touching photos, messages or other apps.

Device enrollment (MDM) App protection (MAM)
What you manage The whole phone The Iristick.Teams app
Works on personal phones Only if the worker agrees to enroll Yes, no enrollment needed
Wipe Full or corporate wipe of the device Selective wipe of company data in the app
Conditional Access grant Require device to be marked as compliant Require app protection policy

You can also combine the two. App protection policies apply on enrolled phones as well, which some organizations use to add data controls on top of device compliance.

App protection works the same in both deployments. Out-of-the-box and self-hosted Iristick.Teams use the same public app from Google Play and the App Store, so the Intune App SDK and every setting on this page apply to both.

The smart glasses stay outside both models. They are a cabled accessory with no operating system or account of their own, so the policy that protects the app on the phone already covers the pair. See Device Management and MDM for the full explanation.

What you can enforce

Because the SDK is in the app, Iristick.Teams respects the standard Intune app protection settings. The settings most customers use are:

  • Access requirements, such as an app PIN or biometric unlock before the app opens, and a recheck after a period of inactivity
  • Data transfer limits, such as blocking copy and paste or sharing from Iristick.Teams into unmanaged apps
  • Conditional launch, such as blocking the app on jailbroken or rooted phones, or below a minimum OS or app version
  • Selective wipe, which removes the company data in Iristick.Teams when a worker leaves or loses the phone

Iristick.Teams does not add its own policy layer on top of Intune. What your policy allows or blocks is decided in the Intune admin center.

Set up an app protection policy

Make sure your users run Iristick.Teams 2.3.9 or later. Earlier versions do not include the Intune App SDK and are blocked by a Conditional Access policy that requires app protection.

You need the Intune Administrator role, or a role with equivalent rights over app protection policies, and the users need an Intune license.

  1. Open the Microsoft Intune admin center and go to Apps > App protection policies > Create policy.
  2. Create one policy for Android and one for iOS/iPadOS. The settings are platform-specific.
  3. Under Apps, choose Select custom apps and add Iristick.Teams by its app identifier. On Android this is the package name com.iristick.teams, and on iOS the bundle ID com.iristick.apps.teams.
  4. Configure the data protection, access requirement and conditional launch settings you need.
  5. Assign the policy to the user groups that use Iristick.Teams.

The policy reaches the app the next time the user signs in. No configuration in the Iristick.Teams app itself is needed.

What the phone needs

Intune app protection relies on a Microsoft broker app on the phone, which handles the policy check without enrolling the device.

The Intune Company Portal app must be installed. The user does not need to sign in to it or enroll the phone. It only needs to be present so the policy can be delivered.

The Microsoft Authenticator app must be installed if you require app protection in Conditional Access. Without Conditional Access, the policy is delivered through the Intune App SDK in Iristick.Teams directly.

Require app protection in Conditional Access

To block sign-in from any phone where the policy is not applied, create a Conditional Access policy in Microsoft Entra ID:

  1. Go to Entra ID > Protection > Conditional Access > Create new policy.
  2. Target the users or groups who use Iristick.Teams.
  3. Under Target resources, select the cloud apps the policy covers. Office 365 is the common choice.
  4. Under Conditions > Device platforms, include Android and iOS.
  5. Under Grant, select Require app protection policy.

Iristick.Teams passes this grant because it carries the Intune App SDK. Apps without the SDK are blocked outright, which is why you do not need to exclude Iristick.Teams from this kind of policy.

Test with one group first

Assign both the app protection policy and the Conditional Access policy to a small pilot group, and run the policy in Report-only mode for a few days. The sign-in logs then show which users would have been blocked before you enforce it.

What the user sees

What the user sees depends entirely on the policy you configure. Iristick.Teams adds no prompts of its own, so the user only meets the Intune requirements you set, such as a PIN code or biometric unlock when the app opens.

If your policy blocks an action, such as sharing a captured photo into an unmanaged app, the user gets the standard Intune message explaining that the action is not allowed. Test your policy with a pilot group first so you know what your fieldworkers will see before rollout.

Troubleshooting

Symptom Likely cause Fix
Sign-in blocked with a message to install a broker app Company Portal (Android) or Authenticator (iOS) missing Install the broker app on the phone, no enrollment needed
Policy does not apply App older than 2.3.9, policy not assigned to the user, or user has no Intune license Update Iristick.Teams, check the assignment and the license, then sign out and back in
Sign-in blocked after enabling Conditional Access Policy applied to the user but not yet received by the app Open Iristick.Teams once with the broker app installed so the policy can register, then retry
App asks for a PIN the user did not expect Access requirement set in the app protection policy Expected behavior, adjust the policy if needed

For other sign-in errors, see IT Admin Troubleshooting.