MAM Policy Blocking Screen Capture for iOS & iPadOS Devices

After Microsoft announced support for Apple Intelligence, they introduced a feature to block screen capture for Mobile Application Management (MAM) protected apps. This caused issues for many organizations, and I needed to find a solution for my clients.

Table of Contents

The Issue

If you have Application Protection Policies set up in Microsoft Intune and have configured the ‘Send Org data to other apps‘ setting to a value other than ‘All apps‘, screenshots will be blocked for certain applications such as Outlook. The outcome will be a black screen when you attempt to take a screenshot. Below is an example screenshot where my client has it set to ‘Policy managed apps‘.

This Microsoft article states the following:

How do I know which Apps have been updated to v19.7.6 or later?

Intune Portal

Follow the steps to check the SDK versions in Intune.

1. In Intune, go to Apps > Monitor > App Protection Status.

2. Scroll to the right and look for iOS SDK Version. As per Microsoft, any apps with SDK version updated to 19.7.6 or later will be affected. I noticed during my testing, apps like Excel were not affected by the screenshot because their SDK version was below.

Edge Browser

1. Open Edge on your iPhone or iPad then type about:intunehelp in the URL and enter

2. Near the bottom of the page, there should be a link that says View Intune App Status. Click on the link.

3. Select the application and it should show info about the app including the SDK version. In this example, Outlook shows version 20.2.1 which would be affected.

The Solution

1. In Intune, go to Apps > App configuration policies. Click on Create > Managed apps.

2. Enter a Name, Description (Optional but recommended), Target policy to either All apps or specific apps. If you select specific apps, ensure they are iOS/iPadOS apps.

*Note: This policy will only apply to managed devices. There is currently no workaround for unmanaged/BYOD devices.

3. Skip the Settings catalog and click Next.

4. Enter the following then click Next.
   1. Name: com.microsoft.intune.mam.screencapturecontrol
   2. Value: Disabled

5. For group assignment, make sure to assign this to a User group then click Next. (If you assign it to a device group, it does not work)
   
   
6. Create the policy then wait for the policy to apply to the device. You can also sync your device in Intune to speed things up. After the policy applies successfully, you should be able to take screenshots again on your managed device.

Conclusion

This should resolve your issue for managed iOS and iPadOS devices. However, for unmanaged/BYOD devices, there is currently no workaround available unless you assign the policy to ‘All Apps‘.