# Require Approved Client Apps > This Conditional Access Policy requires users to access resources only through approved client apps or apps protected by app protection policies. This Conditional Access Policy requires users to access resources only through approved client apps or apps protected by app protection policies. It helps ensure that organizational data is accessed securely and only through trusted applications. ## Settings this baseline controls | Setting | What it does | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Policy name | Specifies a display name for the Conditional Access Policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | | Enable policy | Specifies the state of the conditional Access Policy. Possible values are: enabled, disabled, enabledForReportingButNotEnforced. Required. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | | Included users | User IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | | Included roles | Role IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | | Included groups | Group IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | | Included guest types | Guest or external user types in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | | Excluded users | User IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | | Excluded roles | Role IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | **5 more settings** | Setting | What it does | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Excluded groups | Group IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | | Excluded guest types | Guest or external user types excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | | Grant controls | List of values of built-in controls required by the policy. Possible values: block, mfa, compliantDevice, domainJoinedDevice, approvedApplication, compliantApplication, passwordChange, unknownFutureValue [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | | Included device platforms | Possible values are: android, iOS, windows, windowsPhone, macOS, linux, all, unknownFutureValue. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | | Client app types | Client application types included in the policy. Possible values are: all, browser, mobileAppsAndDesktopClients, exchangeActiveSync, easSupported, other. Required. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-policy-approved-app-or-app-protection) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this baseline when mobile users should reach Microsoft 365 only through an app that's either approved or wrapped in an Intune app protection policy. It's the usual way to protect data on personal Android and iOS devices without enrolling the whole device. 1. Add the baseline to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or carry it in a scheme you deploy to every tenant you manage (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. Leave **Included users** covering everyone, and use **Excluded users** or **Excluded groups** for your organisation's break-glass accounts. 3. Leave **Included device platforms** set to Android and iOS, the personal-device platforms this policy is meant for. 4. Leave **Grant controls** set to require an approved client app or an app protection policy, satisfying either one. Requiring both together is stricter, but only works once every affected app supports app protection policies. 5. **Save.** Turn on **Auto-remediation** if you want Octiga to reapply the policy whenever it's changed in Microsoft 365, so Android and iOS users keep needing an approved app or Intune app protection. > **Caution:** Set up an Intune app protection policy for the apps you're protecting before this baseline takes effect for them. Without one, users on the affected platforms lose access to those apps rather than being nudged toward an approved app. > **Licence: Entra ID P1 or P2:** This baseline needs Entra ID P1 or P2 on the tenant. Without it, Octiga excludes the baseline rather than reporting it as deviated — see [Licence requirements](https://docs.octiga.io/reference/licence-requirements/). ## Check it worked After the next sync, this baseline shows **Passing** once a policy with `state` set to `enabled` and the approved-app-or-app-protection grant controls exists in Microsoft Entra. You can confirm it in the Microsoft Entra admin centre under **Entra ID > Conditional Access > Policies**. The next time end users sign in from an affected Android or iOS device, they're prompted to install a broker app (Microsoft Authenticator or Company Portal) and use an approved client. ## Standards this addresses ### CIS - **v8 4.1** — CIS Controls v8 Safeguard 4.1 - **v8 3.6** — CIS Controls v8 Safeguard 3.6 ### NIST - **PR.DS-5** — NIST CSF 2.0 PR.DS-5 - **SC-7** — NIST SP 800-53 SC-7 - **AC-20** — NIST SP 800-53 AC-20 ### ISO 27001 - **A.8.12** — ISO/IEC 27001:2022 Annex A.8.12 - **A.8.13** — ISO/IEC 27001:2022 Annex A.8.13 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)