Outlook, Teams and Edge on company Android without Intune

You run Microsoft 365, and your company Android devices are managed by an Android Enterprise MDM that isn't Intune. Maybe you're moving away from Intune, or you never licensed it. Either way, you still need Outlook to find the right mailbox on first launch, Teams to accept only work accounts, and Edge to open the right intranet page and block the rest.

Most of that is possible without Intune. Microsoft documents a set of managed configuration keys for Outlook, Teams, Edge and Microsoft Launcher on Android. Any Android Enterprise MDM can deliver them through the operating system. Some protections do depend on Intune, though. This guide separates the two so you can explain the trade-off to your directors.

You will set up account pre-configuration in Outlook, the account and sign-in keys in Teams, browsing controls and kiosk settings in Edge, and Microsoft Launcher as a home screen. Then you'll see what you give up without Intune App Protection and how to move existing Intune app configuration policies to managed configurations.

Leaving Intune? Read Moving the settings over when you leave Intune first and build your mapping sheet. Then work through Steps 1 to 6 using the values from that sheet instead of starting from scratch.

Before you start: managed configurations vs Intune App Protection

These two mechanisms are easy to confuse, and much of the confusion comes from key names.

• Android managed configurations (also called app restrictions) are part of Android Enterprise. Your MDM sends a set of keys and values to an app installed from managed Google Play, and the app reads them from the Android restrictions bundle. Microsoft calls this the "OS channel" or "managed devices" channel. Any Android Enterprise MDM can use it.
• Intune App Protection (MAM) is Microsoft's app-level policy layer. It is built into Microsoft apps through the Intune App SDK and is enforced only when an Intune app protection policy targets the user. Copy/paste controls, save-as restrictions and conditional launch checks belong here. It needs Intune.

The key names are what trip people up. Some keys that start with com.microsoft.intune.mam work through the OS channel anyway. The most important example is com.microsoft.intune.mam.AllowedAccountUPNs, which is named after Microsoft's SDK but which Outlook and Teams read from the Android restrictions bundle. Use this rule instead of the prefix: keys with IntuneMAMOnly in the name need an Intune app protection policy. Microsoft documents the other keys covered in this guide for devices managed through the OS channel.

Prerequisites

• Devices enrolled in Android Enterprise in an MDM that supports managed configurations. Note which mode each device uses: fully managed, dedicated, or work profile. Edge kiosk mode in Step 4 is meant for dedicated devices.
• Your managed Google Play account bound to the MDM, so you can approve Outlook, Teams, Edge and Microsoft Launcher.
• A Microsoft Entra account with an appropriate Microsoft 365 licence for each user who will sign in to Outlook and Teams.
• Microsoft's configuration documentation open on learn.microsoft.com for each app, so you can check value formats.
• One test device that you can wipe and re-enrol.

Note: Key names are case sensitive. If you type edgeenablekioskmode instead of EdgeEnableKioskMode, the app ignores it and shows no error. Pick keys from your MDM's managed configuration form, which is generated from the app's own schema, rather than typing them by hand.

Step 1: Approve the Microsoft apps and add them to your policy

1. In your MDM console, open managed Google Play and approve Microsoft Outlook (com.microsoft.office.outlook), Microsoft Teams (com.microsoft.teams), Microsoft Edge (com.microsoft.emmx) and, if you plan to use it, Microsoft Launcher (com.microsoft.launcher).
2. Add each app to a test policy that only your test device uses, not to the policy your whole fleet runs. Set the install type to required or force-installed so the app arrives without user action.
3. Open each app's managed configuration form. You should see a list of keys that matches Microsoft's documentation.

Expected result: Every app you added appears in the policy, and each one shows an editable managed configuration form. If a form is empty, the app hasn't been approved in managed Google Play yet, or the console hasn't fetched its schema.

Warning: Managed configurations reach only copies of the app installed through managed Google Play in the managed profile or on a fully managed device. If a user installs Outlook in their personal profile, that copy receives nothing.

Step 2: Pre-configure the Outlook account and lock the settings you care about

1. Account setup. Set com.microsoft.outlook.EmailProfile.EmailAddress to the user's email address, together with the keys in the next items.
2. com.microsoft.outlook.EmailProfile.EmailUPN: the user's sign-in UPN. This is often the same as the email address, but not always.
3. com.microsoft.outlook.EmailProfile.AccountType: the account type Microsoft documents for your mailbox. For Exchange Online with modern authentication, Microsoft documents ModernAuth.
4. Allowed accounts. Set com.microsoft.intune.mam.AllowedAccountUPNs to the work account or accounts Outlook may add. Microsoft documents this key for devices managed through the OS channel. Check Microsoft's page for the exact delimiter if you list more than one UPN.
5. Mail behaviour. Choose Focused Inbox, external image blocking and suggested replies in the form. Microsoft also documents keys for contacts and calendar sync, and for S/MIME if you use signed or encrypted mail.
6. Lock what matters. Many Outlook keys have a companion key ending in .UserChangeAllowed. Set it to false for anything users shouldn't change, such as external image blocking. Leave it true for preferences like Focused Inbox if you only want to set a default.

Expected result: On first launch, Outlook shows the work account it found. The user taps to add it and signs in with their Microsoft Entra credentials. Adding an account that isn't in the allowed list is refused, and users can't change the settings you locked.

Note: Pre-configuration doesn't bypass authentication. The user still signs in, and MFA and any sign-in policies you have in Entra ID still apply.

Step 3: Configure Teams for shared and frontline devices

Microsoft documents three Teams keys that work without Intune:

1. com.microsoft.intune.mam.AllowedAccountUPNs restricts Teams to the work accounts you list. Microsoft states that this account restriction works with any UEM on enrolled devices. Single-user devices: set it to that user's UPN, using a per-user variable if your MDM has one.
2. Shared devices: the value has to include every worker who signs in on that device. Check Microsoft's page for the list delimiter. If you can't keep that list current, leave the key unset on shared devices and record the trade-off in your decision log.
3. domain_name sets your sign-in domain, so workers don't need to type the full UPN.
4. enable_numeric_emp_id_keypad shows a numeric keypad at sign-in. On shared devices where workers sign in with a numeric employee ID, this speeds up sign-in.

Teams also has three notification-content keys, which control what appears in notifications. All three end in IntuneMAMOnly. Without an Intune app protection policy they have no effect, so don't rely on them to hide message previews on a shared device.

Expected result: On a shared device, the Teams sign-in screen shows a numeric keypad and the worker enters their employee ID. If you set AllowedAccountUPNs, Teams accepts only the accounts on that list.

Step 4: Configure Edge for browsing control, kiosks and shared devices

1. Allow and block. Use URLAllowlist and URLBlocklist to control which sites can open. On a task device, a short allowlist is usually easier to maintain than a long blocklist.
2. Start points. Use ManagedFavorites to push bookmarks to the intranet, HR portal and ticketing tool. Use EdgeNewTabPageCustomURL to set the new tab page.
3. Security defaults. Turn on SmartScreenEnabled and EdgeDefaultHTTPS.
4. Kiosk and locked view. On dedicated devices, EdgeEnableKioskMode runs Edge as a kiosk browser. EdgeShowAddressBarInKioskMode controls whether users see the address bar, and EdgeLockedViewModeEnabled limits navigation inside the browser. Pair these with IdleTimeout so an unattended session resets. Check Microsoft's page for the time unit.
5. Shared-device hygiene. Set EdgeBlockSignInEnabled and EdgeSyncDisabled so nobody signs a profile into a shared browser. Turn off PasswordManagerEnabled, restrict InPrivateModeAvailability, and turn on SavingBrowserHistoryDisabled. Use the values Microsoft documents for each.

Expected result: Edge opens to your chosen page, shows your managed favorites, refuses blocked sites, and on kiosk devices hides the controls you disabled. Signing in to Edge is blocked for all accounts, work and personal. That is intended on a shared device. Don't set EdgeBlockSignInEnabled on single-user devices where people need their work profile in Edge.

Note: Edge also has Intune app protection keys, documented separately. Like the Outlook and Teams IntuneMAMOnly keys, they do nothing without Intune.

Step 5: Use Microsoft Launcher as the home screen (optional)

Use this if you want a Microsoft-styled home screen instead of your MDM's kiosk launcher.

1. Remove the competing launcher. Turn off your MDM's kiosk launcher in the policy for these devices. Pick one home screen per device, because running Microsoft Launcher alongside an MDM kiosk launcher causes conflicts.
2. Make it the default home app. If your MDM policy can set a default home app, set it to Microsoft Launcher. If it can't, press Home on the device, choose Microsoft Launcher, and tap Always.
3. Configure the layout with these keys. HomeScreen.Applications: which apps appear.
4. AppOrder: their position.
5. WebLinks: shortcuts to web pages.
6. Wallpaper.URL: a company wallpaper. The image URL must be reachable from the device's network.
7. Dock.Mode: dock behaviour.
8. Feed.Enabled: whether the feed panel is available.

Expected result: Pressing Home or rebooting brings up Microsoft Launcher with your app layout, wallpaper and web links. For single-purpose devices, an MDM kiosk is usually the simpler choice.

Step 6: Test on one device before you roll out

1. Wipe and re-enrol a test device into the test policy you created earlier, which no other device uses.
2. Wait for the apps to install, then launch Outlook, Teams and Edge in that order. Check each expected result above.
3. Try to break each setting: add a personal account in Outlook and in Teams, open a blocked URL, change a locked Outlook setting, and try to sign in to Edge on a shared device.
4. Record what works and what doesn't before you widen the group. Use the Troubleshooting FAQ below for anything that fails.

Expected result: Every setting behaves as configured. Anything that doesn't usually comes down to a typo, a wrong value type, or a key that turns out to be Intune-only.

What you lose without Intune, stated plainly

Managed configurations shape how the apps are set up. They don't govern what users can do with the data inside them. Without Intune App Protection, you don't get:

• Data transfer controls: restricting copy/paste out of Outlook or Teams, and blocking "Save as" to unmanaged locations.
• Notification content controls: the IntuneMAMOnly keys that hide message content in notifications.
• Conditional launch and access requirements: app-level checks such as an app PIN, minimum OS or app version, or blocking rooted devices before the app opens.
• App-level selective wipe of corporate data in those apps.

Conditional Access in Microsoft Entra ID is separate from all of this. Policies that require an Intune-compliant device or an app protection policy rely on Intune signals. Neither managed configurations nor a different MDM replaces Intune App Protection or that type of Conditional Access. Review those policies before the move: they will block sign-in from devices that are no longer managed by Intune.

You do still have Android Enterprise itself. A work profile separates work and personal apps at the OS level, a fully managed or dedicated device lets you control the whole device, and device-level restrictions are set by policy. Whether that is enough depends on your data classification. Write the decision down: list which of the controls above you are giving up, the risk each one covered, and the compensating control you're using instead. That record is what your directors will ask for.

Moving the settings over when you leave Intune

1. Export what you have. In the Intune admin center, list every app configuration policy for Outlook, Teams, Edge and Microsoft Launcher. Note each policy's type. Managed devices policies already use the OS channel. Managed apps policies go through the Intune App SDK. Finish this list before you retire Intune, because these policies are the source of your mapping.
2. Map each key. Build a spreadsheet with four columns: key, value, source policy type, and destination. Keys from managed devices policies map directly to managed configurations in your new MDM.
3. For keys from managed apps policies, check Microsoft's page to see whether the same key is documented for the OS channel. If it is, move it. If it contains IntuneMAMOnly or is documented for app protection only, mark it as lost and record it in your decision log.
4. Intune token variables (for example, the user's UPN) have to be replaced with your MDM's variables or with explicit values. Plan the move itself too: a device is managed by a single Android Enterprise MDM, so each device needs its work profile removed, or a factory reset, before it is enrolled in the new MDM.
5. Test on one device exactly as in Step 6, then move a pilot group before the full fleet.

Expected result: A mapping sheet where every former Intune setting is either moved, replaced, or knowingly dropped, plus one device that behaves like the old Intune setup for everything that moved.

Troubleshooting FAQ

Outlook doesn't show the pre-configured account on first launch.

Check that Outlook was installed from managed Google Play into the managed profile, and that com.microsoft.outlook.EmailProfile.EmailAddress, EmailUPN and AccountType are all set with the correct case. If the user opened Outlook before the configuration arrived, clear the app's data or reinstall the app, and launch it again.

Users can still add a personal account.

Check that com.microsoft.intune.mam.AllowedAccountUPNs is set on that specific app (Outlook and Teams each need their own), and that the value matches the user's UPN exactly. A typo in the domain means no account matches.

A shared-device worker can't sign in to Teams.

If AllowedAccountUPNs is set on that device, the worker's UPN must be on the list. Add it, or remove the key on shared devices as described in Step 3.

The Teams notification keys have no effect.

That's expected. The notification-content keys end in IntuneMAMOnly and require an Intune app protection policy.

Users can't sign in to Edge at all.

EdgeBlockSignInEnabled blocks all Edge sign-in, including work accounts. Remove it from policies for single-user devices.

Edge kiosk settings are ignored.

Confirm the device is enrolled as a dedicated device, check the exact case of EdgeEnableKioskMode, and make sure no other launcher is fighting Edge for the foreground.

A setting I locked can still be changed.

Locking needs the matching .UserChangeAllowed companion key set to false. Setting the main key alone only sets a default.

The app's managed configuration form is empty.

The app may not be approved in managed Google Play yet, or the console hasn't fetched its schema. Approve the app, refresh, and reopen the form.

Can I get copy/paste restrictions without Intune?

Not inside Outlook or Teams through managed configurations. At the OS level, Android Enterprise policies can restrict data sharing between the work profile and the personal profile, which can be a compensating control. Record it as such in your decision log.

How to set these in Nomid

In Nomid MDM, you add the app from managed Google Play to a policy and open its managed configuration. Nomid shows the app's managed configuration form, so you choose keys instead of typing them. Start with a test device on that policy, and move more devices onto it once the test passes. To check which keys each app exposes before you start, see the directory pages for Outlook, Teams, Edge and Microsoft Launcher.

If a pilot device doesn't receive an app, the worker can run the Check-up screen in the Nomid Settings app, if your policy shows its button. Its per-app install status covers only Nomid Store apps, so for Outlook, Teams and Edge from managed Google Play the useful rows are the Play Store and Google Play Services versions and whether the device reaches the Nomid servers. Failed rows offer a fix, and the check-up can be run again. The console shows when the last check-up ran, and each one is recorded in the device's command history. The free plan covers up to 10 devices with no time limit, which is enough to run this pilot.

Key takeaways and next steps

• Managed configurations come from any Android Enterprise MDM. Intune App Protection comes only from Intune. Check each key against Microsoft's documentation: IntuneMAMOnly in the name means it needs Intune app protection, while the com.microsoft.intune.mam prefix alone does not.
• Outlook account setup, allowed accounts and locked settings, the Teams sign-in keys, Edge browsing and kiosk controls, and the Microsoft Launcher layout all work without Intune.
• Copy/paste and save-as controls, notification content keys, conditional launch, and Conditional Access that depends on Intune are not available. Document that trade-off before you roll out.

Next steps: build your mapping sheet, configure one test device, and present your decision log alongside the result. To try this in Nomid, start on the free plan at nomidmdm.com and open the app directory pages linked above.