Why this matters for SMB admins
Microsoft Intune’s mobile application management (MAM) service — also known as app protection policies (APP) — lets organizations protect corporate data inside apps like Microsoft Teams, Outlook, and Edge, even on personal (BYOD) devices that aren’t enrolled in mobile device management. That protection depends on apps being built with a current version of the Intune App SDK or wrapped with a current version of the Intune App Wrapping Tool, and on the Android Company Portal app being kept up to date.
Microsoft has published two confirmed dates in its Intune “in development” documentation that change how outdated SDK and app versions are handled. One date introduces a hard block. The other introduces a non-blocking warning. Getting the distinction right matters, because missing the first deadline can stop end users from opening apps they rely on every day.
This article also covers how Intune’s Android Play Integrity–related settings work today, since they’re closely related to app protection enforcement. However, the supplied Microsoft source material does not include a confirmed enforcement date or deprecation timeline specifically tied to Play Integrity changes, so that part of this article describes current documented behavior rather than an upcoming deadline.
Confirmed enforcement dates for MAM SDK versions
January 19, 2026 (or soon after): blocking enforcement
According to Microsoft’s Intune “in development” article, starting January 19, 2026, or soon after, Intune will require the following to be on current versions:
- iOS SDK-integrated apps — must use Intune App SDK for iOS version 20.8.0 or later for apps compiled with Xcode 16, or version 21.1.0 or later for apps compiled with Xcode 26.
- iOS wrapped apps — must use the Intune App Wrapping Tool for iOS version 20.8.1 or later for apps compiled with Xcode 16, or version 21.1.0 or later for apps compiled with Xcode 26.
- Android Company Portal — must be updated to version 5.0.6726.0 or later.
Microsoft’s documentation states plainly: if you don’t update to the latest versions, users will be blocked from launching the app. This applies to custom line-of-business (LOB) apps that organizations have integrated with the Intune SDK or wrapped with the Intune App Wrapping Tool, not just Microsoft’s own apps.
For Android, Microsoft notes that once at least one Microsoft application with the updated SDK is present on the device and the Company Portal app is current, Android apps update as part of that process — which is why the January 19, 2026 guidance is focused mainly on iOS SDK and wrapper updates.
Late June 2026: non-blocking warning for older iOS MAM SDK versions
Separately, Microsoft’s documentation describes a second, later change: starting in late June 2026, users opening iOS apps built with an Intune MAM SDK version earlier than 20.8.0 will see a warning message recommending they update. This warning has been described as appearing in apps such as Microsoft Teams, Outlook, Edge, and OneDrive.
Unlike the January 2026 change, this warning is non-blocking — according to Microsoft, users can dismiss the message and continue using the app.
What SMB admins need to do before each deadline
Before January 19, 2026
- If your organization has custom iOS LOB apps using the Intune App SDK or Intune App Wrapping Tool, confirm the build is on the correct minimum version for the Xcode version used (20.8.0/20.8.1 for Xcode 16, or 21.1.0 for Xcode 26).
- Confirm your Android users are running Intune Company Portal version 5.0.6726.0 or later.
- Notify users with iOS or Android app protection policies to update Microsoft and relevant third-party apps from the app stores before the deadline.
- Notify helpdesk and support teams about the change so they can recognize blocked-launch reports tied to outdated SDK or app versions.
Before and after late June 2026
- Treat the late June 2026 warning as an earlier signal to prompt users toward updated apps, since it is non-blocking and will not stop app use on its own.
- Continue monitoring which users are still running apps built on MAM SDK versions earlier than 20.8.0, since Microsoft’s documentation ties this warning specifically to that version threshold.
Using Conditional Launch settings to manage the transition
Microsoft Intune’s app protection policies include Conditional Launch settings that admins can use to control access based on app or SDK version, rather than waiting for Microsoft’s own enforcement timeline. According to Microsoft’s documentation, the following settings are relevant to this transition:
- Min SDK version — can be used to block users if the app is using an Intune SDK for iOS older than 20.8.0.
- Min app version — can be used to warn or block users on older Microsoft apps; Microsoft notes this setting must be targeted to a policy scoped to the specific app.
- Min Company Portal version — can be used to warn users running a Company Portal app version older than 5.0.6726.0.
As a practical recommendation (not a documented Microsoft requirement), SMB admins may want to pilot Conditional Launch rules in warning mode before switching them to a blocking configuration, so that user impact can be assessed ahead of Microsoft’s own enforcement date.
Microsoft’s documentation also notes that organizations using Conditional Access to require approved client apps or app protection policy should review that policy alongside these SDK changes, since both controls interact with how MAM-protected apps are allowed to access corporate resources.
How Android Play Integrity checks work in Intune today
Although the research question asked about “Play Integrity enforcement changes,” the supplied Microsoft sources do not state a confirmed enforcement date, deprecation timeline, or required action specifically tied to a Play Integrity policy change. What the sources do confirm is how the existing Play Integrity–related settings function, which is useful context for any future changes.
Play Integrity Verdict in Android Enterprise compliance policy
Within Android Enterprise compliance policy (covering fully managed, dedicated, corporate-owned work profile, and personally owned work profile device categories), Intune includes a Play Integrity Verdict setting under device health / Google Play Protect. Per Microsoft’s reference documentation, the options are:
- Not configured (default) — not evaluated for compliance.
- Check basic integrity — requires devices to pass Play’s basic integrity check.
- Check basic integrity & device integrity — requires devices to pass both basic integrity and device integrity checks.
Admins can optionally also require devices to pass a strong integrity check using hardware-backed security features, but only when basic or device integrity checks are already required; Microsoft notes that not all devices support strong integrity checks, and unsupported devices are marked noncompliant.
Basic integrity vs. certified devices, explained
Microsoft’s MAM FAQ explains the practical difference between these checks. “Check basic integrity” evaluates general device integrity — rooted devices, emulators, virtual devices, and devices showing signs of tampering fail this check. “Check basic integrity & certified devices” additionally evaluates whether the device is a Google-certified, unmodified device; devices with an unlocked bootloader, a custom system image, no Google certification, or a beta/developer preview system image fail this stricter check.
How Play Integrity interacts with the “jailbroken/rooted devices” setting
According to the FAQ source, Google’s Play Integrity API checks require the end user’s device to be online, at least briefly, for the attestation “roundtrip” to complete. If the device is offline, the separate ‘jailbroken/rooted devices’ setting can still be enforced. Microsoft describes an offline grace period value: once that grace period is exceeded, access to work or school data is blocked until network access is available again. Microsoft recommends using both settings together as a layered approach to device health checks.
Dependency on Google Play Services
Microsoft’s documentation notes that Play Integrity–related settings, including ‘Play integrity verdict’ and ‘Threat scan on apps,’ require a Google-determined version of Google Play Services to function. If a device doesn’t meet that version requirement or lacks access to Google Play Services, the end user is blocked when targeted by these settings, since they fall into a security-related category.
Practical governance recommendations
The following suggestions are practical recommendations for SMB admins, not documented Microsoft requirements:
- Build a simple inventory of custom LOB apps that use the Intune App SDK or Wrapping Tool so you know which ones need version updates before January 19, 2026.
- Communicate the January 2026 blocking change and the June 2026 warning change separately to end users, since the practical impact (blocked vs. dismissible) is different.
- Review existing Android Enterprise compliance policies to confirm whether Play Integrity Verdict is configured as intended, since it defaults to “Not configured” and is not evaluated unless explicitly set.
- Keep an eye on the Intune “in development” and “what’s new” documentation for any future Play Integrity enforcement dates, since none were confirmed in the reviewed source material at the time of writing.
Conclusion
Microsoft has published clear, dated enforcement milestones for Intune MAM SDK versions: a blocking requirement starting January 19, 2026 (or soon after) for iOS SDK/wrapper versions and the Android Company Portal app, followed by a non-blocking warning starting in late June 2026 for older iOS MAM SDK versions. SMB admins should treat the January date as the priority deadline, since it can stop end users from launching apps if ignored. Android Play Integrity checks, by contrast, are already a documented part of Intune’s Android Enterprise compliance settings today — but based on the supplied Microsoft sources, no confirmed enforcement date exists yet for additional Play Integrity changes. As with any Intune change, confirm current guidance in the Microsoft Intune admin center and official “what’s new” documentation before making policy changes, since this article reflects a snapshot of Microsoft’s published plans and remains subject to human review before any action is taken.