Created by Claude - please verify

App protection coverage - based on app registrations reported by the Intune SDK in each app; apps never opened after sign-in do not register.

Required Microsoft Graph permissions

DeviceManagementApps.Read.All User.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Intune.

Endpoint: GET /v1.0/deviceAppManagement/managedAppRegistrations?$expand=appliedPolicies

If Graph rejects expanding the applied policies, the coverage columns show 'unknown' rather than marking everything unprotected.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Mobile App Protection Coverage

On personal phones, app protection policies (MAM) are what stop company mail and files being copied into personal apps or backed up to a private cloud. Users whose Outlook, Teams or OneDrive registered with Intune but received no protection policy are exposed.

No mobile app has registered with Intune app protection.