Preventing Quick Start data transfer on Intune

Use MDM enrollment instead of MAM-only

Quick Start moves the 'boxes' but not the 'keys'.

The apps move.

The Intune protection stays.

The corporate data stays encrypted.

The user still must authenticate.

An unmanaged device is still blocked.

If devices are corporate-owned or should be tightly controlled:

• Enforce Company Portal enrollment
• Use ADE (Automated Device Enrollment) with supervision
• Force MDM enrollment before the user can sign in

This is the only reliable method to avoid Quick Start auto-start.

Harden App Protection Policies

Key settings to require:

• Require PIN or biometric for managed apps
• Require the device to be marked as compliant
• Block access on jailbroken devices
• Disable backup to iCloud
• Restrict cut/copy/paste
• Require conditional access with device compliance

This way, even if Quick Start transfers data, the Managed data remains locked down and unusable without compliance.

We are using MAM not MDM, also not using app protection policy.

We are using CA Policy to enforce enrollment.

But token transferred through Quick Migration and its bypasses Microsoft contact while accessing apps Google related.

In Intune there is no record of this new device, or sign in logs.

Even if user tries to logout from apps google related still can relogin to them without contacting Microsoft.

.