Microsoft Intune Security Update May Block Outlook & Teams Access

Microsoft is now enforcing stricter security rules for its Intune Mobile Application Management (MAM) service. Starting on January 19, 2026, users running outdated apps may find themselves locked out of work email and other critical Microsoft services. With the stricter Intune MAM security requirements, Microsoft now mandates that all iOS SDK-integrated apps, iOS-wrapped apps, and the Intune Company Portal for Android run the latest versions of Microsoft Intune. Enterprise customers that fail to update risk having users blocked from launching apps, including Microsoft Teams and Outlook. “Starting January 19, 2026, or soon after, we’re making updates to improve the Intune mobile application management (MAM) service. To stay secure and run smoothly, this update will require iOS wrapped apps, iOS SDK integrated apps, and the Intune Company Portal for Android to be updated to the latest versions. If you don’t update to the latest versions, users will be blocked from launching your app,” Microsoft explained. Microsoft had previously warned organizations about this upcoming requirement in the Microsoft 365 Admin Center. The original deadline was December 15, but Microsoft later pushed it back. Updated SDK and wrapper versions explained According to Microsoft, apps built with Xcode 16 must be updated to use version 20.8.0 of the Intune App SDK for iOS, and those compiled with Xcode 26 need version 21.1.0 or newer. Moreover, administrators must update the App Wrapping Tool to use 20.8.1 for Xcode 16 and 21.1.0 for Xcode 26. For Android users, once a single Microsoft app on the device is running the updated SDK and the Company Portal app has been upgraded to version 5.0.6726.0 or later, the remaining managed Android apps will begin updating as well. What do IT administrators need to do now? For tenants with Microsoft Intune policies that cover both Android and iOS, Microsoft recommends IT admins to alert users about their apps and ensure that Microsoft Teams and Outlook are up-to-date. Administrators can also configure Conditional Launch rules to either block apps that rely on outdated Intune SDK versions or display warnings when users are running older app versions. To prevent work disruptions, admins should proactively review compliance from the Intune admin center by going to Apps > Monitor > App protection status. This report shows the app and SDK versions in use, which helps identify who needs updates before access is interrupted. How to reduce user disruption with conditional launch rules? Administrators can enhance their Intune readiness by building a clear diagnostic workflow. They should perform a full audit of mobile apps to determine whether they’re running the latest Intune SDK or wrapper versions. Enterprise admins can also use Conditional Access “What If” simulations to preview how policy changes affect different device or user scenarios. Lastly, it’s important to verify that custom or wrapped apps have been updated to meet the latest Intune requirements. Administrators can then use the Intune admin center’s App protection status dashboard to identify users running older app or SDK versions across the fleet.