Finance users bring personal iOS and Android devices enrolled in Intune. A new mobile app (App1) is developed for finance users, and the finance department gains new users monthly. To restrict App1 so only finance users can download it, what is the first action you should take?

The first action is to add App1 to Intune. Intune is Microsoft's unified endpoint management solution, and adding the app here allows you to manage its deployment, security policies, and access for enrolled devices. Once in Intune, you can create an app protection policy and assign it to specific user groups (like your finance users), ensuring only authorized individuals can download and use the app. Registering App1 in Azure AD is incorrect because Azure AD is primarily for identity and access management; while Intune leverages Azure AD for user identities, the app itself needs to be managed within Intune for deployment. Adding App1 to vendor stores (Apple App Store, Google Play Store) is incorrect because this makes the app publicly available, which contradicts the requirement to restrict access to finance users. MDT is used for OS deployment and imaging, not for managing mobile applications on enrolled devices.