You have a Microsoft 365 subscription with 1,000 iOS devices managed by Intune. You need to block printing of corporate data from managed apps on those devices. Which configuration should you apply?

An app protection policy (APP) is the correct choice because it specifically targets how corporate data is handled within managed applications, even on personal devices. These policies define what users can and cannot do with organizational data, such as preventing "save as," "copy/paste," and, critically, "print" functionality from within managed apps. An app configuration policy is used to pre-configure settings for an app, not to enforce data protection rules. A security baseline applies security settings at the device level, not granular data protection within apps. An iOS app provisioning profile is used for app deployment and signing, not for data loss prevention within apps.