Your Microsoft 365 subscription includes Intune. You created an Android app protection policy (Policy1) that blocks screenshots in Microsoft apps, but an unmanaged Android email client can still take screenshots. To force users to use only Microsoft apps for email, which action should you take?

Creating a Conditional Access policy is the correct solution because it allows you to enforce app protection policies on unmanaged devices or specific apps. You can configure a Conditional Access policy to require that users access Exchange Online (email) only from approved client apps that have an Intune App Protection Policy applied. This prevents users from accessing corporate email via unmanaged third-party email clients that don't respect your organization's data protection rules, such as blocking screenshots. A compliance policy primarily assesses device health and compliance, not app-specific behavior or access restrictions for unmanaged apps. Changing data protection settings in Policy1 would only affect Microsoft apps already targeted by that policy, not unmanaged third-party apps. Changing assignments for Policy1 would only modify which users or groups receive the existing app protection policy for Microsoft apps, it wouldn't address unmanaged apps.