Microsoft’s January 19, 2026 enforcement cutoff for Intune iOS app protection policies is now live. If you’re managing iOS devices and haven’t yet audited your app inventory, you may already be fielding calls from users who suddenly can’t launch critical business apps. The change is simple: Intune can now block, not just warn, when a managed app falls below a required SDK or wrapping-tool baseline. The fix, however, is not one-size-fits-all. It hinges on whether the app came from the App Store or your internal development team.
The New Baseline: What Actually Changed
Until January 19, Intune’s Conditional Launch setting for minimum Intune SDK version defaulted to a warning—an alert that didn’t stop the app from opening. That grace period ended. Now, if your app protection policy is configured with the Block action, any managed iOS app carrying an Intune SDK below the threshold will refuse to launch. Microsoft’s documentation (last updated after the deadline) spells out the exact requirements:
- Apps built with Xcode 16 need Intune App SDK v20.8.0 or, if wrapped, the Intune App Wrapping Tool v20.8.1.
- Apps compiled with Xcode 26 require a newer baseline: Intune App SDK v21.1.0 and Intune App Wrapping Tool v21.1.0.
These versions aren’t arbitrary. Xcode 26 introduces changes that demand a different SDK integration, and Microsoft explicitly matched the support baseline to the toolchain. An app that was compliant last year on an older Xcode might be flagged today if it hasn’t been recompiled against the appropriate SDK.
What This Means for You, Depending on Your Role
For IT Administrators
You need an immediate inventory of every managed iOS/iPadOS app covered by an app protection policy. Don’t assume your device compliance reports tell the full story. The enforcement reaches the application layer, so a device-level “healthy” status can mask app-level blocking. Start in the Intune admin center: open each iOS app protection policy, note the assigned apps, and check the Conditional Launch configuration. Is “Min Intune SDK version” set to Warn or Block? If it’s Block, that policy is already actively preventing outdated apps from opening.
Next, classify every app into one of three categories:
- App Store–delivered apps from Microsoft or third-party vendors: These are the easy ones. The vendor bears the responsibility of shipping a compatible build. Your job is to verify the current version meets the baseline and to push users to update. Use Intune’s app update policies or communicate directly.
- Internally developed apps with Intune SDK integration: If your own developers added the Intune App SDK to the app’s source code, you own the fix. That means updating the SDK to v20.8.0 (Xcode 16) or v21.1.0 (Xcode 26), rebuilding, testing, signing, and redistributing.
- Internally wrapped line-of-business apps: Many organizations took an existing iOS binary and ran it through the Intune App Wrapping Tool to layer on management controls. These packages must be re-wrapped with version 20.8.1 or 21.1.0, depending on the Xcode version, and published through your internal distribution mechanism.
A critical subtlety: a wrapped Microsoft app—say, Teams wrapped by your packaging team—will not be fixed by a user installing the latest App Store update. The wrapped version still contains old protection logic. You must find and replace those packages manually.
For Developers and Application Packagers
If you’re on the hook for an internally maintained app, don’t confuse a successful launch with compliance. The app must be tested under the exact same protection policies your production users face. A quick smoke test on an unmanaged device tells you nothing. Validate sign-in, data transfer between managed apps, and any workflows that involve opening corporate documents. The App Protection Policy might enforce restrictions on copy/paste, file sharing, or web content, and a rebuilt app that ignores those rules is still a risk.
Also, confirm which Xcode version was used to compile the current production binary. If the build pipeline recently moved to Xcode 26—perhaps to support a new iOS SDK—you need the v21.1.0 baseline even if the app worked fine on an older SDK. A misalignment here is a common source of post-deadline blocks.
For End Users
If you’re a user seeing an error that your app “can’t be opened because of a management policy,” your first stop is the App Store. For Microsoft 365 apps like Outlook or Word, or for known third-party productivity tools, an update may already be available. But if the app is a custom in-house tool, you’ll need to wait for your IT or development team to deliver a new version. There’s nothing a device restart, reinstalling the management profile, or updating iOS will do to bypass the SDK check.
How We Got Here
Microsoft has been signaling this shift for months. The Intune App SDK for iOS evolves alongside Apple’s operating system and Xcode toolchain. Old SDK versions miss critical security fixes, can’t enforce newer policy controls, and may fail silently on modern iOS releases. The dual baseline—one for Xcode 16 and another for Xcode 26—reflects a fork in Apple’s development environment that Microsoft had to accommodate.
Historically, Intune admins could leave the minimum SDK version set to Warn indefinitely, treating it as a low-priority compliance metric. But as iOS and Xcode moved forward, Microsoft began nudging organizations toward active enforcement. The January 19, 2026 date was the moment when the default posture flipped: the underlying platform now expects compliance, and the policy toggle is the only lever admins have to avoid a hard block.
Your Action Plan: Stop the Blocks and Prevent the Next One
Treat the immediate work as a packaging audit, not just a policy tweak. Here’s a step-by-step sequence drawn from the field experience shared by early responders on WindowsForum:
- Inventory every managed app in scope – Pull the list of apps from each iOS app protection policy. Do not rely on generic asset inventories; they often miss wrapped packages or hidden versions. For each app, record the name, publisher, distribution channel, and business owner.
- Determine the app’s lineage – For every app, ask: “Can my organization change the app package directly?” If the answer is no, and the app comes from the App Store, the vendor must provide an update. If yes, identify whether it’s SDK-integrated (source code modified by your team) or wrapped (an existing binary processed by your packaging team). This distinction decides the remediation path.
- Pin down the toolchain – For internal apps, find out which Xcode version was used the last time the app was built. Use that to map to the required Intune SDK or Wrapping Tool version (see table below). If you can’t determine the Xcode version, assume the worst and target the highest baseline (v21.1.0).
- Assign an owner to every app – An app without a clear development or packaging team is an outage waiting to happen. Queue any unowned app for a deeper investigation immediately. If the original signer or distribution certificate has expired, you may need to rebuild from source or re-enroll the app.
- Choose your Conditional Launch setting wisely – While you work through the inventory, consider temporarily setting the “Min Intune SDK version” action to Warn. This buys time by showing users a notification rather than blocking launch. But note: a Warn policy still leaves the app non-compliant; it only defers the business interruption. Reserve Block for after you’ve validated and distributed replacements.
- Rebuild or rewrapper internally owned apps – For SDK-integrated apps, update the Intune App SDK via your package manager (CocoaPods, Swift Package Manager, etc.), recompile, and test. For wrapped apps, obtain the original unmanaged binary, run the latest Intune App Wrapping Tool, and validate the output. Do not skip the wrapping tool’s built-in validation steps.
- Test in a pilot ring before broad rollout – Deploy the updated app to a small group of users who are subject to the same app protection policies. Verify that the app opens, that organizational data is properly sandboxed, and that cross-app communication (e.g., opening an email attachment in Word) works as expected.
- Communicate the rollout clearly – Tell your help desk and end users exactly what to expect. Provide a short list of apps that will update automatically from the App Store, and a separate list of internal apps that will arrive via your company portal or MDM. This reduces confusion and support tickets.
Key technical note: The “Min Intune SDK version” setting is separate from a “Minimum app version” policy. The former checks the Intune protection layer; the latter checks the app’s own release number. Do not try to use a minimum app version rule to enforce SDK compliance—it will confuse users and miss the root cause. Stick to the dedicated SDK version control for this work.
Quick-Reference Baseline Table
| Build Toolchain | Required Intune App SDK | Required Intune App Wrapping Tool |
|---|---|---|
| Xcode 16 | v20.8.0 | v20.8.1 |
| Xcode 26 | v21.1.0 | v21.1.0 |
Outlook: Staying Ahead of Future Deadlines
Apple’s annual Xcode cycle means this won’t be the last time a baseline shifts. Once Xcode 27 lands, anticipate another Microsoft advisory with new minimum SDK versions. The organizations that fare best will treat internal app maintenance as an ongoing process, not a one-time fire drill. Build a partnership between your mobility team and app developers: schedule quarterly reviews of all internally maintained packages, and make the Intune SDK version part of your app’s release checklist. For wrapped apps, document the wrapping process itself so anyone can reproduce it when the next deadline hits.
Microsoft is also likely to expand the scope of Conditional Launch in future updates; already, settings like “Minimum app version” and “Max Inactivity Time” are available. The lesson from January 19 is clear: when the platform warns you about a compatibility deadline, use the Warn window to prepare, not to ignore. Because once that switch flips to Block, the call you get from a stranded executive is the symptom of a process that started months earlier.