Merge pull request #211104 from Gargi-Sinha/patch-139

Incorporated changes suggested by Cody and Connor

Author: prmerger-automator[bot]

articles/active-directory/hybrid/howto-troubleshoot-upn-changes.md

@@ -6,7 +6,7 @@ services: active-directory
 ms.service: active-directory
 ms.subservice: hybrid
 ms.topic: how-to
-ms.date: 03/13/2020
+ms.date: 09/13/2022
 
 ms.author: gasinh
 author: gargi-sinha
@@ -165,6 +165,17 @@ The user will need to [re-enroll](/windows/security/identity-protection/hello-fo
 Windows 7 and 8.1 devices are not affected by this issue after UPN changes.
 
 
+## Mobile Application Management (MAM) app protection policies known issues and workarounds
+
+**Known Issues**
+
+Your organization may use [MAM app protection policies](https://docs.microsoft.com/mem/intune/apps/app-protection-policy) to protect corporate data in apps on end users' devices.
+MAM app protection policies are currently not resiliant to UPN changes. UPN changes can break the connection between existing MAM enrollments and active users in MAM integrated applications, resulting in undefined behavior. This could leave data in an unprotected state.
+
+**Work Around**
+
+IT admins should [issue a selective wipe](https://docs.microsoft.com/mem/intune/apps/apps-selective-wipe) to impacted users following UPN changes. This will force impacted end users to reauthenticate and reenroll with their new UPNs.
+
 ## Microsoft Authenticator known issues and workarounds
 
 Your organization might require the use of the [Microsoft Authenticator app](https://support.microsoft.com/account-billing/how-to-use-the-microsoft-authenticator-app-9783c865-0308-42fb-a519-8cf666fe0acc) to sign in and access organizational applications and data. Although a username might appear in the app, the account isn't set up to function as a verification method until the user completes the registration process.