search

microsoftconnect / ms-intune-app-sdk-android

Intune App SDK for Android enables data protection features and mobile app management via Microsoft Intune
45 stars 18 forks source link

Unable to unenroll user on logout #234

Closed sandeep-kumar-eptura closed 3 weeks ago

sandeep-kumar-eptura commented 5 months ago

Intune Android App SDK Policy Enforcement Issue

Questions to Ask Before Submission

  1. Have you completed the exit criteria for each phase in the Intune App SDK for Android Integration Guide? Y
  2. Have you checked the Microsoft Intune App SDK for Android repository for similar issues? Y
  3. Are you using the latest version of the SDK? Y

Summary

I'm trying to unenroll user on logout but policies are still being delivered to app.

override fun onMAMunEnrollment(upn: String, aadId: String) {
        val thread = Thread {
            try {
                MSALUtil.signOutAccount(requireContext(), aadId)
            } catch (e: MsalException) {
                LOGGER.log(Level.SEVERE, "Failed to sign out user ", e)
            } catch (e: InterruptedException) {
                LOGGER.log(Level.SEVERE, "Failed to sign out user ", e)
            }
            val primaryUser = MAMComponents.get(MAMUserInfo::class.java)?.primaryUser ?: upn
            mEnrollmentManager?.unregisterAccountForMAM(primaryUser)
        }
        thread.start()
    }

Logs

2024-06-13 00:38:10.320 22440-23479 AMEnrollmentManagerImpl com.condecosoftware.condeco.develop  W 
unregisterAccountForMAM called without valid OI
D; identity may be ambiguous.
2024-06-13 00:38:10.324 22440-23479 AMEnrollmentManagerImpl com.condecosoftware.condeco.develop  I  unregisterAccountForMAM attempting unenrollment for removed account: aOS@Eptura749.onmicrosoft.com;b9f78416-5ba0-4318-8182-9b446898e3f0
2024-06-13 00:38:10.346 22440-23479 MAMAppConfigManagerImpl com.condecosoftware.condeco.develop  I  Updated App Config cache for user User1931126298.2088628670
2024-06-13 00:38:10.346 22440-23479 MAMAppConfigManagerImpl com.condecosoftware.condeco.develop  I  Found cached app config data, returning it.
2024-06-13 00:38:10.352 22440-23479 MAMWEAccountRegistry    com.condecosoftware.condeco.develop  I  removing account aOS@Eptura749.onmicrosoft.com;b9f78416-5ba0-4318-8182-9b446898e3f0
2024-06-13 00:38:10.358 22440-23479 MAMWERetrySchedulerImpl com.condecosoftware.condeco.develop  I  removing any remaining scheduled tasks for aOS@Eptura749.onmicrosoft.com;b9f78416-5ba0-4318-8182-9b446898e3f0
2024-06-13 00:38:10.361 22440-23479 AMEnrollmentManagerImpl com.condecosoftware.condeco.develop  I  Unenrolling application for identity aOS@Eptura749.onmicrosoft.com;b9f78416-5ba0-4318-8182-9b446898e3f0, wipe reason APP_UNENROLLMENT.
2024-06-13 00:38:10.362 22440-23479 SessionDurationStore    com.condecosoftware.condeco.develop  I  Setting telemetry session [f4a63d1f-89e1-43e3-928c-8fba1c201585] start time: 639948169
2024-06-13 00:38:10.392 22440-22550 UserDataWiper           com.condecosoftware.condeco.develop  I  Call Wipe from internal for identity aOS@Eptura749.onmicrosoft.com;b9f78416-5ba0-4318-8182-9b446898e3f0, wipe reason APP_UNENROLLMENT.
2024-06-13 00:38:10.393 22440-22550 AMEnrollmentStatusCache com.condecosoftware.condeco.develop  I  MAM enrollment status found for identity aOS@Eptura749.onmicrosoft.com;<null>
2024-06-13 00:38:10.395 22440-22550 AMEnrollmentStatusCache com.condecosoftware.condeco.develop  I  Clearing MAM enrollment status for identity aOS@Eptura749.onmicrosoft.com;<null>
2024-06-13 00:38:10.401 22440-22550 AMEnrollmentStatusCache com.condecosoftware.condeco.develop  I  Clearing Company Portal required.
2024-06-13 00:38:10.406 22440-22550 MAMWEAccountRegistry    com.condecosoftware.condeco.develop  I  getAccountInfo() called for account that is not registered: aOS@Eptura749.onmicrosoft.com;b9f78416-5ba0-4318-8182-9b446898e3f0
2024-06-13 00:38:10.407 22440-22550 MAMWEAccountRegistry    com.condecosoftware.condeco.develop  I  removeAccount() called for account that is not registered: aOS@Eptura749.onmicrosoft.com;b9f78416-5ba0-4318-8182-9b446898e3f0
2024-06-13 00:38:10.408 22440-22550 WipeAppDataHelper       com.condecosoftware.condeco.develop  I  Starting a full wipe.
2024-06-13 00:38:10.417 22440-22550 TelemetryLoggerImpl     com.condecosoftware.condeco.develop  I  {"DEVICE_SDK_PREVIEW_INT":0,"CORP_TAGGED_FILES_WIPED":true,"DEVICE_SDK_INT":34,"IS_MULTI_IDENTITY_WIPE":false,"MAM_APP_ID":"com.condecosoftware.condeco.develop","SUCCEEDED":true,"MAM_APP_VERSION":"4.0.4-develop","WIPE_REASON":"APP_UNENROLLMENT","EVENT_CLASS":"com.microsoft.intune.mam.client.telemetry.events.SelectiveWipeEvent","DEVICE_BRAND":"google"}

Please reference the specific exit criteria scenario that is failing.

Repro Steps

Please provide concrete steps to reproduce the issue you are encountering.

1.

Expectation:

Clear MAM policies on unenrollment

Observation:

Logs Found cached app config data, returning it. removing account aOS@Eptura749.onmicrosoft.com;b9f78416-5ba0-4318-8182-9b446898e3f0 Unenrolling application for identity aOS@Eptura749.onmicrosoft.com;b9f78416-5ba0-4318-8182-9b446898e3f0, wipe reason APP_UNENROLLMENT. Clearing MAM enrollment status for identity aOS@Eptura749.onmicrosoft.com; Clearing Company Portal required.

Details

Logs

Company Portal Logs

Incident ID: DAQTFN7S For guidance, see Report a problem in Company Portal or Intune app for Android.

Screenshots and Recordings

If screenshots and/or recordings would help explain the behavior, please include them here.

AndroidX Dependencies

If your app includes any AndroidX libraries, please list them here, along with the version info:

Third-Party Library Dependencies

If your app includes any third-party libraries, please list them here, along with the version info:

kanishkaBagga commented 5 months ago

We are Looking into this.

sandeep-kumar-eptura commented 5 months ago

@kanishkaBagga any updates?

kanishkaBagga commented 3 months ago

@sandeep-kumar-eptura -Whenever the app adds an account, it must register the account with the SDK. Likewise, whenever the app removes an account, it should unregister that account to indicate that the app should no longer apply policy for that account. If the account was enrolled in the MAM service, the account is unenrolled and the app will be wiped.

void registerAccountForMAM(String upn, String aadId, String tenantId); void registerAccountForMAM(String upn, String aadId, String tenantId, String authority); void unregisterAccountForMAM(String upn, String aadId); Result getRegisteredAccountStatus(String upn, String aadId);

To register an account for management, the app should call registerAccountForMAM(). An account is identified by both its UPN and its Microsoft Entra user ID. The tenant ID is also required to associate enrollment data with the account's Microsoft Entra tenant. The account's authority may also be provided to allow enrollment against specific sovereign clouds The SDK may attempt to enroll the app for the given account in the MAM service; if enrollment fails, it will periodically retry enrollment until enrollment succeeds or the account is unregistered. The retry period will typically be 12-24 hours. The SDK provides the status of enrollment attempts asynchronously via notifications.

The best time to call registerAccountForMAM is after the user has signed into the app and is successfully authenticated using MSAL. The account's Microsoft Entra user ID, tenant ID and authority are returned from the MSAL authentication call as part of the The account comes from the IAuthenticationResult.getAccount() method and contains the pertinent account information. The AAD ID (also known as Microsoft Entra ID or OID) comes from the IAccount.getId() method. The tenant ID comes from the IAccount.getTenantId() method. The authority comes from the IAccount.getAuthority() method. To unregister an account from Intune management, the app should call unregisterAccountForMAM(). If the account has been successfully enrolled and is managed, the SDK unenrolls the account and wipe its data. Periodic enrollment retries for the account will be stopped. The SDK provides the status of unenrollment requests asynchronously via notification.

kanishkaBagga commented 3 months ago

@sandeep-kumar-eptura, Please let us know if this resolves your concern, and we can close the issue