search

microsoftconnect / ms-intune-app-sdk-ios

Intune App SDK for iOS enables data protection and mobile app management features in iOS mobile apps with Microsoft Intune
89 stars 25 forks source link

You can't get there from Here. #433

Closed Jason-wonku-Ji closed 3 months ago

Jason-wonku-Ji commented 4 months ago

IMG_0156 2 IMG_0157

Describe the bug: Specific client company normal accont cannot loginned. But management account of that company can be loginned.

To Reproduce Steps to reproduce the behavior: We trying get token from MSAL using 'acquireTokenWithParameters' When we try this with our company account, it works well. But when we try this with our client's normal account, it cannot be login. management account of that company can be loginned. When the failure has been occured, the attached screen shot is shown.

Expected behavior: One drive account would be logined.

Screenshots and logs: Please check attached screen shot.

Smartphone (please complete the following information):

Intune App SDK for iOS (please complete the following information):

Additional context: I think this may be resolved if the policy or some condition on initue control center is changed. But I don't know what is exactly problem. Could you let me know what is problem? Or hint?

Jason-wonku-Ji commented 4 months ago

Android also had same issue. After login Outlook in Android, this issue was gone in Android. But iOS has issue yet.

wangxiaoms commented 4 months ago

Hi, can you verify End-user requirements to use app protection policies: https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy#end-user-requirements-to-use-app-protection-policies

Jason-wonku-Ji commented 4 months ago

@wangxiaoms Hello wangxiaoms.

When checked internally We confirmed that the connection was successful by excluding SharePoint Online (SPO) from the blocking target in Conditional Access. It appears that the SPO API is being called when logging in with a OneDrive account. Could you pelase check this is correct?

And we should remove SharePoint Online (SPO) from the blocking target in Conditional Access?

wangxiaoms commented 4 months ago

Hi @Jason-wonku-Ji what is your conditional access policy setting, are you requiring app protection policy? https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant#require-app-protection-policy

Jason-wonku-Ji commented 3 months ago

@wangxiaoms

Yes, we need an app protection policy. Conditional access policy settings cannot be confirmed at this time. Do you need to check your conditional access policy settings?

To summarize once again,

We are creating a LOB app. I am trying to apply the MAM function by applying the intune SDK. However, we are in a situation where we need to set up SPO (SharePoint Online).

In this situation

  1. Android: If you log in to Outlook and then log in to OneDrive from our app, OneDrive login will be performed normally.
  2. iOS: Even after logging in to OutLook, if you log in to OneDrive from our app, you will not be able to log in to OneDrive.

However, if you turn off SPO, OneDrive login will proceed normally on iOS.

I deleted all intuen-related information and tested it. Even though I removed the framework, removed all related settings and related sources, and only logged in to OneDrive through MSAL, the situation was the same. You can see the screenshot above.

Now, I think it is not clear whether this problem is Intune-related or OneDrive-related.

Do you have any guess into the problem?

Additionally, can you tell me if this problem is something we did wrong when applying the Intune SDK or MSAL, or if we made a mistake in policy settings or conditional access settings in the management center of Intune or Azure?

wangxiaoms commented 3 months ago

Hi @Jason-wonku-Ji as this is related to SharePoint Online, you will need to open a support case to check related settings and logs to find out the root cause. It is unlikely to be Intune MAM SDK problem unless you can provide more evidence. I will close the issue, please open support ticket to investigate this.