App Registration Requirement Will be Enforced in Version 21.0.0+

[Kyle Reis (Kyle-Reis)]

For several years, it has been a documented requirement that all applications linking to the Intune SDK must be registered in Entra. In many cases, applications will not function properly if this requirement has not been met. However, it is still technically possible for applications to successfully enroll in Intune MAM without configuring the Intune MAM SDK to use a provided Entra client ID or redirect URI. Beginning with the 21.0.0 release of the iOS Intune MAM SDK, this will no longer be possible. If you have not already done so, please ensure you have registered your application with Entra and have configured the Intune SDK to use the client ID, redirect URI, and authority URI (for single-tenant apps) associated with your app before integrating the 21.0.0 SDK release. You should also make sure your app is given access to the Intune MAM service for any tenant where it is used. The 21.0.0 release will be available in September of 2025. If you have any questions or concerns, please file an issue or reply directly to this announcement.

[ryanbland]

Kyle Reis (@Kyle-Reis)
When reading the docs for creating the entra app we came across something that was slightly confusing and would like more info on what this actually means? My IT department is worried that they will have to go though and do this for all our customers using intune.

Grant admin consent (external tenants only)
Once you register your application, it gets assigned the User.Read permission. However, for external tenants, the customer users themselves can't consent to permissions themselves. You as the admin must consent to this permission on behalf of all the users in the tenant:

From the Overview page of your app registration, under Manage select API permissions.
Select Grant admin consent for < tenant name >, then select Yes.
Select Refresh, then verify that Granted for < tenant name > appears under Status for the permission.

[Kyle Reis (Kyle-Reis)]

Hi ryanbland. Your customers will need to provide admin consent for your application to access the Intune service within their tenant. I recommend reaching out to customers in advance to inform them of this change and to ensure they've granted your application access to avoid any disruptions.

[ryanbland]

Kyle Reis (@Kyle-Reis) If users had already authenticated when the ADALClientId and RedirectUris were not included in the IntuneMAMSettings will everything continue to work once they upgrade the app if the admins have granted permissions to the entra app? We did a test and if the user was authenticated in our previous version they didnt get the permissions page even if the admin hadnt yet granted permissions.

Also what is the best way to get our Entra app added to the Microsoft Entra application gallery? I see that it says applications will be granted on a case by case basis as "We are currently not accepting new SSO or provisioning requests while we focus on the Secure Future Initiative" Does this affect Entra apps made specifically for intune registration? Or do we just have to have an admins sign out and back in before any users do to grant permissions?

[Kyle Reis (Kyle-Reis)]

Hey ryanbland. If the client ID/redirect was not previously being used by your app, and your app does not initiate any authentication on its own, MAM policy check-ins will silently fail because the MAM SDK will be unable to silently acquire a token for the MAM service until the offline grace period timeout is exceeded. At that point, the MAM SDK should prompt the user to sign in, and if the admin has not consented to your app being used in their tenant, the end user will be blocked. Admins shouldn't need to sign into your app in order to grant consent. This can be done by constructing and navigating to the URL mentioned here.

[ryanbland]

Kyle Reis (@Kyle-Reis) Thank you so much!

[Ted Bradley (earltedly)]

Would the correct thing to do here be to:

1. implement IntuneMAMComplianceDelegate
2. when the delegate is called with a status code of IntuneMAMComplianceInteractionRequired, call remediateCompliance on the IntuneMAMComplianceManager?

Would this then trigger a user interactive sign in flow?

[Kyle Reis (Kyle-Reis)]

Ted Bradley (@earltedly) - This can help in the scenario where the application is attempting to remediate compliance for "Require App Protection Policy" Entra conditional access. This is the only scenario where the compliance delegate would be called. If the app received that response from a previous silent remediation attempt, it could retry with the "silent" parameter set to NO.