1

I have an app that includes the "Microsoft Intune App SDK". The app does not use MSAL for authentication and requires the user to authenticate using an SSO/OAuth login.

Some customers have conditional access policies defined that require the SSO authentication to be performed using the MS Edge browser. We use a WKWebView to host the authentication screens. The authentication fails because the access policy reports the browser like Safari.

I have tried to launch the MS Edge browser externally to the app using MS Edge URL scheme like

if let url = URL(string: "microsoft-edge-https-intunemam://oatuhurl?client_id=12234&redirect_uri=myapp://callback") {
            UIApplication.shared.open(url)
        }

This launches the Edge browser and I can complete the authentication. However, the callback to myapp is blocked by Intune.

I receive the message: Action Not Allowed Your organization does not allow you to open this data here.

enter image description here

How can I allow the app to receive the callback?

I can handle the UIApplication open method in an app without Intune and extract the tokens returned from the Edge browser session but cannot find a way to accomplish this with an Intune enabled app.

I have tried various combinations of application protection policies but cannot find a way to enable my app to accept the callback.

RTXGamer
  • 3,215
  • 6
  • 20
  • 29
Jeff Martin
  • 550
  • 4
  • 12
  • Did you find any solution to the issue. If so, can you please share it. We do have similar issue in our app. Thanks – Naveen Jun 01 '22 at 17:39
  • @Naveen we did not find a solution. We modified our app to use MSAL authentication instead of the custom authentication service. – Jeff Martin Jun 02 '22 at 18:30
  • After using MSAL for authentication, did app start using Edge browser instead of Safari? What would happen if some customer use other SSO service (say Okta)? – Naveen Jun 03 '22 at 06:53
  • 1
    The iOS MSAL library uses WKWebView, SFSafariViewController, or ASWebAuthenticationSession internally https://learn.microsoft.com/en-us/azure/active-directory/develop/customize-webviews For our solution we bypass the SSO authentication completely. We use the idToken from the MSAL authentication, verify it, and generate a JWT token that is compatible with our services. – Jeff Martin Jun 04 '22 at 15:16

0 Answers0