Blog Post

Intune Customer Success
2 MIN READ

Resolved - Conditional access unexpectedly blocking macOS 10.15.4 native mail client/other apps

Intune_Support_Team's avatar
Intune_Support_Team
Icon for Microsoft rankMicrosoft
Apr 20, 2020

Update: A fix for this issue has been rolled out with the latest release of macOS 10.15.5.

 

We were recently alerted to a scenario whereby after an end user updated to macOS 10.15.4, they experienced unexpected access app prompts or blocks to applications such as native mail. The macOS device was enrolled in Intune and there was a conditional access policy requiring a compliant device. Working with Apple, we discovered that upgrading to macOS 10.15.4 exposed a bug in auth for several apps including mail and calendar (despite existing enrollment or compliance). Microsoft and Apple are working on a resolution and we’ll update this post when new information is available.

 

In the interim, if you use conditional access on macOS, be aware that not all apps will be available after updating to macOS 10.15.4. As an admin, if you're wondering if your end users have run into this known issue, you can tell by validating that 1) you have set conditional access rules requiring a compliant device, then 2) you'll likely see conditional access failures in the Azure AD blade under sign-ins. 

 

Again, we'll keep this post updated as we receive additional information.

 

Blog post updates:

  • 5/6/20: A fix for this issue will be included in the macOS 10.15.5 Beta.
  • 5/7/20: Clarifying that a fix is included in the macOS 10.15.5 Beta 4 release. If you continue to experience an issue after updating to this version, please let us know!
  • 5/27/20: We received reports that this has been resolved with the latest release of macOS 10.15.5.
Updated Dec 18, 2020
Version 9.0
  • Ross Smith IV's avatar
    Ross Smith IV
    Icon for Microsoft rankMicrosoft
    Jun 01, 2020

    werneryue1004 - I've asked around and based on limited information we're not sure what the cause could be. Please open a support case with Microsoft Support so they can investigate further.

  • werneryue1004's avatar
    werneryue1004
    Copper Contributor
    May 30, 2020

    Thanks Intune_Support_Team , I hope the team can provide more details and advise about how we can fix the issue asap.   There had MacOS Mail issue with Office 365 Exchange from 10.15.4, sadly in original issue is fixed in 10.15.5, but the mentioned new issue is happened.

    On Apple side they said MS updated something on Office 365, what they said is "a security settings in o365 that blocks it's content to be shown in the mac mail server. And the same reason that affects the other old emails on the local folders because there's exchange emails on the same folder."

     

    Our client had a local Mailbox (Folder) created in MacOS Mail very long time ago, she was using NetSol email system with POP connection before.  Few months ago we helped to migrate to Office 365.  The local Mailbox (Folder) used to keep the emails which from NetSol and also Office365. Not sure how it can define it is email from exchange but the issue start to appear after 10.15.4 MacOS update.   It will be nice if someone can let us know which security setting has been updated on Office 365 during Apple release 10.15.4 and 10.15.5 update, then we can try to enable/disable for testing.

     

     

  • werneryue1004's avatar
    werneryue1004
    Copper Contributor
    May 29, 2020

    Hi Support,

     

    After upgrading my client's MacBook from 10.15.4 to 10.15.5, the "Require Exchange password" pop up on MacOS Mail seems gone.

     

    However there have another issue, that when the client moves the exchange email from her Exchange Inbox in MacOS Mail to the folder in Mail under "On My Mac", the email contents are not displaying, even double click to open.   We have discussed with Apple Support, what the senior support have mentioned is there has a new security setting on Office 365 side, which causing content to be blocked for showing in the mac. And the same reason that affects the other old emails on the local folders because there's exchange emails on the same folder.

     

    Can you please advise which setting we can change to fix it?

  • niko78's avatar
    niko78
    Copper Contributor
    May 27, 2020

    The last update of MACOS fixed it.

    Thank you .

  • andreas_koerber's avatar
    andreas_koerber
    Copper Contributor
    May 27, 2020

    I can confirm that the issue was solved with the release of macOS 10.15.5. 

    Exchange integration with Intune works as expected. 

  • Intune_Support_Team's avatar
    Intune_Support_Team
    Icon for Microsoft rankMicrosoft
    May 14, 2020

    Hi CV-NTT, thanks for the feedback and sorry that this is still occurring within your environment. If after upgrading to the latest macOS Beta 4 and are still experiencing Conditional Access failures in the Azure Active Directory blade under sign-ins, let's get you over to our support folks over in Azure for further investigation. You can raise a new support request via the Help + support blade in the Azure portal, or any of the methods here.