Forum Discussion

DrBojlerGyula's avatar
DrBojlerGyula
Copper Contributor
Dec 14, 2021

App Protection iOS & Android - the operation couldn't be completed (MSALErrorDomain error -50000)

Hi All!   I have a strange behavior.   The current setup is: We are using iOS and Android devices with conditional access policies and application protection policies. The conditional access pol...
Conditional Access
Intune
Mobile Application Management (MAM)
Rudy_Ooms_MVP's avatar
Rudy_Ooms_MVP
MVP
Dec 14, 2021

Just wondering, but what happens when (if thats possible) they first open Microsoft outlook to check if that's working and if so open teams... 

 

Could you also show us the CA config in wich you enforce app protection ?

 

And maybe a stupid thought... but are terms of use configured ? 

DrBojlerGyula's avatar
DrBojlerGyula
Copper Contributor
Dec 15, 2021
Unfortunately we the migration to Exchange Online is pendent. 🙂

The CA looks like this:

Assignments:
All Users
Office 365 Apps
Device Plattforms: Android, iOS
Client Apps: Browser, Mobile apps and desktop clients
All device state

Access Controls:
Require MFA
Sign-in frequency: 30 days
-----------------

Terms of use is configured, but is not required for the mobile device conditional access policy.

  • Rudy_Ooms_MVP's avatar
    Rudy_Ooms_MVP
    MVP
    Dec 15, 2021
    I am assuming al these users alrady have mfa :P.

    Thats the only policy ? and the app protection ca policy?
    • DrBojlerGyula's avatar
      DrBojlerGyula
      Copper Contributor
      Dec 15, 2021

      Rudy_Ooms_MVP 

      Sure, they do have MFA. 🙂

       

      The app protection policy is this: (the new one, the older one had a pin length of 4 digits and enabled third party keyboards.

       

      Apps

       
      Target to apps on all device types
      No
      Device types
      Unmanaged
      Public apps
      Microsoft Invoicing
      Microsoft Kaizala
      Microsoft Power Apps
      Microsoft Edge
      Microsoft 365 Admin
      Microsoft Excel
      Microsoft Outlook
      Microsoft PowerPoint
      Microsoft Word
      Microsoft Bookings
      Microsoft Office
      Microsoft OneNote
      Microsoft Planner
      Microsoft Power BI
      Microsoft SharePoint
      Microsoft StaffHub
      Microsoft OneDrive
      Microsoft Teams
      Microsoft Lists
      Microsoft Stream
      Microsoft To-Do
      Microsoft Visio Viewer
      Microsoft Whiteboard
      Custom apps
      --

      Data protection

       
      Prevent backups
      Block
      Send org data to other apps
      Policy managed apps
       
      Save copies of org data
      Block
      Allow user to save copies to selected services
      OneDrive for Business
      SharePoint
      Transfer telecommunication data to
      Any dialer app
      Dialer App URL Scheme
      --
      Receive data from other apps
      All Apps
      Open data into Org documents
      Allow
      Allow users to open data from selected services
      OneDrive for Business
      SharePoint
      Camera
      Restrict cut, copy, and paste between other apps
      Any app
      Cut and copy character limit for any app
      0
      Third party keyboards
      Block
      Encrypt org data
      Require
      Sync policy managed app data with native apps or add-ins
      Allow
      Printing org data
      Allow
      Restrict web content transfer with other apps
      Any app
      Unmanaged browser protocol
      --
      Org data notifications
      Allow

      Access requirements

       
      PIN for access
      Require
      PIN type
      Numeric
      Simple PIN
      Allow
      Select minimum PIN length
      6
      Touch ID instead of PIN for access (iOS 8+/iPadOS)
      Allow
      Override biometrics with PIN after timeout
      Not required
      Timeout (minutes of inactivity)
      0
      Face ID instead of PIN for access (iOS 11+/iPadOS)
      Allow
      PIN reset after number of days
      No
      Number of days
      0
      App PIN when device PIN is set
      Require
      Work or school account credentials for access
      Not required
      Recheck the access requirements after (minutes of inactivity)
      10

      Conditional launch

      Max PIN attempts
      5
      Reset PIN
       
      Offline grace period
      720
      Block access (minutes)
       
      Offline grace period
      90
      Wipe data (days)
       
      Jailbroken/rooted devices
       
      Block access
       
      Min OS version
      14.0
      Block access
       
      Min OS version
      13.0
      Wipe data

       

      • Rudy_Ooms_MVP's avatar
        Rudy_Ooms_MVP
        MVP
        Dec 16, 2021
        WHen trying to connect, could you share the sign in event from the sign in log? so we can rule out any existing ca's blocking the login.
        What happens when you exclude 1 user (to test with) from this app protection policy? (delete the app first to be sure no app protection policy is already applied to it)

Resources