Forum Discussion

DrBojlerGyula's avatar
DrBojlerGyula
Tin Contributor
Dec 14, 2021

App Protection iOS & Android - the operation couldn't be completed (MSALErrorDomain error -50000)

Hi All!   I have a strange behavior.   The current setup is: We are using iOS and Android devices with conditional access policies and application protection policies. The conditional access pol...
Conditional Access
intune
Mobile Application Management (MAM)
DrBojlerGyula's avatar
DrBojlerGyula
Tin Contributor
Dec 15, 2021
Unfortunately we the migration to Exchange Online is pendent. 🙂

The CA looks like this:

Assignments:
All Users
Office 365 Apps
Device Plattforms: Android, iOS
Client Apps: Browser, Mobile apps and desktop clients
All device state

Access Controls:
Require MFA
Sign-in frequency: 30 days
-----------------

Terms of use is configured, but is not required for the mobile device conditional access policy.

Rudy_Ooms_MVP's avatar
Rudy_Ooms_MVP
MVP
Dec 15, 2021
I am assuming al these users alrady have mfa :P.

Thats the only policy ? and the app protection ca policy?
  • DrBojlerGyula's avatar
    DrBojlerGyula
    Tin Contributor
    Dec 15, 2021

    Rudy_Ooms_MVP 

    Sure, they do have MFA. 🙂

     

    The app protection policy is this: (the new one, the older one had a pin length of 4 digits and enabled third party keyboards.

     

    Apps

     
    Target to apps on all device types
    No
    Device types
    Unmanaged
    Public apps
    Microsoft Invoicing
    Microsoft Kaizala
    Microsoft Power Apps
    Microsoft Edge
    Microsoft 365 Admin
    Microsoft Excel
    Microsoft Outlook
    Microsoft PowerPoint
    Microsoft Word
    Microsoft Bookings
    Microsoft Office
    Microsoft OneNote
    Microsoft Planner
    Microsoft Power BI
    Microsoft SharePoint
    Microsoft StaffHub
    Microsoft OneDrive
    Microsoft Teams
    Microsoft Lists
    Microsoft Stream
    Microsoft To-Do
    Microsoft Visio Viewer
    Microsoft Whiteboard
    Custom apps
    --

    Data protection

     
    Prevent backups
    Block
    Send org data to other apps
    Policy managed apps
     
    Save copies of org data
    Block
    Allow user to save copies to selected services
    OneDrive for Business
    SharePoint
    Transfer telecommunication data to
    Any dialer app
    Dialer App URL Scheme
    --
    Receive data from other apps
    All Apps
    Open data into Org documents
    Allow
    Allow users to open data from selected services
    OneDrive for Business
    SharePoint
    Camera
    Restrict cut, copy, and paste between other apps
    Any app
    Cut and copy character limit for any app
    0
    Third party keyboards
    Block
    Encrypt org data
    Require
    Sync policy managed app data with native apps or add-ins
    Allow
    Printing org data
    Allow
    Restrict web content transfer with other apps
    Any app
    Unmanaged browser protocol
    --
    Org data notifications
    Allow

    Access requirements

     
    PIN for access
    Require
    PIN type
    Numeric
    Simple PIN
    Allow
    Select minimum PIN length
    6
    Touch ID instead of PIN for access (iOS 8+/iPadOS)
    Allow
    Override biometrics with PIN after timeout
    Not required
    Timeout (minutes of inactivity)
    0
    Face ID instead of PIN for access (iOS 11+/iPadOS)
    Allow
    PIN reset after number of days
    No
    Number of days
    0
    App PIN when device PIN is set
    Require
    Work or school account credentials for access
    Not required
    Recheck the access requirements after (minutes of inactivity)
    10

    Conditional launch

    Max PIN attempts
    5
    Reset PIN
     
    Offline grace period
    720
    Block access (minutes)
     
    Offline grace period
    90
    Wipe data (days)
     
    Jailbroken/rooted devices
     
    Block access
     
    Min OS version
    14.0
    Block access
     
    Min OS version
    13.0
    Wipe data

     

    • Rudy_Ooms_MVP's avatar
      Rudy_Ooms_MVP
      MVP
      Dec 15, 2021
      WHen trying to connect, could you share the sign in event from the sign in log? so we can rule out any existing ca's blocking the login.
      What happens when you exclude 1 user (to test with) from this app protection policy? (delete the app first to be sure no app protection policy is already applied to it)
      • DrBojlerGyula's avatar
        DrBojlerGyula
        Tin Contributor
        Dec 16, 2021
        Sing in event log: everything normal, State=success, no other conditional access is blocking, also double checked via "what if" tool.

        The behavior for the excluded user is normal: there is no message and the user can use teams.