Forum Discussion
Solved
Conditional Access native iOS mail app works - but not if manually configured or if mail already set
Hello
When I create CA Policies for iOS, (All iOS devices on iOS 11+)
Scenario: Client has existing iPhone's already in use - 90% use native iOS App - We want to force these devices into MDM Enrollment (via Intune)
I am essentially using this guide to set CA policies : https://www.easycloud365.com/blog/how-to-block-native-apple-mail-app-ios-with-conditional-access-part-1
So far this works if I am setting up a new device, it will prompt me to sign into organisation and require me to enroll the device etc. - Works as it says on the tin. However....
A couple of things are apparent:
- When I setup a new phone - i click on the iOS mail app > Add Account > Exchange > type in username(email address) & password and I receive a prompt:
"Sign in to your "username@tenant.onmicrosoft.com"Exchange account using Microsoft?"
1) Configure Manually
2) Sign In
If I select "Sign In" then no drama - I go through the enrollment process normally
If I select can also select "Set up manually" and then proceed to set up the device using- email address: (username@tenant.onmicrosoft.com)
- username & Password (username@tenant.onmicrosoft.com)
- Server: outlook.office365.com
I am then able to get mail flowing in the native iOS mail app without the phone being required to go into MDM or adhere to the Conditional Access Policies and Compliance policies
Next is that any phones already with their mail configured in the default iOS App
- Nothing happens - you just continue to use the phone as normal and it does not block mail on the native iOS app sop that the users are forced to enroll their devices.
I hope this all makes some sense - and looking for any guidance. i.e. perhaps I need to block via PowerShell?
https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/secure-outlook-for-ios-and-android#leveraging-exchange-online-mobile-device-policies
Thanks for your time reading this.
- The first policy (legacy) should block access. It's also recommended to make one policy for active sync and one for other clients. Make sure to exclude service accounts that doesn't support modern authentication.
I would monitor the sign-in log and look for logins from other client and active sync (unsupported) before doing this in production.
JT
- So were you able to block the manual sign-in? I'm at this stage too.
- You need to block legacy authentication in order to fully make use of Conditional Access
Adam Weldon-Ming
What does the sign-inn log in Azure AD say, choose to show the client app column?Do you also block legacy authentication?
You could also add an App Protection Policy to make sure also nonregistered BYOD devices are forced to use Outlook, but this shouldn't be necessary for access control if you don't also want better management of company data.
JT
thanks for your time going through my problem jenstf & Alexander Vanyurikhin
I have created two policies
1 Policy for Legacy and Native iOS App
1 Policy for Modern Authentication
Both Require device to be marked as compliant & Requires approved client app
But I am still able to get mail to flow in once configuring manually.
(unless while I am changing policies it may take some time before it takes affect)
These are my policies
Only applying to Exchange Online App
Only applying to iOS and Android devices.
[First is for native iOS / Legacy Auth]1
[Second below is for Modern Auth - If setting up via outlook app this works fine and enrolls the device problem I think is the first policy above]
2
2
With the above set - I was able to manually configure mail on iOS device by adding the server: outlook.office365.com
I have turned policies on and off for the first one so maybe it will rake some time to apply(?)
I checked Sign-Ins on Azure AD monitoring but not showing anything with signing if I configure manually -- The first policy (legacy) should block access. It's also recommended to make one policy for active sync and one for other clients. Make sure to exclude service accounts that doesn't support modern authentication.
I would monitor the sign-in log and look for logins from other client and active sync (unsupported) before doing this in production.
JT
Adam Weldon-Ming Nature of Conditional Access is that it actually works only with Modern Auth. So, in your case you need to have 2 policies.
- One to block Legacy authentication.
- And one more following guide you used.
