Forum Discussion
Why different broker apps for iOS and Android (not enrolled) when using app protection policies?
Hi Jonas,
yes I can explain why, but I can't explain if it will change in future. Here is the reason for this:
Android has a way to share data between apps which the Intune product uses on the Android platform. Which data actually is shared I don't know, but there are various opportunities for which you can use this. For example to deliver new SDK versions to other apps on the Android platform. The Company Portal is maintained by the Intune product group where the Authenticator app is maintained by the Azure AD product group.
The sharing is officially documented here: https://docs.microsoft.com/en-us/intune/end-user-mam-apps-android
The Company Portal app is a way for Intune to share data in a secure location. Therefore, the Company Portal app is a requirement for all apps that are associated with app protection policies, even if the device is not enrolled in Intune.
For iOS this is not possible because Apple does not allow such a scenario due to his app model and containerization. So, for iOS there is absolutely no reason then to force usage of the Company Portal but the Authenticator as a broker makes totally sense.
So why does not Android switch to Authenticator as well? I think that's because of the different teams, Intune does not own the Authenticator and maybe the publishing of new versions then is not that fast as they would like it to have (that's the way how big companies and product ownership works).
You can use Microsoft Intune UserVoice to make a Design Change Request or support a maybe already existing one here:
https://microsoftintune.uservoice.com/forums/291681-ideas
best,
Oliver
Hi Jonas,
yes I can explain why, but I can't explain if it will change in future. Here is the reason for this:
Android has a way to share data between apps which the Intune product uses on the Android platform. Which data actually is shared I don't know, but there are various opportunities for which you can use this. For example to deliver new SDK versions to other apps on the Android platform. The Company Portal is maintained by the Intune product group where the Authenticator app is maintained by the Azure AD product group.
The sharing is officially documented here: https://docs.microsoft.com/en-us/intune/end-user-mam-apps-android
The Company Portal app is a way for Intune to share data in a secure location. Therefore, the Company Portal app is a requirement for all apps that are associated with app protection policies, even if the device is not enrolled in Intune.
For iOS this is not possible because Apple does not allow such a scenario due to his app model and containerization. So, for iOS there is absolutely no reason then to force usage of the Company Portal but the Authenticator as a broker makes totally sense.
So why does not Android switch to Authenticator as well? I think that's because of the different teams, Intune does not own the Authenticator and maybe the publishing of new versions then is not that fast as they would like it to have (that's the way how big companies and product ownership works).
You can use Microsoft Intune UserVoice to make a Design Change Request or support a maybe already existing one here:
https://microsoftintune.uservoice.com/forums/291681-ideas
best,
Oliver
Oliver Kieselbach since the UserVoice link is broken, please consider voting for my issue in the MS Feedback Portal: https://feedbackportal.microsoft.com/feedback/idea/cf437861-3949-ef11-b4ad-0022484d3ecc
Found this when researching the Required App for Conditional Access. It looks like Android can either use Authenticator or the company portal.
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-grant#require-approved-client-app"In order to leverage this grant control, Conditional Access requires that the device be registered in Azure Active Directory which requires the use of a broker app. The broker app can be the Microsoft Authenticator for iOS, or either the Microsoft Authenticator or Microsoft Company portal for Android devices. If a broker app is not installed on the device when the user attempts to authenticate, the user gets redirected to the appropriate app store to install the required broker app."Notice the part I bolded.Hi, I also did read the same information, but this information is about an approved app, not require app protection
Take a look at this Microsoft doc, it tells us to use the company portal app
Android app protection policy settings - Microsoft Intune | Microsoft Docs
Of course to be sure...I tested it... I downloaded Onedrive and when I logged in with my username and password it tells me to install the company portal first.
I did the same test but with the authenticator preinstalled. This time I did not ask me to immediately install the Company portal when I logged in.. but after a few seconds the same prompt... So make sure when you are requiring app protection the company portal is installedIf you want to know some more about app protection
Call4Cloud requiring Approved Apps or an App Protection Policy
Rudy_Ooms_MVP After testing this it seems that the Company Portal is also required on Android for use of Outlook when hitting a CA policy with 'approved client app' requirement. Authenticator was not sufficient unfortunately.
- Hi Oliver,
I had set up an app based conditional access policy to force outlook mobile mail app, but after some tests on an android phone its looks like I don't get any prompt to install the company portal. I only had to register the device.
I already have the authenticator app installed on the android device, so to my understanding the auth app can be used as the broker app in some cases.
Do you know the reason for this behaviour.
Best,
Mil - This is great information and just what I was looking for. I suspect not even Microsoft can tell us the future roadmap for this. At the same time we have users performing MFA with text message (SMS) and they are confused why they need to install the authenticator app when they don’t need it for authentication.
In the end, we have a problem users don’t wanting to ”Azure AD register” (which the app protection policy will do) their device with the company because of privacy concerns (even though we can’t see much) since many are using their personal device. But I consider this a HR-problem, not an IT-problem :)
