Why different broker apps for iOS and Android (not enrolled) when using app protection policies?

[Jonas Back]

So we're setting up app-based conditional access so that iOS and Android are forced to use the Outlook Mobile app instead of the built-in ones and then applying app protection policies to force PIN etc. We are not enrolling devices.

One customer wanted more information regarding the broker app requirement. We understand this is required so that Intune securely can communicate with the device and push down policies and we assume this is so that the apps themselves only talk to the broker app rather than each app talks directly to Intune.

But why are the broker apps different on iOS (Authenticator) and Android (Company Portal)? Most of their users already run the Authenticator so for iOS that is great but the Android users have to install the Company Portal which cause an extra step for the user and they also have privacy concerns for this. Why is that and are we likely to see this change in the future, only needing the Authenticator app on Android? Then we can save the Company Portal dicussion for the future when we start doing complete enrollment for some devices.

Hope someone knows something about this.

[#2 · Accepted solution]

Hi Jonas,

yes I can explain why, but I can't explain if it will change in future. Here is the reason for this:

Android has a way to share data between apps which the Intune product uses on the Android platform. Which data actually is shared I don't know, but there are various opportunities for which you can use this. For example to deliver new SDK versions to other apps on the Android platform. The Company Portal is maintained by the Intune product group where the Authenticator app is maintained by the Azure AD product group.

The sharing is officially documented here: https://docs.microsoft.com/en-us/intune/end-user-mam-apps-android

The Company Portal app is a way for Intune to share data in a secure location. Therefore, the Company Portal app is a requirement for all apps that are associated with app protection policies, even if the device is not enrolled in Intune.

For iOS this is not possible because Apple does not allow such a scenario due to his app model and containerization. So, for iOS there is absolutely no reason then to force usage of the Company Portal but the Authenticator as a broker makes totally sense.

So why does not Android switch to Authenticator as well? I think that's because of the different teams, Intune does not own the Authenticator and maybe the publishing of new versions then is not that fast as they would like it to have (that's the way how big companies and product ownership works).

You can use Microsoft Intune UserVoice to make a Design Change Request or support a maybe already existing one here:

https://microsoftintune.uservoice.com/forums/291681-ideas

best,

Oliver

[#3]

This is great information and just what I was looking for. I suspect not even Microsoft can tell us the future roadmap for this. At the same time we have users performing MFA with text message (SMS) and they are confused why they need to install the authenticator app when they don’t need it for authentication.

In the end, we have a problem users don’t wanting to ”Azure AD register” (which the app protection policy will do) their device with the company because of privacy concerns (even though we can’t see much) since many are using their personal device. But I consider this a HR-problem, not an IT-problem :)