Why different broker apps for iOS and Android (not enrolled) when using app protection policies?

[JonasBack]

So we're setting up app-based conditional access so that iOS and Android are forced to use the Outlook Mobile app instead of the built-in ones and then applying app protection policies to force PIN etc. We are not enrolling devices.

One customer wanted more information regarding the broker app requirement. We understand this is required so that Intune securely can communicate with the device and push down policies and we assume this is so that the apps themselves only talk to the broker app rather than each app talks directly to Intune.

But why are the broker apps different on iOS (Authenticator) and Android (Company Portal)? Most of their users already run the Authenticator so for iOS that is great but the Android users have to install the Company Portal which cause an extra step for the user and they also have privacy concerns for this. Why is that and are we likely to see this change in the future, only needing the Authenticator app on Android? Then we can save the Company Portal dicussion for the future when we start doing complete enrollment for some devices.

Hope someone knows something about this.

[#2 · Accepted solution]

Hi Jonas,

yes I can explain why, but I can't explain if it will change in future. Here is the reason for this:

Android has a way to share data between apps which the Intune product uses on the Android platform. Which data actually is shared I don't know, but there are various opportunities for which you can use this. For example to deliver new SDK versions to other apps on the Android platform. The Company Portal is maintained by the Intune product group where the Authenticator app is maintained by the Azure AD product group.

The sharing is officially documented here: https://docs.microsoft.com/en-us/intune/end-user-mam-apps-android

The Company Portal app is a way for Intune to share data in a secure location. Therefore, the Company Portal app is a requirement for all apps that are associated with app protection policies, even if the device is not enrolled in Intune.

For iOS this is not possible because Apple does not allow such a scenario due to his app model and containerization. So, for iOS there is absolutely no reason then to force usage of the Company Portal but the Authenticator as a broker makes totally sense.

So why does not Android switch to Authenticator as well? I think that's because of the different teams, Intune does not own the Authenticator and maybe the publishing of new versions then is not that fast as they would like it to have (that's the way how big companies and product ownership works).

You can use Microsoft Intune UserVoice to make a Design Change Request or support a maybe already existing one here:

https://microsoftintune.uservoice.com/forums/291681-ideas

best,

Oliver

[#3]

This is great information and just what I was looking for. I suspect not even Microsoft can tell us the future roadmap for this. At the same time we have users performing MFA with text message (SMS) and they are confused why they need to install the authenticator app when they don’t need it for authentication.

In the end, we have a problem users don’t wanting to ”Azure AD register” (which the app protection policy will do) their device with the company because of privacy concerns (even though we can’t see much) since many are using their personal device. But I consider this a HR-problem, not an IT-problem 🙂

[#4]

Hi Oliver,
I had set up an app based conditional access policy to force outlook mobile mail app, but after some tests on an android phone its looks like I don't get any prompt to install the company portal. I only had to register the device.
I already have the authenticator app installed on the android device, so to my understanding the auth app can be used as the broker app in some cases.
Do you know the reason for this behaviour.
Best,
Mil

[#5]

@Oliver Kieselbach 

Found this when researching the Required App for Conditional Access. It looks like Android can either use Authenticator or the company portal.
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-acces...

"In order to leverage this grant control, Conditional Access requires that the device be registered in Azure Active Directory which requires the use of a broker app. The broker app can be the Microsoft Authenticator for iOS, or either the Microsoft Authenticator or Microsoft Company portal for Android devices. If a broker app is not installed on the device when the user attempts to authenticate, the user gets redirected to the appropriate app store to install the required broker app."

Notice the part I bolded. 

[#6]

@Coopem16 That would be amazing that you'd only need Authenticator for Android going forward. Will see if I get the opportunity to test this in a future rollout.

[#7]

Hi, I also did read the same information, but this information is about an approved app, not require app protection

Take a look at this Microsoft doc, it tells us to use the company portal app

Android app protection policy settings - Microsoft Intune | Microsoft Docs

Of course to be sure...I tested it... I downloaded Onedrive and when I logged in with my username and password it tells me to install the company portal first.

I did the same test but with the authenticator preinstalled. This time I did not ask me to immediately install the Company portal when I logged in.. but after a few seconds the same prompt... So make sure when you are requiring app protection the company portal is installed

If you want to know some more about app protection

Call4Cloud requiring Approved Apps or an App Protection Policy

[#8]

Thanks,
Right now we are only using MFA and Required app in CA. When we set up our policy few apps supported the require app protection. So far this is the only Documentation that mentioned using either for the broker. None of the other docs do not mention it.

[#9]

@Rudy_Ooms_MVP After testing this it seems that the Company Portal is also required on Android for use of Outlook when hitting a CA policy with 'approved client app' requirement. Authenticator was not sufficient unfortunately.

[#10]

Hi, I guess that's what I was telling? 🙂

"So make sure when you are requiring app protection the company portal is installed"

[#11]

Yeah Reading the Snippet I posted, they are talking Specifically about Registration. So for an Android Registration of the device can probably be provided by Authenticator or the Company Portal. But delivering App Protection Policies probably requires Company Portal.
However this seems like an internal struggle inside MS, so we will probably never see a resolution.

[#12]

It's been another year since this and it seems like many articles at docs.microsoft.com has been changed so that Company Portal is no longer required for App Protection policies. Anyone tried it yet? Back in March 2022 when we tried it the last time, Company Portal was still required.

Here's a list of updates:

This article was changed on 5th April 2022:
https://docs.microsoft.com/en-us/mem/intune/protect/app-based-conditional-access-intune

Before it said:
The user gets redirected to the app store to install a broker app when trying to authenticate for the first time. The broker app can be either the Microsoft Authenticator for iOS, or the Microsoft Company portal for Android devices.

Now it says:
The user gets redirected to the app store to install a broker app when trying to authenticate for the first time. The broker app can be the Microsoft Authenticator for iOS, or either the Microsoft Authenticator or Microsoft Company portal for Android devices.

---
This article was changed on 7th Jul 2022:
https://docs.microsoft.com/en-us/intune/end-user-mam-apps-android

Before it says but not anymore:
The Intune Company Portal is required on the device to receive App Protection Policies for Android devices.

---

This was changed on 7th July 2022:
https://docs.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-android

Before it said:
The Intune Company Portal is required on the device to receive App Protection Policies for Android devices.

Now it says:
Either the Intune Company Portal or the Microsoft Authenticator is required on the device to receive App Protection Policies for Android devices.

[#13]

@Oliver Kieselbach Especially you maybe have tested it since you had great insights into it in 2019?

[#14]

Although this article states that Authenticator can suffice as broker app on Android: Android app protection policy settings - Microsoft Intune | Microsoft Docs

In our testing this is not true, if we have APP deployed to Android then it still prompts the user to install InTune Company Portal app (which we don't want since that's kind of the point of MAM instead of MDM).

I'm hoping Microsoft teams can coordinate and clarify when we can get off the requirement for Company Portal to deploy APP on Android?

[#15]

@NT-DW thanks for letting us know.

As a matter of fact, we're doing multiple implementations of this now at customers and see the same issue - Intune Company Portal is still required on Android devices to apply App Protection Policies. It's requested by Outlook once the policy is applied to the user.

I'll post feedback on the docs.microsoft.com pages and also see if I can log a support ticket.

[#16]

Many hours later we still confirm that Intune Company Portal is still required on Android. Also had a support ticket with Microsoft [Case #:32525687] and they came to the same conclusion. So I will go ahead and post feedback on docs.microsoft.com.

[#17]

Found this today. Have submitted a feedback request for the doco: https://github.com/MicrosoftDocs/azure-docs/issues/105756

[#18]

@NT-DW Actually, after submitting the above, I think the article is correct. I have found the cause of the confusion:

• The 'Require approved client app' Conditional Access policy requires a broker app to perform device registration - on Android, this can be Microsoft Authenticator, or Microsoft Company Portal.
• The 'Require app protection policy', and the general Intune App Protection Policy feature require app protection functionality, which on Android is only built into the Company Portal app.

In my testing, it seems that the 'Require approved client app' setting by itself can work on an Android device with Microsoft Authenticator installed.

However the 'Require app protection policy' setting, and applying app protection policies in Intune, do require the Company Portal app on Android.

This is slightly confusing since often the 'Require approved client app' setting (which can use Microsoft Authenticator or Company Portal on Android) is setup along with app protection policies (which can only use Company Portal on Android). But the current text in the article is actually correct, once you realise that a 'broker app' is not the same as 'app protection functionality'.

Perhaps the 'Require app protection policy' section should be worded more clearly:

'The broker app can be Microsoft Authenticator for iOS. On Android the broker app must additionally support app protection functionality, so the only supported broker app for this policy is Microsoft Company Portal for Android devices.'

[#19]

I ran into the same issue, iOS uses authenticator app but Android requires Company Portal for App Protection Policy, therefore i created a feedback in the feedback portal to make an administrator able to choose which app is the broker:

https://feedbackportal.microsoft.com/feedback/idea/d164a118-e4bc-ed11-a81b-000d3a0450e3

[#20]

@Oliver Kieselbach since the UserVoice link is broken, please consider voting for my issue in the MS Feedback Portal: App Protection Policies should use Authenticator for Android · Community (microsoft.com)