Intune app protection for the mobile apps
The AI-Public iPhone and Android apps support app protection with Microsoft Intune (MAM). Your organization then defines with an App Protection Policy what employees are allowed to do with data in the app, for example blocking copying to unmanaged apps or requiring a PIN. Employees sign in to the app with Sign in with Microsoft; the app then registers with Intune.
For the integration, AI-Public uses the Microsoft Entra app HandiHow AI apps - Intune. An Entra administrator grants consent for this once for the entire organization.
What do you need?
- An Entra account with the Global Administrator or Privileged Role Administrator role. With that role, you can grant consent for the Intune permission.
- Microsoft Intune with an App Protection Policy for the employees who use the app.
- An AI-Public environment where employees sign in with Microsoft.
1. Grant consent via the connection page
- Open Connect Intune app protection in a regular browser on your computer.
- Enter the domain or Directory (tenant) ID of your organization, for example
gemeente.nl. - Choose Grant consent in Microsoft and sign in with your administrator account.
- Review the app (HandiHow AI apps - Intune, publisher HandiHow) and the permissions, then choose Accept.
- Microsoft will return you to the connection page. There you will see Consent granted or a message with the error code.
The app requests two delegated permissions. They only work on behalf of the signed-in employee:
| Permission | For what |
|---|---|
User.Read (Microsoft Graph) | Sign in and read the employee's profile. |
DeviceManagementManagedApps.ReadWrite (Microsoft Mobile Application Management) | Retrieve the employee's app protection policy and register the app with Intune. |
Do not use a separate link with only adminconsent?client_id=…. After Accept, Microsoft will then redirect you to an address that only the mobile apps can open. The screen will keep loading and you will not get confirmation. The connection page provides Microsoft with the correct return address.
2. Check the consent in Entra
In the Microsoft Entra admin center, open Enterprise applications → HandiHow AI apps - Intune → Permissions. Under Admin consent, both permissions must be listed. The app appearing in the enterprise applications list does not yet prove that consent has been granted.
3. Add the app to your App Protection Policy
In the Intune admin center, add the app to the App Protection Policy for the relevant employees. Under apps, choose Custom apps and use:
| Platform | Package name or bundle ID |
|---|---|
| Android | info.aipublic.app |
| iOS | info.aipublic.app |
4. Enable Intune app protection
Let us know that steps 1 through 3 are complete. We will then enable Intune app protection for your AI-Public environment. From that moment on, employees will sign in to the app via the Microsoft broker (Company Portal or Authenticator) and the app will register with Intune.
Then test with an employee who has the policy: sign in to the app, complete the Intune prompts, and verify a policy rule, for example that copying to an unmanaged app is blocked.
Troubleshooting
| What you see | What you do |
|---|---|
The Microsoft screen keeps loading after Accept (login.microsoftonline.com/common/reprocess). | You probably used a separate link without a return address. Check the consent as in step 2. If it is missing, start again via the connection page. |
AADSTS900561: The endpoint only accepts POST requests | You refreshed the Microsoft page while it was loading. This error says nothing about the consent itself. Check step 2 and, if necessary, start again via the connection page. |
access_denied or consent_required on the connection page | Consent was canceled or your account does not have the required admin role. Nothing has been changed. Try again with an account with the correct role. |
AADSTS50011 (redirect URI does not match) | Contact us and include the error code. |
| Microsoft asks employees to get admin approval (Need admin approval) when signing in to the app. | The consent from step 1 is missing in your organization. Grant it via the connection page. |
If it still does not work, send us the error code, the error message, the Correlation ID, and the time shown by Microsoft or the connection page.