Microsoft Intune Integration for Enterprise Mobile Apps

Enterprise iOS and Android apps require policies that can't be implemented through standard OS restrictions. If your organization already runs Azure AD, Office 365, and Teams, Microsoft Intune is the de facto EMM standard. We specialize in integrating the Intune SDK and MSAL into mobile applications, enabling Conditional Access at the Azure AD level and data protection through MAM. We once took on a project for a major bank: we had to integrate Intune MAM into an existing React Native app within two weeks. We completed it in 12 working days — and now we'll share how to avoid common pitfalls.

Intune is the de facto EMM standard for Microsoft-oriented organizations. If your infrastructure is built on Azure AD, Office 365, Teams — Intune is the logical choice: a single console, Conditional Access at the Azure AD level, native integration with Defender for Endpoint. For a mobile app, integration means supporting the MAM SDK or App Wrapping plus correct MSAL token acquisition that respects device compliance status.

Azure AD App Registration

The first step is App Registration in the Azure Portal. Without correct registration, Intune cannot apply policies to the app.

Minimum configuration:

1. Create an App Registration in Azure AD.
2. Add API permissions: DeviceManagementApps.ReadWrite.All, DeviceManagementConfiguration.ReadWrite.All (if the app reads policies directly).
3. Add IntuneMAM to the Redirect URI: msauth.{bundle-id}://auth.
4. Enable Public client flows for mobile clients.
5. In the Intune Portal (portal.azure.com → Intune → Client Apps), add the app to an App Protection Policy and assign it to groups.

How Conditional Access Works with MSAL

MSAL (Microsoft Authentication Library) replaces ADAL and is mandatory for modern Intune integration. Conditional Access works automatically: if the device is non-compliant (outdated OS, jailbreak detected by Intune), MSAL returns an MSALError with the conditionalAccessClaim code — the app must request a token again with additional claims. MSAL v1.1+ handles the CA challenge automatically with correct configuration.

iOS (Swift):

import MSAL let config = MSALPublicClientApplicationConfig( clientId: "YOUR_CLIENT_ID", redirectUri: "msauth.com.company.app://auth", authority: try MSALAADAuthority(url: URL(string: "https://login.microsoftonline.com/YOUR_TENANT_ID")!) ) config.bypassRedirectURIValidation = false let application = try MSALPublicClientApplication(configuration: config) let webParameters = MSALWebviewParameters(authPresentationViewController: viewController) let interactiveParameters = MSALInteractiveTokenParameters( scopes: ["https://graph.microsoft.com/.default"], webviewParameters: webParameters ) application.acquireToken(with: interactiveParameters) { result, error in if let result = result { // result.accessToken — use for API requests // result.account — save for silent token refresh } } 

Intune MAM SDK: Key Integration Points

After adding IntuneMAMSwift (iOS) or intune-mam-sdk (Android), several mandatory steps exist: Account Registration After Authentication:

// After successful MSAL login IntuneMAMEnrollmentManager.instance().loginAndEnrollAccount(userPrincipalName) // SDK registers the UPN with the MAM service and requests policies 

Handling the Enrollment Callback:

class MAMEnrollmentDelegate: NSObject, IntuneMAMEnrollmentDelegate { func enrollmentRequestWithStatus(_ status: IntuneMAMEnrollmentStatus) { switch status.statusCode { case .enrollmentSuccess: // Policies applied, allow access to corporate features case .enrollmentFailed: // Show error, restrict access case .unenrollmentSuccess: // Selective wipe completed } } } 

Policy Check Before Action:

let policyManager = IntuneMAMPolicyManager.instance() if policyManager.policy(forIdentity: userUPN).isSaveToPersonalAllowed(for: .camera) { // Allow saving to Camera Roll } else { showRestrictedActionAlert() } 

What Managed App Configuration Provides

In the Intune Portal, you can define a Configuration Policy for each app — a dictionary of key/value pairs that the app reads via UserDefaults.standard.dictionary(forKey: "com.apple.configuration.managed") (iOS) or RestrictionsManager (Android). This lets IT administrators change parameters (e.g., backend URL or session timeout) without updating the app.

Typical parameters for an enterprise app:

<!-- App Configuration Policy in Intune Portal (XML format) --> <dict> <key>BackendURL</key> <string>https://api.corp.example.com</string> <key>TenantID</key> <string>corp-tenant-001</string> <key>EnableVerboseLogging</key> <false/> <key>SessionTimeoutMinutes</key> <integer>30</integer> </dict> 

Integration with Microsoft Defender for Endpoint

If your organization uses Defender for Endpoint (MDE), Intune can receive mobile threat defense signals from it: jailbreak, malicious networks, vulnerable apps. Conditional Access uses these signals to block tokens. To enable this, the Defender SDK is embedded in the app — it runs in the background, sends threat events to MDE, and Intune receives the compliance status. From an app perspective, it's a separate dependency but requires no changes to core business logic.

Comparison: MAM SDK vs. App Wrapping

MAM SDK gives you full control over corporate data without needing App Wrapping — it's 3x faster in terms of policy configuration and does not require modifying third-party module code.

What's Included in Our Work

We provide a full integration cycle:

• Audit of the current app and Azure AD configuration.
• App registration in Azure AD and configuration of required permissions.
• MSAL integration with Conditional Access support.
• Embedding the Intune MAM SDK (iOS/Android/React Native/Flutter).
• Implementation of enrollment lifecycle and selective wipe.
• Setup of Managed App Configuration and App Protection Policy.
• Testing all scenarios: Conditional Access, file transfer protection, blocking on non-compliant devices.
• Documentation for IT and administrator training.
• Support through App Store and Google Play release.

Contact us for a project assessment — we'll provide a commercial proposal within a day. Order a turnkey integration — timelines from 3 to 8 weeks depending on complexity.

Our experience includes 5 years in enterprise mobile development, over 20 successful Intune projects across banking, retail, and logistics. We guarantee clean integration with no conflicts with existing code and full App Store Review compliance.

Integration Steps

Azure AD App Registration → MSAL configuration → Add Intune MAM SDK → Implement enrollment lifecycle → Managed App Configuration → App Protection Policy in Intune Portal → Test Conditional Access → Test selective wipe → Rollout.

Timelines: MSAL + MAM SDK integration into an existing app — 3–5 weeks. With Intune Portal, policies, and testing — 6–8 weeks. Pricing is determined individually.

For more on Intune SDK, see the official Microsoft documentation, and for MSAL, see MSAL for iOS.