Intune App Protection for the mobile apps

The iPhone and Android apps of AI-Corporate support app protection with Microsoft Intune (MAM). Your organization then uses an App Protection Policy to determine what employees may do with data in the app, for example blocking copying to unmanaged apps or requiring a PIN. Employees sign in to the app with Sign in with Microsoft; the app registers with Intune during this process.

For the integration, AI-Corporate uses the Microsoft Entra app HandiHow AI-apps - Intune. An Entra administrator grants consent for this once, for the entire organization.

What do you need?

• An Entra account with the Global Administrator or Privileged Role Administrator role. With that role, you can grant consent for the Intune permission.
• Microsoft Intune with an App Protection Policy for the employees who use the app.
• An AI-Corporate environment in which employees sign in with Microsoft.

1. Grant consent via the connection page

1. Open Link Intune app protection in a regular browser on your computer.
2. Enter the domain or Directory (tenant) ID of your organization, for example bedrijf.nl.
3. Choose Grant consent in Microsoft and sign in with your administrator account.
4. Review the app (HandiHow AI-apps - Intune, publisher HandiHow) and the permissions, then choose Accept.
5. Microsoft will return you to the connection page. There you will see Consent granted or a message with the error code.

The app requests two delegated permissions. They only work on behalf of the signed-in employee:

Permission	Purpose
User.Read (Microsoft Graph)	Sign in and read the employee’s profile.
DeviceManagementManagedApps.ReadWrite (Microsoft Mobile Application Management)	Retrieve the employee’s app protection policy and register the app with Intune.

Use the connection page

Do not use a separate link with only adminconsent?client_id=…. After you click Accept, Microsoft will then redirect you to an address that only the mobile apps can open. The screen will keep loading and you will not get a confirmation. The connection page provides Microsoft with the correct return address.

2. Check the consent in Entra

In the Microsoft Entra admin center, open Enterprise applications → HandiHow AI-apps - Intune → Permissions. Under Admin consent, both permissions must be listed. The app appearing in the list of enterprise applications does not yet prove that consent has been granted.

3. Add the app to your App Protection Policy

In the Intune admin center, add the app to the App Protection Policy for the relevant employees. Under apps, choose Custom apps and use:

Platform	Package name or bundle ID
Android	info.aicorporate.app
iOS	info.aicorporate.app

4. Have Intune app protection enabled

Let us know that steps 1 through 3 are complete. We will then enable Intune app protection for your AI-Corporate environment. From that point on, employees sign in to the app through the Microsoft broker (Company Portal or Authenticator) and the app registers with Intune.

After that, test with an employee who has the policy: sign in to the app, complete the Intune prompts, and check a policy rule, for example that copying to an unmanaged app is blocked.

Troubleshooting

What you see	What you do
The Microsoft screen keeps loading after Accept (login.microsoftonline.com/common/reprocess).	You probably used a separate link without a return address. Check the consent as in step 2. If it is missing, start again via the connection page.
AADSTS900561: The endpoint only accepts POST requests	You refreshed the Microsoft page while it was loading. This error says nothing about the consent itself. Check step 2 and, if necessary, start again via the connection page.
access_denied or consent_required on the connection page	The consent was canceled or your account does not have the required administrator role. Nothing has changed. Try again with an account that has the correct role.
AADSTS50011 (redirect URI does not match)	Contact us and mention the error code.
Microsoft asks employees for administrator approval when signing in to the app (Need admin approval).	The consent from step 1 is missing in your organization. Grant it via the connection page.

If it still does not work, send us the error code, the error message, the Correlation ID, and the time shown by Microsoft or the connection page.