MS Intune Mobile App Support config, setup, troubleshooting, and end user workflows #8599

cwarnermm · 2025-12-22T18:57:36Z

Documentation for:

Docs Previews Shortcuts for Reviewers:

Decision Makers & Risk Assessors

System Administrators

Configure Microsoft Intune MAM

End Users

…user workflows

github-actions · 2025-12-22T19:00:57Z

Newest code from mattermost has been published to preview environment for Git SHA 599a914

enahum · 2025-12-22T19:13:22Z

@cwarnermm I glanced at it and I spotted a few things that are incorrect.. going to take my time to
review this tomorrow and try and guide you a bit more soecially regarding steps on Entra

enahum

Intune.md

Check this file to see if it helps.

The implementation plan has more info about the error codes. (i'll share over DM)

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

enahum · 2025-12-23T09:21:33Z

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

+
+* Commit to Azure AD ``objectId`` as the authoritative identity.
+* Ensure all authentication methods (OAuth, SAML, LDAP) resolve to the same value.
+* Confirm access tokens include the ``oid`` claim.


this will be part of the configuration steps when configuring in Entra, not sure this is needed here.

Is it accurate to say that Entra configuration enforces these conditions, or should we phrase this as "must be validated by the admin during Entra setup"?

I mean, this is something that they will HAVE to configure in Entra when they register the application (This is not registering the mobile application, just an Entra application, then during the configuration of that Application they will need to add some claims the the access token, but the access token even without optional claims, will include the oid

Screenshot for reference

enahum · 2025-12-23T09:23:28Z

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

+* You require Android Intune MAM support (not yet available).
+* Your deployment cannot use Microsoft Entra ID (Azure AD).
+* Your identity strategy cannot use Azure AD ``objectId`` as the authoritative user identifier.
+* You need a rollout model where users can defer or bypass Intune enrollment.


This point is interesting, cause they can have multiple login methods, only the login method selected in the Intune MAM configuration in the system console is subject to this.

I think we need to make this clearer.. for example they can have users with another login method and this is then a false statement, guest users and again this is a false statement.

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

enahum · 2025-12-23T09:42:29Z

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

+* Register the Mattermost mobile app as a public/native Entra application.
+* Copy the **Application (Client) ID**.
+
+  To register an application in Microsoft Entra, see: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app
+
+* Configure the iOS platform with the correct bundle ID and redirect URI.
+
+  For Entra portal steps, see: https://learn.microsoft.com/en-us/entra/identity-platform/scenario-mobile-app-configuration
+
+  For redirect URI formatting details, see: https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-redirect-uri
+
+* Grant required Intune MAM API permissions with admin consent.
+
+  To grant tenant-wide admin consent, see: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent


not at all.

Register an Application in Entra that will be use to authenticate the users.

this link works To register an application in Microsoft Entra, see: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app and we can keep that, but probably best to direct them to configure this for Single tenant

The redirect URI should remain empty

Once the app is registered, they should Expose an API more info here: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apis

The API to be exposed should be api://<APPLICATION-ID> normally filled automatically, then add a scope named login.mattermost

Once that is done, they need to Add a client application, add the Client Id as listed below and assign the Authorized scopes to api://<APPLICATION-ID>/login.mattermost

Mattermost Mobile Beta: 64e9952b-20eb-46dc-92ad-99089ed24903

Mattermost Mobile: not yet created, we will need to update this document

in addition I will share a script once we have the Client Id for Mattermost Mobile so we can attach it here.

Then in Token configuration -> Add optional claim, Select Token type Access then select the claims

email

family_name

given_name

preferred_username

upn

To finalize the documentation, I'll need:

Production Mobile Client ID

Confirmation that login.mattermost is the final scope name

Confirmation that all listed access token claims are mandatory

The script you mentioned (or guidance on where it will live)

To finalize the documentation, I'll need:

Production Mobile Client ID

Confirmation that login.mattermost is the final scope name

Confirmation that all listed access token claims are mandatory

The script you mentioned (or guidance on where it will live)

Production Mobile Client ID -> @iyampaul still needs to configure this, I need it too.

login.mattermost is the FINAL scope

Not all claims are mandatory, but let's act as if they are.

The script I can provide once I have the Production Mobile Client ID, the Guidance should be in the document I shared in the section that describes the configuration for "Expose an API"

enahum · 2025-12-23T10:21:47Z

source/end-user-guide/access/access-your-workspace.rst

+  3. Enter your credentials.
+  4. When prompted, tap **Enroll**.
+
+     During enrollment, you may see the Microsoft sign-in screen again. This is normal and usually takes only a few seconds.


this does not happen during sign-in only if Intune is enabled mid-session

enahum · 2025-12-23T10:22:06Z

source/end-user-guide/access/access-your-workspace.rst

+     During enrollment, you may see the Microsoft sign-in screen again. This is normal and usually takes only a few seconds.
+
+  5. When enrollment completes, you are notified.
+  6. When prompted, enter a PIN to add an extra layer of protection for your work data.


this is only if the policy enforces a PIN

enahum · 2025-12-23T10:22:32Z

source/end-user-guide/access/access-your-workspace.rst

+
+  .. note::
+
+    If you tap **Cancel**, you will not be able to use Mattermost on mobile until enrollment succeeds. You can retry immediately or `log out <#what-happens-when-i-log-out-manually>`__ and retry later.


this is only in mid-session, not during signin

source/end-user-guide/access/access-your-workspace.rst

enahum · 2025-12-23T10:25:19Z

source/end-user-guide/access/access-your-workspace.rst

+  If you try to copy content from Mattermost into another app, the paste will not work.
+
+  Screenshot & Screen Recording Restrictions
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+  To prevent sensitive content from being captured, you will not be able to take screenshots or record your screen while using Mattermost.
+
+  If you try to take a screenshot or record your screen, the screenshot or recording will not be captured.
+
+  File Save Restrictions
+  ~~~~~~~~~~~~~~~~~~~~~~~
+
+  To keep work files protected, you will not be able to save files to personal locations.
+
+  If you try to save a file from Mattermost to a personal location, the save will not work. Files can be saved only to locations approved by your organization.
+
+  Browser & Sharing Restrictions
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+  To ensure data stays within protected apps, you will not be able to open links in unapproved browsers or share content to unmanaged apps.
+
+  If you tap a link in Mattermost, it opens only in an approved browser. If you try to share content to an unmanaged app, the share will not work.


All of these are enforced or not depending on the Intune policy, perhaps we should point to a microsoft documentation that explains each policy or we should try to be broad with the explanation.

Co-authored-by: Elias Nahum <[email protected]>

github-actions · 2025-12-23T13:42:15Z

Newest code from mattermost has been published to preview environment for Git SHA 6334a30

Co-authored-by: Elias Nahum <[email protected]>

…intune-mam

github-actions · 2025-12-23T14:09:53Z

Newest code from mattermost has been published to preview environment for Git SHA 3350638

github-actions · 2025-12-23T14:11:08Z

Newest code from mattermost has been published to preview environment for Git SHA 0f31a06

Co-authored-by: Elias Nahum <[email protected]>

github-actions · 2025-12-23T21:46:17Z

Newest code from mattermost has been published to preview environment for Git SHA f47ab17

github-actions · 2025-12-23T21:47:05Z

Newest code from mattermost has been published to preview environment for Git SHA a2dfc71

…intune-mam

github-actions · 2025-12-23T22:15:19Z

Newest code from mattermost has been published to preview environment for Git SHA 90580db

github-actions · 2025-12-23T22:19:51Z

Newest code from mattermost has been published to preview environment for Git SHA 3af81d6

github-actions · 2026-01-07T20:31:28Z

Newest code from mattermost has been published to preview environment for Git SHA 5147147

enahum

sorry, the comments remain in a pending state

enahum · 2026-01-08T07:02:05Z

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

+
+* Commit to Azure AD ``objectId`` as the authoritative identity.
+* Ensure all authentication methods (OAuth, SAML, LDAP) resolve to the same value.
+* Confirm access tokens include the ``oid`` claim.


I mean, this is something that they will HAVE to configure in Entra when they register the application (This is not registering the mobile application, just an Entra application, then during the configuration of that Application they will need to add some claims the the access token, but the access token even without optional claims, will include the oid

Screenshot for reference

enahum · 2026-01-08T07:06:16Z

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

+* Register the Mattermost mobile app as a public/native Entra application.
+* Copy the **Application (Client) ID**.
+
+  To register an application in Microsoft Entra, see: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app
+
+* Configure the iOS platform with the correct bundle ID and redirect URI.
+
+  For Entra portal steps, see: https://learn.microsoft.com/en-us/entra/identity-platform/scenario-mobile-app-configuration
+
+  For redirect URI formatting details, see: https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-redirect-uri
+
+* Grant required Intune MAM API permissions with admin consent.
+
+  To grant tenant-wide admin consent, see: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent


To finalize the documentation, I'll need:

Production Mobile Client ID

Confirmation that login.mattermost is the final scope name

Confirmation that all listed access token claims are mandatory

The script you mentioned (or guidance on where it will live)

Production Mobile Client ID -> @iyampaul still needs to configure this, I need it too.

login.mattermost is the FINAL scope

Not all claims are mandatory, but let's act as if they are.

The script I can provide once I have the Production Mobile Client ID, the Guidance should be in the document I shared in the section that describes the configuration for "Expose an API"

enahum · 2026-01-08T07:09:59Z

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

+Step 5: Validate Using the Mobile App
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Ensure test users are assigned in Intune and properly licensed.


They'll get an alert saying

"Consent Denied"
"You denied consent for Intune management. The affected accounts have been unenrolled and signed out."

So of course, this is not true from the part of the user, but still the consent is missing.

enahum · 2026-01-08T07:39:43Z

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

+| Custom attributes | Not supported    | Unsupported by Intune        |
+-------------------+------------------+------------------------------+
+
+Attribute Synchronization & Access Enforcement


"Your account isn't fully set up yet. Please sign in to Mattermost via the web or desktop app first."

github-actions · 2026-01-08T22:08:30Z

Newest code from mattermost has been published to preview environment for Git SHA 3240e43

github-actions · 2026-01-09T16:02:30Z

Newest code from mattermost has been published to preview environment for Git SHA 9a770d3

…intune-mam

github-actions · 2026-01-09T18:27:24Z

Newest code from mattermost has been published to preview environment for Git SHA bf6a4e8

github-actions · 2026-01-09T19:31:27Z

Newest code from mattermost has been published to preview environment for Git SHA 31d650e

github-actions · 2026-01-09T19:31:57Z

Newest code from mattermost has been published to preview environment for Git SHA dceacd5

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

enahum · 2026-01-12T07:31:39Z

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

+4. Authorize the ``api://<APPLICATION-ID>/login.mattermost`` scope.
+5. Save your changes.
+
+If the official client application ID isn't yet available, complete the remaining steps and return here once Mattermost provides it.


we have the one for the beta app, I already shared it but here it is again just in case 64e9952b-20eb-46dc-92ad-99089ed24903 we can add this one and once we have the id for the production app we can update this doc.

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

source/end-user-guide/access/access-your-workspace.rst

enahum · 2026-01-12T08:18:24Z

source/end-user-guide/access/access-your-workspace.rst

+  4. When enrollment completes, you are notified.
+  5. If your organization’s Intune App Protection Policy requires it, you’ll be prompted to set a PIN to protect your work data. Once the PIN is confirmed, the Mattermost Mobile App unlocks access to your workspace.
+
+  If you dismiss enrollment during sign-in, return to the sign-in flow and complete enrollment to continue using Mattermost on that device.


enrollment cannot be dismissed, this happens automatically on sign-in, what they dismiss/cancel is the login flow.

In the event that Intune is enabled mid-session, they could dismiss the prompt to enroll, but this seems to belong in the next section.

Co-authored-by: Elias Nahum <[email protected]>

github-actions · 2026-01-12T16:34:47Z

Newest code from mattermost has been published to preview environment for Git SHA f1eea82

github-actions · 2026-01-12T16:35:47Z

Newest code from mattermost has been published to preview environment for Git SHA 7f36db7

github-actions · 2026-01-12T16:35:48Z

Newest code from mattermost has been published to preview environment for Git SHA 8aec224

enahum

almost there

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

Co-authored-by: Elias Nahum <[email protected]>

github-actions · 2026-01-12T17:42:45Z

Newest code from mattermost has been published to preview environment for Git SHA 844e7bc

MS Intune Mobile App Support config, setup, troubleshooting, and end …

599a914

…user workflows

cwarnermm added this to the v11.3.0 milestone Dec 22, 2025

cwarnermm requested review from DSchalla, enahum, iyampaul, roberson-io and yasserfaraazkhan December 22, 2025 18:57

cwarnermm added 1: Dev Review Requires review by a core commiter 2. SME Review Guidance labels Dec 22, 2025

enahum requested changes Dec 23, 2025

View reviewed changes

Update source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

6334a30

Co-authored-by: Elias Nahum <[email protected]>

cwarnermm and others added 3 commits December 23, 2025 09:05

Update source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

3350638

Co-authored-by: Elias Nahum <[email protected]>

Incorporating technical review feedback

7c305b7

Merge branch 'intune-mam' of https://github.com/mattermost/docs into …

0f31a06

…intune-mam

cwarnermm and others added 2 commits December 23, 2025 16:42

Incorporated technical reviewer feedback

f47ab17

Update source/end-user-guide/access/access-your-workspace.rst

a2dfc71

Co-authored-by: Elias Nahum <[email protected]>

cwarnermm added 2 commits December 23, 2025 17:09

Incorporated technical reviewer updates

9171afa

Merge branch 'intune-mam' of https://github.com/mattermost/docs into …

90580db

…intune-mam

Fixed build warnings

3af81d6

cwarnermm requested a review from enahum December 23, 2025 22:23

cwarnermm requested a review from enahum January 7, 2026 20:31

enahum reviewed Jan 8, 2026

View reviewed changes

Incorporated reviewer feedback, round 3

3240e43

Merge branch 'master' into intune-mam

9a770d3

cwarnermm added 2 commits January 9, 2026 13:24

Admin config simplification overhaul

7ab7103

Merge branch 'intune-mam' of https://github.com/mattermost/docs into …

bf6a4e8

…intune-mam

cwarnermm added 2 commits January 9, 2026 14:27

draft complete updates minus 3rd party config steps

31d650e

Table formatting fix

dceacd5

cwarnermm requested review from enahum and esarafianou and removed request for iyampaul January 9, 2026 19:32

enahum requested changes Jan 12, 2026

View reviewed changes

cwarnermm and others added 3 commits January 12, 2026 11:31

Incorporated reviewer feedback

f1eea82

Update source/end-user-guide/access/access-your-workspace.rst

8aec224

Co-authored-by: Elias Nahum <[email protected]>

Merge branch 'master' into intune-mam

7f36db7

cwarnermm requested a review from enahum January 12, 2026 16:32

enahum requested changes Jan 12, 2026

View reviewed changes

source/deployment-guide/mobile/configure-microsoft-intune-mam.rst Outdated Show resolved Hide resolved

Update source/deployment-guide/mobile/configure-microsoft-intune-mam.rst

844e7bc

Co-authored-by: Elias Nahum <[email protected]>

cwarnermm requested a review from enahum January 12, 2026 17:39

enahum approved these changes Jan 12, 2026

View reviewed changes


		.. note::

		If you tap Cancel, you will not be able to use Mattermost on mobile until enrollment succeeds. You can retry immediately or `log out <#what-happens-when-i-log-out-manually>`__ and retry later.

MS Intune Mobile App Support config, setup, troubleshooting, and end user workflows #8599

Are you sure you want to change the base?

MS Intune Mobile App Support config, setup, troubleshooting, and end user workflows #8599

Conversation

cwarnermm commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 22, 2025

Uh oh!

enahum commented Dec 22, 2025

Uh oh!

enahum left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

github-actions bot commented Jan 7, 2026

Uh oh!

enahum left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 8, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

cwarnermm commented Dec 22, 2025 •

edited

Loading