Support tip: Intune MAM users on iOS/iPadOS userless devices may be blocked in rare cases

Previously, for iOS/iPadOS, Intune Mobile Application Management (MAM) required you to manually configure the IntuneMAMUPN, IntuneMAMOID, and IntuneMAMDeviceID app configuration values ​​to determine if the device was enrolled in Intune. Create and deploy app protection policies. Based on customer feedback to streamline the admin experience, we have started automatically passing these values ​​to managed applications on iOS devices enrolled in Intune. Starting with the September (2409) service release of Intune, we have enabled this change for the following apps: Microsoft Excel, Microsoft Outlook, Microsoft PowerPoint, Microsoft Teams, and Microsoft Word. We will continue to expand this to additional managed apps in the coming months.

We have recently received a warning that if these values ​​are not configured, users may be incorrectly blocked in certain scenarios. If an iOS device is “enrolled without user friendliness” and an app protection policy is applied to the user on one of the listed applications, the user will see “Configuration error warning” A conversation with the following message:

“Your organization’s support team wants you to log in with this account, but you tried to log in using: user@company.comIf you need assistance, please contact your organization’s support team.“

There is no solution, but we are actively working to address this issue.

You’ve likely already configured your app configuration values ​​to correctly apply app protection policies based on management type, but in the rare case that you haven’t, this change will modify the MAM device management type status from “Unmanaged” to “Managed.” This means that you’ll notice the change for MAM users with devices enrolled in Intune in the following scenarios:

• When using Managed App deviceManagementType Filter To customize your App Protection Policy (APP) deployment: every The user-targeted policy is for “unmanaged” iOS/iPadOS devices, and users will be relegated to a “no policy” state and APP will not be applied. To fix this, apply the app protection policy to all device types or specifically to managed devices.
• You use the APP Open in Management Data transfer settings to allow data sharing with other managed applications. Manage data transfer between iOS apps. This setting now correctly applies to Intune MAM users. Review the documentation. iOS/iPadOS App Protection Policy Settings, for Send Org data to other apps and Receiving data from other apps Make sure you have configured your MDM data sharing settings appropriate for your organization.

We will continue to update this post as new information becomes available. If you have any questions or comments for the Intune team, please reply to this post or contact X. @IntuneSoupTeam.