[Feature Request] [IOS] Xamarin Implement Conditional Access Grant Control “require app protection policy”

[mafrank1]

Is your feature request related to a problem? Please describe.
We are using MSAL and Intune Xamarin library in our app. Both integrations are working in most cases, but we want to use the Conditional Access Grant Control “require app protection policy”. Based on the feedback of the Intune team the MSAL library does not provide this feature yet.

Describe the solution you'd like
Please integrate the Conditional Access Grant Control “require app protection policy” feature in the MSAL library and provide an release timeline.

• Create App for testing
• Create IntunePolicyRequiredException
• Trap Broker exception in Android
• Documentation of Android
• Ensure Keychain value is used for iOS
• Customize AcquireTokenSilent flow per platform
• Documentation of iOS

Estimate time to code complete: 10 days.

[tomzeni]

I have the same issue, please advise

[HannesVo]

I have the same issue, please advise us !

[mafrank1]

Any updates on this request?

[bgavrilMS]

We are exploring options for the future of Xamarin (e.g. wrapping native libs etc.), as we are falling behind the MSAL Android and MSAL iOS teams. We are aware of this gap.

@henrik-me in case he knows more

[mafrank1]

@bgavrilMS Thanks for the update!
@henrik-me Are you have any timeline for the implementation? Is there any workaround for Xamarin based apps available?

[henrik-me]

@mafrank1 we do not have any timeline at the moment. we are re-evaluating previous approaches. We are going to spend the next 3 months to validate our newest approach leveraging a native implementation. The previous attempts for wrapping native implementations did prove to be to hard to build and maintain, We are cautiously optimistic that this new approach will be successful.

@maliksahil @SameerK-MSFT

[tomzeni]

IMHO it looks like a perfect match at the beginning... using Microsoft Visual Studio with C# and an MS Multiplatform Framework like Xamarin to build Mobile Apps using Microsoft SDK’s like “INTUNE” & MSAL” to access data in a Microsoft Cloud like AZURE… but unfortunately this does not work as expected, because the .net implementation of MSAL still does NOT YET work flawlessly together with the INTUNE SDK.

Currently we have an iOS App for enterprise customers almost ready which we want to release ASAP.
But we can’t because all of our enterprise customers are using Conditional Access Grant Control “require app protection policy…
For development we can disable Conditional Access but in an production environment it’s just not possible.

We came across this issue some month ago and tough this might be just a bug in one of the SDK’s which will be fixed soon by MS as we go along with our own development…
But there was no movement and no bug tracks in this regards. After we talked to the guys responsible for the INTUNE SDK, they told us also that’s not them, it’s a issue of the current .net MSAL implementation…

And here we are now, waiting for a (IMHO) mandatory Feature of MSAL… and we even don’t have a timeline for that…
So to be honest, from my perspective this is very annoying… and should have been fixed already…

Hopping for an timeline or even an outlook in this regard.

Thanks,

Tom

[Nicwalle]

Same issue here on Xamarin.iOS

[tomzeni]

any updates on this ?

@maliksahil @SameerK-MSFT @henrik-me

[henrik-me]

We do not have an ETA we can communicate yet. I can say that we are working on this with high priority; this includes working with the Intune and Xamarin team on the e2e. This is not a feature which is enabled just by MSAL, the Intune SDK needs to support this as well.

@tomzeni not sure who you got the information from that it's just about MSAL, can you please point to an issue or a person where you have that information from?

For others reading, also want to remind that this is for App CA only, we support MDM via brokered auth today.

Note: We are not tracking this as an App CA work item, but as a change in how we build our library for Xamarin.

[tomzeni]

@henrik-me We got this information from a Jamie. S. from Microsoft via Email and he stated:

"The limitation is not actually with the Intune SDK. It’s related to the MSAL library. The .Net MSAL library does not currently support this feature"

[henrik-me]

Investigating where our difference in understanding is. @SameerK-MSFT to help provide an update here when we have it.

[mafrank1]

@henrik-me Just one question regarding your comment.

For others reading, also want to remind that this is for App CA only, we support MDM via brokered auth today.

Do you mean that the current Xamarin implementation for iOS is supporting the Conditional Access compliance state check? If yes, is there any code example or documentation available?

[tomzeni]

@bgavrilMS @henrik-me
are there any news, achievements, release dates or an new outlook?
can you please give an update on the current status in this regard.
thanks a lot

[bgavrilMS]

Hi @tomzeni - we have started working on this. @SameerK-MSFT will update the thread as needed. It's too early to give an estimate, and a lot of people are going on holiday etc. Probably early next year.

[SameerK-MSFT]

Tasks

• Create App for testing
• Create IntunePolicyRequiredException
• Trap Broker exception in Android
• Ensure Keychain value is used for iOS
• Customize AcquireTokenSilent flow per platform

[tomzeni]

@bgavrilMS @henrik-me
can you please provide an brief update about the current status?
Thanks a lot!

[bgavrilMS]

We are actively working on it, trying to test out the Android changes now. Would you be interested in testing a preview on Android only?

The iOS changes are more significant. If testing goes well I'd expect this to land around Feb.

[tomzeni]

Hey @bgavrilMS thanks for offering me to test Android, but currently we have only an iOS App in development.

Looking forward to the iOS Version.

[robbo-aj]

Is there a timeline on when the iOS changes will be ready? We are about to write a LOB app for iOS and were hoping to support both MDM and MAM. Thanks

[SameerK-MSFT]

Created separate issue for Android - #3185

[tomzeni]

@SameerK-MSFT @bgavrilMS @henrik-me
can you please provide an brief update about the current status regarding iOS?
is there an ETA including an DEMO App in sight already?
Thanks a lot!

[bgavrilMS]

I'll let @SameerK-MSFT update the thread with details, especially around app provisioning.

TrueMAM support for iOS has been merged we'll release it with MSAL 4.42, possibly today or early next week, depending on testing.

[bgavrilMS]

ios support released in 4.42

[SameerK-MSFT]

@tomzeni As @bgavrilMS mentioned, this functionality now has been provided in release 4.42. Please take a look. Regarding how to use it, here is unofficial blog that explains it. https://sameer.blog/2022/02/25/secure-resources-using-xamarin-and-intune-mam-sdk-on-ios/ and a dev app demonstrating it can be found here: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/tree/master/tests/devapps/Intune-xamarin-ios

[tomzeni]

Hey @SameerK-MSFT @bgavrilMS and Team, my first tests with 4.42 were all successful.
It just works! I'm happy AF. thank you so much for your effort fixing that issue. also for the great and well commented demo app. love u guys!