MSAL InTune authentication issue with "Account credentials for access" App Privacy Policy.

[r-jarvis]

We have an iOS application that uses the InTune SDK with MSAL authentication and works in most cases. In the InTune Admin Center app protection policy, If the user sets the "Work or school account credentials for access" option to "Required" we are having issues.

Normally we authenticate users via MSAL SDK using MSALPublicClientApplication.acquireToken(with:) . In this specific use case, InTune requires an additional authentication when the app is opened or brought back from the background (As well as on first launch after enrolling). This additional authentication works successfully, but we need to make sure the other logic in our app waits until it is finished to continue.

When InTune runs this additional authentication, is there any callback or delegate method that we can listen to in order to know when that operation is complete?

I've tried conforming to this delegate, but it only seems to be called when manually prompting for authentication via MSAL. https://learn.microsoft.com/en-us/entra/identity-platform/tutorial-v2-ios#handle-the-sign-in-callback-ios-only

[wangxiaoms]

There is no delegate or callback for PIN, auth or other conditional launch policy enforcement. However, in the case of an app launch or foregrounding, Intune should delay app lifecycle notifications (didFinishLaunching, didEnterForeground, etc.) until conditional launch checks have completed to avoid potential issues.

[r-jarvis]

@wangxiaoms Ah gotcha, okay that makes sense. Thanks for your response!