Skip to main content

Intune app protection for the mobile apps

The AI-School iPhone and Android app supports app protection with Microsoft Intune (MAM). Your organization can then use an App Protection Policy to determine what employees may do with data in the app, for example blocking copy to unmanaged apps or requiring a PIN code. Employees sign in to the app with Sign in with Microsoft; the app then registers with Intune.

For the integration, AI-School uses the Microsoft Entra app HandiHow AI-apps - Intune. An Entra administrator grants consent for this once for the entire organization.

What do you need?​

  • An Entra account with the Global Administrator or Privileged Role Administrator role. With that role, you can grant consent for the Intune permission.
  • Microsoft Intune with an App Protection Policy for the employees who use the app.
  • An AI-School environment in which employees sign in with Microsoft.

1. Grant consent via the linking page​

  1. Open Link Intune app protection in a regular browser on your computer.
  2. Enter the domain or Directory (tenant) ID of your organization, for example school.nl.
  3. Choose Grant consent in Microsoft and sign in with your administrator account.
  4. Check the app (HandiHow AI-apps - Intune, publisher HandiHow) and the permissions, then choose Accept.
  5. Microsoft will send you back to the linking page. There you will see Consent granted or a message with the error code.

The app requests two delegated permissions. They only work on behalf of the signed-in employee:

PermissionPurpose
User.Read (Microsoft Graph)Sign in and read the employee's profile.
DeviceManagementManagedApps.ReadWrite (Microsoft Mobile Application Management)Retrieve the employee's app protection policy and register the app with Intune.
Use the linking page

Do not use a separate link with only adminconsent?client_id=…. After Accept, Microsoft will then send you to an address that only the mobile apps can open. The screen will keep loading and you will not receive confirmation. The linking page passes Microsoft the correct return address.

2. Check consent in Entra​

In the Microsoft Entra admin center, open Enterprise applications → HandiHow AI-apps - Intune → Permissions. Under Admin consent, both permissions must be listed. The app appearing in the list of enterprise applications does not yet prove that consent has been granted.

3. Add the app to your App Protection Policy​

In the Intune admin center, add the app to the App Protection Policy for the relevant employees. Under apps, choose Custom apps and use:

PlatformPackage name or bundle ID
Androidinfo.aischool
iOSinfo.aischool.mobiel

4. Have Intune app protection enabled​

Let us know when steps 1 through 3 are complete. We will then enable Intune app protection for your AI-School environment. From that moment on, employees sign in to the app via the Microsoft broker (Company Portal or Authenticator) and the app registers with Intune.

Then test with an employee who has the policy: sign in to the app, complete the Intune prompts, and check a policy rule, for example that copying to an unmanaged app is blocked.

Troubleshooting​

What you seeWhat you do
The Microsoft screen keeps loading after Accept (login.microsoftonline.com/common/reprocess).You probably used a separate link without a return address. Check the consent as in step 2. If it is missing, start again via the linking page.
AADSTS900561: The endpoint only accepts POST requestsYou refreshed the Microsoft page while it was loading. This error says nothing about the consent itself. Check step 2 and, if needed, start again via the linking page.
access_denied or consent_required on the linking pageConsent was canceled or your account does not have the required administrator role. Nothing has been changed. Try again with an account that has the correct role.
AADSTS50011 (redirect URI does not match)Contact us and mention the error code.
Microsoft asks employees for administrator approval when signing in to the app (Need admin approval).The consent from step 1 is missing in your organization. Grant it via the linking page.

If it still does not work, send us the error code, the error message, the Correlation ID, and the time shown by Microsoft or the linking page.

On this page