Before you start
- You are an IT administrator with the right to manage apps in your MDM system (for example Microsoft Intune or VMware Workspace ONE / AirWatch).
- Your users sign in to Findity with SSO against Microsoft Entra ID.
- Microsoft Authenticator or Company Portal is deployed to the devices so the SSO broker can be used.
How it works
The mobile app uses the operating system’s native authentication: ASWebAuthenticationSession on iOS and Custom Tabs / the native Google Sign-In SDK on Android. Authentication runs on MSAL (Microsoft Authentication Library) and uses a broker (Microsoft Authenticator or Company Portal) to pass the device information Entra ID needs to verify that the device is compliant. In practice this means:- Sign-in satisfies Compliant Device requirements in your Conditional Access policies.
- Device telemetry is included in the SSO flow so Entra ID can perform its check.
- The app can be containerized with Intune App Protection Policies (APP), so you can control copy-paste, backups, in-app PIN requirements, and similar settings without having to manage the whole device.
Deploy the app to users
1
Add the mobile app to your app catalog
Pull the Findity mobile app from the App Store or Google Play, add it to your MDM system, and publish it to the user group that should have access.
2
Configure any App Protection policies
If you want to containerize the app, apply your Intune App Protection Policies to the Findity mobile app the same way as for your other line-of-business apps.
3
Make sure the SSO broker is on the devices
Microsoft Authenticator (iOS and Android) or Company Portal (Android) must be installed and configured for SSO. The app uses the broker automatically when the user signs in.
4
The user signs in
When the user opens the app and starts SSO, the OS native sign-in is invoked, which in turn routes through the broker. Entra ID verifies the device and the user is signed in without manual steps.
Good to know
- No manual settings in the app. The user does not need to configure anything themselves. If the device is correctly configured by IT, sign-in just works.
- Both iOS and Android are supported. The technical flow differs (ASWebAuthenticationSession versus Custom Tabs / Google Sign-In SDK), but the user experience is the same.
- The “non-compliant device” error should not appear. If it does, check that the broker is installed on the device, that the device is registered in Entra ID, and that your Conditional Access policies allow the app.
- The web version is not affected. This guide covers the mobile app. Sign-in in the web version continues to work through the browser’s SSO flow.
Frequently asked questions
Which MDM systems are supported?
Which MDM systems are supported?
The mobile app is built on the standards used by Microsoft Entra ID and Intune (MSAL, broker SSO, App Protection Policies), so any MDM system that can distribute apps from the App Store and Google Play and that works with those standards is supported. Microsoft Intune and VMware Workspace ONE / AirWatch are the most common.
Do users have to install Microsoft Authenticator?
Do users have to install Microsoft Authenticator?
Microsoft Authenticator (or Company Portal on Android) must be present on the device so the broker can send device information to Entra ID. Without a broker, sign-in cannot satisfy the Compliant Device check.
Is Intune App Protection Policies (APP) supported?
Is Intune App Protection Policies (APP) supported?
Yes. The mobile app can be containerized with your APP policies, so you can enforce settings such as in-app PIN, copy-paste rules, and backup restrictions without managing the whole device.
Can users sign in without MDM?
Can users sign in without MDM?
Yes. The SSO flow in the mobile app works without MDM too, as long as your Entra ID configuration allows the sign-in. MDM support is for organizations that require managed devices.
What happens if a device is not compliant?
What happens if a device is not compliant?
Entra ID decides. Your Conditional Access policies control what happens: sign-in can be blocked, require additional steps, or be allowed through. Troubleshooting is done in the Entra sign-in logs.