question

Problem:
1、After an iOS device is successfully registered, the application protection policy fails. What is the cause of the check-in failure
2、Device check-in must be registered with Azure Active Directory platform
3、Are these operation procedures the same as the background configuration of Intune after uploading to App Store (download link is configured in App Store)"

Integration:
1、The framework：
（1）IntuneMAMSwift.xcframework
（2）IntuneMAMSwiftStub.xcframework
（3）MSAL（Since our app needs to be sent to the App Store later, this framework will not be used in the future, but for testing, we tested the two cases of using and not using）

2、Configure Schmes, etc., according to the documentation, and configure “ADALClientId” or not for application registration. There are tests for both

3、Packaged using a “Company account”, packaged with a Hoc certificate, uploaded to the “Microsoft Endpoint Manager” Manager and configured as a line of business application

The background configuration:
1、Add groups and users for testing

2、User configuration
（1）Configure roles global administrator and Intune administrator
（2）The two configuration licenses are “Azure Active Directory Premium P2” and “Enterprise Mobility + Security E5”

3、Application configuration
（1）Configure a protection policy to prevent copying, pasting, and third-party keyboards

The test results:
1、The device is registered successfully
2、The application is installed successfully
3、Background deletion and other operations are successful
4、Failed to apply the protection policy
（1）View the process: Application > Monitor > Application Protection Status > iOS User Status > Select User
（2） Check the results:
Status: Unavailable
Delivered policy: None
Status: Not checked in, next synchronization...
Last synced time: never
5、Android is a success
6、Succeeded in adding a public application by checking in

From the test, it can be seen that the code should be wrong, the configuration is ok

If use MSAL：

Debug Message: The operation failed because the SDK could not access the user's AAD token. The application should prompt the user for credentials to refresh the user's AAD token.

NSString kClientID = @"";
NSString kGraphEndpoint = @"https://graph.microsoft.com/";
NSString kAuthority = @"https://login.microsoftonline.com/common";
NSString kRedirectUri = @"";

 MSALPublicClientApplicationConfig *config = [[MSALPublicClientApplicationConfig alloc]
                                              initWithClientId:kClientID
                                              redirectUri:kRedirectUri
                                              authority:nil];
 MSALPublicClientApplication *application = [[MSALPublicClientApplication alloc] initWithConfiguration:config error:nil];
 MSALWebviewParameters *webParameters = [[MSALWebviewParameters alloc] initWithAuthPresentationViewController:self];
 webParameters.webviewType = MSALWebviewTypeWKWebView;
 webParameters.presentationStyle = UIModalPresentationFullScreen;
 MSALInteractiveTokenParameters *parameters = [[MSALInteractiveTokenParameters alloc] initWithScopes:@[@"User.Read", @"Calendars.Read"] webviewParameters:webParameters];
 [IntuneMAMEnrollmentManager instance].delegate = self;
 [application acquireTokenWithParameters:parameters completionBlock:^(MSALResult *result, NSError *error) {
     if (error) {
         return;
     }
     MSALAccount *account = result.account;
     [[NSUserDefaults standardUserDefaults] setValue:account.homeAccountId.identifier forKey:""];
     [[IntuneMAMEnrollmentManager instance] registerAndEnrollAccount:account.identifier];
 }];


(void)enrollmentRequestWithStatus:(IntuneMAMEnrollmentStatus*)status
{
NSLog(@"enrollment result for identity %@ with status code %ld", status.identity, (unsigned long)status.statusCode);
NSLog(@"Debug Message: %@", status.errorString);
}

(void)policyRequestWithStatus:(IntuneMAMEnrollmentStatus*)status
{
NSLog(@"policy check-in result for identity %@ with status code %ld", status.identity, (unsigned long)status.statusCode);
NSLog(@"Debug Message: %@", status.errorString);
}

(void)unenrollRequestWithStatus:(IntuneMAMEnrollmentStatus*)status
{
NSLog(@"un-enroll result for identity %@ with status code %ld", status.identity, (unsigned long)status.statusCode);
NSLog(@"Debug Message: %@", status.errorString);
}

If don't use MSAL：

If you do not use MSAL below the method completely do not know which method to call

[IntuneMAMEnrollmentManager instance].delegate = self;
[[IntuneMAMEnrollmentManager instance] loginAndEnrollAccount:nil];