iOS 14 + Mail/Calendar + Multi Factor Authentication fails

Question

question

AlexanderHenket-6641 asked Sep 13, '20 tech-0880 published Dec 23, '20

iOS 14 + Mail/Calendar + Multi Factor Authentication fails

As of iOS 14 I am unable to use Mail/Calendar for our Office365 business account because iOS Settings fails for Multi Factor Authentication (MFA).

All Microsoft apps work fine on MFA, so I temporarily fell back to Microsoft Outlook.app on iOS. Also using mobile Safari I can go to outlook.com no problem.

When I use iOS Settings > Mail > Accounts however the procedure takes me to microsoftonline.com which redirects into the regular company site, which redirects into microsoftonline.com to show me the attached screen. [would love to upload picture but upload feature is broken here] -- The 'error' says "Administrator approval required for Apple Internet Accounts"

I noticed that iOS beta 6 fixed something in OAuth/Exchange, but for me that did not solve the issue. Anyone else experiencing this?

Removal and recreation of account in Microsoft Authenticator did not help. My sysops initially told me that the problem is in an incompatibility between Apple Internet Accounts OAuth behavior under iOS 14 and Microsoft Intune. With the final release of iOS 14 around the corner it sounds important to have that fixed at either end.

mem-intune-enrollment

· 7

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Mattynat-6071 · Sep 17, 2020 at 03:47 PM

Seems like a wide spread issue as I am seeing it at my company as well. We actually opened up a case with Apple instead of Microsoft but I am sure we will loop in MS at some point. Seems like some users are able to turn off Cross track and the other security settings in Settings > Safari and then sign in again. While others are reporting they needed to delete their account and try to add it back in multiple times in order for it to work. Someone at Apple said: One thing to be on the lookout for: iOS and iPadOS use randomized MAC addresses for privacy now. Can disable manually in Settings on a per network basis or via MDM. So if your network expects certain MAC addresses you may have trouble.

Just thought I’d share. Good luck!

2 ·

Bob1459-5117 · Sep 18, 2020 at 11:48 PM

If I saw this earlier I would not of upgraded. Public release and now no access to Corp email

1 ·

SaboEric-4606 · Oct 08, 2020 at 09:56 AM

What was the fix for this ? I have an end user with IOS 14.1

0 ·

NicolasAverseng-3589 SaboEric-4606 · Oct 08, 2020 at 11:27 AM

Managed to fix it by adding the admin consent in AAD (https://docs.microsoft.com/answers/answers/104889/view.html gave the hint)

The name somehow changed from 'iOS Accounts' to 'Apple Internet Accounts' afterwards and users on iOS 14 are now able to connect.

0 ·

RuiCardoso-9867 NicolasAverseng-3589 · Oct 21, 2020 at 10:43 AM

In my tenant, I can see "iOS Accounts" but not "Apple Internet Accounts". Guess why? Admin consent to "iOS Accounts" is not enabling users to configure iOS apps like mail and calendar. They are getting the message "Unable to verify account information".
Even generating app passwords, they still get the same message.

0 ·

tech-0880 NicolasAverseng-3589 · Dec 23, 2020 at 08:59 PM

THANK YOU!! This worked for me as well.

0 ·

SomePerson-0200 · Dec 23, 2020 at 03:09 AM

I'm not sure which step (or both) made it work but here is what I did and now iPad is able to add an account and receive email when it previously didn't. iPad is iOS 14.2.

First step:
1. Sign into Azure AD as an admin, navigate to Enterprise Applications and click on iOS Accounts.
2. In iOS Accounts Overview, click Permissions (in the Security section).
3. Click "Grant admin consent for <company name>".

Second step:
1. On iPad, install either Chrome or Edge.
2. Make Chrome/Edge the default browser.
A. Open Settings on your iPad
B. Swipe down to find the third-party browser you’d like to set as the default.
C. Choose Default Browser App.
D. Tap either Chrome/Edge.
E. Do not restart device.
3. Go to iPad Mail app and add account. This time the Auth request will open Chrome/Edge where the authentication is allowed to complete.
4. Change default browser back to desired default.

0 ·

Answer 1 · 2020-09-13T22:24:18.023Z

Jason-MSFT answered Sep 13, '20 AlexanderHenket-6641 commented Sep 14, '20

Zero-day supports for major iOS versions is the goal for Intune and we've met that with each of the three versions (IIRC). Until then though, all bets are off particularly for a product we don't control and is still subject to change and breaking issues. Additionally, none of this is related to Intune as Intune plays absolutely no part in authentication (including MFA) or what the built-in iOS mail app does.

If this is still broken after iOS 14 is released, then please do report this but make sure that you report it to Apple as only they have control over how the mail app works.

Also note that uploading images works just fine:

new-microsoft-logo-em-168x167.jpg (4.3 KiB)

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

AlexanderHenket-6641 · Sep 14, 2020 at 08:26 AM

I have filed this with Apple in the feedback program already.

I’m not asking for support with my exact case. I would just like to make sure Microsoft uses the beta program to iron out glitches that any beta period has. Also I wanted to know if this is due to the beta at all or something that could have happened in any version.

You tell me to wait for the final product, and I’ll do that certainly. My reporting job thus concludes.

Both Safari and Firefox failed to upload the images. The progress bar rests at 0%.

0 ·

Answer 2 · 2020-09-16T05:27:49.47Z

AlexanderHenket-6641 answered Sep 16, '20

This morning iOS 14 final version was released and installed on my iPhone. The problem persists. Is it possible to help out now that iOS is no longer beta?

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 3 · 2020-09-16T17:35:10.29Z

Jason-MSFT answered Sep 16, '20

As noted, this is not related to Intune in any way as Intune is unrelated to authentication. Also, since nothing has changed with Azure AD authentication, the problem lies with the iOS mail app and thus needs to be pursued with Apple.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 4 · 2020-09-16T19:12:54.043Z

AlexanderHenket-6641 answered Sep 16, '20 DrewLove-9013 edited Sep 17, '20

The mail app nor the calendar app is at play here. This is the iOS Settings for Mail accounts talking to my companies self hosted frontend for Office365 and domain authentication.

I have no idea what software is on their end and frankly I don’t know they do. All I know is they keep checking Intune configuration whenever I call them.

It’s kind of frustrating that nobody seems to able to do anything but point to ‘the other party’. This a common pattern for problems that involve communication between different vendors.

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DrewLove-9013 · Sep 17, 2020 at 01:35 AM

I just updated and I believe I’m having the same issue.

My Office 365 account says it’s not authenticated and I’m prompted to re-enter my password. I tap re-enter password and instead of being redirected to the MS login box I just get another iOS box telling me I need to go into settings and re-enter my password. It just loops.

And it’s not just one device. The same thing is happening on an iPad I also just upgraded.

The only way I was able to fix this with iOS 13 was to wipe the phone and set it up as a new iPhone. Not cool.

0 ·

Answer 5 · 2020-09-16T21:19:53.25Z

Jason-MSFT answered Sep 16, '20

It's time for you to open a support case as there's no way to troubleshoot an issue like this in a forum.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 6 · 2020-09-17T18:47:40.977Z

AlexanderHenket-6641 answered Sep 17, '20 AlexanderHenket-6641 edited Sep 17, '20

My sysops tell me today they are now flooded with users experiencing the same issue. They are investigating why the sts site they run has this issue. I leave the issue with them. They have all the info I don’t have

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 7 · 2020-09-18T00:04:38.647Z

BrianDavis-2755 answered Sep 18, '20 ShanghviChetan-1917 commented Oct 12, '20

@AlexanderHenket-6641 @Jason-MSFT @DrewLove-9013

I was able to fix this on my phone by changing the default browser to chrome. Found this issue is really due to one of the Safari security updates that comes with iOS 14.

Open Settings on your iPhone or iPad
Swipe down to find the third-party browser you’d like to set as the default
Choose Default Browser App
Tap the third-party app you’d like to use.

Then go back to your mail app and add the Exchange account normally. This time the Auth request will open chrome where the authentication is allowed to complete and not loop like it does in Safari.

Test this and let me know if it works for you too.

· 6

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

rschenk · Sep 18, 2020 at 12:38 AM

Having the same issue for myself. Just tried this and no go for me... Switched to Chrome, but still in this loop when selecting work account. :(

1 ·

AlanReagan-3101 · Oct 12, 2020 at 08:10 PM

This worked for me as well. We had a lot of user consent for this app, but applied admin consent as well.

Here's another strange thing occurring in our environment. Users who in-place upgrade to iOS 14 with working mail continue to work after upgrading. In our environment, this seems to be limited to a new enrollments on iOS14. I can remove management profile, and log out of Company Portal on working iOS 14 device that has been upgraded. If I try to re-enroll with Safari as default, Mail cannot connect to exchange server. If I try to re-enroll with Chrome as default it works.

P.S. When we are prompted to enter creds for exchange server, we don't actually get a form credential prompt, the device is passing a cert. With either Safari or Chrome this behavior is displayed. Chrome works Safari doesn't. My guess is there's a bigger issue with Safari as a managed Intune browser in iOS 14 due to changes in client cert security.

1 ·

ShanghviChetan-1917 AlanReagan-3101 · Oct 12, 2020 at 08:57 PM

Same issue for us too with new enrollments on iOS 14.x. Do your organization have a custom Exchange URL like mail.organization.com or outlook.organization.com? If yes, try that instead of outlook.office365.com in the MDM Exchange Email profile and it will work.

1 ·

AlanReagan-3101 ShanghviChetan-1917 · Oct 12, 2020 at 09:45 PM

We have public DNS for on-prem exchange, but no custom public name pointed to exchange online. The public DNS for exchange on-prem used to work and the users would then redirect to exch online, but now iOS 14 only accepts outlook.office365.com as the server.

0 ·

Show more comments

BobDonkey-3565 · Oct 01, 2020 at 01:43 PM

Thanks, this worked for us, we changed default to Edge. When you authenticate, you have to click 'open in edge' first and then it switches browsers, then the auth works.

0 ·

Answer 8 · 2020-09-18T13:31:37.59Z

AlexanderHenket-6641 answered Sep 18, '20 DrewLove-9013 commented Sep 21, '20

Good news: my sysops have succeeded in adding the right authorizations in Azure. The problem turned out to be tenant specific. Their own tenant did not have my problem so originally they were unable to reproduce.

They added that the solution had been something they also had to do for iOS 13.0 but not for 13.1. This leads me to believe that is a returning issue for major versions of iOS. In any case: my issue is solved.

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

NicolasAverseng-3589 · Sep 21, 2020 at 12:08 PM

Could you share the resolution with us ?

1 ·

DrewLove-9013 · Sep 21, 2020 at 12:11 PM

What was the resolution, please? I ended up wiping my phone and tablet and setting up both from scratch which took the better part of a day. Had to do the same thing with iOS 13.

0 ·

Answer 9 · 2020-09-18T20:06:49.857Z

MitchGatewood-2516 answered Sep 18, '20 MitchGatewood-2516 published Sep 18, '20

Do you know what Azure authentication?

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 10 · 2020-09-22T13:46:22.133Z

ShanghviChetan-1917 answered Sep 22, '20 NormundsKarklins commented Sep 30, '20

I believe there is an issue with Oauth enabled Exchange payload that's pushed through the MDM profile in iOS 14 as we tested this with two MDM providers and it failed with both. Apple should be notified about this. Adding Exchange account directly without MDM payload is working.

· 5

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

rschenk · Sep 22, 2020 at 07:48 PM

We ended up having a call with Microsoft support. In our case, we are using Oauth (Modern Authentication) and that caused the issue.

Had to change to Basic Auth temporarily, fix the account (asked for some permissions) and then it worked after that. Back to Oauth.

Likely this will be an Apple IOS 14.x bug fix....

0 ·

MitchGatewood-2516 rschenk · Sep 22, 2020 at 07:52 PM

By temporarily, do you mean that you changed it to Basic Authentication until you fixed the account then you went by to Oauth, or do you mean you are keeping it at basic until there is a fix from Apple?

0 ·

rschenk MitchGatewood-2516 · Sep 22, 2020 at 08:01 PM

We just did a quick experiment to see if it would work for the user in question. We excluded them from the policy and retried with Basic Auth. We were then able to authenticate from the phone. Don't suggest making global change to Basic if you have multiple users affected. I'd wait for Apple to fix it.

These are Intune managed devices.

0 ·

Show more comments

question