Skip to main content

 

Eptura Knowledge Center

Eptura Engage and Microsoft Edge authentication

  1. Last updated
  2. Save as PDF

If your organization uses Microsoft Intune to enable single sign-on (SSO) through Microsoft Edge when launching the Eptura Engage mobile app, you must ensure that:

  • The Eptura Engage mobile app is included in the targeted apps list.
  • Microsoft Edge is configured as an approved browser for mobile application management (MAM) and as an approved client.

If these requirements are not met, users may see the Action not allowed message when signing in.

A MAM policy must also be assigned to the user. If no policy is assigned, users may see the Authorization required message and be unable to sign in.

Important: 

When using Microsoft Edge authentication, Conditional Access policies, or Microsoft Intune MAM, with the Eptura Engage mobile app, the following requirements must be met:

  • Tenant-wide admin consent: A Microsoft Entra ID administrator must grant tenant-wide admin consent to the Eptura Engage application. The following permissions are required:
  • Microsoft Graph: User.Read
  • Microsoft Mobile Application Management: DeviceManagementManagedApps.ReadWrite
  • Microsoft Entra ID identity: Users must have a Microsoft Entra ID identity. Users authenticated solely through on-premises Active Directory are not supported unless their accounts are synchronized or federated to Microsoft Entra ID.

If the required permissions and admin consent have not been granted, users may be unable to complete authentication or Intune enrollment and could receive authorization errors during sign-in.

Follow these steps to configure Microsoft Intune for Microsoft Edge authentication in the Eptura Engage mobile app. This ensures Microsoft Intune recognizes both Microsoft Edge and Eptura Engage, allowing users to complete the sign-in process successfully.

Configure Microsoft Intune for Microsoft Edge authentication

Step 1. Configure Edge as the approved browser for MAM

From your Azure Portal, go to Microsoft Entra ID > Enterprise Applications > [Eptura Engage app] > Conditional Access and check:

  • The policy allows browser access via Microsoft Edge for mobile platforms.
  • Microsoft Edge is configured as a compliant browser or as an approved app in the Conditional Access policy (under the 'Cloud apps or actions' condition).
Step 2. Add the Eptura Engage mobile app to Targeted apps

From the Intune Admin Center, go to Apps > Apps protection policies > Targeted apps, and add the Eptura Engage mobile app if it is not already listed.

Step 3. Configure Edge as an approved client

If your Conditional Access policy requires an approved client app or app protection policy, ensure Microsoft Edge is recognized as an approved client:

  • In your Conditional Access policy, ensure Microsoft Edge is included under the Client apps filter.
Step 4. Configure and assign MAM policies
  1. From the Intune Admin Center, go to Apps > App protection policies, and ensure:
  • A MAM policy (iOS and/or Android, as appropriate) is assigned to the same user group for Eptura Engage and Microsoft Edge.
  • The MAM policy applies to both Eptura Engage and Microsoft Edge.
  1. Make sure the MAM policy supports the mobile device OS:
  • For Android users, the policy must apply to 'Android device administrator' or 'Android Enterprise' (depending on your configuration).
  • For iOS users, confirm that the app identifiers (bundle IDs) match the Eptura Engage app.
  1. If your users are using personal devices (non-enrolled), make sure MAM without enrollment is enabled:
  • From the Intune Admin Center, go to Tenant Administration > Intune App Protection > App Management Settings > MAM for unenrolled devices = Enabled.

Additional notes

Grant required Microsoft permissions and admin consent

The Eptura Engage application must be granted the required Microsoft permissions and admin consent within the tenant. The following permissions are required:

  • Microsoft Graph: User.Read
  • Microsoft Mobile Application Management: DeviceManagementManagedApps.ReadWrite
Use the same Microsoft Entra ID account

Users must sign in to Microsoft Edge using the same Microsoft Entra ID account as they use for Eptura Engage.

Users must have a Microsoft Entra ID identity. Users authenticated solely through on-premises Active Directory are not supported unless their accounts are synchronized or federated to Microsoft Entra ID.

Refresh policies and sign in again

Always restart Microsoft Edge and Eptura Engage after a policy refresh. Users must sign out and back into Eptura Engage via Microsoft Edge.

Force a device sync

If users are not receiving updated policies, initiate a sync from the Intune Admin Center to force managed devices to check in with the Intune service and download the latest configuration.

From the Intune Admin Center, go to Company Portal > Settings > Sync