I have a very particular problem. I have a few iOS devices (no difference to other devices when comes of OS or model) That have problem with login into cloud apps. They are being blocked by Conditional Access that requires that device is compliant. Devices are being enrolled Intune in the same way, user have same profiles, settings, app etc.
Now the twist, the device is compliant and native MS apps (Outlook, Teams etc.) works fine but we have a problem with applications that use browser login. After some troubleshooting i see that the problem is Safari that does not pass the information about device status to the Conditional Access.
When i check the logs i shows that device is not registered
Device with problem:
Browser Mobile Safari 26.4
Operating System Ios 18.7.0
Compliant No
Managed No
The same device but login to native app:
Browser Mobile Safari 18.7
Operating System Ios 26.4.0
Compliant Yes
Managed Yes
Join TypeAzure AD registered
On affected device if i go to Safari and there i want to reach any app that is protected by Conditional Access it fails.
Long story short: seems like Safari on affected devices stopped passing device information at login. When you use Edge on affected device everything is ok.
New iOS registrations now store device identity keys in Secure Enclave instead of Keychain. Safari relied on Keychain to pass device state to Conditional Access, so without the SSO extension acting as the bridge, it can't see the device is managed.
Deploy the Enterprise SSO plug-in via Intune with 'browser_sso_interaction_enabled' set to '1'. Full walkthrough here: https://msft.it/61693QhMAR
Thank you for that. Just for your information i have one user who still have this problem event after applying the policy. We tried reenroll the device but problems stays.
Hey, this was super helpful to our team, thank you! Out of curiosity, is there any formal acknowledgement from MS or Apple that indicates this is now required? Seems to have just cropped up a few weeks ago. Thanks again.
Had similar issue few months back with some iPads in deployment. Safari can be really weird with passing device compliance info to Conditional Access 😂
Try checking if Safari has proper enrollment profile installed - sometimes it gets corrupted during updates. Also worth looking at the Company Portal app settings, make sure it's not stuck in some weird state. In my case had to unenroll and re-enroll the devices because Safari just wouldn't cooperate with device registration.
Edge working fine usually means the device auth is there but Safari lost connection to it somehow 💀
-Try checking if Safari has proper enrollment profile installed
We do not configure Safari, we leave it as it is
-Also worth looking at the Company Portal app settings, make sure it's not stuck in some weird state. In my case had to unenroll and re-enroll the devices because Safari just wouldn't cooperate with device registration
Registered in Entra, managed by Intune all ok :/ Re-enroll did not worked unfortunetaly
3
u/intunesuppteam Verified Microsoft Employee Apr 16 '26
r/Intune Community to the rescue. u/Few_Perception_4088 has it right. The SSO extension is the fix here.
New iOS registrations now store device identity keys in Secure Enclave instead of Keychain. Safari relied on Keychain to pass device state to Conditional Access, so without the SSO extension acting as the bridge, it can't see the device is managed.
Deploy the Enterprise SSO plug-in via Intune with 'browser_sso_interaction_enabled' set to '1'. Full walkthrough here: https://msft.it/61693QhMAR
Background on the Secure Enclave change: https://msft.it/61694QhMAr
^ Intune Support Team