Configuring Microsoft Entra ID

You must perform these steps to configure Microsoft Entra ID. This task is usually performed by the Microsoft Entra ID/Intune administrator of your organization.

  1. Register the XM application in Microsoft Entra ID
  2. Add the iOS redirect URI
  3. Grant API permissions and administrator consent
  4. Create a user group and assign Intune licenses

Registering Infor XM Mobile

You must register the Infor XM Mobile application in Microsoft Entra ID.

  1. Sign on to Microsoft Azure portal or Microsoft Entra admin center.
  2. Select Microsoft Entra ID.
  3. Select App registrations.
  4. Click New registration.
  5. Specify this information:
    Name
    The name for the application registration, such as Infor Expense Mobile.
    Supported account types
    Select Single tenant only to limit application access to users in your organization.
    Redirect URI
    Leave this field blank.
    Note: Add the redirect URI after completing the registration.
  6. Click Register.
  7. Copy this information displayed on the Overview page:
    • Application (client) ID
    • Directory (tenant) ID
    Note: The application client ID and directory tenant ID are required when configuring MAM in SAT.

Adding the iOS redirect URI

You must configure the iOS/macOS platform and redirect URI for the registered application.

  1. Open the application registration in Microsoft Entra ID.
  2. Select Authentication.
  3. Click Add a platform.
  4. Select iOS/macOS.
  5. Specify com.infor.hl.xm in the Bundle ID field.
  6. Click Configure. Microsoft Entra ID generates msauth.com.infor.hl.xm://auth redirect URI.
  7. Save the configuration.

Granting API permissions and admin consent

Grant the delegated API permissions required by Infor XM Mobile.

  1. Open the application registration.
  2. Select API permissions.
  3. Click Add a permission.
  4. Add these delegated permissions:
    API Permission Description
    Microsoft Graph User.Read Reads the basic profile of the signed-in user.
    Microsoft Mobile Application Management DeviceManagementManagedApps.ReadWrite Enables the application to communicate with Intune and receive the application protection policy.
  5. Locate the Microsoft Mobile Application Management permission.
    1. Click Add a permission.
    2. Select APIs my organization uses.
    3. Search Microsoft Mobile Application Management.
    4. Select Delegated permissions.
    5. Select DeviceManagementManagedApps.ReadWrite.
  6. Click Grant admin consent for <organization> on the API permissions page.
  7. Confirm the action.
  8. Verify that the Status column displays a green check mark for both permissions.
    Note: Admin consent is required. Without admin consent, the app cannot retrieve the App Protection Policy, and users cannot be protected by the policy.

Creating a user group

Create a group for users who require access to the Infor XM Mobile with application protection.

  1. Select Groups in Microsoft Entra ID.
  2. Click New group
  3. Specify this information:
    Group type
    Select Security.
    Group name
    Specify a name, such as Infor-Expense-Mobile-Users
    Membership type
    Select a Dynamic User group, which is recommended for automatically including new employees. Alternatively, select All users when assigning the policy. You can also select a static Assigned group to manage membership explicitly.
  4. Add users who require access to Infor XM Mobile.
  5. Create the group.

Assigning Intune licenses

Assign an Intune license to the user group.

  1. Select Groups in Microsoft Entra ID
  2. Select the group created in the previous step.
  3. Select Licenses.
  4. Click Assignments.
  5. Assign the applicable Intune, Microsoft 365, or Enterprise Mobility + Security license.
  6. Save the assignment.
    Note: Assign the Intune license and app protection policy to the same user group.