Troubleshooting MAM
This section lists some issues that are encountered, the cause of the issue, and the resolution.
| Symptom | Cause and resolution |
|---|---|
| No Microsoft sign-in or PIN prompt is displayed, and the application functions normally without MAM restrictions | The value of mam.enable parameter is not set to True, or the status of the application parameter is not Active in Infor Expense SAT. When MAM is disabled, the application does not display an error. Verify the mam.enable value and status before checking other MAM settings. |
| The “MAM Configuration is invalid. Missing '…' parameters.” message is displayed and the user cannot access the application. | A required parameter, mam.provider, mam.appClientId, or mam.azureTenantId, is missing. The error message identifies the missing parameter. Add the identified parameter and set the Status to Active. You can sign in again without updating the application. |
| The user receives a message indicating that the account is not licensed for application protection. | The account specified in mam.userUpn, which defaults to the email address in the user’s Infor Expense profile, does not have an Intune license or does not match the user’s Entra UPN. Assign an Intune license to the account or correct the value of mam.userUpn application parameter. |
| The user receives a message indicating that no app protection policy is assigned to the account. | The user has an Intune license but is not included in a group assigned to the policy, or the policy does not target com.infor.hl.xm under Custom apps. Verify the policy assignment and ensure that com.infor.hl.xm is included as the target application. |
| The app repeatedly switches to Microsoft Authenticator, and the sign-in process does not complete. | A Conditional Access policy requires app protection, but the user does not have an Intune license. As a result, the app protection requirement cannot be met. Assign an Intune license to the user or exclude the user from the Conditional Access policy. |
| Sign-in fails because of a redirect URI mismatch. | The iOS platform or bundle ID in the app registration is missing or incorrect. Verify that the configuration generates the following redirect URI exactly: msauth.com.infor.hl.xm://auth. |
| Users can sign in, but the app protection policy is not applied. | Admin consent has not been granted for the required API permissions, preventing the app from retrieving the policy. |
| Face ID or Touch ID is not displayed, and the user is always prompted for a PIN | The Override biometrics with PIN after timeout value is not set higher than the Recheck access requirements after inactivity value.
Note: A PIN is always required when the app is launched for the first time after a fresh start
|
| Copy and paste is blocked even when transferring content to another managed app, such as Outlook. | When Policy managed apps is selected, clipboard boundary is scoped per organization. The other app must be signed in with an account from the same tenant. |
| Policy changes do not take effect | Policy changes are applied at the next check-in. Force-quit and reopen the app while connected to a network to initiate a check-in. An app update is not required |