Configuring MAM in SAT

Add the MAM settings as application parameters in the Infor Expense Management SAT application. Set the status of each parameter to Active.
Application parameter Value Description
mam.appClientId Application client ID Required. Identifies your Entra application registration that the mobile application uses to sign in, as specified when configuring Microsoft Entra. See, Configuring Microsoft Entra ID.
mam.azureTenantId Directory tenant ID Required. Identifies your Entra tenant (directory) that issues the sign-in, as specified when configuring Microsoft Entra. See, Configuring Microsoft Entra ID. This is your Microsoft directory ID, not your Infor tenant name.
mam.enableUnenrolledUsers true Reserved for future use.
mam.provider mam_microsoft_intune Required. Selects the MAM provider. For Microsoft Intune, the value must be exactly mam_microsoft_intune
mam.userUpn The Microsoft sign-in account for the user, specified as the User Principal Name (UPN) / email address Identifies the Entra work account that maps to the signed-in Infor Expense user, preventing an additional identification prompt. If a value is not specified for this parameter, the email address in the user’s Infor Expense profile is used.
mam.enable true Enables Intune App Protection (MAM) for the Infor Expense mobile app. The default value is False, which keeps MAM disabled. Set this parameter to True after configuring all other MAM parameters.

The mam.userUpn parameter supports these values:

Value Description
emailAddress Uses the primary email address. This value is used by default if not configured.
emailAddress2 Uses Alternate Email 1 from the user profile.
emailAddress3 Uses Alternate Email 2 from the user profile.
userLogin Uses the user login ID.

For example, if Microsoft work email addresses are stored in the Alternate Email 1 field, set mam.userUpn to emailAddress2.

Note: 
  • Do not store mam.userUpn as a single value in the tenant-level configuration because the value is unique to each user. In most organizations, the user’s XM email address is the same as the Microsoft work account.

    If the XM account and Microsoft Entra ID account use different identifiers, configure the appropriate mapping attribute, such as the email address, Microsoft Entra ID user identifier, or another supported identity attribute.

  • The mam.provider, mam.appClientId, and mam.azureTenantId parameters are required. If any required parameter is missing when the value of themam.enable is set to true, the configuration is rejected and users cannot access the application.
  • Configure and validate all other MAM parameters before setting the value of mam.enable to true.