Skip to main content

Microsoft Intune and Genesys mobile apps

Overview

Microsoft Intune provides mobile device management (MDM) and mobile application management (MAM). Organizations use it to enforce device compliance, protect corporate data, and control how employees access company resources from mobile devices.

Genesys Cloud mobile apps are available as public apps in the Apple App Store and Google Play Store, and you can add them to your organization’s Intune app catalog.

Note: Genesys mobile apps do not integrate the Intune App SDK.

Organizations can still meet common enterprise access requirements, especially Microsoft Entra ID Conditional Access policies that require compliant devices, by combining the following:

  • Intune MDM enrollment and device compliance
  • Microsoft Entra ID single sign-on to Genesys Cloud (via )
  • External browser authentication, typically through Microsoft Edge on a managed device

Genesys Cloud for Azure and Conditional Access

Genesys Cloud integrates with Microsoft Entra ID through the enterprise application Genesys Cloud for Azure. That application is the protected resource Conditional Access evaluates—not the Genesys mobile app binary itself.

When a user signs in to a Genesys organization that uses Microsoft Entra SSO:

  1. The Genesys mobile app starts its normal OAuth login flow.
  2. The user authenticates to their organization, which redirects to Microsoft Entra ID for Genesys Cloud for Azure.
  3. Entra ID evaluates Conditional Access policies that target that enterprise application (for example, Require compliant device).
  4. If the user and device satisfy the policy, SSO completes and the mobile app receives its Genesys Cloud session.

Genesys mobile apps participate in this model by performing authentication in an external browser that can present Intune device identity and compliance signals (typically Microsoft Edge on an enrolled, compliant device).

Important: This approach supports Conditional Access grants that depend on device compliance and identity evaluation in the browser. This approach does not support Conditional Access that requires Intune app protection (MAM) policies or the Intune App SDK (for example, “Require app protection policy”).

Prerequisites

To use compliant-device Conditional Access with Genesys mobile apps, confirm the following criteria:

  • The Genesys Cloud organization is configured for Microsoft Entra ID single sign-on (Genesys Cloud for Azure).
  • Devices are enrolled in Intune (or another MDM that reports compliance to Entra ID) and meet your compliance policies.
  • Users sign in with organization / SSO login, not the Genesys-specific username and password.
  • A browser that can assert device compliance is available on the device—Microsoft Edge is recommended.
  • Recommended: Intune app configuration forces Genesys login into that browser so users cannot fall back to a browser that cannot satisfy Conditional Access.

Adding the Genesys app to your Intune catalog alone does not enable Conditional Access. Use the following pattern.

  1. Add the Genesys app to Intune.
    1. In the Microsoft Intune admin center, go to Apps > All apps > Add.
    2. Select iOS/iPadOS store app or Android store app.
    3. Search for your Genesys Cloud mobile app.
    4. Complete the prompts and assign the app to the appropriate user or device groups.
  1. Deploy Microsoft Edge.
    • Deploy Microsoft Edge to managed devices through Intune (Company Portal / Managed Google Play / App Store as applicable). Edge is the browser Genesys recommends for Entra Conditional Access scenarios that require device compliance.
  1. Enforce device compliance.
    • Configure Intune device compliance policies as required by your organization (for example passcode, OS version, encryption, jailbreak/root detection). Ensure compliant devices report compliance state to Microsoft Entra ID.
  1. Create Conditional Access for Genesys Cloud for Azure.

In Microsoft Entra ID, create or update Conditional Access policies that do the following:

    • Target the enterprise application Genesys Cloud for Azure
    • Apply the grants that you intend to support on mobile (for example, Require a compliant device)
    • Assign the policies to the appropriate users or groups

Do not assume that policies attached only to other Microsoft 365 apps automatically apply to Genesys Cloud.

  1. Force authentication into Edge (recommended).

Use an Intune app configuration policy (managed devices) for the Genesys mobile app and set:

KeyRecommended valuePurpose
definedBrowserSchememicrosoft-edge-httpsForces OAuth / SSO login into Microsoft Edge

When definedBrowserScheme is set and the required browser is missing, login does not silently fall back to another browser. Users must install the required browser through your managed app catalog. 

Note: The definedBrowserScheme is currently only available for Genesys iOS mobile apps. Genesys will make the key available for Android mobile apps in a future release.

What Genesys mobile apps support

External browser authentication

Genesys mobile apps authenticate through an external browser rather than embedding Entra authentication inside the app with MSAL or the Intune App SDK. That lets your existing Microsoft security controls evaluate the sign-in before access is granted.

With a suitable managed browser (typically Edge) on a compliant device:

  • Conditional Access — Entra ID evaluates policies for Genesys Cloud for Azure during organization SSO
  • Device compliance — Intune compliance state can be assessed as part of that browser-based Entra sign-in
  • MFA — Multi-factor authentication requirements are handled by Entra ID in the browser
  • SSO — Organization SSO (including Microsoft Entra ID) works because the identity provider runs in the browser

Default or unmanaged browsers may not present the device identity signals that conditional access needs. For enterprise deployments that require compliant devices, force Edge with definedBrowserScheme.

Device-level management (MDM)

Genesys mobile apps work within an Intune MDM-managed environment:

  • Device compliance policies — passcode, OS minimums, encryption, jailbreak/root detection, and similar controls.
  • App deployment — distribute Genesys apps to managed devices through Intune.
  • Remote device actions — wipe, lock, and retire at the device level.

Managed configuration values are read when the user starts login or reauthentication. Changes pushed mid-session do not take effect until the next login.

Why Genesys does not integrate the Intune App SDK

Genesys deliberately does not embed the Intune App SDK in its Cloud mobile apps:

  • Maintenance burden — SDK integration requires ongoing updates tied to Microsoft’s release cadence, including work ahead of major iOS and Android releases.
  • Availability risk — Apps that fall behind on required SDK versions can be blocked from launching by Intune, which is an unacceptable reliability risk for contact center agents.
  • Security goals achievable without it — For many enterprises, the controls that matter most for access (device compliance, Conditional Access on the Entra SSO resource, identity verification, and MFA) are achievable through MDM plus browser-based authentication.

Limitations

Because Genesys mobile apps do not integrate the Intune App SDK, the following are not available:

  • App-level encryption enforced through Intune app protection policies
  • Screenshot prevention via Intune MAM policies
  • Copy/paste restrictions through Intune app protection policies
  • Selective wipe of Genesys app data only (device wipe still applies under MDM)
  • App-specific PIN requirements separate from the device PIN
  • Conditional Access grants that require Intune app protection policies (for example, “Require app protection policy”) without device compliance / App SDK integration
Notes:
  • Compliant-device Conditional Access applies when users authenticate through Microsoft Entra SSO to Genesys Cloud for Azure. It does not apply to Genesys-only username and password login.
  • Success depends on the authentication browser’s ability to assert device identity. Unmanaged or ephemeral browser sessions may fail policies that Require compliant device even when the device is enrolled.

Additional resources