Microsoft Authenticator broker required when adding Atlassian apps as custom apps in Intune MAM on i

Question

When we create an Intune mobile policy in Atlassian Admin (admin.atlassian.com → Security → Mobile app policies → Add Intune mobile policy), iOS devices prompt users to install Microsoft Authenticator as a broker app.

This does not happen with any other apps in our MAM policy (Microsoft Outlook, Teams, Edge, Slack for Intune) — only Atlassian apps trigger this requirement.

Is Microsoft Authenticator a hard requirement for Atlassian apps under Intune MAM on iOS, or is there a way to configure this without it?Is this behaviour specific to how Atlassian apps use MSAL for authentication?Is there a roadmap to support Intune MAM on iOS without requiring the broker app?

Arkadiusz Wroblewski · Answer

@Devika Sahadevan

Could you confirm whether the Entra Conditional Access policy applied to Jira/Confluence contains:

Grant → Require app protection policy

or whether you are using Intune APP/MAM without that CA control?

That distinction should tell us whether the Authenticator requirement is coming from Microsoft’s CA design or specifically from the Atlassian app’s enrollment flow.

Devika Sahadevan · Answer

Hi @Arkadiusz Wroblewski

Thanks for getting back!

To confirm my undertanding, is the immediate Microsoft Authenticator prompt a result of Atlassian implementing MSAL with the broker authentication flag enabled in the iOS app?

We ask because other third-party MAM apps in our environment do not trigger this broker prompt, which suggests it is specific to how Atlassian has configured MSAL.

Arkadiusz Wroblewski · Answer

Hello @Devika Sahadevan

This is actually expected behavior for iOS Intune MAM. Microsoft and iOS require the Microsoft Authenticator app to act as the authentication broker for Atlassian mobile apps to connect securely.

Check that you have the correct iOS bundle IDs in Intune, granted admin consent in Microsoft Entra, and exempted the necessary auth schemes (like `jiraauth`) if you are using Edge.

There is no public roadmap indicating this broker requirement will change anytime soon.

At least not i know and was able to found.

Best,

Arkadiusz🤠