Microsoft Intune and Genesys mobile apps - Genesys Cloud Resource Center
Microsoft Intune and Genesys mobile apps
AI-generated summary
Genesys Cloud integrates with Microsoft Intune and Microsoft Entra ID to enforce enterprise access requirements through device compliance and conditional access policies without requiring Intune App SDK integration. The mobile apps, available as public applications in the Apple App Store and Google Play Store, can be added to organizational Intune app catalogs and leverage external browser authentication to enable Microsoft security controls to evaluate sign-in requests before granting access.
When users sign in to a Genesys organization configured for Microsoft Entra SSO, the mobile app initiates an OAuth login flow that redirects to Microsoft Entra ID, where conditional access policies targeting the Genesys Cloud for Azure enterprise application are evaluated based on device compliance status. This architecture supports conditional access grants dependent on device compliance and identity evaluation but does not support conditional access policies requiring Intune app protection (MAM) policies or the Intune App SDK.
Implementation requires configuring the Genesys Cloud organization for Microsoft Entra ID single sign-on, enrolling devices in Intune with compliant status, using organization/SSO login credentials, and ensuring a compliance-capable browser such as Microsoft Edge is available. Authentication must be forced through Microsoft Edge using an Intune app configuration policy by setting the definedBrowserScheme key to "microsoft-edge-https," which enforces OAuth/SSO login through the managed browser. Optional configuration keys include login_hint to prefill organization credentials and genesys.region to bypass the in-app region picker.
Genesys Cloud mobile apps operate within Intune MDM-managed environments, supporting device compliance policies covering passcode requirements, OS minimums, encryption, and jailbreak/root detection, as well as app deployment and remote device actions including wipe, lock, and retire functions. Genesys deliberately does not integrate the Intune App SDK to reduce maintenance burden, mitigate availability risks from Microsoft release dependencies, and leverage alternative security controls including MDM, browser-based authentication, device compliance, conditional access on Entra SSO resources, identity verification, and multi-factor authentication.
This architectural decision results in unavailable capabilities such as app-level encryption through Intune app protection policies, screenshot prevention, copy/paste restrictions, selective app data wipe, app-specific PIN requirements, and conditional access grants requiring Intune app protection policies without device compliance integration. Compliant-device conditional access applies only to Microsoft Entra SSO authentication to Genesys Cloud for Azure, not to Genesys-only username/password login. Success depends on the authentication browser's ability to assert device identity; unmanaged or ephemeral browser sessions may fail compliant-device policies even on enrolled devices. Organizations should not assume policies applied to other Microsoft 365 apps automatically extend to Genesys Cloud and must create conditional access policies in Microsoft Entra ID that specifically target the Genesys Cloud for Azure enterprise application.
Overview
Microsoft Intune provides mobile device management (MDM) and mobile application management (MAM). Organizations use it to enforce device compliance, protect corporate data, and control how employees access company resources from mobile devices.
Genesys Cloud mobile apps are available as public apps in the Apple App Store and Google Play Store, and you can add them to your organization’s Intune app catalog.
Note: Genesys mobile apps do not integrate the Intune App SDK.
Organizations can still meet common enterprise access requirements, especially Microsoft Entra ID Conditional Access policies that require compliant devices, by combining the following:
External browser authentication, typically through Microsoft Edge on a managed device
Genesys Cloud for Azure and Conditional Access
Genesys Cloud integrates with Microsoft Entra ID through the enterprise application Genesys Cloud for Azure. That application is the protected resource Conditional Access evaluates—not the Genesys mobile app binary itself.
When a user signs in to a Genesys organization that uses Microsoft Entra SSO:
The Genesys mobile app starts its normal OAuth login flow.
The user authenticates to their organization, which redirects to Microsoft Entra ID for Genesys Cloud for Azure.
Entra ID evaluates Conditional Access policies that target that enterprise application (for example, Require compliant device).
If the user and device satisfy the policy, SSO completes and the mobile app receives its Genesys Cloud session.
Genesys mobile apps participate in this model by performing authentication in an external browser that can present Intune device identity and compliance signals (typically Microsoft Edge on an enrolled, compliant device).
Important: This approach supports Conditional Access grants that depend on device compliance and identity evaluation in the browser. This approach does not support Conditional Access that requires Intune app protection (MAM) policies or the Intune App SDK (for example, “Require app protection policy”).
Prerequisites
To use compliant-device Conditional Access with Genesys mobile apps, confirm the following criteria:
The Genesys Cloud organization is configured for Microsoft Entra ID single sign-on (Genesys Cloud for Azure).
Devices are enrolled in Intune (or another MDM that reports compliance to Entra ID) and meet your compliance policies.
Users sign in with organization / SSO login, not the Genesys-specific username and password.
A browser that can assert device compliance is available on the device—Microsoft Edge is recommended.
Recommended: Intune app configuration forces Genesys login into that browser so users cannot fall back to a browser that cannot satisfy Conditional Access.
Recommended Intune configuration
Adding the Genesys app to your Intune catalog alone does not enable Conditional Access. Use the following pattern.
Add the Genesys app to Intune.
In the Microsoft Intune admin center, go to Apps > All apps > Add.
Select iOS/iPadOS store app or Android store app.
Search for your Genesys Cloud mobile app.
Complete the prompts and assign the app to the appropriate user or device groups.
Deploy Microsoft Edge.
Deploy Microsoft Edge to managed devices through Intune (Company Portal / Managed Google Play / App Store as applicable). Edge is the browser Genesys recommends for Entra Conditional Access scenarios that require device compliance.
Enforce device compliance.
Configure Intune device compliance policies as required by your organization (for example passcode, OS version, encryption, jailbreak/root detection). Ensure compliant devices report compliance state to Microsoft Entra ID.
Create Conditional Access for Genesys Cloud for Azure.
In Microsoft Entra ID, create or update Conditional Access policies that do the following:
Target the enterprise application Genesys Cloud for Azure
Apply the grants that you intend to support on mobile (for example, Require a compliant device)
Assign the policies to the appropriate users or groups
Do not assume that policies attached only to other Microsoft 365 apps automatically apply to Genesys Cloud.
Force authentication into Edge (recommended).
Use an Intune app configuration policy (managed devices) for the Genesys mobile app and set:
Key
Recommended value
Purpose
definedBrowserScheme
microsoft-edge-https
Forces OAuth / SSO login into Microsoft Edge
When definedBrowserScheme is set and the required browser is missing, login does not silently fall back to another browser. Users must install the required browser through your managed app catalog.
Note: The definedBrowserScheme is currently only available for Genesys iOS mobile apps. Genesys will make the key available for Android mobile apps in a future release.
What Genesys mobile apps support
External browser authentication
Genesys mobile apps authenticate through an external browser rather than embedding Entra authentication inside the app with MSAL or the Intune App SDK. That lets your existing Microsoft security controls evaluate the sign-in before access is granted.
With a suitable managed browser (typically Edge) on a compliant device:
Conditional Access — Entra ID evaluates policies for Genesys Cloud for Azure during organization SSO
Device compliance — Intune compliance state can be assessed as part of that browser-based Entra sign-in
MFA — Multi-factor authentication requirements are handled by Entra ID in the browser
SSO — Organization SSO (including Microsoft Entra ID) works because the identity provider runs in the browser
Default or unmanaged browsers may not present the device identity signals that conditional access needs. For enterprise deployments that require compliant devices, force Edge with definedBrowserScheme.
Device-level management (MDM)
Genesys mobile apps work within an Intune MDM-managed environment:
Device compliance policies — passcode, OS minimums, encryption, jailbreak/root detection, and similar controls.
App deployment — distribute Genesys apps to managed devices through Intune.
Remote device actions — wipe, lock, and retire at the device level.
Managed configuration values are read when the user starts login or reauthentication. Changes pushed mid-session do not take effect until the next login.
Why Genesys does not integrate the Intune App SDK
Genesys deliberately does not embed the Intune App SDK in its Cloud mobile apps:
Maintenance burden — SDK integration requires ongoing updates tied to Microsoft’s release cadence, including work ahead of major iOS and Android releases.
Availability risk — Apps that fall behind on required SDK versions can be blocked from launching by Intune, which is an unacceptable reliability risk for contact center agents.
Security goals achievable without it — For many enterprises, the controls that matter most for access (device compliance, Conditional Access on the Entra SSO resource, identity verification, and MFA) are achievable through MDM plus browser-based authentication.
Limitations
Because Genesys mobile apps do not integrate the Intune App SDK, the following are not available:
App-level encryption enforced through Intune app protection policies
Screenshot prevention via Intune MAM policies
Copy/paste restrictions through Intune app protection policies
Selective wipe of Genesys app data only (device wipe still applies under MDM)
App-specific PIN requirements separate from the device PIN
Conditional Access grants that require Intune app protection policies (for example, “Require app protection policy”) without device compliance / App SDK integration
Notes:
Compliant-device Conditional Access applies when users authenticate through Microsoft Entra SSO to Genesys Cloud for Azure. It does not apply to Genesys-only username and password login.
Success depends on the authentication browser’s ability to assert device identity. Unmanaged or ephemeral browser sessions may fail policies that Require compliant device even when the device is enrolled.