Intune SDK iOS is not wiping app data‎

[LarryOlsen]

We have implemented the Intune SDK into our app on Android and iOS.

On Android, when I enter an incorrect PIN too many times, I receive a prompt that the app data will be wiped and the app closes. When I re-open the app, I am presented with the initial login screen and app data is erased.

On iOS, when I enter an incorrect PIN too many times, I also receive a prompt that the app data will be wiped and the app closes. However, when I re-open the app, the user is still logged in and app data remains.

ScreenRecording_05-20-2025.17-53-41_1.mp4

See attached screen recording.

Why is the app data not being erased on iOS?

[pmod2]

@LarryOlsen - Were you able to implement this step - https://learn.microsoft.com/en-us/intune/intune-service/developer/app-sdk-ios-phase3#deregister-user-accounts ?

[LarryOlsen]

On logout, the app deregisters the user. I was under the impression that when the app wipe is triggered, the Intune SDK would deregister the user automatically. Does the iOS app need to call deregister on some event?

[pmod2]

@LarryOlsen - Could you please share MAM logs for this app and Intune SDK version you are using?

[LarryOlsen]

We are using Intune SDK version 20.5.0. Here are the logs.

IntuneMAMDiagnosticFiles.txt

[pmod2]

@LarryOlsen - Based on the logs above, looks like the app was selectively wiped and the user was asked to reauthenticate and set the PIN again on the next launch.

I was able to confirm the above behavior using Chatr sample here.

[LarryOlsen]

Thank you for confirming this. When can we expect a fix?

[LarryOlsen]

The user is not being asked to reauthenticate (silent authentication succeeds because the refresh token wasn't wiped) and the app data persists.

[LarryOlsen]

The Chatr sample uses loginAndEnrollAccount which is intended for apps that do NOT use MSAL for authentication. I created a sample that implements MSAL and Intune and duplicated this issue. You can find the sample project at https://github.com/LarryOlsen/ms-identity-mobile-apple-swift-objc

[pmod2]

The sample app shared above with registerAndEnroll method is not correctly integrated with Intune SDK as it's missing some key elements like the EnrollmentDelegate and setting the delegate of the IntuneMAMEnrollmentManager to an instance of the EnrollmentDelegateClass in willFinishLaunchingWithOptions.

For trying to repro with a registerAndEnroll method you can try the Wagr sample .

[pmod2]

@LarryOlsen - Can you check if you are able to repro the issue with the above Wagr sample app and latest Intune SDK version - 20.6.0

[pmod2]

@LarryOlsen - I was unable to repro the same on sample Wagr app with the latest SDK version, is the issue resolved at your end?

[LarryOlsen]

@pmod2 When a wipe request is received on Android, app data is erased, and the user is logged out. When a wipe request is received on iOS, app data is erased, but the user remains logged in.

It is as if the access token on Android is stored in app data, and is removed when app data is erased, and on iOS the access token is stored in the keychain and is not erased with the app data.

We worked around this by adding a call to MSAL's removeAccount function on the Unenrollment event. It seems like the Intune SDK should be performing that step automatically.

[pmod2]

Although this was not reproducible on Wagr app (one that uses registerAndEnrollAccount), I was able to repro the same on Chatr app (that uses loginAndEnrollAccount) where the user is still logged in after receiving the org data removal message.

We are looking into this and will keep this thread posted.

[pmod2]

@LarryOlsen - If you're willing to share a minimal sample app repo where Intune SDK integration is complete and issue is consistently reproducible, I can take a look.