Power Apps failing Sign-in on Kiosk Android Device

(0) Share

Report

Posted on by SM-13021300-0

Hi all,

I’ve been trialling Android Kiosk Enrollment profiles for several projects, all of which have worked successfully using apps like Tulip, KT Pulse, etc.

I now have a new project that requires a device to be enrolled using a Kiosk Enrollment Profile, with Microsoft Power Apps set as the single allowed application.

Issue

When Power Apps attempts to authenticate the user, the sign‑in fails.

In Azure AD sign‑in logs, the attempt appears as Chrome Mobile, but after further investigation it looks like Power Apps relies on a WebView for authentication. Because Intune cannot properly detect or validate this WebView session, the Conditional Access policy treats the device as non‑compliant, resulting in a failed sign‑in.

To validate the behaviour, I tested the same device using the less restrictive Corporate-Owned, Fully Managed enrollment profile. In this mode, Power Apps authenticates successfully with no issues.

Request

Has anyone encountered this before or know why Power Apps authentication might fail specifically under a Kiosk Enrollment Profile? Any guidance or recommendations would be greatly appreciated.

Thanks in advance!

Categories:

Building Power Apps

Error handling

Power Apps Pro Dev & ISV

I have the same question (0)

All responses (4)

Answers (0)

Sort by

Suggested answer

WarrenBelz 155,838 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @SM-13021300-0,

Some research suggests that when Power Apps asks the user to sign in, it opens an embedded WebView instead of using a brokered authentication flow. That WebView shows up as Chrome Mobile because it’s based on Chromium components from Google. Since the session isn’t brokered, Conditional Access can’t verify the device’s compliance or link it to a registered device record, so it flags the sign-in as non-compliant and blocks it.

In Fully Managed mode, though, sign-in works because brokered authentication is supported, letting apps like Company Portal or Authenticator pass valid device compliance details to Microsoft, which satisfies Conditional Access.

Please ✅ Does this answer your question if my post helped you solve your issue. This will help others find it more readily. It also closes the item. If the content was useful in other ways, please consider answering Yes to Was this reply helpful? or give it a Like ♥
Visit my blog Practical Power Apps LinkedIn

Was this reply helpful? Yes No
SM-13021300-0 3 on at

Like
a
(0)

Report
Copy link

Link copied!

Thanks @WarrenBelz,

I will test using a Fully Managed Mode. When using a Fully Managed Mode, does it need to be linked with an account or can it be userless?

Was this reply helpful? Yes No
WarrenBelz 155,838 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @SM-13021300-0,

You are going to need a licensed account to open it.

Was this reply helpful? Yes No
WarrenBelz 155,838 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @SM-13021300-0,

A quick follow-up to see if you received the answer you were looking for. Happy to assist further if not.

Please ✅ Does this answer your question if my post helped you solve your issue. This will help others find it more readily. It also closes the item. If the content was useful in other ways, please consider answering Yes to Was this reply helpful? or give it a Like ♥
Visit my blog Practical Power Apps LinkedIn

Was this reply helpful? Yes No