Microsoft Intune
Device securityMam Android
In brief
The page refreshes links for Intune App SDK certificate trust management, including the MAMCertTrustWebViewClient reference, which now points to GitHub documentation.
What Intune admins need to know
No product or configuration change is indicated. Administrators reviewing Android MAM certificate trust guidance should use the updated links.
This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.
Documentation change
Open full page diff →The comparison below shows only the changed extract. Open the full-page diff for complete context.
Trusted Root Certificates Management:
If your application requires SSL/TLS certificates issued by an on-premises or private certificate authority to provide secure access to internal websites and applications, the Intune App SDK has added support for certificate trust management using the API classes MAMTrustedRootCertsManagerMAMTrustedRootCertsManager and MAMCertTrustWebViewClientMAMCertTrustWebViewClient.
Requirements:
Android fails to build the certificate chain when you use private certification authority
When using WebView with MAMCertTrustWebViewClientMAMCertTrustWebViewClient in MAM to validate certificates, MAM delegates to Android to build a certificate chain from certificates provided by the admins and the server. If a server that uses private certificates provides the full chain to the connecting WebView but the admin deploys only the root certificate, Android can fail to build the cert chain and fail when checking the server trust. This behavior occurs because Android requires intermediate certificates to build the chain to an acceptable level.
Workaround: To ensure proper certificate validation, admins must deploy the root certificate and all intermediate certificates in Intune. If the root certificate along with all intermediate certificates aren't deployed, Android can fail to build the certificate chain and fail to trust the server.
\ No newline at end of file [Microsoft Intune admin center]: https://go.microsoft.com/fwlink/?linkid=2109431
@@ -226,7 +226,7 @@ LOB apps that use the MAM tunnel on Android are required to integrate with the I **Trusted Root Certificates Management**: -If your application requires SSL/TLS certificates issued by an on-premises or private certificate authority to provide secure access to internal websites and applications, the Intune App SDK has added support for certificate trust management using the API classes [MAMTrustedRootCertsManager](https://microsoftconnect.github.io/ms-intune-app-sdk-android/reference/com/microsoft/intune/mam/client/app/MAMTrustedRootCertsManager.html) and [MAMCertTrustWebViewClient](https://microsoftconnect.github.io/ms-intune-app-sdk-android/reference/com/microsoft/intune/mam/client/app/MAMCertTrustWebViewClient.html).+If your application requires SSL/TLS certificates issued by an on-premises or private certificate authority to provide secure access to internal websites and applications, the Intune App SDK has added support for certificate trust management using the API classes [MAMTrustedRootCertsManager](https://github.com/microsoftconnect/ms-intune-app-sdk-android/blob/master/docs/com/microsoft/intune/mam/client/app/MAMTrustedRootCertsManager.html) and [MAMCertTrustWebViewClient](https://github.com/microsoftconnect/ms-intune-app-sdk-android/blob/master/docs/com/microsoft/intune/mam/client/app/MAMCertTrustWebViewClient.html). **Requirements**: @@ -282,7 +282,7 @@ You can choose to use MAM Tunnel with enrolled devices instead of using MDM Tunn ### Android fails to build the certificate chain when you use private certification authority -When using WebView with [MAMCertTrustWebViewClient](https://microsoftconnect.github.io/ms-intune-app-sdk-android/reference/com/microsoft/intune/mam/client/app/MAMCertTrustWebViewClient.html) in MAM to validate certificates, MAM delegates to Android to build a certificate chain from certificates provided by the admins and the server. If a server that uses private certificates provides the full chain to the connecting WebView but the admin deploys only the root certificate, Android can fail to build the cert chain and fail when checking the server trust. This behavior occurs because Android requires intermediate certificates to build the chain to an acceptable level.+When using WebView with [MAMCertTrustWebViewClient](https://github.com/microsoftconnect/ms-intune-app-sdk-android/blob/master/docs/com/microsoft/intune/mam/client/app/MAMCertTrustWebViewClient.html) in MAM to validate certificates, MAM delegates to Android to build a certificate chain from certificates provided by the admins and the server. If a server that uses private certificates provides the full chain to the connecting WebView but the admin deploys only the root certificate, Android can fail to build the cert chain and fail when checking the server trust. This behavior occurs because Android requires intermediate certificates to build the chain to an acceptable level. **Workaround**: To ensure proper certificate validation, admins must deploy the root certificate and all intermediate certificates in Intune. If the root certificate along with all intermediate certificates aren't deployed, Android can fail to build the certificate chain and fail to trust the server. @@ -342,4 +342,4 @@ Also see: <!--links--> -[Microsoft Intune admin center]: https://go.microsoft.com/fwlink/?linkid=2109431\ No newline at end of file+[Microsoft Intune admin center]: https://go.microsoft.com/fwlink/?linkid=2109431