Expose MSALResourceTenantIdKey for guest/MTO MAM (AB#3673092) - #3022
Draft
antonioalwan wants to merge 3 commits into
Draft
Expose MSALResourceTenantIdKey for guest/MTO MAM (AB#3673092)#3022antonioalwan wants to merge 3 commits into
antonioalwan wants to merge 3 commits into
Conversation
…B#3673092) Adds the public MSALResourceTenantIdKey constant and maps the broker MSIDResourceTenantIdKey onto it in MSALErrorConverter so client apps can read the resource tenant id from protection-policy-required errors and enroll with the Intune MAM SDK against the correct tenant. Includes a unit test for the key mapping. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a new public NSError.userInfo key to MSAL so client apps can retrieve the resource tenant ID from broker “protection policy required” errors, enabling correct Intune MAM enrollment in guest / multi-tenant organization (MTO) scenarios.
Changes:
- Added new public constant
MSALResourceTenantIdKeytoMSALError.h/.m. - Mapped
MSIDResourceTenantIdKey→MSALResourceTenantIdKeyinMSALErrorConverterso the value surfaces on public MSAL errors. - Added a unit test covering the userInfo key mapping and updated the changelog entry.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| MSAL/test/unit/MSALErrorConverterTests.m | Adds a regression/unit test validating resource tenant ID key mapping and removal of the MSID key. |
| MSAL/src/public/MSALError.h | Exposes the new public MSALResourceTenantIdKey constant with documentation for client usage. |
| MSAL/src/MSALErrorConverter.m | Maps MSIDResourceTenantIdKey to the new public key during MSID→MSAL error conversion. |
| MSAL/src/MSALError.m | Defines the new string constant backing MSALResourceTenantIdKey. |
| CHANGELOG.md | Documents the new public error userInfo key in the 2.13.0 notes. |
* dev: Update IdentityCore submodule for MSIDMobileOnboardingState (#3016)
| MSIDUserDisplayableIdkey: MSALDisplayableUserIdKey, | ||
| MSIDBrokerVersionKey: MSALBrokerVersionKey, | ||
| MSIDHomeAccountIdkey: MSALHomeAccountIdKey, | ||
| MSIDResourceTenantIdKey: MSALResourceTenantIdKey, |
| subError:nil | ||
| underlyingError:nil | ||
| correlationId:[NSUUID UUID] | ||
| userInfo:@{MSIDResourceTenantIdKey : resourceTenantId} |
antonioalwan
marked this pull request as draft
June 24, 2026 22:15
kaisong1990
reviewed
Jul 22, 2026
| @@ -1,4 +1,5 @@ | |||
| ## [2.13.0] | |||
| * Expose `MSALResourceTenantIdKey` in error userInfo so client apps can enroll with the Intune MAM SDK against the correct resource tenant for guest / multi-tenant organization (MTO) scenarios. | |||
Contributor
There was a problem hiding this comment.
This entry is under 2.13.0, but that version has already shipped and does not include this change. Please move it to the next unreleased version section.
kaisong1990
self-requested a review
July 22, 2026 16:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Work item
AB#3673092 — MSAL layer of the Guest/MTO cross-tenant MAM fix.
Summary
Exposes the resource tenant id from protection-policy-required broker errors to client apps (e.g. Teams) so they can enroll with the Intune MAM SDK against the correct resource tenant in guest / multi-tenant organization (MTO) scenarios.
Changes
Testing
MSALErrorConverterTests pass (20 tests, 0 failures).
Dependencies
Requires the CommonCore change that defines MSIDResourceTenantIdKey and maps resource_tenant_id from broker responses:
antonio_alwan/mto_resource_tenant_enrollment(Automation tests failure #1873)Part of the broker-side fix:
antonio_alwan/mto_guest_mam_resource_tenant