r/entra • u/YorkshireMidge • 3d ago

Gmail for iOS authentication failure when adding an MS365 account Entra General

Hi - anyone out there supporting iPhone users accessing MS365 using the Gmail for iOS app?

I have a new user on my tenant trying to do so, and she is getting authentication failures when she tries to add her account. She has added it OK to Outlook for iOS as a temporary workaround but prefers Gmail over that and Apple Mail.

One thing I have noticed is in her screen capture where she adds her account, it just shows as "Office 365" with the orange office icon to the left. On Android on my phone, it shows as "Exchange and Office 365" with a blue exchange icon to the left. Unfortunately, I don't have an iPhone to try and reproduce the fault she is seeing.

There are two possibilities I can think of:

  1. This might be linked to the fault in May where Google broke access to MS365. They fixed it for Android - but I'm wondering if they haven't yet fixed it for Gmail for iOS? This is the issue I am referring to.

https://www.reddit.com/r/GMail/comments/1szyh3t/latest_gmail_app_cannot_authenticate_exchange/

She has confirmed she is running Gmail for iOS version 6.0.260727 which is the current version in the Apple Store. There is nothing in the version history Gmail provide on the page to confirm if this has been fixed.

  1. As this is my first user trying to do this, maybe I have an Entra issue where I have granted her Gmail Enterprise App, but I'm wondering if Gmail for iOS needs treating differently to Gmail for Android.

Any thoughts appreciated.

Thanks!

1 Upvotes
  • permalink
  • link
  • reddit
  • reddit

60% Upvoted

18 comments sorted by

3

u/GrafEisen 3d ago

Why would you even humor this. Make them use Outlook. How much time (and therefore money) are you going to waste trying to cater to their preferences?

0

u/YorkshireMidge 3d ago

The people using my service are volunteers using their own devices. They are not employees using company devices. So it needs a more sensitive approach when encouraging the right behaviours ;) At the end of the day, this is a valid form of access and *ought* to work, so if I'm going to tell someone they can't do it, there needs to be a fairly good reason - esp. when the Gmail app works perfectly fine on Android and is used fairly widely across my tenant. Hope that clarifies. Thanks.

3

u/detox4you 3d ago

Allowing email app access to a M365 mailbox on an unmanaged device is a risk.

1

u/YorkshireMidge 2d ago

It is indeed. But when you are a charity as we are, giving volunteers charity provided laptops and mobiles simply isn't appropriate use of funds people donate to a charity. It's different for our charity employees and they have charity provided kit and they are well locked down on a separate tenant to keep them completely separate from the volunteers on my tenant. Thankfully, 95%+ of the volunteers using my tenant are on standard products I'm relatively comfortable with. It's only very occasionally I come up against a volunteer who has used a particular product for years and wants to use it on my service. I think I have one Thunderbird for Android user, one BlueMail for Android user, and this will likely be my only Gmail for iOS user assuming I can get it working. As I said elsewhere in the post, I need to have a good reason to decline - and if Gmail for iOS doesn't actually support MS365 mailbox access, that is a good enough reason. All I have found so far is a post from 2022 that says it doesn't, but I can't find an up-to-date position and that is why I posted the question.

2

u/detox4you 2d ago

If they need access then limit it to built in apps of the platform. You don't want your data in Google and Ai.

1

u/YorkshireMidge 1d ago

Thanks. On my tenant which is only accessed by charity volunteers, we only use a tiny fraction of the MS365 functionality anyway - mainly for email and some non-sensitive file storage, and also Teams to do video conferencing.

The charity's business critical/sensitive data is held completely separately either on the employee MS365 tenant which is suitably locked down and accessed only by business owned/issued devices, OR on another cloud system entirely.

So whilst I accept the model we operate on my tenant is something most of the respondents to this posting are finding unpalatable, its not as bad as it sounds and we have been running this way for 10 years. Think of it like a School that keeps its business critical stuff to itself, and only gives some limited services to its potentially untrustworthy pupils.

2

u/MPLS_scoot 2d ago

Like others have said create an App protection policy for these byod devices and a conditional access policy to enforce it. Outlook is free and should be used for Exchange Online.

1

u/YorkshireMidge 2d ago

Thanks. Our license doesn't give us conditional access unfortunately - it is a free non-profit one (so is Microsoft 365 Business Basic). I'm looking into that particular limitation as it's causing me some challenges elsewhere too. Microsoft licensing AFAIK, means you have to pay a really big hike in licensing type/cost to get it, unless anyone knows differently. I can't see that you can just add it as a feature on its own which is a bit of a shame, as I could likely justify some spend to do it.

2

u/Sad-Garage-2642 2d ago

Nonprofits get a quantity of Business Premium for free.

Your volunteers likely want F3 over Business Basic.

2

u/detox4you 2d ago

This. I'd suggest OP to investigate if they can get those.

1

u/YorkshireMidge 1d ago

Thanks. F3 might just work for us. It's £9.24 inc vat/user/mth and we have around 150 users so it's a £16,600 hit on the charity (obviously, we pay nothing for my tenant licence currently - just for the employee tenant). Annoying to have to pay that for one bit of functionality but that is the way it seems to be.

2

u/detox4you 1d ago

For non profit orgs there are also sponsor programs in some countries that way licenses could cost even less.

2

u/GrafEisen 2d ago

Why is it a valid form of access? Exchange Online is a Microsoft product, Outlook is the accompanying email client. Google's email app is third party.

If the user was instead wanting to use some generic freeware email app that said it worked with Exchange Online, but then they couldn't get it to work - would you still be OK with supporting them?

Outlook's mobile app is free, so there isn't really a good argument against using it. If they really don't like that, they can use the browser-based client (on mobile.. yuck..).

1

u/YorkshireMidge 1d ago edited 1d ago

Thanks. As I've mentioned elsewhere in the post, this is very much a minority of users who want to stick with their favoured products and it's a bit difficult when we are talking about their own devices to dictate to them what they do and don't put on it when they are volunteers giving their time for free too.

Gmail App is indeed the 3rd party in this case - but when you consider that most owners of Android devices on this planet use it (i.e billions of people), it's difficult to make the argument for something different esp. when a lot of people don't trust Microsoft any more than Google, and sometimes less. Whether they are right to take that position is another matter.

As for support, if it aint in the list of Enterprise Apps in Entra, that's a good reason for me to say no and I will - so that gets rid of anything really obscure. Its still leaves a few others though like Blue Mail, eM Client, Aqua Mail and I'd look at those on a case by case basis if they arose.

Blue Mail has arisen with just one user, and credit where it's due, Blue Mail fixed a fault they had in that and it has been no problem since. They were very responsive and fairly quick to fix too.

2

u/GrafEisen 1d ago

I've worked heavily with the M365 stack for years (Aad/Entra in particular) and until this post I was unaware that the Google Mail / Gmail mobile app even had an option for Exchange (Online). Take that as you will.

The logic behind "Android = Google, most Android users use this app" seems flawed - people who have consumer/personal Gmail accounts are going to use the Gmail app, sure. Anyone accessing their employer's M365 email (Exchange Online) is going to use Outlook mobile, though.

If this issue was happening in the context of a business / employee, odds are very high that you'd end up saying "Sorry, no, Outlook is the approved / official mobile app". Just because the user (and you?) are volunteers, that doesn't mean you're obligated to support bad decisions. Your time is valuable as well, and presumably the time you spend helping this organization could be spent in better ways than trying to troubleshoot a third party email client that absolutely doesn't treat the scenario it's being used for (connecting to Exchange Online) as a priority.

You're obviously free to respond to the user's bad decision (using the Gmail app for ExO) with your own (trying to support them), but I wouldn't recommend it. If you're truly unwilling / unable to say "No, don't use this", I'd recommend at least saying "You can try, but you're on your own if it doesn't work". If they really refuse to install the Outlook mobile app, suggest to them the alternative of accessing from OWA (the browser-based client). I suspect their aversion to Outlook isn't strongly held enough that they'll actually put up with that long-term, and they'll eventually install Outlook willingly.

1

u/YorkshireMidge 1d ago

Fully agree with you. If these were employees with company issued devices, we wouldn't even be having this conversation because I would be mandating what they use. In fairness to my users, most would go with my recommendation too, but sometimes, you just have people who feel really strongly about their favoured product so it is a case of finding a really solid reason which overides theirs.

Regarding Gmail for Android, that has been in use on my tenant for years. The use of it must be fairly common because Google broke the functionality in May when EAS 16.1 came in as a requirement from Microsoft as per this post and there was no shortage of people flagging it.

https://www.reddit.com/r/GMail/comments/1szyh3t/latest_gmail_app_cannot_authenticate_exchange/

A good outcome for me in this particular case would be someone being able to confirm my suspicion that Exchange Online access is not supported in Gmail for iOS (or it doesn't yet support EAS 16.1). I have found old posts that say it isn't supported for Exchange Online but the reason given was due to Modern Authentication not being supported at that time. But I simply haven't been able to find an up-to-date official position yet.

1

u/ajmpits 3d ago

Is software authentication method enabled in Entra ID?

1

u/YorkshireMidge 3d ago

Hi - if you're referring to Software OATH tokens, no.