API reference

Enumerations

EnrollmentStatus

Normalized enrollment outcome. The two platforms report different enums — iOS 28 codes, Android 10 — and both are mapped onto this set natively. See SPEC §4.1 for the full table; EnrollmentResult.nativeCode always carries the raw platform constant.

The blocking distinction in SPEC §8 is load-bearing and easy to get backwards: NotLicensed and NotTargeted must NOT block the user, Failed must.

Enumeration Members

Enumeration Member	Value	Description	Defined in
`AuthorizationNeeded`	`"authorizationNeeded"`	-	src/types.ts:32
`CompanyPortalRequired`	`"companyPortalRequired"`	Android only. iOS uses Authenticator as a broker and has no equivalent code.	src/types.ts:34
`Failed`	`"failed"`	Licensed and targeted, but enrollment failed. This one DOES block.	src/types.ts:29
`NotLicensed`	`"notLicensed"`	Tenant is MAM-enabled but the user has no Intune licence. Must NOT block.	src/types.ts:25
`NotTargeted`	`"notTargeted"`	Licensed, but no App Protection Policy targets the user. Must NOT block.	src/types.ts:27
`Pending`	`"pending"`	Android reports this itself; on iOS it is our own state while the delegate is pending.	src/types.ts:31
`Succeeded`	`"succeeded"`	-	src/types.ts:23
`Unenrolled`	`"unenrolled"`	-	src/types.ts:36
`UnenrollmentFailed`	`"unenrollmentFailed"`	-	src/types.ts:37
`Unknown`	`"unknown"`	Any native value the mapping does not cover. Unknown values map here rather than throwing, so an SDK update that adds a status cannot crash a shipped app.	src/types.ts:42
`WrongUser`	`"wrongUser"`	-	src/types.ts:35

FileProtectionLevel

Defined in: src/types.ts:57

iOS MaxFileProtectionLevel. The default makes protected files unreadable roughly ten seconds after the device locks, which breaks local databases; an app with lock-screen UI wants CompleteUntilFirstUserAuthentication. See SPEC §5.2.

Enumeration Members

Enumeration Member	Value	Defined in
`Complete`	`"complete"`	src/types.ts:58
`CompleteUnlessOpen`	`"completeUnlessOpen"`	src/types.ts:59
`CompleteUntilFirstUserAuthentication`	`"completeUntilFirstUserAuthentication"`	src/types.ts:60
`None`	`"none"`	src/types.ts:61

ResetStage

Defined in: src/types.ts:46

Journal stage of an unfinished reset. See SPEC §7.

Enumeration Members

Enumeration Member	Value	Defined in
`CleaningAuth`	`"cleaningAuth"`	src/types.ts:48
`CleaningLocal`	`"cleaningLocal"`	src/types.ts:49
`Unregistering`	`"unregistering"`	src/types.ts:47

Classes

IntuneError

Defined in: src/internal/errors.ts:9

Extends

Error

Constructors

Constructor

new IntuneError(
   code: IntuneErrorCode, 
   message: string, 
   native?: {
  nativeCode?: string;
  nativeMessage?: string;
}
): IntuneError;

Defined in: src/internal/errors.ts:14

Parameters

Parameter	Type
`code`	`IntuneErrorCode`
`message`	`string`
`native?`	{ `nativeCode?`: `string`; `nativeMessage?`: `string`; }
`native.nativeCode?`	`string`
`native.nativeMessage?`	`string`

Returns

IntuneError

Overrides

Error.constructor

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
`cause?`	`public`	`unknown`	-	`Error.cause`	website/node_modules/typescript/lib/lib.es2022.error.d.ts:24
`code`	`readonly`	`IntuneErrorCode`	-	-	src/internal/errors.ts:10
`message`	`public`	`string`	-	`Error.message`	website/node_modules/typescript/lib/lib.es5.d.ts:1075
`name`	`public`	`string`	-	`Error.name`	website/node_modules/typescript/lib/lib.es5.d.ts:1074
`nativeCode?`	`readonly`	`string`	-	-	src/internal/errors.ts:11
`nativeMessage?`	`readonly`	`string`	-	-	src/internal/errors.ts:12
`stack?`	`public`	`string`	-	`Error.stack`	website/node_modules/typescript/lib/lib.es5.d.ts:1076
`stackTraceLimit`	`static`	`number`	The `Error.stackTraceLimit` property specifies the number of stack frames collected by a stack trace (whether generated by `new Error().stack` or `Error.captureStackTrace(obj)`). The default value is `10` but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed. If set to a non-number value, or set to a negative number, stack traces will not capture any frames.	`Error.stackTraceLimit`	website/node_modules/@types/node/globals.d.ts:67

Methods

captureStackTrace()

static captureStackTrace(targetObject: object, constructorOpt?: Function): void;

Defined in: website/node_modules/@types/node/globals.d.ts:51

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters

Parameter	Type
`targetObject`	`object`
`constructorOpt?`	`Function`

Returns

void

Inherited from

Error.captureStackTrace

isError()

static isError(error: unknown): error is Error;

Defined in: website/node_modules/typescript/lib/lib.esnext.error.d.ts:21

Indicates whether the argument provided is a built-in Error instance or not.

Parameters

Parameter	Type
`error`	`unknown`

Returns

error is Error

Inherited from

Error.isError

prepareStackTrace()

static prepareStackTrace(err: Error, stackTraces: CallSite[]): any;

Defined in: website/node_modules/@types/node/globals.d.ts:55

Parameters

Parameter	Type
`err`	`Error`
`stackTraces`	`CallSite`[]

Returns

any

See

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from

Error.prepareStackTrace

Type Aliases

AcquireTokenParams

type AcquireTokenParams = {
  accountId?: string;
  scopes: string[];
};

Defined in: src/types.ts:142

Properties

Property	Type	Defined in
`accountId?`	`string`	src/types.ts:144
`scopes`	`string`[]	src/types.ts:143

AuthAccount

type AuthAccount = {
  accountId: string;
  tenantId: string;
  username: string;
};

Defined in: src/types.ts:161

Properties

Property	Type	Defined in
`accountId`	`string`	src/types.ts:162
`tenantId`	`string`	src/types.ts:163
`username`	`string`	src/types.ts:164

AuthMode

type AuthMode = "builtin" | "external";

Defined in: src/types.ts:79

Who owns MSAL. builtin is the module (SPEC §3.1) and the default. external is for apps that already have their own MSAL and supply MAM tokens via setTokenProvider; it is a supported mode, not a documentation fallback.

AuthResult

type AuthResult = {
  accessToken: string;
  accountId: string;
  expiresOn: number;
  idToken: string | null;
  scopes: string[];
  tenantId: string;
  username: string;
};

Defined in: src/types.ts:147

Properties

Property	Type	Description	Defined in
`accessToken`	`string`	For the scopes you asked for. Never the MAM service token.	src/types.ts:154
`accountId`	`string`	Entra object ID. This is what `enroll` takes — never the UPN.	src/types.ts:149
`expiresOn`	`number`	Unix seconds.	src/types.ts:157
`idToken`	`string` \| `null`	-	src/types.ts:155
`scopes`	`string`[]	-	src/types.ts:158
`tenantId`	`string`	-	src/types.ts:150
`username`	`string`	UPN. Display only; never log or persist it (SPEC §16, CLAUDE.md rule 3).	src/types.ts:152

Branding

type Branding = {
  accent?: string;
  background?: string;
  foreground?: string;
  secondaryBackground?: string;
  secondaryForeground?: string;
};

Defined in: src/types.ts:121

Hex strings, e.g. #1B5E20.

Properties

Property	Type	Defined in
`accent?`	`string`	src/types.ts:124
`background?`	`string`	src/types.ts:122
`foreground?`	`string`	src/types.ts:123
`secondaryBackground?`	`string`	src/types.ts:125
`secondaryForeground?`	`string`	src/types.ts:126

BrokerStatus

type BrokerStatus = {
  authenticatorInstalled: boolean;
  brokerAvailable: boolean;
  companyPortalInstalled: boolean;
  required: boolean;
};

Defined in: src/types.ts:198

Properties

Property	Type	Description	Defined in
`authenticatorInstalled`	`boolean`	iOS only; always `false` on Android.	src/types.ts:203
`brokerAvailable`	`boolean`	Any usable broker is present.	src/types.ts:200
`companyPortalInstalled`	`boolean`	-	src/types.ts:201
`required`	`boolean`	`true` on Android — enrollment is impossible without a broker.	src/types.ts:205

Diagnostics

type Diagnostics = Record<string, string>;

Defined in: src/types.ts:287

Opaque key/value for support bundles. Contains no tokens and no UPNs.

EnrollInteractiveParams

type EnrollInteractiveParams = {
  upn?: string;
};

Defined in: src/types.ts:182

Properties

Property	Type	Description	Defined in
`upn?`	`string`	The account's UPN. Leave unset to let the SDK ask for it — it shows its own sign-in screen either way.	src/types.ts:187

EnrollmentResult

type EnrollmentResult = {
  accountId: string | null;
  nativeCode: string;
  nativeMessage: string;
  restartRequired: boolean;
  status: EnrollmentStatus;
};

Defined in: src/types.ts:208

Properties

Property	Type	Description	Defined in
`accountId`	`string` \| `null`	-	src/types.ts:210
`nativeCode`	`string`	Raw platform constant name, e.g. `LicensedNotTargeted`. For support bundles.	src/types.ts:212
`nativeMessage`	`string`	SDK debug string. Safe to log — contains no token.	src/types.ts:214
`restartRequired`	`boolean`	-	src/types.ts:215
`status`	`EnrollmentStatus`	-	src/types.ts:209

EnrollParams

type EnrollParams = {
  accountId: string;
  upn?: string;
};

Defined in: src/types.ts:167

Properties

Property	Type	Description	Defined in
`accountId`	`string`	Entra object ID. Never a UPN — that is what `upn` below is for.	src/types.ts:169
`upn?`	`string`	Android, `authMode: 'external'` only. `registerAccountForMAM` takes the UPN as well as the object ID and will not accept null for it, and in `external` mode the module has no MSAL cache to resolve one from. Leave it unset in `builtin` mode — the module reads it from its own MSAL account. iOS never needs it: `registerAndEnrollAccountId:` takes the object ID alone and the SDK resolves the UPN itself. See SPEC §6.3.	src/types.ts:179

IntuneConfig

type IntuneConfig = {
  authMode?: AuthMode;
  authority: string;
  branding?: Branding;
  clientId: string;
  keychainGroupOverride?: string;
  maxFileProtectionLevel?: FileProtectionLevel;
  redirectUri: string;
  restartHandledByApp?: boolean;
  strictMode?: boolean;
  telemetryEnabled?: boolean;
  tenantId: string;
  verboseLogging?: boolean;
};

Defined in: src/types.ts:83

Properties

Property	Type	Description	Defined in
`authMode?`	`AuthMode`	Default `'builtin'`.	src/types.ts:93
`authority`	`string`	e.g. `https://login.microsoftonline.com/<tenantId>`	src/types.ts:89
`branding?`	`Branding`	Colours for the screens the SDK draws itself — the PIN prompt, the blur overlay, the policy and diagnostics screens. Anything left unset keeps Microsoft's default. These are the SDK's own UI, not yours: it renders them over your app and you cannot restyle them any other way (SPEC §15 P4).	src/types.ts:117
`clientId`	`string`	Entra application (client) ID, GUID.	src/types.ts:85
`keychainGroupOverride?`	`string`	iOS only. MSAL's keychain access group. Leave unset unless the app already uses a custom one: the module sets `ADALCacheKeychainGroupOverride` from this same value in the same code path, so the two can never disagree (SPEC §5.1.2).	src/types.ts:107
`maxFileProtectionLevel?`	`FileProtectionLevel`	iOS only. Default `Complete`, which is the SDK's own default.	src/types.ts:99
`redirectUri`	`string`	Must match the platform format — see the README.	src/types.ts:91
`restartHandledByApp?`	`boolean`	iOS only. Default `false`. See SPEC §5.2 and open question O-C.	src/types.ts:97
`strictMode?`	`boolean`	Android only. Default `__DEV__`. Throws on integration bugs, so never ship it on.	src/types.ts:101
`telemetryEnabled?`	`boolean`	Default `true`, matching the SDK. Set `false` to opt out of Microsoft telemetry.	src/types.ts:109
`tenantId`	`string`	Entra directory (tenant) ID, GUID.	src/types.ts:87
`verboseLogging?`	`boolean`	Default `false`.	src/types.ts:95

IntuneErrorCode

type IntuneErrorCode = 
  | "E_NOT_CONFIGURED"
  | "E_RESET_REQUIRED"
  | "E_SDK_UNAVAILABLE"
  | "E_BROKER_MISSING"
  | "E_INVALID_ACCOUNT_ID"
  | "E_TOKEN_PROVIDER_FAILED"
  | "E_TOKEN_PROVIDER_MISSING"
  | "E_EXTERNAL_AUTH_MODE"
  | "E_INTERACTION_REQUIRED"
  | "E_NO_ACTIVITY"
  | "E_USER_CANCELLED"
  | "E_RESET_IN_PROGRESS"
  | "E_ALREADY_ENROLLED"
  | "E_NOT_NEEDED"
  | "E_PLIST_CONFLICT"
  | "E_UPN_REQUIRED"
  | "E_NATIVE";

Defined in: src/types.ts:351

Stable rejection codes. A non-success enrollment status is data and resolves; these mean the caller did something wrong or the environment is broken. See SPEC §13.6.

E_NATIVE appearing in logs is a signal to extend the native mapping table, not an acceptable steady state.

IntuneEvents

type IntuneEvents = {
  brokerStatusChanged: BrokerStatus;
  enrollmentResult: EnrollmentResult;
  policyChanged: PolicySnapshot;
  restartRequired: RestartRequest;
  tokenRequest: TokenRequest & {
     requestId: string;
  };
  unenrollmentResult: EnrollmentResult;
  wipeRequested: WipeRequest;
};

Defined in: src/types.ts:332

Event names and their payloads, used to type the emitter in index.ts.

Properties

Property	Type	Defined in
`brokerStatusChanged`	`BrokerStatus`	src/types.ts:339
`enrollmentResult`	`EnrollmentResult`	src/types.ts:333
`policyChanged`	`PolicySnapshot`	src/types.ts:334
`restartRequired`	`RestartRequest`	src/types.ts:337
`tokenRequest`	`TokenRequest` & { `requestId`: `string`; }	src/types.ts:338
`unenrollmentResult`	`EnrollmentResult`	src/types.ts:335
`wipeRequested`	`WipeRequest`	src/types.ts:336

IntuneState

type IntuneState = {
  configured: boolean;
  configuredTenantId: string | null;
  enrolledAccountId: string | null;
  pendingReset: ResetStage | null;
  pendingResetReason: ResetReason | null;
  registeredAccountIds: string[];
  status: EnrollmentStatus | null;
};

Defined in: src/types.ts:224

The reconciliation primitive, and the intended way to drive this module. Read it at launch, compare against what your backend says the state should be, act on the difference. Do not drive enrollment from lifecycle hooks: the process can die mid-operation and only a state comparison recovers from that. See SPEC §13.2.

Properties

Property	Type	Description	Defined in
`configured`	`boolean`	-	src/types.ts:225
`configuredTenantId`	`string` \| `null`	-	src/types.ts:226
`enrolledAccountId`	`string` \| `null`	-	src/types.ts:228
`pendingReset`	`ResetStage` \| `null`	Non-null means a reset is unfinished and must be resumed (SPEC §7).	src/types.ts:232
`pendingResetReason`	`ResetReason` \| `null`	Why that unfinished reset started, from the journal. Pass it back as `reset({ reason })` when resuming, so the reset handler sees what actually happened rather than `'resume'`. It is the difference between telling a user their administrator revoked access and telling them nothing — and on the path that matters most, a service-initiated wipe, the process dies before the handler ever runs in the original call, so the resume is the only place it can be said.	src/types.ts:242
`registeredAccountIds`	`string`[]	-	src/types.ts:227
`status`	`EnrollmentStatus` \| `null`	`null` means no account is registered.	src/types.ts:230

PolicySnapshot

type PolicySnapshot = {
  canOpenFromUnmanaged: boolean;
  canSaveToLocal: boolean;
  canSaveToPersonal: boolean;
  isManaged: boolean;
  raw: Record<string, string>;
  screenshotAllowed: boolean;
};

Defined in: src/types.ts:267

Only what an app needs to adapt its own UI — hiding an export button, disabling a share sheet. PIN prompts, screenshot blocking and encryption are enforced inside the SDK and never surface here. Do not try to implement enforcement from these booleans.

Deliberately short: every field is a support obligation.

There is no clipboard field, and there cannot be one. Neither platform exposes a clipboard policy getter — the restriction is enforced inside the SDK and is not queryable — so canSaveToPersonal and canOpenFromUnmanaged serve the same "adapt your UI" purpose using values both platforms can actually answer (SPEC §4.3).

When no policy applies, every field is permissive rather than false: reporting false would hide functionality that nothing is restricting.

Properties

Property	Type	Description	Defined in
`canOpenFromUnmanaged`	`boolean`	Bring data in from an unmanaged location. Gate an import control on this.	src/types.ts:277
`canSaveToLocal`	`boolean`	Save into the app's own storage.	src/types.ts:270
`canSaveToPersonal`	`boolean`	Save out to a personal, unmanaged destination. Gate an export or "save a copy" control on this.	src/types.ts:275
`isManaged`	`boolean`	-	src/types.ts:268
`raw`	`Record`<`string`, `string`>	Everything else the SDK reports. Excluded from semver — unstable, debug only. Anything you come to depend on must be promoted to a typed field first.	src/types.ts:283
`screenshotAllowed`	`boolean`	-	src/types.ts:278

ResetHandler

type ResetHandler = (context: ResetHandlerContext) => Promise<void> | void;

Defined in: src/types.ts:313

Clear the app's own local data. If it throws, the journal stays open and retries.

Parameters

Parameter	Type
`context`	`ResetHandlerContext`

Returns

Promise<void> | void

ResetHandlerContext

type ResetHandlerContext = {
  accountId: string | null;
  reason: ResetReason;
};

Defined in: src/types.ts:307

Properties

Property	Type	Defined in
`accountId`	`string` \| `null`	src/types.ts:309
`reason`	`ResetReason`	src/types.ts:308

ResetParams

type ResetParams = {
  reason: ResetReason;
  wipe: boolean;
};

Defined in: src/types.ts:245

Properties

Property	Type	Defined in
`reason`	`ResetReason`	src/types.ts:247
`wipe`	`boolean`	src/types.ts:246

ResetReason

type ResetReason = 
  | "logout"
  | "tenant_changed"
  | "intune_disabled"
  | "remote_wipe"
  | "account_switch"
  | "support_reset"
  | "resume";

Defined in: src/types.ts:65

Why a reset was started. Recorded in the journal and surfaced in getDiagnostics.

RestartReason

type RestartReason = "policyAppliedFirstTime" | "unknown";

Defined in: src/types.ts:327

Why the SDK wants the app restarted.

One value today, because that is the only case the SDK reports: policy arrived for the first time. Typed as a union rather than string so a consumer can switch on it, with unknown for a value a future SDK adds — an unrecognised reason must not break a shipped app, and a restart is still a restart.

RestartRequest

type RestartRequest = {
  reason: RestartReason;
};

Defined in: src/types.ts:329

Properties

Property	Type	Defined in
`reason`	`RestartReason`	src/types.ts:329

SignInParams

type SignInParams = {
  loginHint?: string;
  prompt?: SignInPrompt;
  scopes?: string[];
};

Defined in: src/types.ts:134

Properties

Property	Type	Description	Defined in
`loginHint?`	`string`	Pre-fill the account, e.g. from an email field.	src/types.ts:138
`prompt?`	`SignInPrompt`	-	src/types.ts:139
`scopes?`	`string`[]	Scopes for your own API. The MAM service scopes are added internally.	src/types.ts:136

SignInPrompt

type SignInPrompt = "selectAccount" | "login" | "consent" | "whenRequired";

Defined in: src/types.ts:131

SignOutParams

type SignOutParams = {
  accountId: string;
  wipeIntune: boolean;
};

Defined in: src/types.ts:190

Properties

Property	Type	Description	Defined in
`accountId`	`string`	-	src/types.ts:191
`wipeIntune`	`boolean`	Also runs the full reset sequence. On Android the process may terminate.	src/types.ts:193

TokenProvider

type TokenProvider = (request: TokenRequest) => Promise<string | null> | string | null;

Defined in: src/types.ts:303

Return the access token, or null to signal "cannot get a token right now". Runs on a background thread's behalf, and the SDK may ask with no JS call in flight.

Parameters

Parameter	Type
`request`	`TokenRequest`

Returns

Promise<string | null> | string | null

TokenRequest

type TokenRequest = {
  accountId: string;
  authority: string;
  resourceId: string;
  tenantId: string;
};

Defined in: src/types.ts:292

Payload of a native-initiated MAM service token request. See SPEC §13.4.

Properties

Property	Type	Defined in
`accountId`	`string`	src/types.ts:296
`authority`	`string`	src/types.ts:295
`resourceId`	`string`	src/types.ts:293
`tenantId`	`string`	src/types.ts:294

WipeRequest

type WipeRequest = {
  accountId: string | null;
};

Defined in: src/types.ts:317

Properties

Property	Type	Defined in
`accountId`	`string` \| `null`	src/types.ts:317

Variables

default

const default: {
  acquireToken: (params: AcquireTokenParams) => Promise<AuthResult>;
  configure: (config: IntuneConfig) => Promise<void>;
  enroll: (params: EnrollParams) => Promise<EnrollmentResult>;
  enrollInteractive: (params: EnrollInteractiveParams) => Promise<EnrollmentResult>;
  getAccounts: () => Promise<AuthAccount[]>;
  getBrokerStatus: () => Promise<BrokerStatus>;
  getDiagnostics: () => Promise<Diagnostics>;
  getPolicy: () => Promise<PolicySnapshot>;
  getState: () => Promise<IntuneState>;
  isSupported: () => Promise<boolean>;
  onBrokerStatusChanged: (listener: (status: BrokerStatus) => void) => EventSubscription;
  onEnrollmentResult: (listener: (result: EnrollmentResult) => void) => EventSubscription;
  onPolicyChanged: (listener: (policy: PolicySnapshot) => void) => EventSubscription;
  onRestartRequired: (listener: (request: RestartRequest) => void) => EventSubscription;
  onUnenrollmentResult: (listener: (result: EnrollmentResult) => void) => EventSubscription;
  onWipeRequested: (listener: (request: {
     accountId: string | null;
  }) => void) => EventSubscription;
  openBrokerInstall: () => Promise<void>;
  reset: (params: ResetParams) => Promise<void>;
  setResetHandler: (handler: ResetHandler | null) => void;
  setTokenProvider: (provider: TokenProvider | null) => void;
  signIn: (params: SignInParams) => Promise<AuthResult>;
  signInAndEnroll: (params: SignInParams) => Promise<{
     auth: AuthResult;
     enrollment: EnrollmentResult;
  }>;
  signInSilent: (params: SignInParams) => Promise<AuthResult>;
  signOut: (params: SignOutParams) => Promise<void>;
};

Defined in: src/index.ts:100

Type Declaration

Name	Type	Defined in
`acquireToken()`	(`params`: `AcquireTokenParams`) => `Promise`<`AuthResult`>	src/index.ts:108
`configure()`	(`config`: `IntuneConfig`) => `Promise`<`void`>	src/index.ts:101
`enroll()`	(`params`: `EnrollParams`) => `Promise`<`EnrollmentResult`>	src/index.ts:111
`enrollInteractive()`	(`params`: `EnrollInteractiveParams`) => `Promise`<`EnrollmentResult`>	src/index.ts:112
`getAccounts()`	() => `Promise`<`AuthAccount`[]>	src/index.ts:109
`getBrokerStatus()`	() => `Promise`<`BrokerStatus`>	src/index.ts:103
`getDiagnostics()`	() => `Promise`<`Diagnostics`>	src/index.ts:117
`getPolicy()`	() => `Promise`<`PolicySnapshot`>	src/index.ts:116
`getState()`	() => `Promise`<`IntuneState`>	src/index.ts:113
`isSupported()`	() => `Promise`<`boolean`>	src/index.ts:102
`onBrokerStatusChanged()`	(`listener`: (`status`: `BrokerStatus`) => `void`) => `EventSubscription`	src/index.ts:124
`onEnrollmentResult()`	(`listener`: (`result`: `EnrollmentResult`) => `void`) => `EventSubscription`	src/index.ts:119
`onPolicyChanged()`	(`listener`: (`policy`: `PolicySnapshot`) => `void`) => `EventSubscription`	src/index.ts:121
`onRestartRequired()`	(`listener`: (`request`: `RestartRequest`) => `void`) => `EventSubscription`	src/index.ts:123
`onUnenrollmentResult()`	(`listener`: (`result`: `EnrollmentResult`) => `void`) => `EventSubscription`	src/index.ts:120
`onWipeRequested()`	(`listener`: (`request`: { `accountId`: `string` \| `null`; }) => `void`) => `EventSubscription`	src/index.ts:122
`openBrokerInstall()`	() => `Promise`<`void`>	src/index.ts:104
`reset()`	(`params`: `ResetParams`) => `Promise`<`void`>	src/index.ts:114
`setResetHandler()`	(`handler`: `ResetHandler` \| `null`) => `void`	src/index.ts:115
`setTokenProvider()`	(`provider`: `TokenProvider` \| `null`) => `void`	src/index.ts:118
`signIn()`	(`params`: `SignInParams`) => `Promise`<`AuthResult`>	src/index.ts:105
`signInAndEnroll()`	(`params`: `SignInParams`) => `Promise`<{ `auth`: `AuthResult`; `enrollment`: `EnrollmentResult`; }>	src/index.ts:107
`signInSilent()`	(`params`: `SignInParams`) => `Promise`<`AuthResult`>	src/index.ts:106
`signOut()`	(`params`: `SignOutParams`) => `Promise`<`void`>	src/index.ts:110

Functions

acquireToken()

function acquireToken(params: AcquireTokenParams): Promise<AuthResult>;

Defined in: src/api/auth.ts:41

For your own API's scopes, after sign-in.

Parameters

Parameter	Type
`params`	`AcquireTokenParams`

Returns

Promise<AuthResult>

configure()

function configure(config: IntuneConfig): Promise<void>;

Defined in: src/api/lifecycle.ts:25

Configures the SDK for one customer tenant. Every other method rejects with E_NOT_CONFIGURED until this resolves.

Two things it will refuse rather than paper over:

a different tenantId than the active one — E_RESET_REQUIRED, because silently reconfiguring would leave the old tenant enrolled, and the iOS runtime overrides persist across restarts so the mismatch would survive a relaunch;
an Info.plist that disagrees with it — E_PLIST_CONFLICT, see SPEC §5.1.2.

Parameters

Parameter	Type
`config`	`IntuneConfig`

Returns

Promise<void>

enroll()

function enroll(params: EnrollParams): Promise<EnrollmentResult>;

Defined in: src/api/enrollment.ts:44

Resolves with a result for every outcome including failures — a non-success status is data, not an exception. It only rejects for programming errors.

Expect seconds, and a spinner: the promise settles when the SDK reports through its delegate or notification, not when the underlying call returns.

Read SPEC §8 before branching on status. NotLicensed and NotTargeted must not block the user; Failed must.

Parameters

Parameter	Type
`params`	`EnrollParams`

Returns

Promise<EnrollmentResult>

enrollInteractive()

function enrollInteractive(params?: EnrollInteractiveParams): Promise<EnrollmentResult>;

Defined in: src/api/enrollment.ts:66

iOS only. Hands the whole sign-in to the SDK: it shows its own credential screen, signs the user in, and enrolls them. No MSAL on our side, which is why this works before the built-in auth layer exists.

Rejects with E_SDK_UNAVAILABLE on Android — registerAccountForMAM there always needs a token supplied by the app, so there is nothing equivalent to call.

Like enroll, it resolves with a result for every outcome including failures.

Parameters

Parameter	Type
`params`	`EnrollInteractiveParams`

Returns

Promise<EnrollmentResult>

getAccounts()

function getAccounts(): Promise<AuthAccount[]>;

Defined in: src/api/auth.ts:51

Accounts with cached refresh tokens. Under single identity (SPEC §9) this holds at most one; more than one means state a reset should have cleared.

Returns

Promise<AuthAccount[]>

getBrokerStatus()

function getBrokerStatus(): Promise<BrokerStatus>;

Defined in: src/api/lifecycle.ts:68

Answerable before configure, on purpose — the app needs it to decide whether to prompt for a broker install.

A false negative here usually means a missing manifest entry rather than a missing app: LSApplicationQueriesSchemes on iOS, <queries> on Android 11+.

Returns

Promise<BrokerStatus>

getDiagnostics()

function getDiagnostics(): Promise<Diagnostics>;

Defined in: src/api/policy.ts:20

Safe to attach to a support ticket: no tokens, no UPNs.

Returns

Promise<Diagnostics>

getPolicy()

function getPolicy(): Promise<PolicySnapshot>;

Defined in: src/api/policy.ts:15

For adapting your own UI — hiding an export button, disabling a share sheet.

PIN prompts, screenshot blocking and encryption are enforced inside the SDK and never surface here. Do not attempt to implement enforcement from these booleans.

Returns

Promise<PolicySnapshot>

getState()

function getState(): Promise<IntuneState>;

Defined in: src/api/enrollment.ts:79

The reconciliation primitive, and the intended way to drive this module. Call it at launch, compare against what your backend says the state should be, act on the difference. It never rejects.

Returns

Promise<IntuneState>

isSupported()

function isSupported(): Promise<boolean>;

Defined in: src/api/lifecycle.ts:57

SDK linked and platform prerequisites met. Gate the whole Intune path on this so a misbuilt binary degrades instead of crashing.

Returns

Promise<boolean>

onBrokerStatusChanged()

function onBrokerStatusChanged(listener: (status: BrokerStatus) => void): EventSubscription;

Defined in: src/api/events.ts:57

The user installed or removed Company Portal.

Parameters

Parameter	Type
`listener`	(`status`: `BrokerStatus`) => `void`

Returns

EventSubscription

onEnrollmentResult()

function onEnrollmentResult(listener: (result: EnrollmentResult) => void): EventSubscription;

Defined in: src/api/events.ts:36

Also fires for the SDK's own background enrollment retries, which have no caller.

Parameters

Parameter	Type
`listener`	(`result`: `EnrollmentResult`) => `void`

Returns

EventSubscription

onPolicyChanged()

function onPolicyChanged(listener: (policy: PolicySnapshot) => void): EventSubscription;

Defined in: src/api/events.ts:50

An administrator changed policy — re-read whatever UI you gate on it.

Parameters

Parameter	Type
`listener`	(`policy`: `PolicySnapshot`) => `void`

Returns

EventSubscription

onRestartRequired()

function onRestartRequired(listener: (request: RestartRequest) => void): EventSubscription;

Defined in: src/api/events.ts:77

iOS, on first policy application. See configure({ restartHandledByApp }).

Parameters

Parameter	Type
`listener`	(`request`: `RestartRequest`) => `void`

Returns

EventSubscription

onUnenrollmentResult()

function onUnenrollmentResult(listener: (result: EnrollmentResult) => void): EventSubscription;

Defined in: src/api/events.ts:43

The terminal state of a reset.

Parameters

Parameter	Type
`listener`	(`result`: `EnrollmentResult`) => `void`

Returns

EventSubscription

onWipeRequested()

function onWipeRequested(listener: (request: {
  accountId: string | null;
}) => void): EventSubscription;

Defined in: src/api/events.ts:64

Service-initiated. Can arrive with no prior app call at all.

Parameters

Parameter	Type
`listener`	(`request`: { `accountId`: `string` \| `null`; }) => `void`

Returns

EventSubscription

openBrokerInstall()

function openBrokerInstall(): Promise<void>;

Defined in: src/api/lifecycle.ts:73

Rejects with E_NOT_NEEDED when a broker is already present.

Returns

Promise<void>

reset()

function reset(params: ResetParams): Promise<void>;

Defined in: src/api/enrollment.ts:91

Unregisters, unenrolls, optionally wipes corporate data, and clears the runtime configuration.

The process is expected to terminate during this call on Android (SPEC §7). Do not write code after await reset(...) that must run — put the continuation in the launch-time reconciliation and let the journal resume it.

Parameters

Parameter	Type
`params`	`ResetParams`

Returns

Promise<void>

setResetHandler()

function setResetHandler(handler: ResetHandler | null): void;

Defined in: src/api/enrollment.ts:30

Clears the app's own local data during a reset. The module cannot do this for you — it does not know what you store or where.

Registered rather than passed to reset because a reset can be resumed at launch from the journal, with no reset call in flight (SPEC §7).

Parameters

Parameter	Type
`handler`	`ResetHandler` \| `null`

Returns

void

setTokenProvider()

function setTokenProvider(provider: TokenProvider | null): void;

Defined in: src/api/tokenProvider.ts:24

Registers the provider for authMode: 'external'. Return null from it to say "cannot get a token right now" — the SDK treats that as needing authorization rather than as a hard failure.

Parameters

Parameter	Type
`provider`	`TokenProvider` \| `null`

Returns

void

function signIn(params?: SignInParams): Promise<AuthResult>;

Defined in: src/api/auth.ts:26

Uses the broker when one is present, which also gives device-wide SSO: a user already signed into Outlook usually gets a token with no prompt at all.

Parameters

Parameter	Type
`params`	`SignInParams`

Returns

Promise<AuthResult>

signInAndEnroll()

function signInAndEnroll(params?: SignInParams): Promise<{
  auth: AuthResult;
  enrollment: EnrollmentResult;
}>;

Defined in: src/api/auth.ts:67

The common path in one call. Use the primitives when you need a step in between.

Parameters

Parameter	Type
`params`	`SignInParams`

Returns

Promise<{ auth: AuthResult; enrollment: EnrollmentResult; }>

signInSilent()

function signInSilent(params?: SignInParams): Promise<AuthResult>;

Defined in: src/api/auth.ts:34

Cache-first. Rejects with E_INTERACTION_REQUIRED when a prompt is needed — the normal pattern is signInSilent first, signIn on that rejection.

Parameters

Parameter	Type
`params`	`SignInParams`

Returns

Promise<AuthResult>

signOut()

function signOut(params: SignOutParams): Promise<void>;

Defined in: src/api/auth.ts:61

Removes the account from the MSAL cache. With wipeIntune: true it also runs the full reset sequence, which is what you want on logout — and which means the process may terminate during this call on Android.

Parameters

Parameter	Type
`params`	`SignOutParams`

Returns

Promise<void>

Enumerations​

EnrollmentStatus​

Enumeration Members​

FileProtectionLevel​

Enumeration Members​

ResetStage​

Enumeration Members​

Classes​

IntuneError​

Extends​

Constructors​

Constructor​

Parameters​

Returns​

Overrides​

Properties​

Methods​

captureStackTrace()​

Parameters​

Returns​

Inherited from​

isError()​

Parameters​

Returns​

Inherited from​

prepareStackTrace()​

Parameters​

Returns​

See​

Inherited from​

Type Aliases​

AcquireTokenParams​

Properties​

AuthAccount​

Properties​

AuthMode​

AuthResult​

Properties​

Branding​

Properties​

BrokerStatus​

Properties​

Diagnostics​

EnrollInteractiveParams​

Properties​

EnrollmentResult​

Properties​

EnrollParams​

Properties​

IntuneConfig​

Properties​

IntuneErrorCode​

IntuneEvents​

Properties​

IntuneState​

Properties​

PolicySnapshot​

Properties​

ResetHandler​

Parameters​

Returns​

ResetHandlerContext​

Properties​

ResetParams​

Properties​

ResetReason​

RestartReason​

RestartRequest​

Properties​

SignInParams​

Properties​

SignInPrompt​

SignOutParams​

Properties​

TokenProvider​

Parameters​

Returns​

TokenRequest​

Properties​

WipeRequest​

Enumerations

EnrollmentStatus

Enumeration Members

FileProtectionLevel

Enumeration Members

ResetStage

Enumeration Members

Classes

IntuneError

Extends

Constructors

Constructor

Parameters

Returns

Overrides

Properties

Methods

captureStackTrace()

Parameters

Returns

Inherited from

isError()

Parameters

Returns

Inherited from

prepareStackTrace()

Parameters

Returns

See

Inherited from

Type Aliases

AcquireTokenParams

Properties

AuthAccount

Properties

AuthMode

AuthResult

Properties

Branding

Properties

BrokerStatus

Properties

Diagnostics

EnrollInteractiveParams

Properties

EnrollmentResult

Properties

EnrollParams

Properties

IntuneConfig

Properties

IntuneErrorCode

IntuneEvents

Properties

IntuneState

Properties

PolicySnapshot

Properties

ResetHandler

Parameters

Returns

ResetHandlerContext

Properties

ResetParams

Properties

ResetReason

RestartReason

RestartRequest

Properties

SignInParams

Properties

SignInPrompt

SignOutParams

Properties

TokenProvider

Parameters

Returns

TokenRequest

Properties

WipeRequest