Securing and configuring the Qlik Analytics mobile app with Microsoft Intune

The Qlik Analytics mobile app gives field teams secure access to Qlik Cloud analytics on their mobile devices. You can use Microsoft Intune and Microsoft Entra ID to control access, protect company data, and provide the settings users need to connect to your Qlik Cloud tenant.

What you need before you start

Before configuring the Qlik Analytics mobile app in Intune, make sure you have the following:

• Qlik Cloud tenant using Microsoft Entra ID

  Your Qlik Cloud tenant must be configured to use Entra ID (Azure AD) for authentication through OIDC or SAML. For more information, see Identity providers in Qlik Cloud.

• Microsoft Entra ID integrated with Microsoft Intune

  Your organization must have Entra connected with Intune so you can enforce device and app policies.

• Users registered in Microsoft Entra ID

  All users who will access the Qlik Analytics mobile app must have accounts in your Entra ID tenant and be included in the user directory configured for Qlik Cloud tenant access.

Installing the Qlik Analytics mobile app

The Qlik Analytics mobile app is available in the iOS App Store and Google Play Store. For more information, see Get started with the Qlik Analytics mobile app.

Setting up Microsoft Intune for the Qlik Analytics mobile app in Microsoft Entra ID

This section outlines the main steps to register and manage the Qlik Analytics mobile app in Entra ID and Intune. Configure Entra ID and Intune according to your organization's requirements. For detailed instructions on application registration, see the Microsoft Intune documentation.

Registering the Qlik Analytics app in Microsoft Entra ID

Register the Qlik Analytics mobile app in Microsoft Entra ID to use it with Microsoft Intune.

Do the following:

1. In Entra ID, go to App registrations and select New registration.

2. Select the link to Enterprise applications, since you are integrating a globally registered application.

3. Search for the application ID: 53dfc2c0-8711-4bb3-a48f-b384ff663ab9. This is the Qlik global app registration.

4. If required, the Intune administrator can initiate registration by signing in and visiting:

   https://login.microsoftonline.com/common/adminconsent?client_id=53dfc2c0-8711-4bb3-a48f-b384ff663ab9

5. Once the Qlik Analytics mobile app is added and appears under Enterprise applications, complete the following:

   • Assign users and groups if you want to limit who can access the app.

   • Under Permissions, grant admin consent for your domain.

Conditional Access policy guidance

The Qlik Analytics mobile app is an extension of your Qlik Cloud tenant. When managing the app with Microsoft Entra ID and Intune, keep the following in mind:

• App authentication is handled through the IdP-registered Entra app.

• The Qlik Analytics mobile app uses an external browser on the device to complete the authentication flow.

Conditional Access policy definitions will vary depending on your deployment scenario. Configuring a Conditional Access policy requires understanding of mobile authentication flows and thorough testing to confirm the desired control. For guidance, see the Microsoft documentation: Learn about Conditional Access and Intune.

Microsoft Intune policy logic

Intune provides two policy types to manage the Qlik Analytics mobile app:

• App protection policies: Control how the app handles and protects organizational data.

• App configuration policies: Supply Qlik Cloud tenant settings automatically so used don't need to enter them manually.

To support the MAM flow, the login screen includes a toggle. Users should turn it on to enforce policy access. In MDM deployments, this toggle is managed automatically by the Company Portal.

Policies apply at the app level on the mobile device, not at the tenant level. This means that if users switch between Qlik Cloud tenants in the Qlik Analytics mobile app, the same Intune policies continue to apply.

Policy information in the app

The About screen in the Qlik Analytics mobile app settings shows whether a policy is applied to the app.

• When any policy is deployed (app protection or app configuration), the screen displays Policy Applied — Yes.

• If the policy has a policy name configured, it also appears on a separate row as the Policy Name.

Important considerations

App protection policies control which apps can share data with each other.

• If users need to send diagnostic emails from the Qlik Analytics mobile app, the policy must allow data transfer between apps.

• Any app protection policy must account for communication between the Qlik Analytics mobile app and the device web browser.

• Key Intune app policy settings to review include:

  • Data protection > Send org data to other apps

  • Data protection > Select apps to exempt (com.qlik.qsm)

  • Functionality > Restrict web content transfer with other apps

The Qlik Analytics mobile app also requires the device web browser to complete sign-in, so your policy must allow browser access for authentication.

{
  "policyName": "<policy name>",
  "Accounts": [
    {
      "name": "<tenant name>",
      "url": "<tenant URL>"
    },
    {
      "name": "<tenant name>",
      "url": "<tenant URL>"
    }
  ]
}

{
  "policyName": "<policy name>",
  "Accounts": [
    {
      "name": "<tenant name>",
      "url": "<tenant URL>"
    },
    {
      "name": "<tenant name>",
      "url": "<tenant URL>"
    }
  ]
}