[patch][bugfix]: Align mobile onboarding telemetry and Intune redirect context by agubuzomaximus · Pull Request #1977 · AzureAD/microsoft-authentication-library-common-for-objc

agubuzomaximus · 2026-10-16T01:22:56Z

Draft scope

Draft for reviewing the combined mobile-onboarding telemetry and Intune redirect changes against dev. Not ready to merge.

Proposed changes

Record NewCAMdmRedirect for the CA MDM redirect and MobileOnboardingPhase1 after the existing download-profile purpose guard, independently of notification-provider availability.
Keep a strong local reference to the weak onboarding blob builder while recording profile-download telemetry.
Record native-observed Company Portal App Store handoffs as CPDownloadTriggered, rejecting URLs without a scheme and preserving enrollment fwlink classification. Safari-only behavior is out of scope.
Normalize inner/outer onboarding enrollment and compliance query values to exactly one canonical in-app=true.
Apply additional headers, then set client-request-id from the embedded webview's original request context. The context value replaces caller-supplied variants; a missing context ID removes that header.
Rely on the existing upstream onboarding delegation gate. The shared request builder adds no HTTPS or destination-host restriction. Preserve enrollment defaults, external-navigation overrides, profile continuations, and fallback handling.
Add regression tests for telemetry classification, upstream gating, marker duplicates/casing, context correlation IDs, and HTTP/non-allowlisted destinations.
Use the existing 0.1-second mock response delay in three webview authorization tests, leaving margin before their 0.5-second timeout.

This PR includes the Intune changes also reviewed in #1975 alongside the telemetry changes so the full combined diff can be inspected. No Broker/MSAL source changes, dependency-pointer updates, or temporary URL logs are included.

Checklist

Latest combined changes pass automated tests
PR Size Check policy passes
Code-owner review completed
No UI layout changes
Static diff checks completed

Validation

Focused tests passed on iOS (261) and macOS (256), covering the AAD and base embedded-webview controllers, navigation decision resolver, navigation handler, and onboarding blob builder. Tests cover conflicting caller correlation headers, mixed casing, absent context correlation IDs, missing URL schemes, and onboarding delegation. The full local iOS suite passed before the timing fix (3,232 tests, three skipped); after the fix, all 10 webview authorization tests passed across 10 iterations (100 executions, zero failures) on Xcode 26.3 / iOS 26.3. Patch-format checks passed. Downstream CI and end-to-end device validation remain outstanding; automation pipeline failures are outside this investigation.

Device logs showed in-app=true at the WebKit handoff for enrollment, profile installation, JIT compliance/linking, and troubleshooting. They do not prove server receipt, correlation-header delivery, or successful end-to-end onboarding.

Type and risk

Bug fix / telemetry / tests. Medium risk: shared embedded-webview navigation and onboarding telemetry.

Rollout / rollback

Redirect normalization relies on the existing upstream mobile-onboarding gate. Consumers adopt dependency updates separately. Revert the changes to roll back.

Related work items

Distinguish CA redirects from validated profile-download handoffs and classify native-observed Company Portal App Store handoffs as CPDownloadTriggered. Add regression coverage for telemetry serialization, invalid handoffs, cancellation, and duplicate completion. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d907b2ba-130e-4ee4-a75b-2fab6760b99f

Normalize onboarding URL markers and source eligible Intune correlation headers from the original request context. Preserve telemetry UX classification and upstream delegation coverage on the dev-based branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d907b2ba-130e-4ee4-a75b-2fab6760b99f

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d907b2ba-130e-4ee4-a75b-2fab6760b99f

…locally Apply optional headers before assigning the authoritative context correlation ID. Keep the weak onboarding telemetry builder alive across profile-download telemetry calls. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d907b2ba-130e-4ee4-a75b-2fab6760b99f

Copilot

🟡 Changes recommended

New tests contain compilation errors, and scheme-relative URLs are incorrectly classified as Company Portal handoffs.

3 open findings

What changed in this PR

Aligns IdentityCore’s mobile-onboarding telemetry and preserves request context through embedded Intune redirects.

Changes:

Separates CA redirect, profile-download, and Company Portal handoff telemetry.
Normalizes in-app=true and applies context-derived correlation headers.
Adds regression coverage for telemetry, delegation gates, and redirect handling.

File	Description
IdentityCore/tests/MSIDWebviewNavigationHandlerTests.m	Tests profile-download telemetry timing.
IdentityCore/tests/MSIDWebviewNavigationDecisionResolverTests.m	Tests query normalization and correlation headers.
IdentityCore/tests/MSIDOnboardingBlobBuilderTests.m	Tests Company Portal URL classification.
IdentityCore/tests/MSIDOAuth2EmbeddedWebviewControllerTests.m	Tests terminal telemetry deduplication.
IdentityCore/tests/MSIDAADOAuthEmbeddedWebviewControllerTests.m	Tests onboarding delegation and UX tags.
IdentityCore/src/webview/embeddedWebview/MSIDWebviewNavigationHandler.m	Records profile-download UX independently of notifications.
IdentityCore/src/webview/embeddedWebview/MSIDWebviewNavigationDecisionResolver.m	Normalizes markers and applies context correlation IDs.
IdentityCore/src/webview/embeddedWebview/MSIDWebviewNavigationDecisionResolver.h	Documents redirect handling requirements.
IdentityCore/src/webview/embeddedWebview/MSIDAADOAuthEmbeddedWebviewController.m	Records the CA redirect UX tag.
IdentityCore/src/telemetry/MSIDOnboardingBlobFieldKeys.m	Defines new telemetry constants.
IdentityCore/src/telemetry/MSIDOnboardingBlobFieldKeys.h	Declares new telemetry constants.
IdentityCore/src/telemetry/MSIDOnboardingBlobBuilder.m	Classifies Company Portal store handoffs.
changelog.txt	Summarizes telemetry and redirect changes.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Swasti Gupta (swasti29) · 2026-10-16T20:56:22Z

    }

+    [request setValue:context.correlationId.UUIDString forHTTPHeaderField:MSID_OAUTH2_CORRELATION_ID_REQUEST_VALUE];
+


just make sure with you tell Dan we are sending correlation Id in client-request-id:

Swasti Gupta (swasti29) · 2026-10-16T20:58:47Z

@@ -529,6 +531,7 @@ - (NSURLRequest * _Nullable)externallyOverriddenRequestForRequest:(NSURLRequest
 - (nullable NSURLRequest *)buildRequestForURL:(NSString *)URLString


Send in-app and correlationId from caller as parameter in extraParams and extraHeaders from caller than modifying generic method

agubuzomaximus · 2026-10-16T21:59:52Z

        return;
    }

+    MSIDOnboardingBlobBuilder *onboardingBlobBuilder = self.onboardingBlobBuilder;


Please see addition of phase 1 blob in correct location here.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 452f0661-93ec-4e3b-af52-842802119e48

Use the existing 0.1-second success delay in the three URL-response tests so their callbacks have margin before the 0.5-second timeout. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43e45018-a9d1-4d32-81f2-54b26e77c4f8

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43e45018-a9d1-4d32-81f2-54b26e77c4f8

Swasti Gupta (swasti29) · 2026-10-19T18:39:57Z

 NSString * const MSIDOnboardingModeBrokered = @"brokered";

 // UX flow tags (appended to the `ux_flow_used` array).
+NSString * const MSIDOnboardingUxFlowNewCAMdmRedirect = @"NewCAMdmRedirect";


Nit: NewCAMDMRedirect

Maximus Agubuzo and others added 5 commits October 15, 2026 18:36

Reuse profile handoff guard and align onboarding telemetry values

a21f352

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d907b2ba-130e-4ee4-a75b-2fab6760b99f

simplified code from agency's over complication

3c1c646

agubuzomaximus marked this pull request as ready for review October 16, 2026 20:28

agubuzomaximus requested a review from a team as a code owner October 16, 2026 20:28

agubuzomaximus requested review from Antonio Alwan (antonioalwan) and tarekk-ms and a balanced review from Copilot October 16, 2026 20:28

Copilot started reviewing on behalf of agubuzomaximus October 16, 2026 20:28

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

Comment thread IdentityCore/tests/MSIDAADOAuthEmbeddedWebviewControllerTests.m Outdated

Comment thread IdentityCore/tests/MSIDAADOAuthEmbeddedWebviewControllerTests.m Outdated

Comment thread IdentityCore/src/telemetry/MSIDOnboardingBlobBuilder.m

Swasti Gupta (swasti29) reviewed Oct 16, 2026

View reviewed changes

Comment thread IdentityCore/src/webview/embeddedWebview/MSIDAADOAuthEmbeddedWebviewController.m

Swasti Gupta (swasti29) reviewed Oct 16, 2026

View reviewed changes

agubuzomaximus commented Oct 16, 2026

View reviewed changes

Swasti Gupta (swasti29) approved these changes Oct 16, 2026

View reviewed changes

Maximus Agubuzo and others added 3 commits October 19, 2026 10:14

Fix onboarding test setup and reject schemeless telemetry URLs

7ecc643

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 452f0661-93ec-4e3b-af52-842802119e48

Retrigger PR validation

6462f54

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43e45018-a9d1-4d32-81f2-54b26e77c4f8

Swasti Gupta (swasti29) reviewed Oct 19, 2026

View reviewed changes

Swasti Gupta (swasti29) approved these changes Oct 19, 2026

View reviewed changes

agubuzomaximus merged commit abc58c1 into dev Oct 19, 2026
17 of 19 checks passed

Navigation Menu

Repository navigation

[patch][bugfix]: Align mobile onboarding telemetry and Intune redirect context - #1977

[patch][bugfix]: Align mobile onboarding telemetry and Intune redirect context#1977
agubuzomaximus merged 8 commits into
devfrom
maagubuzo/mobile-onboarding-telemetry-dev

agubuzomaximus commented Oct 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Swasti Gupta (swasti29) Oct 16, 2026

Uh oh!

Swasti Gupta (swasti29) Oct 16, 2026

Uh oh!

agubuzomaximus Oct 16, 2026

Uh oh!

Swasti Gupta (swasti29) Oct 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		}

		[request setValue:context.correlationId.UUIDString forHTTPHeaderField:MSID_OAUTH2_CORRELATION_ID_REQUEST_VALUE];

		@@ -529,6 +531,7 @@ - (NSURLRequest * _Nullable)externallyOverriddenRequestForRequest:(NSURLRequest
		- (nullable NSURLRequest )buildRequestForURL:(NSString )URLString

Conversation

agubuzomaximus commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Draft scope

Proposed changes

Checklist

Validation

Type and risk

Rollout / rollback

Related work items

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Swasti Gupta (swasti29) Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

Swasti Gupta (swasti29) Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

agubuzomaximus Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

Swasti Gupta (swasti29) Oct 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

agubuzomaximus commented Oct 16, 2026 •

edited

Loading