Zime Mobile with Intune and Entra
Signing in to Zime Mobile where Conditional Access requires Intune app protection
Zime Mobile signs users in with their Microsoft work account and supports Intune App Protection (MAM without device enrolment).
If Conditional Access requires an app protection policy, an admin completes Steps 1 to 3 once; each user completes Step 4.
Microsoft sign-in in the app is switched on for each company. Your Zime contact sets this up and will ask for your Microsoft Entra tenant ID, your email domains and one pilot user. Until it is on, people see a single Sign in button that opens a browser sheet, and a policy that requires app protection blocks that sign-in.
- Admin consent
- Add custom app
- Assign users + licences
- User signs in
- Verify
Reference
Keep these values handy during setup.
| Setting | Value |
|---|---|
App name (Entra) | Zime Mobile |
Application (client) ID | e9b17ec8-756d-4c74-9ba9-2b761c3b42cb |
iOS bundle ID | ai.zime.app |
Android package name | com.zimemobile |
Minimum iOS | 17.0 |
Broker app | Microsoft Authenticator (iOS); Intune Company Portal (Android) |
Step 1: Grant admin consent
Approve Zime Mobile for your Microsoft Entra tenant.
Use Enterprise applications, NOT App registrations. Zime Mobile is registered in Zime's tenant, so it only appears under Enterprise applications in yours.
- Open Enterprise applications → All applications. Leave search empty.
- Open the row “Zime Mobile” whose Application ID starts with
e9b17ec8. - Security → Permissions → Admin consent tab.
- Click “Grant admin consent for <your organization>”.
- Refresh and confirm all show “Admin consent”:
- Microsoft Graph (5): email, offline_access, openid, profile, User.Read
- Microsoft Mobile Application Management (1): DeviceManagementManagedApps.ReadWrite
- Zime AI (1): access_as_user
If Zime Mobile isn't listed, approve its request under Enterprise applications → Activity → Admin consent requests. If Properties → “Assignment required?” is Yes, add users under Users and groups.
Zime Mobile relies on Zime AI, the app your organization approves for signing in to the Zime web app. If Zime AI is not approved in your tenant yet, consent for Zime Mobile fails with error AADSTS650052. Approve Zime AI first, as described in Sign in with Google or Microsoft.
Step 2: Add Zime as a custom app
Target Zime in the Intune App Protection Policy.
Adding Zime under Data protection → “Select apps to exempt” is NOT enough, because that only controls data sharing. Zime must be a targeted app.
- Open the Intune admin center → Apps → Manage apps → Protection.
- Open the iOS/iPadOS policy (or Create policy → iOS/iPadOS).
- Properties → Apps → Edit.
- Set Target policy to = Selected apps.
- + Select custom apps → bundle ID
ai.zime.app→ Select. - Review + save.
- Repeat on the Android policy with package
com.zimemobile.
A policy with no restrictive settings is enough to satisfy Conditional Access.
Step 3: Assign users and check licences
Ensure every Zime user is covered by the policy and correctly licensed.
- Policy → Properties → Assignments → Edit: add the Zime users' group under Included groups, not Excluded groups.
- Each user needs an Intune-bearing licence: Intune Plan 1, EMS E3/E5, Microsoft 365 E3/E5, or Business Premium. Check Entra → Users → <user> → Licenses.
Allow 15 to 30 minutes after saving for changes to apply; longer if group membership changed.
Step 4: Sign in on the device
Each user completes these steps on their own device.
- Install and sign in to Microsoft Authenticator (iOS) or Intune Company Portal (Android).
- Install the latest Zime app (iOS 17+).
- If a previous attempt failed, delete and reinstall Zime first. Intune otherwise retries only after 24 hours.
- Sign in to the Zime web app with Microsoft once, if you have not already.
- Open Zime → enter work email → Sign in with Microsoft.
- On first sign-in, Intune shows “Your organization is now protecting its data in this app” and may restart the app. This is expected.
Step 5: Verify
Confirm policy delivery and a successful Conditional Access result.
- Intune → Apps → Monitor → App protection status → user: confirm Zime is listed with the policy and a recent check-in.
- Entra → Users → <user> → Sign-in logs: confirm Zime Mobile sign-in = Success; the Conditional Access tab shows the policy satisfied.
Alternative: Exclude Zime from Conditional Access
Use instead of Steps 2 to 5 if Zime should not be managed by Intune.
No enrolment or licence is needed. Zime data will be outside app protection controls.
- Entra → Protection → Conditional Access → Policies → open the policy requiring an app protection policy.
- Target resources → Exclude → Select resources → Zime Mobile (
e9b17ec8-756d-4c74-9ba9-2b761c3b42cb). - Save; repeat for any other policy applying the same requirement.
Zime's sign-in requests a Microsoft Graph token, so depending on how the policy targets resources this may not take effect. If users stay blocked, use Steps 2 to 5.
Troubleshooting: Common sign-in issues
Match the user's message to the most likely cause.
| What the user sees | Likely cause | Fix |
|---|---|---|
“Approval required” / “Request sent” | Admin consent not granted on the Enterprise app | Step 1 |
“You can't get there from here” | Outdated Zime app | Update Zime |
“Couldn't apply the required app protection” | Zime not targeted, user not assigned, or no Intune licence | Steps 2 and 3, then reinstall Zime |
Authenticator opens and returns immediately | Failed enrolment cached | Delete and reinstall Zime |
AADSTS50105 in sign-in log | Assignment required, user not assigned | Step 1 → Users and groups |
“We couldn't find an active Zime workspace” | Email domain not linked | Contact Zime support (support@zime.ai) |
“You can’t get there from here” after Other sign-in options | The browser sign-in cannot meet an app protection policy | Use Sign in with Microsoft |
“Please sign in to Zime on the web with Microsoft once, then try again here.” or “Sign in to Zime on the web once to set up your account, then retry on mobile.” | The user has not signed in to the Zime web app with Microsoft yet | Sign in once on the web, then try again in the app |
“Microsoft sign-in needs the Authenticator or Company Portal app.” | The broker app is not installed | Install Microsoft Authenticator (iOS) or Intune Company Portal (Android), then try again |
“Microsoft Company Portal is required to protect this app.” | Company Portal is missing on Android | Install or open Company Portal, then try again |
“Your account isn’t licensed for Intune app protection.” | Zime not targeted, user not assigned, or no Intune licence | Steps 2 and 3, then reinstall Zime |
“The account signed in to Company Portal doesn’t match.” | Company Portal is signed in with a different work account | Sign out of Company Portal and try again |
“Setting up app protection took too long.” | Enrolment did not finish in time | Try again. If it keeps happening, check Step 5 |
AADSTS65001 in sign-in log | Consent missing for a permission | Step 1: grant admin consent again |
AADSTS53009 in sign-in log | The policy requires app protection. Zime then sets it up and signs in again | Nothing, if a successful sign-in follows. Otherwise Steps 2 and 3 |
Why don’t users see Sign in with Microsoft?
Your Zime contact switches on Microsoft sign-in in the app for each company. Until it is on, or on an older version of the app, users see a single Sign in button. Ask your Zime contact, and update Zime.
Do we have to manage Zime with Intune?
No. You can exclude Zime from Conditional Access instead, as described in Alternative: Exclude Zime from Conditional Access. Step 1 is still needed.
Where are the other Microsoft 365 settings for Zime?
See Zime with Microsoft 365: a guide for IT for sign-in, the Outlook calendar, Teams and the Microsoft error codes people may see.
Still stuck?
Email support@zime.ai with the time of the attempt and the user's sign-in log entry.
Still need help?
Write to support@zime.ai and the team will get back to you.