Fix Outlook, Teams, and OneDrive “No Internet” Issue on Intune-Managed iPads: A Troubleshooting Guide

In-Depth Guide: Fixing Internet Access Issues in Intune-Managed iPads

Several schools have reported a puzzling issue: Intune-managed iPads can’t connect to key Microsoft 365 apps—Outlook, Teams, and OneDrive—yet other internet-dependent apps (Word, Safari, Chrome) work fine. This disconnect occurs on both filtered school Wi-Fi and unfiltered hotspots. Below is a deep dive into causes, troubleshooting steps, and solutions.

---

1. Problem Overview

• Affected Apps: Outlook, Teams, OneDrive
• Unaffected Apps: Word, Excel, Safari, Chrome, Third-party browsers
• Networks Tested: School Wi-Fi with Smoothwall; mobile hotspot (no filter)
• Error: Apps report “No internet connection” or fail to sync

---

2. Why Other Apps Work

Word and browsers use the system network stack without Intune-specific controls. Outlook, Teams, and OneDrive are protected by Intune App Protection Policies (APP) or use per-app VPN and App Configuration Policies. If these policies misalign with network settings, the apps can’t reach their services, even when basic internet works.

---

3. Common Root Causes

1. Per-App VPN or Network Isolation
   • A per-app VPN profile may be assigned to M365 apps but not correctly routed or enabled on the device.
2. App Protection Policy (MAM) Required Connectivity
   • APP can force data to flow through the “Intune Managed Browser” or a protected webview. If that browser isn’t allowed or the Managed Browser app isn’t installed, connectivity fails.
3. Conditional Access & Compliance
   • Conditional Access may block sign-in if the device isn’t marked compliant. Word and browsers bypass this because they use web-based auth flows.
4. Certificate or SCEP Profile Misconfiguration
   • M365 apps may require client certificates for authentication. If the certificate profile fails to install or renew, apps can’t authenticate.
5. Network Proxy Settings
   • A misconfigured proxy in the Intune Wi-Fi profile may apply only to managed apps.
6. App Configuration Settings
   • Outlook and Teams rely on App Configuration Policies for redirecting URLs. Incorrect keys can break network calls.

---

4. Step-by-Step Troubleshooting

4.1 Verify Compliance & Conditional Access

1. In Azure AD Conditional Access, check policies targeting iOS/Android.
2. Temporarily exclude a test iPad from those policies to see if apps connect.
3. If connectivity returns, refine your CA rules or grant a “Compliant” state.

4.2 Check Per-App VPN Profiles

1. In Endpoint Manager, under Devices > iOS/iPadOS > Configuration profiles, locate any per-app VPN profiles.
2. Ensure the VPN connection name matches the VPN client on the device.
3. Confirm the VPN server is reachable externally (test on a non-managed device).
4. If you’re not using VPN, remove these profiles to rule out interference.

4.3 Review App Protection (MAM) Policies

1. Under Apps > App protection policies, open the policy for iOS.
2. Look for settings under Data transfer—especially “Require Managed Browser or Open in place only.”
3. Install the Intune Managed Browser from the App Store.
4. Test opening a link from Outlook; if it opens in Safari instead of Managed Browser, adjust the policy or add the Managed Browser.

4.4 Inspect Wi-Fi & Proxy Settings

1. Open the Wi-Fi profile in Intune and examine Proxy settings.
2. If using automatic proxy (PAC) or manual proxy, verify the proxy works for non-managed apps.
3. On a test iPad, remove the Intune Wi-Fi profile and join the network manually—see if managed apps now connect.

4.5 Validate Certificate Deployment

1. Under Devices > iOS/iPadOS > Configuration profiles, find any PKCS or SCEP profiles.
2. On the iPad, go to Settings > General > VPN & Device Management and confirm certificates are listed.
3. If missing, re-deploy the profile or check your SCEP/NDES server logs for enrollment errors.

4.6 Collect Logs & Network Traces

1. In Settings, tap Privacy & Security > Analytics & Improvements > Analytics Data to capture app crash logs.
2. Use a network proxy tool (e.g., Charles Proxy) configured on the iPad to see where connections fail.
3. Correlate errors with specific URLs or IP blocks.

---

5. Solutions & Best Practices

1. Simplify VPN Usage
   • Only deploy per-app VPN if necessary. Rely on Conditional Access for security when possible.
2. Deploy Intune Managed Browser
   • Make it required in APP policies so protected traffic flows through a known channel.
3. Align Wi-Fi & Proxy Profiles
   • Use the same proxy settings for all apps or avoid proxying managed apps.
4. Monitor Compliance States
   • Use a dynamic Azure AD group to test and exclude non-compliant devices from CA policies.
5. Documentation & Rollback Plans
   • Keep a record of profile changes and have a rollback strategy if new profiles break connectivity.

---

6. Conclusion

Connectivity issues in Intune-managed iPads often stem from the interplay between App Protection, per-app VPN, Conditional Access, and certificate profiles. By systematically isolating each component—testing without VPN, installing Managed Browser, verifying compliance, and inspecting certificates—you can pinpoint and resolve the block. Applying these best practices ensures that Outlook, Teams, OneDrive, and other essential apps work reliably on your managed iPads.