Official documentation checked October 14, 2026.
If organizational Copilot works on a computer but not on a phone, first identify the failed sign-in and its policy result. Do not replace device compliance with MFA, trust an entire mobile carrier, or exclude Copilot from security policies merely to remove the error. The correct remedy is usually to satisfy the intended requirement or correct a documented targeting mistake.
1. Capture the mobile sign-in evidence
Save the error code, time with time zone, correlation/request ID, app name and version, mobile OS, and work account. Use the error page’s details if available. Note whether the request started in an app, a browser, or an embedded sign-in view.
An authorized administrator can open Entra ID > Monitoring & health > Sign-in logs and narrow by user, time, and correlation ID. Microsoft’s troubleshooting guide starts with the Reports Reader role. Examine both the application and requested resource; searching only for an app whose name contains Copilot can miss a dependent service.
2. Read the policy result accurately
Open the matching event’s Conditional Access tab and inspect applied policies, device details, and authentication details. Record the failing requirement and whether the policy is enforced or report-only. A policy marked “Not applied” is not itself the blocking policy.
Platform conditions decide whether a policy applies; selecting iOS or Android is not an “allow mobile” switch. Excluding a platform from one policy also does not establish that it is blocked by that policy. Compare the actual event with all relevant policies, not just the first familiar policy name. See Microsoft’s condition semantics.
3. Satisfy the specific mobile control
- Compliant device required: ask the device-management team to confirm the phone’s enrollment and compliance record. Resolve the specific compliance failure through the organization’s supported enrollment and remediation process. Installing Authenticator alone is not equivalent to completing Intune enrollment.
- App protection required: verify that the exact app/platform supports the control and that the user receives the required Intune app protection policy. Use the required broker and supported app; do not assume every app with Copilot in its name qualifies.
- MFA or authentication strength required: complete the permitted method. Do not approve an unexpected authentication prompt.
- Network or risk condition: have the security team examine the recorded signal. A carrier’s shared address space is not automatically a trusted corporate location.
Microsoft describes the distinction between device compliance, app protection, and authentication requirements in its grant-control reference.
4. Account for the approved-client-app transition
Older advice to enable “Require approved client app” for every Copilot phone deployment is outdated. Microsoft’s dedicated migration notice says that policies containing this control became read-only on June 30, 2026, while existing enabled policies continue enforcing it. New policies should use app protection policy requirements where supported. See the migration guidance.
The administrator should confirm the current tenant state and app support before planning a replacement. Preserve the intended protection during migration; do not simply disable the old policy and leave the user uncovered.
5. Test any approved correction without weakening other requirements
Use a controlled test user/device and report-only evaluation for a proposed policy before broad deployment. Record the original configuration and the intended audience. Within a policy, selecting “require all” versus “require one” changes security meaning; adding MFA is not automatically an alternative to compliance.
A separate permissive policy does not override another applicable blocking policy. Review the policy evaluation model, then retest the original mobile action and inspect the new sign-in event. Confirm that required protections still apply and unintended users remain blocked. Escalate with sanitized event details if the documented requirements are satisfied but access still fails.