Your work IT administrator should now inspect the failed mobile sign-in in Microsoft Entra and correct any Conditional Access, Intune app-protection, device-compliance, or registration requirement shown there.
A factory reset, app reinstall, and current Chrome/WebView already rule out the main local repair path. Do not factory-reset the phone again.
What your IT administrator should check
- Reproduce the white screen and note the exact time.
- In the Microsoft Entra admin center, open Entra ID → Monitoring & health → Sign-in logs.
- Filter by:
- Your work account
- The recorded time
- Status: Failure
- The affected application, such as Microsoft Teams
- Open the failed event and review:
- Failure reason
- Sign-in error code
- Additional details
- Conditional Access tab
- Device ID, operating system, client app, and compliance status
Microsoft documents these logs as the primary place for administrators to identify how Conditional Access policies were applied to a failed sign-in.^1^
The administrator should then act on the result rather than broadly disabling security controls:
- Require compliant device: Confirm that this newly reset phone is enrolled and reported compliant.
- Require approved client app/app protection: Confirm that your account, Android platform, and Teams are correctly targeted. Android devices must first register with Microsoft Entra when these controls are enforced.^2^
- Stale or duplicate device registration: Compare the sign-in event’s device ID with the current phone registration and remove only an obsolete record before registering the phone again.
- Authentication or MFA failure: Confirm that your authentication method remains registered and usable after the password change and factory reset.
Authenticator and Company Portal requirements
Whether these apps are required depends on your organization’s mobile-access policy:
- Microsoft Authenticator can provide MFA, passwordless authentication, and sign-in approval for a work account.^3^
- If your organization uses Intune app protection on Android, Intune Company Portal is required as the policy broker even when full device enrollment is not required.^4^
If Intune app protection applies, IT should verify all of these:
- Your account has the required Intune license.
- Your account belongs to the group targeted by the Android app-protection policy.
- Teams and the other affected apps are included in that policy.
- The latest Company Portal app is installed.
- You are signing in with the same corporate account targeted by the policy.^5^
Do not independently enroll the phone or delete Authenticator account entries unless IT confirms that the relevant policy requires it; doing so can create another device registration or remove a working MFA method.
Useful isolation test
Try the same work account in Microsoft 365 or Teams through Chrome on the phone:
- Browser works, apps fail: Give that result to IT; it points them toward mobile-client Conditional Access, app protection, broker, or device-registration processing.
- Browser also fails: Record the complete error and correlation/request details shown on the page. Browser error pages often expose the policy requirement that the app’s white screen hides.^6^
If the administrator cannot identify or correct the failed event, a Microsoft 365 administrator—not the end user—should open a support request through the Microsoft 365 admin center so Microsoft support can review the tenant’s sign-in records and policies.^7^
References
- View applied Conditional Access details in the Microsoft Entra activity logs
- Require approved client apps or app protection policy
- Authentication methods in Microsoft Entra ID - Microsoft Authenticator app
- Troubleshooting app protection policy user issues
- Troubleshooting app protection policy deployment in Intune
- Troubleshoot sign-in problems with Conditional Access
- Microsoft teams app has suddenly stopped allowing me to log in with work account - Microsoft Q&A