Azure AD Conditional Access: AAD Joined / Compliant Device Detection - How does it work under the hood?

Question

Hi all,

we do work quite often with these grant controls :

In one of our projects, our client is using a self-developed web app that calls multiple Azure Functions with AAD Authentication. Although they are using edge, the browser/computer is not detected as Azure AD Hybrid Joined when using this self-developed app. Other Portals/Apps like portal.office.com do work as expected and the browser/computer is detected as AAD Hybrid Joined. I guess the browser has to sent a specific header to AAD. Is there any SDK or documentation to enable custom developed apps to work with these Conditional Access Grant Controls?

Thanks
Tobias

Answer 1

Just found the answer: during oAuth Access token request the app has to use "Conditional Access authentication contexts": https://learn.microsoft.com/en-us/azure/active-directory/develop/developer-guide-conditional-access-authentication-context

Answer 2

@Tobi Kr

In your scenario, edge browser is not sending the device information is because while oauth access token request, application has to use conditional access authentication context.

You can refer below article to get more information on "Developer guide to Conditional Access authentication context".
https://learn.microsoft.com/en-us/azure/active-directory/develop/developer-guide-conditional-access-authentication-context

Do let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.