Conditional Access stating a Compliant iOS Device is Not-Compliant and blocking sign-in for iOS LastPass App.

Question

Sign-In logs show the user is using a non-compliant device, however the device IS compliant.

Sign-in log is also void of the Device ID in this specific log, so it's as if after signing in to the phone app that is SSO'd the deny message says they must use Edge or Safari, but the users are using Safari when they get the message...

	
The user is using a browser that does not support device identification so the device state is unknown. Access to the resource requires a compliant device. To see a list of browsers that support device identification, see https://docs.microsoft.com/azure/active-directory/conditional-access/technical-reference#supported-browsers

Device ID

Browser

Mobile Safari 16.2

Operating System

iOS 16

Compliant

No

Managed

No

Join Type

UPDATE: As a work around I've removed the Compliant Device requirement for iOS and it works without issue. My assumption is the iOS app is using an embedded Safari browser that for some reason can't play with Conditional Access, however that is a HUGE issue because out LastPass is federated/SSO. Works fine for BYOD Android I might add IF its through the Work Profile.

Answer 1

I'm also in a very similar situation. I suspect your assumption here is correct:
"My assumption is the iOS app is using an embedded Safari browser that for some reason can't play with Conditional Access"

I can see the sign request coming form:
Browser: Mobile Safari 16.2

Operating System: iOS 16

however, no Device ID is displayed.

Going deeper into troubleshooting:

The device is clearly joined and compliant, it was confirmed in Intune and by looking up the device info.

Now I wonder what's stopping Safari to pass the Device ID onto the auth flow?

**For those stumbling upon this discussion:

The issue of the in-app browser (Safari) not communicating Device ID with CA was resolved by deploying the following configuration profile:**
[https://learn.microsoft.com/en-us/mem/intune/configuration/use-enterprise-sso-plug-in-ios-ipados-macos

Enterprise SSO plugin resolved our issue and I successfully authenticated with a compliant iPad based on device ID/compliance.

Answer 2

The problem lies in the fact that many apps, specially on iOS, relies on embeded browser (usually safari) to authenticate users. So if you have App Protection policy with the enforcing conditional access policy (Require Approved Apps and Require App Protection Policy), conditional access will force you to use edge. As soon as you open edge then you fall on a CSRF error because the token cannot be ported to another app.

The bottom line is that App Protection cannot work with Safari and apps that rely on this cannot go through App Protection policy (if enforced). The only way to get this to work is to litteraly exclude users from the conditional access policies that enforces App Protection (and open a big hole in your security posture that can and most likely will, be exploited).

Answer 3

@Dalton Reeves, Thanks for posting in Q&A. From your description, it seems condition access policy block our access.

To troubleshoot the issue, please collect the following information to clarify:

1. Go to the sign in log and look into the "Conditional Access" tab. find the failed policy and click it to see the detailed failed reason. Please get a screen shot of the conditional access policy details of the failed policy.

2. Go to Azure AD to see if the device is also compliant.
3. Go to the affected device->Device compliance, click each compliance policy and check if there's any error for any compliance settings.

Please check the above information and if there's any update, feel free to let us know.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Does the sign-in work with Edge?

Answer 5

This was happening with me, if you take a look a the sign-in logs, some of these third party apps use other internet browsers for device authentication ie Firefox, Chrome, etc, Intune mobile device compliance policies can only authenticate using managed browsers such as Safari and Edge.