Global Secure Access for SMB doesn't recognize Windows Hello Authentication or Conditional Access Policies

Question

Starting to play around with Global Secure Access, specifically on prem SMB file share access. I'm encountering two problems. One, if I log into my test machine with a username and password the access works seemlessly. If I log in via Windows Hello using a pin I'm prompted to enter credentials to access the SMB share. Two, in both cases it's ignoring my conditional access policy to require MFA to access the resource. Conditional access policies are working with Global Secure Access; a separate application for RDP to an on prem server works with CA as expected.

Answer 1

@Rich Bouchard

Thank you for posting your query on Microsoft Q&A, from above description I could understand that you have following queries:

1. Logging onto test machine with windows hello pin prompts you for credentials when accessing SMB share.
2. Conditional access policy to require MFA to access the SMB share is ignored by global secure access.

Please do correct me for any discrepancies by responding in the comments section.

PFB answers inline:

• Logging onto test machine with windows hello pin prompts you for credentials when accessing SMB share.

This could be due to On-prem SMB shares being configured with Kerberos authentication, and windows hello is not configured with cloud Kerberos trust

You may validate this with event logs on you device by accessing User Device Registration admin log under Applications and Services Logs > Microsoft > Windows.

The cloud Kerberos trust prerequisite check isn't done on Microsoft Entra joined devices. If Microsoft Entra Kerberos isn't provisioned, a user on a Microsoft Entra joined device will still be able to sign in, but won't have SSO to on-premises resources secured by Active Directory.

• Conditional access policy configured to prompt for MFA while accessing the SMB share is ignored by global secure access.

This could have been because of known limitation for private access traffic, according to which:

"Applying Conditional Access policies to Private Access traffic is not currently supported. To model this behavior, you can apply a Conditional Access policy at the application level for Quick Access and Global Secure Access apps. For more information, see Apply Conditional Access to Private Access apps."

However, if above mentioned is not the case, then kindly share the sign in logs with CA evaluation information by eliminating the PII say username, UPN or tenant id.

Please "Accept the answer", "Upvote" and rate your experience. This will help us and others in the community as well. Thanks, Akshay Kaushik

Answer 2

you also need to publish your Domain Controllers. Instructions at https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-kerberos-sso.

If you don't have the Cloud trust and the line of sight with a DC the following will occur:

• If you logon with username\password you will use NTLM. Seamless. Klist will show no keys and you will have acces to the SMB share. No Conditional access is triggered. Same behavior as in the NT4 days when you wanted to have access across domains without trust. Same username\passord will give you access.
• If you logon with Windows Hello (face,finger, fido2) you will get prompted for credentials and you will get the same behavior as above.

The cloud trust together with line of sight with a DC will get you the desired effect.