Why conditional access policies not applied when try to sign in app in app registration in azure?

Question

I am integrating Azure AD and ISE 3.2 patch 5 version. Using azure credentials authentication and authorization was successful from ISE user was identified by their group. (Here when user is connected to SSID using azure login credential user will be authenticated)

Then I was going to integrate azure AD and Duo. The integration between azure and duo also successful. Also, I applied the conditional access policy if user sign in to previously registered app required duo MFA. But in azure sign in log, it shows as the conditional policy not applied and sign in state as success.

But conditional policy is correctly configured I test with try to login to app using URL then it required Duo MFA. Here user will still authenticate using azure credentials without Duo MFA.

Between azure and ISE authentication protocol is ROPC and since ROPC is does not support MFA (Microsoft Authenticator) do we try with MFA with Duo integration will it work? Screenshot (177).png

Answer 1

Hi @Thanuji Wickramadara

Thanks for reaching out to Microsoft Q&A

I'd suggest you to check whether your application is registered as a Web Application or as a Public / Native Application. CA policies are not applied to public apps as per the document below:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps#other-applications

This is where you can confirm how your app is registered:

Thanks,

Fabio

Answer 2

Hi @ Fabio Andrade

Thank you for your response.

I am already enabling web redirect URL application is shown in cloud app picker while adding conditional policies. Using URL when I am connecting to app conditional policy applied and Duo MFA required. But when I am connecting to SSID still Duo MFA not required. For that way still conditional policy not applied. Since this is ROPC for while connecting to SSID is there any possibility to add MFA as this way?
Waiting for reply

Thanks,

Thanuji

Answer 3

Hi @Thanuji Wickramadara

Thanks for sharing this information.You can see the MFA prompt on the browser because the browser simply redirects your user to the MFA endpoint to proceed with the sign in. If the "SSID" you are mentioning is a client, that client must support some type of web view to prompt you user for MFA.

In a Cisco forum, there is some information related to CA but to exclude the ISE application from the MFA policy as it could cause some issues, so I'd suggest you to check with Cisco if you can use Conditional Access with their client properly.

https://community.cisco.com/t5/network-access-control/cisco-identity-services-engine-3-2-azure-ad-mfa/td-p/4983001

Thanks,

Fabio

Answer 4

Hi @Thanuji Wickramadara

I just wanted to check in and see if you had any other questions or if you were able to resolve your issue.

If you have any other questions, please let me know.

Thanks,

Fabio

Answer 5

Hi @Thanuji Wickramadara

I just wanted to check in and see if you had any other questions or if you were able to resolve your issue.

If you have any other questions, please let me know.

Thanks,

Fabio