MacOS Device Certificate when using Conditional Access olicy

James Seddon 6

We are in the process of enabling conditional access policies (CAP) in Azure and have hit a snag when it comes to MacOS users. As expected and described in the KB's (and even warned in the UX) when applying CAP's to MacOS devices the end user will be prompted for a device certificate in order to complete the SSO journey. All good there, however, we understood (maybe mistakenly) that deploying Company Portal to all devices and having the users complete the setup and import the portal certificate into their KeyChain (with "Always Allow") they would no longer be requested to accept new certificates. This unfortunately means our end users are up in arms about the "constant" requests in their browsers to accept certificates, and we haven't yet tried to touch more complex SSO scenarios such as GCP and AWS federation where users may be using impersonation and command line based SSO.

It's worth noting that we also use JamfPro, and all MacOS devices are "Azure AD Registered" and enrolled into Intune with a valid Compliance Policy.

Is there a solution to this problem?

Pictures for reference:

image (2)

image (1)

1 answer

Crystal-MSFT 49,861 Reputation points Microsoft Vendor

2023-06-20T05:57:34.92+00:00
@James Seddon, Thanks for posting in Q&A. Based on my researching, In MacOS devices, when Azure AD identifies the device using a client certificate provisioned during device registration, the end user is prompted to select the certificate first before using the browser. Deploying the Microsoft Intune Company Portal app through Jamf Pro Self Service can help send the certificate to the Keychain. If the user has already imported the certificate into their KeyChain with "Always Allow" at least once, they should not be requested to accept new certificates. However, launching the Company Portal app manually from the Applications or Downloads folders won't register the device. We recommend directing end users through email, Jamf Pro notifications, or any other method your organization uses to complete device registration. Finally, consider creating a common Conditional Access policy to require a compliant device, to enhance your organization's security.

References:

Enforce compliance on Macs managed with Jamf Pro: https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access-assign-jamf#create-a-policy-in-jamf-pro-to-have-users-register-their-devices-with-azure-active-directory

Common Conditional Access policy: Require a compliant device, hybrid Azure AD joined device, or multifactor authentication for all users: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device#create-a-conditional-access-policy

Learn about Conditional Access policy conditions for client apps: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions#client-apps

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
James Seddon 6 Reputation points

2023-06-20T08:13:54.0333333+00:00

Hey Crystal,

Thanks for the reply. The majority (90%+) of users have successfully enrolled into Intune/Azure, we used a scripted deployment to ensure company portal was installed and launched correctly as per the documentation. We also ran a report yesterday and can see the majority of users have the Workplace Join key in their keychain and a valid JamfAAD PLIST value.

We have also tested what happens during enrollment if a user fails to press "Always Allow" on the keychain request, and that does lead to more issues but does not resolve this issue.

Is it a requirement to deploy the SSO Plugin? Our MDM partner believes this isn't a requirement or related to the issue however there are a couple of things that make me believe this might resolve the issue:

This video mentions the SSO Plugin will automatically login users to other Microsoft services (3min 45s): https://youtu.be/7QUiN-6TWJ0?t=229

This guide makes reference to "handle authentication for any app that uses MSAL.....or SSO": https://community.jamf.com/t5/tech-thoughts/macos-conditional-access-best-practices/ba-p/273760#:~:text=Azure%20AD%20SSO%20Extensions

And the Microsoft KB for it says "The Microsoft Enterprise SSO plug-in provides single sign-on (SSO) to apps and websites that use Microsoft Azure Active Directory (Azure AD) for authentication[...]It reduces the number of authentication prompts users get": https://learn.microsoft.com/en-us/mem/intune/configuration/use-enterprise-sso-plug-in-macos-with-intune?tabs=prereq-intune%2Ccreate-profile-jamf-pro

Crystal-MSFT 49,861 Reputation points Microsoft Vendor

2023-06-21T02:20:19.34+00:00

@James Seddon, Thanks for the reply. For the SSO Plugin, you can test on one device to see if it is the solution. Or you can contact our Azure AD support to get more help on this.

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/how-to-get-support

Anish Bhowmick 0 Reputation points

2024-02-28T08:08:53.1333333+00:00

By deploying the SSO Plugin, did it solve the issue?

James Seddon 6 Reputation points

2024-02-28T09:48:11.7066667+00:00

@Anish Bhowmick Yes it did, we found that it's a hard requirement for this to work correctly.

James Seddon 6 Reputation points

2024-02-28T09:53:28.79+00:00

@Anish Bhowmick Yes it did, we found that it's a hard requirement for this to work correctly.

Anish Bhowmick 0 Reputation points

2024-02-29T10:36:56.6266667+00:00

Did the user had to accept the certificate in the initial stage or after the SSO it takes care of these prompts and login directly? And also does this works with chrome and firefox or how did you tackle those

Maria Coniglio 0 Reputation points

2024-02-29T21:58:17.59+00:00

The MS SSO Ext only works seamlessly with Safari and Edge browsers as these use Apple networking technologies underneath. For FF and Chrome, they do not use Apple networking technology so the experience is not as seamless for users. They will get prompted to 'trust' the WPJ cert. We were looking at a way to possibly automate that with a config profile but so far have not been successful.

James Seddon 6 Reputation points

2024-03-01T13:58:05.3666667+00:00

Yep, the user has to accept the certificate, it's also important that they "Always Allow" it as well if not this seems to also cause more issues and can lead to having to re-register the device again.

@Maria Coniglio Can you provide some more context to your comment please, I'm curious what you mean by "Apple networking technology".

Maria Coniglio 0 Reputation points

2024-03-01T14:19:16.2366667+00:00

Check out this MS article: https://learn.microsoft.com/en-us/entra/identity-platform/apple-sso-plugin specifically this box:

Ryali, Sankardayalsarma 0 Reputation points

2024-09-19T14:56:48.95+00:00

We are not using the Jamf Pro, all the devices are enrolled with the Intune user-based enrolment. can you please help us?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

MacOS Device Certificate when using Conditional Access olicy

1 answer

Your answer