SAML Auth with Conditional Access that requires Hybrid Join

[fortibobert]

Using the FortiClient VPN to connect with SAML authentication, logins worked before we created a Conditional Access policy that enables "Require device to be marked as compliant" and "Require Microsoft Entra hybrid joined device".

When we connect Microsoft blocks the login because it doesn't recognize the device with the following info.

You can't get there from here

This application contains sensitive information and can only be accessed from:
domain joined devices. Access from personal devices is not allowed.
The current browser is not supported, please use Microsoft Edge, Internet Explorer, Chrome or Firefox 91+ to access this application.
If you're not planning to do this right now, you might still be able to browse to other domain sites. Otherwise, sign out to protect your account.
Sign out and sign in with a different account
More details

Error Code: 53001
Request Id: RequestUUID
Correlation Id: CorrelationUUID
Timestamp: 2024-09-14T20:46:27.958Z
App name: My VPN Enterprise AppName
App id: AppUUID
IP address: MyClientIP Address
Device identifier: Not available
Device platform: Windows 10
Device state: Unregistered

When I look at the login event in EntraID, It's status is failed the device info shows Browser is Chrome 87.0.4280 and the Failure Reason is "Device is not in required device state: {state}. Conditional Access policy requires a domain joined device, and the device is not domain joined."

I've validated the device state using "dsregcmd /status"

+----------------------------------------------------------------------+
| Device State |
+----------------------------------------------------------------------+

AzureAdJoined : YES
EnterpriseJoined : NO
DomainJoined : YES
DomainName : MyDomain
Virtual Desktop : NOT SET
Device Name : Computer_FQDN

+----------------------------------------------------------------------+
| SSO State |
+----------------------------------------------------------------------+

AzureAdPrt : YES
AzureAdPrtUpdateTime : 2024-09-14 18:33:51.000 UTC
AzureAdPrtExpiryTime : 2024-09-28 18:33:56.000 UTC
AzureAdPrtAuthority : https://login.microsoftonline.com/TENNANTUUID
EnterprisePrt : NO
EnterprisePrtAuthority :
OnPremTgt : NO
CloudTgt : YES
KerbTopLevelNames : .windows.net,.windows.net:1433,.windows.net:3342,.azure.net,.azure.net:1433,.azure.net:3342

Has anyone been able to apply Conditional Access Policy that requires a device to be Domain/Hybrid joined?

I suspect it has to do with the version of Chrome that the FortiVPN client uses.  If I use the desktop version of Chrome to access the SSL VPN portal the deviceID and DeviceState is populated

Device identifier: EntriID_DeviceUUID

Device platform: Windows 10

Device state: DomainJoined

[holenco1]

I'm not sure if it applies in this case, but I had to deploy an extension in chrome to recognize hybrid joined devices. I'm not sure how that would be possible in the Forticlient https://tutuapp.uno/ .

[Berkley · Accepted solution]

I ran into the same issue, though our CA policy was in place from the beginning of FortiClient deployment. To get ours to work, we needed to enable 'Use External Browser as User-agent for SAML Login'. It has worked for us and is only required (so far) on the start of the VPN connection each session. Unfortunately, should the VPN session be disrupted by a lapse of internet connection, the authentication process needs to happen again, which opens another browser tab. I'm currently trying to track down a way to make it less invasive, or at least close the browser window/tab when complete.

For reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Implementing-device-based-Conditional-Acce...

[fortibobert]

Thanks, this was the fix for my issue.  I was given an older version of the client (v6.4.9) by our ISP who is managing the firewalls. The older version did not have the option to use the External Browser.  When I upgraded to v7.4 of the FortiClient I enabled the External Browser option and I was able to use Conditional Access policies because a full browser was launched and authenticated the user.  

We also deployed the Chrome Extension "Microsoft Single Sign On" to simplify the process for users who had Chrome Set as their default browser.  Edge did not require an additional configuration.

https://chromewebstore.google.com/detail/microsoft-single-sign-on/ppnbnpeolgkicgegkbkbjmhlideopiji