Forum Discussion

Robert Woods's avatar
Robert Woods
Steel Contributor
Jan 03, 2019

Logging for conditional access

I have a policy set up to only allow compliant mobile devices to access Exchange Active Sync. When reviewing access logs I show Not Applied under the logs, and device info is blank for compliance. It...
Conditional Access
Mobile Device Management (MDM)
bbhorrigan's avatar
bbhorrigan
Brass Contributor
Jan 03, 2019

Are you sure you are using modern authentication?  Generally I think AS does not use modern authentication.  

  • eglockling's avatar
    eglockling
    Steel Contributor
    Jan 04, 2019

    EAS does support modern authentication, just limited when it comes to Conditional Access. You're definitely asking the right question though. It appears as though legacy authentication could be in use, which is why the conditional access policy isn't applied. Mail for iOS 11.3.1 or later supports modern authentication, so I would suggest Robert Woods confirm the iOS version of the device to ensure it will comply.

    • Robert Woods's avatar
      Robert Woods
      Steel Contributor
      Jan 04, 2019

      eglockling device is iOS 12.1 and this is what I see when I run a Get-OrganizationConfig

       

      • eglockling's avatar
        eglockling
        Steel Contributor
        Jan 04, 2019

        Perfect, thanks. So we know that modern authentication is enabled at the organization level and the user has an email client that supports it. Next, I would verify that the Exchange on-premise connector is setup and functioning as intended. One more thing to consider is that Microsoft advises to create two separate conditional access policies to protect both Modern Authentication clients and Exchange ActiveSync clients. So, this might be worth a try as well.

Resources