Forum Discussion
Conditional Access using certificate from Internal PKI
Hi Natalie,
You are exactly right. You can create an Azure AD conditional access policy that routes traffic to Cloud App Security. In Cloud App Security, you would then upload the root or intermediate cert, and create an access policy that has:
The following conditions:
Device tag | does not equal | Valid client certificate
App | [relevant applications go here]
IP address | category | does not equal | Corporate
The resulting controls:
Block
If you need help with this, feel free to reach me at alex.esibov@microsoft.com
I've tried implementing this with absolutely no success whatsoever. I've put out internal and root certificate in MCAS. Created my conditional access policy. I can see alerts from my policy so I know the conditional access policy is running and the policy is triggered. But it seems MCAS is simply unable to make any certificate comparison so just blocks everything. Certificate or no certificate. There seems little detail on this. Which browsers are supported? Should it prompt when attempting to verify the certificate?
- I'm having the same issue here. Did you have any update on this?
Hi folks, it would be super helpful to get a support case number so I can track it with the team. You can reach out to me at mailto:alex.esibov@microsoft.comif you need help with this.
In general, the docs cover Client-Certificate Authenticated Devices in quite some detail here: https://docs.microsoft.com/en-us/cloud-app-security/proxy-intro-aad#managed-device-identification
If you feel like this is missing explicit content, please let me know and we can work to update it.
- Thanks for you reply Alex. I think I'll open a support case to get some help on this.
I read that article and I configured both conditional access and MCAS access policy, I uploaded the certificate (I tried only root CA, root + Intermediate CA and only intermediate CA) and in any case it didn't work.
Looking at some logs should be useful to see which part of the certificate validation is failing.
- Hey Kevin, did you ever get this fixed?
Ru we have this working. You have to use a user certificate that the user cannot export and not a machine certificate. Another thing to watch for is the user experience through different browers. the browser will prompt for a certificate (except Firefox which will just block). Put the MCAS redirect url in trusted sites and ensure browser settings do not prompt for a certificate.
- Can you elaborate on the redirect URL? Is this what site we expect to prompt for a client cert?
Also, “do not prompt for a cert”..Is this that setting that (more or less) says if there’s only one client cert go ahead and use it? And I’m assuming this is in the trusted sites zone settings?
This is all working perfectly on macOS, but I can’t get it to ask for a cert on Win10. My Win10 devices with certs are going directly to the CAS proxy in the browser.
Kevin Spreadbury we're having the same issues, any resolutions?
