Conditional Access with Android phones

%3CLINGO-SUB%20id%3D%22lingo-sub-888127%22%20slang%3D%22en-US%22%3EConditional%20Access%20with%20Android%20phones%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-888127%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20struggling%20a%20bit%20with%20Conditional%20Access%20policies.%3C%2FP%3E%3CP%3EI%20am%20trying%20to%20create%20the%20following%20scenario%20for%20access%20from%20mobile%20phones.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20the%20device%20is%20marked%20as%20compliant%20(Intune%20enrolled)%2C%20then%20accept%20access%20to%20Exchange%20Online%20with%20modern%20auth%20and%20EAS.%3C%2FP%3E%3CP%3EIf%20the%20device%20is%20not%20marked%20as%20compliant%2C%20then%20people%20can%20use%20Approved%20Apps.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20is%20working%20really%20well%20on%20iOS%20devices.%20On%20Android%20not%20so%20well.%20Even%20if%20an%20Android%20device%20is%20enrolled%20and%20compliat%2C%20it%20behaves%20like%20it's%20not%20enrolled%20and%20offers%20the%20user%20to%20continue%20with%20Company%20Portal.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EShould%20it%20not%20be%20possible%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-888127%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAndroid%20Enterprise%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EConditional%20Access%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-888435%22%20slang%3D%22en-US%22%3ERe%3A%20Conditional%20Access%20with%20Android%20phones%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-888435%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F52988%22%20target%3D%22_blank%22%3E%40Henrik%20Skovgaard%3C%2FA%3E%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Edid%20you%20try%20to%20access%20via%20EAS%20from%20work%20profile%3F%20If%20yes%3A%20Can%20you%20provide%20information%20about%20your%20CA%20policies%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-888734%22%20slang%3D%22en-US%22%3ERe%3A%20Conditional%20Access%20with%20Android%20phones%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-888734%22%20slang%3D%22en-US%22%3ECould%20you%20share%20your%20CA%20policies%3F%20Are%20you%20using%201%20policy%20or%20multiple%20policy%3F%3CBR%20%2F%3EHave%20you%20checked%20the%20sign-in%20logs%20of%20Azure%20AD%20to%20check%20which%20policies%20are%20being%20assigned%3F%3CBR%20%2F%3E%3CBR%20%2F%3EWe%20need%20some%20more%20info%20before%20we%20can%20help%20you%20out%20%3A)%3C%2Fimg%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1207918%22%20slang%3D%22en-US%22%3ERe%3A%20Conditional%20Access%20with%20Android%20phones%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1207918%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3EI%20would%20like%20to%20resurrect%20this%20topic%2C%20as%20we%20are%20also%20having%20this%20issue%20with%20enabling%20enrolled%20android%20devices%20with%20native%2Fmanufacturer%20developed%20email%20clients.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFrom%20the%20Conditional%20Access%20(CA)%20logs%2C%20the%20android%20devices%20did%20not%20report%20back%20to%20AAD%2FCA%20its%20compliance%20status.%20Its%20simply%20blank.%20See%20below%20for%20screenshot.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESeems%20like%20I%20can%20only%20ID%20the%20device%20by%20OS%2C%20not%20its%20state.%20Not%20sure%20if%20this%20is%20a%20limitation%20on%20the%20Android%20side%20since%20iOS%20is%20reporting%20all%20info%20to%20CA.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Screen%20Shot%202020-03-03%20at%206.35.11%20PM.png%22%20style%3D%22width%3A%20822px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F174958iD417E8B25F80B480%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Screen%20Shot%202020-03-03%20at%206.35.11%20PM.png%22%20alt%3D%22Screen%20Shot%202020-03-03%20at%206.35.11%20PM.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1208258%22%20slang%3D%22en-US%22%3ERe%3A%20Conditional%20Access%20with%20Android%20phones%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1208258%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F389370%22%20target%3D%22_blank%22%3E%40stevenpsiu%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20Android%20enrollment%20are%20you%20using%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1208961%22%20slang%3D%22en-US%22%3ERe%3A%20Conditional%20Access%20with%20Android%20phones%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1208961%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3BWe%20are%20using%20android%20work%20profile%2C%20they%20are%20all%20personal%20owned%20devices.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20pulling%20hairs%20out%20trying%20to%20figure%20this%20out.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1224810%22%20slang%3D%22en-US%22%3ERe%3A%20Conditional%20Access%20with%20Android%20phones%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1224810%22%20slang%3D%22en-US%22%3EI%20just%20checked%20and%20I%20am%20also%20not%20seeing%20it%20in%20a%20couple%20of%20tenants.%3CBR%20%2F%3EAre%20the%20devices%20failing%20on%20device%20compliance%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1224841%22%20slang%3D%22en-US%22%3ERe%3A%20Conditional%20Access%20with%20Android%20phones%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1224841%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3BThey%20are%20showing%20up%20as%20compliant%20under%20Intune.%20I%20have%20about%2020%20Androids%20now%20that%20we%20have%20started%20the%20MDM%20enrollment%20last%20month.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20a%20ticket%20open%20with%20Microsoft%20and%20its%20in%20the%20process%20of%20being%20escalated.%20At%20this%20moment%20I%20cannot%20do%20a%20Conditional%20Access%20Policy%20based%20on%20device%20compliance.%20I%20have%20a%20policy%20that%20will%20require%20MFA%20for%20non-managed%20devices%20connecting%20to%20cloud%20apps%20(Workday)%2C%20and%20it%20simply%20not%20working%20for%20Android.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20support%20person%20was%20sort%20of%20arguing%20with%20me%20because%20I%20put%20the%20ticket%20in%20about%20android%20vendor%20specific%20email%20app%20(Samsung%20email%20on%20a%20Galaxy%20s9)%20not%20working%20in%20the%20same%20logic.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20all%20your%20help.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1227492%22%20slang%3D%22en-US%22%3ERe%3A%20Conditional%20Access%20with%20Android%20phones%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1227492%22%20slang%3D%22en-US%22%3EDoes%20it%20work%20correctly%20for%20Outlook%20mobile%20app%3F%3CBR%20%2F%3E%3CBR%20%2F%3EI%20have%20seen%20the%20Samsung%20app%20having%20errors%20on%20a%20Work%20Profile%20before%20(it%20doesn't%20seem%20to%20detect%20it).%20I%20fear%20it's%20a%20Samsung%20issue%2C%20not%20a%20Microsoft%20issue%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1227704%22%20slang%3D%22en-US%22%3ERe%3A%20Conditional%20Access%20with%20Android%20phones%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1227704%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3BIt%20doesnt%20seem%20to%20be%20working%20with%20the%20Outlook%20mobile%20app%20either.%20When%20I%20modify%20a%20CA%20rule%20to%20require%20complaint%20devices%20AND%20approved%20app%2C%20Outlook%20app%20will%20keep%20asking%20to%20enroll%20the%20device.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%20I%20dont%20think%20its%20a%20samsung%20issue%20either%2C%20because%20the%20non-reporting%20of%20compliant%20status%20is%20happening%20to%20all%20android%20devices%2C%20regardless%20of%20the%20brands%2C%20even%20though%20most%20of%20the%20android%20devices%20enrolled%20are%20Samsung.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eso%20hypothetically%2C%20if%20its%20a%20samsung%20device%2C%20how%20to%20get%20this%20issue%20resolved%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20so%20much%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1233386%22%20slang%3D%22en-US%22%3ERe%3A%20Conditional%20Access%20with%20Android%20phones%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1233386%22%20slang%3D%22en-US%22%3EI%20have%20just%20tested%20this%20and%20when%20I%20require%20both%20approved%20app%20and%20a%20compliant%20app%2C%20it%20works%20fine%20when%20using%20Outlook%20on%20a%20work%20profile.%3CBR%20%2F%3E%3CBR%20%2F%3EIf%20you%20are%20still%20facing%20this%20issue%2C%20I%20think%20a%20support%20case%20is%20in%20order.%3C%2FLINGO-BODY%3E
Highlighted
Regular Visitor

I am struggling a bit with Conditional Access policies.

I am trying to create the following scenario for access from mobile phones.

 

If the device is marked as compliant (Intune enrolled), then accept access to Exchange Online with modern auth and EAS.

If the device is not marked as compliant, then people can use Approved Apps.

 

It is working really well on iOS devices. On Android not so well. Even if an Android device is enrolled and compliat, it behaves like it's not enrolled and offers the user to continue with Company Portal.

 

Should it not be possible?

10 Replies
Highlighted

Hi @Henrik Skovgaard,

 

did you try to access via EAS from work profile? If yes: Can you provide information about your CA policies?

Highlighted
Could you share your CA policies? Are you using 1 policy or multiple policy?
Have you checked the sign-in logs of Azure AD to check which policies are being assigned?

We need some more info before we can help you out :)
Highlighted

@Thijs LecomteI would like to resurrect this topic, as we are also having this issue with enabling enrolled android devices with native/manufacturer developed email clients.

 

From the Conditional Access (CA) logs, the android devices did not report back to AAD/CA its compliance status. Its simply blank. See below for screenshot.

 

Seems like I can only ID the device by OS, not its state. Not sure if this is a limitation on the Android side since iOS is reporting all info to CA.

 

Screen Shot 2020-03-03 at 6.35.11 PM.png

 

 

 

Highlighted

@stevenpsiu 

 

What Android enrollment are you using?

Highlighted

@Thijs Lecomte We are using android work profile, they are all personal owned devices. 

 

I am pulling hairs out trying to figure this out.

Highlighted
I just checked and I am also not seeing it in a couple of tenants.
Are the devices failing on device compliance?
Highlighted

@Thijs Lecomte They are showing up as compliant under Intune. I have about 20 Androids now that we have started the MDM enrollment last month.

 

I have a ticket open with Microsoft and its in the process of being escalated. At this moment I cannot do a Conditional Access Policy based on device compliance. I have a policy that will require MFA for non-managed devices connecting to cloud apps (Workday), and it simply not working for Android. 

 

The support person was sort of arguing with me because I put the ticket in about android vendor specific email app (Samsung email on a Galaxy s9) not working in the same logic.

 

Thanks for all your help.

Highlighted
Does it work correctly for Outlook mobile app?

I have seen the Samsung app having errors on a Work Profile before (it doesn't seem to detect it). I fear it's a Samsung issue, not a Microsoft issue
Highlighted

@Thijs Lecomte It doesnt seem to be working with the Outlook mobile app either. When I modify a CA rule to require complaint devices AND approved app, Outlook app will keep asking to enroll the device.

 

Also I dont think its a samsung issue either, because the non-reporting of compliant status is happening to all android devices, regardless of the brands, even though most of the android devices enrolled are Samsung.

 

so hypothetically, if its a samsung device, how to get this issue resolved?

 

Thank you so much 

 

Highlighted
I have just tested this and when I require both approved app and a compliant app, it works fine when using Outlook on a work profile.

If you are still facing this issue, I think a support case is in order.