Conditional Access conditions
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 310aec2 · +2 −8 lines · also on GitHub
⋯ 123 unchanged lines
124124
| Windows Server 2019 | Microsoft Edge, [Chrome](#chrome-support) |
125125
| iOS | Microsoft Edge, Safari (see the notes) |
126126
| Android | Microsoft Edge, Chrome |
127
−| macOS | Microsoft Edge, Chrome, [Firefox 133+](https://support.mozilla.org/kb/firefox-enterprise-133-release-notes), Safari |
127
+| macOS | Microsoft Edge, [Chrome](#chrome-support), [Firefox 133+](https://support.mozilla.org/kb/firefox-enterprise-133-release-notes), Safari |
128128
| Linux Desktop|Microsoft Edge|
129129
130130
These browsers support device authentication, allowing the device to be identified and validated against a policy. The device check fails if the browser is running in private mode or if cookies are disabled.
⋯ 8 unchanged lines
139139
>
140140
> [Chrome 111+](https://chromeenterprise.google/policies/#CloudAPAuthEnabled) is supported for device-based Conditional Access, but "CloudApAuthEnabled" needs to be enabled.
141141
>
142
−> macOS devices using the Enterprise SSO plugin require the [Microsoft Single Sign On](https://chromewebstore.google.com/detail/windows-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji) extension to support SSO and device-based Conditional Access in Google Chrome.
143
−>
144142
> macOS devices using the Firefox browser must be running macOS version 10.15 or newer and have the [Microsoft Enterprise SSO plug-in installed](/mem/intune-service/user-help/enroll-your-device-in-intune-macos-cp) and [configured appropriately](/entra/identity-platform/apple-sso-plugin#microsoft-intune-configuration).
145143
146144
#### Why do I see a certificate prompt in the browser
⋯ 8 unchanged lines
155153
156154
To automatically enable the CloudAPAuthEnabled policy in Chrome, create the following registry key:
157155
158
− - Path: `HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome`
156
+- Path: `HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome`
159157
- Name: `CloudAPAuthEnabled`
160158
- Value: `0x00000001`
161159
- PropertyType: `DWORD`
⋯ 33 unchanged lines
195193
| Outlook mobile app | Exchange Online | Android, iOS |
196194
| Power BI app | Power BI service | Windows 10, Android, and iOS |
197195
| Azure DevOps Services (formerly Visual Studio Team Services, or VSTS) app | Azure DevOps Services (formerly Visual Studio Team Services, or VSTS) | Windows 10, iOS, and Android |
198
−
199
−> [!NOTE]
200
−> For Apple devices, as Microsoft Entra ID transitions the storage of device identity keys from Apple Keychain to Apple Secure Enclave, the Microsoft Enterprise SSO plug‑in for Apple devices must be enabled for applications that do not use the Microsoft Authentication Library (MSAL), including Safari. Enabling the Enterprise SSO plug‑in ensures that these applications can participate in device-based authentication required by Conditional Access policies, such as Require device to be marked as compliant and Filter for devices condition. For more information about this transition to Apple Secure Enclave, see [Microsoft Enterprise SSO plug‑in for Apple devices – Microsoft identity platform on Microsoft Learn](/entra/identity-platform/apple-sso-plugin#device-identity-key-storage)
201
−
202196
203197
### Exchange ActiveSync clients
204198
⋯ 34 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:35 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.