1

I know this is probably not the best place to ask this question. But, after days of working on this, and having posted in the Microsoft Forum, I'm at my wits end.

We are utilizing a hybrid ADFS 4.0 (Server 2016) / Azure AD / Office 365 setup with device registration and SSO working.

We are attempting to enable multi-factor authentication with device based access policies. We don't want "recognized" devices seeing additional MFA prompts. We are evaluating the claims being returned by ADFS using the Microsoft Claims Xray.

We have successfully enabled MFA and configured ADFS to only prompt for MFA if a device is unrecognized. This works because devices that are recognized have additional properties in active directory (isRegisteredUser; isManaged; isKnown; trustType; etc) and we can take action on those properties. We've tested with IE, Firefox, Chrome, and Safari on an iPad. However, the "DeviceContext" claims only come through when the authentication is done from IE or Safari on the iPad.

For some reason, it appears no device authentication occurs when the request is made from Chrome or Firefox. Authentication works, we just can't see any of the devicecontext claims that allow us to make a decision based on if the device is registered or not. So, these browsers get an additional MFA prompt.

I simply cannot find any posts online matching my exact problem. There are a few threads that are similar, but turn out to be different issues, or end up at a dead end. I'm hoping someone has this similar setup and knows why Chrome and Firefox would not perform the additional device based authentication, but safari on an iPad would. All the devices have valid certificates to perform the authentication.

I don't get any errors to go on in any event logs. The browser simply doesn't make a device authentication request, and no devicecontext claims are issued. It's possible this isn't supported, but I can't find any information indicating one way or another.

5
  • We are facing the same problem: Device Authentication in ADFS only works with IE. Hope you can share any insight with me, or any ideas we could verify something. For now I did traffic inspection with Fiddler, and from what I understand other browsers are not even trying to authenticate the device. Strange that the same device auth works with Office 365 services in Chrome, for example. It's just not working with ADFS – Jevgenij Martynenko Jan 25 '18 at 9:03
  • @JevgenijMartynenko Thanks for the comment. Can you clarify how it "works with Office 365 services?" I need something to go on here. Thanks. – Appleoddity Jan 25 '18 at 14:46
  • I ment, device auth works in non-IE browsers for office.com but does not work with ADFS server. So I guess it is the ADFS server which is the fault. I have two ideas I did not have time to test yet: 1. Use Fiddler to compare headers and cookies between IE and Chrome/Edge 2. Try to use Azure for SSO/Federation and avoid using ADFS alltogether. Still need more time to test both – Jevgenij Martynenko Feb 1 '18 at 20:42
  • @JevgenijMartynenko Thanks. This is what I discovered as well. I’ve pretty much answered this question now and can post some details soon. Non IE / Edge browsers do not pass the device context claims to ADFS nor Office 365. Microsoft created a plugin for Chrome that solves this, if you have Win 10 v1703 or newer. But, the plugin only works with MFA handled by Office 365, not ADFS. Device authentication is different, and works on mobile devices that have “user” scoped certificates, but that is not how MFA is done with Windows, which uses a PRT. – Appleoddity Feb 1 '18 at 21:33
  • 1
    @JevgenijMartynenko Check out my answer. All the studying over weeks came around full circle, so that the problem is a simple inability to access the Local Computer certificate store when using Chrome or Firefox in Windows 10. – Appleoddity Feb 6 '18 at 20:49
1

Device Context claims are necessary for ADFS / Azure AD to determine if a device is recognized, managed, compliant, etc. Without them, scenarios that rely on MFA and SSO are broken, if bypassing MFA relies on "recognizing" a known device. The device context claims are generated when device authentication is performed alongside user authentication in ADFS.

I found that in Windows 7, a Workplace Joined machine is per user based and receives a device authentication certificate that is stored in the "Current User" certificate store. During authentication, device authentication is successfully performed using the certificate even in Chrome.

In Windows 10, I found that Azure AD device registration is per machine, and the machine receives a device authentication certificate that is stored in the "Local Machine" certificate store. During authentication, IE and Edge successfully use this certificate to complete device authentication. Chrome will not touch any certificates in the "Local Machine" certificate store. If using Chrome the device is not recognized, MFA fails, and the user is prompted for a secondary form of authentication.

This appears to be a known issue with alternative browsers without a suitable answer. Without device authentication occurring, a device can not be recognized for the purposes of bypassing MFA with conditional access policies.

Microsoft has provided a plug-in for Google Chrome, that allows it to perform device authentication when using MFA. However, there are a couple caveats to be aware of:

  • The plug-in only works for Chrome and only works with Windows 10 Creators Updates (1703) or newer.
  • The plugin only works for Azure AD conditional access policies.
  • ADFS device based conditional access policies will not work.
  • Relying party trusts in ADFS other than Office 365 will not be able to utilize the plugin due to the previous limitation.

Long story short, Windows 7 device authentication seems to work fine and recognized devices will support device based conditional access policies if you use Chrome. Windows 10 devices using Chrome have limited ability to support device based conditional access policies. Mobile devices receive a user based certificate when enrolled in to MDM, therefore they also seem to support bypassing MFA when the device is managed.

I believe the main problem here is that the developers of Chrome have deliberately prevented it from accessing the "Local Computer" certificate store for authentication purposes. This can be verified with Process Monitor, and from looking at available certificates in the certificate settings in Chrome.

I am sorry to say this, but Mozilla has continued their headstrong approach that causes their browser to be very difficult to utilize in enterprise, and the developers have made Firefox not able to access any Windows certificate stores. So, unless you deliberately import a certificate in to Firefox, device based conditional access doesn't work at all on any OS.

1
  • Thanks for sharing. Wierd thing though, for us device auth in ADFS only works in IE. Edge on Azure AD registered devices and any browser on compliant devices enrolled in Intune both behave the same way as Chrome :( Could you confirm Edge/Intune mobile devices can auth to ADFS and bypass manual MFA requirement? – Jevgenij Martynenko Feb 6 '18 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.