Sign-in to realms with Entra ID datastore fails due to Conditional Access

Version Affected:  [All Versions]

Description:  

Sign-in to realms with Entra ID datastore fails when Conditional Access policy is configured to require MFA for All cloud apps.

Cause:  

When Conditional Access policy in Entra ID is configured to require MFA for "All Cloud Apps", it includes SecureAuth App as well. Since, SecureAuth app in Azure is configured a public client (as shown below), it is not possible to exclude it from conditional access as documented here: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps#other-applications

Resolution:  

Change Conditional Access policy in Entra ID to explicitly add all cloud applications in the tenant instead of selecting "All Cloud Apps" option.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.