WS-Trust Request Blocking

Version Affected:  [All Versions]

Description:  

WS-Trust Request Blocking rules for User Agents are not getting applied.

Cause:  

Application sends the agent name in X-MS-Client-Application header and not X-MS-Client-User-Agent header.

Resolution:  

Enable debug logging and look for below event:

LogChannel="SA_DEBUG" FormatVersion="0.0.1" EventID="40999" Timestamp="2026-07-17T17:18:02.258Z" CompanyID="" ApplianceID="" Realm="" UserID="" BrowserSession="0e5a0a96-885d-4235-9645-6ea36fa458ad" StateMachineID="" RequestID="83246f8a-dc82-42b7-903a-44e8ebfd3d2f" UserHostAddress="" Message="[ApplicationAgent].[ValidateApp]: Found header key, X-MS-Client-Application. With value Windows-AzureAD-Authentication-Provider/1.0"

In this case, the application is sending the agent name in X-MS-Client-Application header, so the WS-Trust Request Blocking rule should block it via Application Blocking rule. E.g., 

Request Blocking Enabled : True
Logic : AND
IP Address Blocking - Allow : *
Application Blocking - Allow : Windows-AzureAD-Authentication-Provider/1.0
User Agent Blocking - Allow : *

This configuration will block all applications from using WS-Trust except Windows-AzureAD-Authentication-Provider/1.0 application from any IP address and with any User Agent. 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.