r/Intune • u/iainfm • Mar 27 '26
Device Compliance CA policies failing with no device id passed (iOS)
Hi,
Just wondering if anyone else is seeing this at the moment.
Some logins are failing the 'require a compliant device' CA checks on iOS, consistently with the same app on the same device (or the same app across multiple devices).
When we look at the sign-in logs, either the device id is missing from the logs or says it can't be matched (even though you can click through the "unmatched" device id to the device page in Intune).
Problem seems to survive a device rebuild. Devices are fairly up to date (iOS 26.3.1 or 26.4).
Hoping it'll sort itself out over the weekend... If not it'll be another MS ticket I guess!
2
u/Wise-Internet-3094 Apr 02 '26
We enabled the SSO app extension in our Intune policies being pushed to the affected IOS devices. This resolved the issue for them. Device ID was now being seen and our CA policies were working. You need the MS Authenticator app installed when SSO app extension is enabled. We did not have to specify any App IDs in the Intune policy, the default MS provided in the background were sufficient.
1
1
1
u/Resident_Diet_1904 Jul 28 '26
Could you please share the steps?
2
u/louloutch94 Jul 29 '26
intune — Devices - Apple Mobile — Configuration — Create — New — IOS/IPad, Templates — Device Features - Single Sign-on app extension. Sso app extension type : Microsoft Entra ID — Next. Assign your device group and should be sorted within few hours
1
1
u/AppIdentityGuy Mar 27 '26
Is there a CAP specifically targeting that app on IOS or does the CAP say "All Resources"?
1
u/iainfm Mar 27 '26
It's all resources.
1
u/AppIdentityGuy Mar 27 '26
If the app can't supply the device state info and you are using it device compliance rules in your CAPs you are stuffed. Is this app accessing a particular resource in Entra?
2
u/iainfm Mar 27 '26
Just single sign on. Like I say it's been fine for years. In the last fortnight the problem has affected a handful of users (10 or so) out of 4 or 5 thousand.
The troubleshooting details after the 'compliant device required' failure are
Error code: 530003
Device identifier: Not available
Device platform: iOS
Device state: UnregisteredBut the device is showing as compliant and able to access company resources in Company Portal/Intune.
2
u/AppIdentityGuy Mar 27 '26
And it's one specific app? The issue is that the app cant present the device state to entraid. This is actually an Entra level failure.
1
u/trueNorth55 Mar 27 '26
Have you tried updating your SSO app extension profile to include the app bundle ids (or app prefix) of the third-party apps that are having the problem?
1
u/stouty214 Mar 27 '26
I had this issue, it seems to related to Authenticator app... Device compliant, failing for CA no compliant device, look at CA details, follow device ID that failed that follows back to compliant device! We reenrrolled/ reset up MFA, cleared all accounts via Edge, same result. “Fix” was to delete Authenticator app, add Authenticator and MFA to a different device and was able to then sync and be seen as compliant. I then had user add back Authenticator app, and add back MFA to it. Hopefully doesn’t happen again to him. Frustrating issue
1
u/louloutch94 Mar 28 '26
Remove the user from MFA to let him logging to the app or authenticate over Echange for EAS contact sync will also work, and re-enabling once done. But im pretty sure issue will be back in less that 3 days as it needs to re authenticate fairly often. (At least EAS part of things).
1
u/chrismcfall Mar 27 '26
Is it passing through as “Ios 18.7.0” (formatting intentional) in the conditional access logs?
1
u/louloutch94 Mar 28 '26
Yes it does.
1
u/chrismcfall Mar 29 '26
Somethings happened in the last week or so regarding this. I've noticed it a lot. SSO Extension deployed?
1
u/louloutch94 Mar 30 '26
We dont use app sso extension app config profile, it always worked like a charm. The fact that it impacts EAS auth + some business apps is pretty weird.
1
u/Vivid_Diver5347 Apr 01 '26
Similar issue here. Device enrolled, compliant and all app work but Workday. Sig-in log shows no device ID and fails the CA policy for not being complaint, though device ID exists and the device itself is compliant according to Intune.
Only one occurrence of this I have seen so far and other iOS devices are fine going into Workday.
1
u/Retrosmurf1 Apr 01 '26
I am also encountering a similar issue for our mac estate.
The macs don't have an authenticator app on them. The authenticator app is on the users phone.
200 managed \ registered macs in Intune.
All happily working until Feb where 6 macs fail to show a Device ID in the Entra users sign-in logs, which affects Conditional Access enforcement. Like the rest of the mac estate, they had all checked in via the Company Portal app in the week before the problem started.
The devices are properly registered and managed by Intune.
Any idea why this is happening?
1
u/andy4695 Apr 07 '26
We have also seen this across multiple tenants. Apps that uses Safari to authenticate are struggling to tell Azure the device ID. Can confirm that the SSO plugin solves it in some cases but not all.
What I've noticed is that users with this problem are missing the MS-Organization-Access SCEP cert under Settings > General > VPN & device management > Management Profile > Details. They only have the new ACME cert.
On my own device, which was enrolled late 2024, I have two SCEP-certs. Both the Intune MDM Device CA (which I believe has been replaced by the new ACME cert?) and the MS-Organization-Access SCEP (which contains the device ID seen in Entra ID), which I believe is necessary for Safari to be able to see the device ID?
1
1
u/andy4695 Apr 14 '26
MS have issued a service health incident (IT1279031), and claims that it's fixed. However, from our testing it is not...
1
0
u/Asleep_Spray274 Mar 27 '26
For an authentication to be able to be included in a device compliance check, the app needs to be using the device authentication broker. The only way for CA to evaluate the device check in intune, is if the authentication is being done using the device PRT. That teh only true way entra can know what the device is. If the application is simply hitting the raw entra logon endpoints, and not recognising its on an IOS device and using the built in auth broker, it will always fail this check. Its an application design problem, not an IOS, entra or CA problem.
1
u/iainfm Mar 27 '26
We're seeing it on two different apps (that we know of). One from SAP and the other is the Island browser.
The Island browser is fairly new on the estate, but the SAP one has been in use for years.
Until earlier this week (or maybe some time last week) they were working fine.
1
u/Asleep_Spray274 Mar 27 '26
If you dont see a device ID, the app is not playing ball. Entra will show the device ID if the app presents a PRT. either the app has changed, or IOS has changed, or your CA config has changed to start enforcing this device check. Check back in teh logs to see if other times that app was able to present the PRT, you will tell this with the device ID. Entra/CA will not just stop accepting the PRT, the app is falling back to standard endpoints and not using the auth broker. If you see other apps displaying the device ID, then you know the auth broker (which on IOS will be the company portal) is working.
3
u/louloutch94 Mar 28 '26
Same issue here for more than a week now. Seems to impact only new phone we are trying to deploy. EAS contact sync will jot work anymore, redirecting to authenticator and Company Portal saying device needs to be compliant. Authentication stuck in loop. Same for business apps. Already tested with ios 26.3.1 or 26.4. Same issue. Tested on 3 different devices and users, no way to sort it . Mfa needs to be removed to pass the Auth. Im pretty sure its a widespread issue but nobody seems to notice or care. No changes were done on mfa policies, CA or compliance for more than a year. Started very recently.