365 Apps not reporting Device ID or Join Type

Question

Hi all,

This issue is happening on brand new install of RDS 2016 server with out of the box set up and minimal configuration for seamless sso.

Device is hybrid azure ad joined, users get prt, silent sso works fine via edge/chrome/ie.

The 365 apps for enterprise are not reporting device ID or join type to azure which is resulting in my CA policy to fail. It's set to require either compliant/or hybrid azure ad joined device to grant access.

Device filter (exception) is failing also because no device id is reported.

See photo below

This is the result that is passed to Azure during silent sso on a rds 2016 server.

Device info:

Device ID: BLANK
Browser
Rich Client v3.4.1.35249

This is the CA policy

Cloud apps: office 365

Conditions: any device

location: any

client apps: mobile apps/desktop clients

Grant access:

Require device to be compliant

or

Require hybrid azure ad joined device.

Answer 1

For the RDS issue where Edge is not passing the DeviceID and Join Type, I found that the user needs to be signed in to the Edge with their work profile and not as a guest. After that the details are passed to Azure.

Answer 2

Also the same issue here.
Enabled Conditional Access, based upon Device ID.
However, Office365 apps like Teams on both Windows and Android (not sure about iOS) don't report Device ID or Join type.
It's using Chrome when authenticating the user to Office365, and Chrome don't send along these details.

I solved it on Windows by using the Windows Accounts plugin on Chrome, but this is not an option on Android.

Is there a way to fix this?

Answer 3

I'm facing exactly the same issue, the conditional are set to allow only hybrid joined computers but the Outlook on Windows 10 does not connect and on Signin logs the Join Type is empty, all other services are working fine except Outlook.

Answer 4

Bumping this up in case someone encounters this issue which eventually they will.

Microsoft offered a free tech support here to save face.
However, in private emails they state that the ticket is pretty much worthless. It does not apply to the department which can reproduce the issue so moot.

Answer 5

This Is the official response from MS, see below They did not open a ticket for a whole month with the appropriate department to actually look into this because I would have to pay for this ticket to be processed normally.

See this answer:

"My adviser mentioned that by design RDS servers cannot be compliant with Azure AD.

To sum up, your issue could be either by design or misconfiguration within your environment.

So an RDS server cannot be compliant, and then it could be by design or misconfiguration ? Which one is it ?

Also, this is happening on two different environments with minimal configuration, so I know it's not misconfiguration.