Access-Manager and Entra External ID ?

[thomasthomsen]

Customer wants to have all their students in an Entra External ID, so they can set up the students, as a username, with their own current private email address, like somethingsomething@yahoo.com or whatever email you might privately have.

This would provide them with some better support options, when the students use the schools Microsoft products (as far as I understand).

But can you do EAP-TTLS with those users on Access-Manager ?
I do not think this it is possible to do this kind of "authentication" using Access-Manager, or ISE for that matter, towards an Entra External ID. - But do anyone know for sure ?

Currently, as a test, we have setup access-manager towards this "Entra External ID", and I do get all the groups and users listed when i do a sync. But I can never connect.

Access-manager just says "Failure/ Rejection info: Reason : An unexpected server error occurred." - That does not help a lot 🙂

And logs from the "Entra External ID" side ? - Well, said like Nate Bargatzes George Washington on SNL - "nobody knows".

But as mentioned , do anyone know if this is possible , and what could I be missing ?

Thanks

Thomas

[Ryan_Miles]

Deleted

[thomasthomsen]

Yeah, thats the guide we usually follow. - So you would be accurate in "thats what we are describing".
And it of course works other places where we have setup Access-Manager towards Entra (no-External) ID.
But have you setup this in your lab for Entra External ID or just Entra ID ?
https://learn.microsoft.com/en-us/entra/external-id/external-identities-overview

I think, from what I have been able to gather, that there is something about sending an unencrypted password (inside the EAP) to the Entra External ID that is not allowed (a microsoft thing ?) .. or something to that fact.

No, I have not created a support case on this, I unfortunately do not have the time (in this case). - Sorry.

[Ryan_Miles]

Ah, didn't notice the Entra External ID part. Don't think that is supported currently. 

[thomasthomsen]

Yeah ... And I dont think that is supported on ISE either (and that would have been my first choice for authentication "engine", so to speak).
At least I cannot find any information on it regarding Cisco ISE (or for that matter Aruba Clearpass, so .... ).

[rhbirkelund]

Access Manager is not supported with Entra External ID. 

We had a customer who'd been looking into this, and according to Cisco, it is not supported.

[thomasthomsen]

Yeah and I think ISE is the same thing. As far as I know. 😕