Meraki Access Manager - with username+password

[PhilipDAth]

I'm trying to follow this guide to try out Access Manager using username+password authentication.

https://documentation.meraki.com/Access_Manager/Access_Manager_Configuration_Guides/Access_Manager_U...

The issue is on the Entra ID side.

I configured an exclusion in every conditional access policy for the app (yucky, but ok).  So 100%, there is no policy requiring MFA.

Our authentication methods policy has been fully migrated to use modern policies.

Despite having every conditional access disabled through exclusion, Entra ID is saying the authentication failed because MFA is required.  Everyone has to do the above migration - there is no choice.

So does this mean the entire section on using username/password authentication against Entra ID in the new Access Manager is a non-starter?  Anyone who has it working at the moment will have it fail when their tennancy is forced migrated?

[alemabrahao]

I've never configured or implemented anything like this but after searching a bit I found these links. I hope it helps you.

Manage users excluded from Conditional Access policies - Microsoft Entra ID Governance | Microsoft L...

How to troubleshoot sign-in errors - Microsoft Entra ID | Microsoft Learn

[PhilipDAth]

Good attempt, but neither of those help.

[cmr]

I just tried setting this up and it seems you are right, a somewhat useless feature 😥

[cmr]

This is what the session logs show:

[PhilipDAth]

That is what I get as well.  There is simply no way (once Authentication Methods is migrated) to create an account that does not require MFA.

[Ruben_S]

Hello,

I confirm I'm able to make it working after excluding from existing Conditionnal Access rules my "Meraki_Access_Manager" App registration.

Ruben

[PhilipDAth]

Have your Authentication methods been migrated?

[Ruben_S]

Not yet. Status is "in progress"

[PhilipDAth]

That means it is not migrated yet.   The username/password authentication is likely to break once it is completed.

[linuxoid70]

Any progress? Did you make it work?

No matter what I do (I even excluded Access Manager app from Conditional access as whole) - I am still getting the same error as shown on screenshot above (MFA thing). 

Anyone made it work?

[PhilipDAth]

If your authentication methods have been migrated to "Modern" (which you cannot stop), you will no longer be able to use username/password authentication.  You can only use certificate authentication.

This is because the modern authentication method FORCES the use of MFA.  It is not possible to create a conditional access policy to prevent it.

[Boston]

This is not accurate, we are on "modern" and have it working, it's just a function of setting up the conditional access polices to exclude the enterprise app when originating from Meraki's broker IP's.  It 100% works if set up this way.  The big problem is getting a comprehensive list of Meraki broker IP's 

[PhilipDAth]

Please refer to my original post, where I included a screenshot showing that the Enterprise app was excluded from all conditional access policies.

I am not sure what the secret is, then.

[Boston]

hmm...

Is it possible that you still have legacy per-user MFA (or security defaults) enabled as well as conditional access policies?  I have seen in some tenants in the past where Microsoft didn't transition the tenant properly and for certain scenarios its failing back to PUMFA when CA does not apply ...

But now that i am looking closer at your screenshots.... I am having flashbacks from about 3 years ago with this.... do you have Identity protection set up ?  it can require MFA without a CA policy if you have it set that way



Either way i can 100% confirm it works on 3 different environments i work in.  

[PhilipDAth]

Lehacy per-use MFA is disabled.

We don't have a licence for Identity Protection, nor have we configured any policies using it.