Meraki Access Manager - with username+password

[PhilipDAth]

I'm trying to follow this guide to try out Access Manager using username+password authentication.

https://documentation.meraki.com/Access_Manager/Access_Manager_Configuration_Guides/Access_Manager_U...

The issue is on the Entra ID side.

I configured an exclusion in every conditional access policy for the app (yucky, but ok).  So 100%, there is no policy requiring MFA.

Our authentication methods policy has been fully migrated to use modern policies.

Despite having every conditional access disabled through exclusion, Entra ID is saying the authentication failed because MFA is required.  Everyone has to do the above migration - there is no choice.

So does this mean the entire section on using username/password authentication against Entra ID in the new Access Manager is a non-starter?  Anyone who has it working at the moment will have it fail when their tennancy is forced migrated?

[alemabrahao]

I've never configured or implemented anything like this but after searching a bit I found these links. I hope it helps you.

Manage users excluded from Conditional Access policies - Microsoft Entra ID Governance | Microsoft L...

How to troubleshoot sign-in errors - Microsoft Entra ID | Microsoft Learn

[PhilipDAth]

Good attempt, but neither of those help.

[cmr]

I just tried setting this up and it seems you are right, a somewhat useless feature 😥

[cmr]

This is what the session logs show:

[PhilipDAth]

That is what I get as well.  There is simply no way (once Authentication Methods is migrated) to create an account that does not require MFA.

[Ruben_S]

Hello,

I confirm I'm able to make it working after excluding from existing Conditionnal Access rules my "Meraki_Access_Manager" App registration.

Ruben

[PhilipDAth]

Have your Authentication methods been migrated?

[Ruben_S]

Not yet. Status is "in progress"

[PhilipDAth]

That means it is not migrated yet.   The username/password authentication is likely to break once it is completed.

[linuxoid70]

Any progress? Did you make it work?

No matter what I do (I even excluded Access Manager app from Conditional access as whole) - I am still getting the same error as shown on screenshot above (MFA thing). 

Anyone made it work?

[PhilipDAth]

If your authentication methods have been migrated to "Modern" (which you cannot stop), you will no longer be able to use username/password authentication.  You can only use certificate authentication.

This is because the modern authentication method FORCES the use of MFA.  It is not possible to create a conditional access policy to prevent it.