ADE & Azure AD User authentication

[beks88_]

Hi all,

is it now possible to use Azure AD for user authentication on SM?

The initial document still says, it's not supported (Feb 2023)

https://documentation.meraki.com/SM/Device_Enrollment/SM_Enrollment_Authentication

Another document (under User management) let us assume it is indeed supported (Jun 2022)

https://documentation.meraki.com/SM/Deployment_Guides/Apple_User_Enrollment_Deployment_Guide

In this thread this part got also a bit discussed and at this time the first document was older than the second one.

https://community.meraki.com/t5/Mobile-Device-Management/Smartphone-enrolment-Apple/m-p/160251#M9599

What is now accurate?

[ConnorL]

Hey @beks88_ ,

During the Apple Automated Device Enrollment set-up process (i.e. when you're first setting up the device), we do not support using Azure AD and instead it'll fall back to using Meraki credentials (SM > Owners). Appreciate the different KBs make this a little confusing so I'll request some clarification is added here. 

Cheers,

Connor

[PaulF · Accepted solution]

The way to achieve this is to use, one creating a NEW ADE profile, is to use the Enrollment Redirect URL

If you've got Enrollment Auth turned on and Azure Configured, then you'll get this as an option

 

Note: I've got OpenID connect with Azure configured, not azure natively, but it does work

[beks88_]

I'll try this, thanks

[beks88_]

This is working fine. The only thing I'm not able to test (since I have no access to customers Azure config) is the question if groups get synced to Meraki.

The log in redirection to Microsoft works fine here. Maybe you could update the docs to match the use case since they are still misleading.

One thing to note here; the customer I tested it with has also Android Enterprise (Meraki managed) active.

[PaulF]

@beks88_ 

We support groups syncing with:

• Azure
• SAML and
• AD