Azure AD Conditional access based on Meraki SM profile

[MSakr]

Hi All

Did anyone manage to enforce conditional access in Azure AD based on a systems manager enrolled profile? without using intune in the backend..

We need to ensure that only enrolled personal iOS devices can login to M365, non SM enrolled devices should not be able to login..

Thanks

[PhilipDAth · Accepted solution]

I don't know the answer.

If only the personal iOS devices have a certificate deployed, you might be able to enable certificate-based authentication in O365.

Typically I would solve something like this using Cisco Duo and the trusted endpoints feature.

https://duo.com/docs/trusted-endpoints

A less strong method would be to buy Cisco Umbrella SIG, run all of those machines traffic cthrough Umbrella, and create a conditional access policy to match the ranges that the IP traffic is coming from.

https://support.umbrella.com/hc/en-us/articles/360059292052-Additional-Egress-IP-Address-Range 

Another option would be to make the devices use a full tunnel back to a Meraki MX - so all of theitr traffic appears to come from one IP - and match on that IP address in conditional access.

[PaulF]

Both of these are suitable solutions to not using conditional access. Duo Trusted Endpoints is the easiest to roll out