Azure AD Conditional access based on Meraki SM profile

[MSakr]

Hi All

Did anyone manage to enforce conditional access in Azure AD based on a systems manager enrolled profile? without using intune in the backend..

We need to ensure that only enrolled personal iOS devices can login to M365, non SM enrolled devices should not be able to login..

Thanks

[PhilipDAth · Accepted solution]

I don't know the answer.

If only the personal iOS devices have a certificate deployed, you might be able to enable certificate-based authentication in O365.

Typically I would solve something like this using Cisco Duo and the trusted endpoints feature.

https://duo.com/docs/trusted-endpoints

A less strong method would be to buy Cisco Umbrella SIG, run all of those machines traffic cthrough Umbrella, and create a conditional access policy to match the ranges that the IP traffic is coming from.

https://support.umbrella.com/hc/en-us/articles/360059292052-Additional-Egress-IP-Address-Range 

Another option would be to make the devices use a full tunnel back to a Meraki MX - so all of theitr traffic appears to come from one IP - and match on that IP address in conditional access.

[PaulF]

Both of these are suitable solutions to not using conditional access. Duo Trusted Endpoints is the easiest to roll out

[MSakr]

Hi

I thought the poster accepts answers and not Meraki staff 🙂 

Sad that you don;t integrate with intune.. this is a major drawback for us.. not being able to apply conditional access policies based on the compliance of Meraki SM, will force us to have 2 systems.. frankly speaking.. we don;t see the value of Systems manager against intune or jamf in that scenario.. I will need to pull your partners pre sales to help here further