Microsoft Entra ID Integration with Splash Page Restrict by Device

[amabt]

I got Microsoft Entra ID Integration with Splash Page working. However, we are looking at restricting the devices that can access via this Entra Auth.

I cannot see any option or mention of this in the docs. Is this possible currently or we need to look at the New Network access manager or go 3rd party?

Thanks.

[RWelch]

If your infrastructure has the required hardware, you might consider Access Manager.

Access Manager Datasheet  

[amabt]

Thanks. I was just reading up on that earlier, looks like it'll do the job. The big question is if that will be part of our EA licensing or cheaper to go 3rd party cloud Radius.

[PhilipDAth]

Typically, if you wanted to restrict which devices have access to an application in an Entra ID world, you would use a Conditional Access policy.

You can configure a "Named Location" and mark it as trusted.

In the "Grant" section you can also require that a device is required to be compliant:

And then you can create an Intune compliance policy to define what you mean by that.

It is quite a lot of hassle if you don't have Entra ID conditional access in use, combined with Intune and compliance policies.

Cisco Duo makes this kind of thing easy with its Trusted Devices feature.  You can say things like "Every device in my AD or my Intune are trusted", and then you can add specific manual overrides for special cases (like contractors).

https://duo.com/docs/trusted-endpoints

[amabt]

Thanks for you reply. Definitely a hassle not not very manageable.

[GavinMcMenemy]

The other issue with doing this is that it's not uncommon for a device to go out of compliance for reasons that are out of a users control. We've been looking into this one and we're not sure how viable it really is. But sure it might work for the majority.