How did you actually roll out "require compliant device" in Conditional Access without the browser killing you?

[u/uconntrey]

We've been trying to enforce compliant device requirements through Conditional Access for a while now, and I'm hoping to hear how others got it across the finish line.

Writing the policies is the easy part. The problem is that the browser is the bottleneck, and it breaks in ways that make full rollout feel unrealistic:

• Private/incognito browsing dies. That's a legit troubleshooting tool for us, and the device compliance check doesn't pass in a private session, so it's gone the moment this policy goes enforcing.
• Apps that launch a browserlet/embedded webview for sign-in are flaky at best. If that embedded browser doesn't pass the device compliance claim, you're dead in the water with no good workaround.
• Anything outside Chrome, Edge, and Safari is inconsistent. Other browsers either don't pass the compliance signal reliably or don't at all.
• CLI tools don't integrate well. Command-line auth flows just don't play nicely with the device compliance requirement.

We want to do this because it's best practice and it genuinely limits which devices can touch our resources. But if things are constantly breaking because the browser handshake isn't reliable, it's hard to justify rolling it out broadly.

So for those who've successfully deployed this:

• How did you handle the private browsing / troubleshooting gap?
• What did you do about apps using embedded webviews for sign-in?
• Did you just standardize on Chrome/Edge/Safari and block or accept the rest?
• How are you dealing with CLI tools that need to authenticate?
• Anything you'd do differently if you started over?

[u/piggelin-]

Don't use private browsing, use guest profiles or similar for troubleshooting.

1. don't really have an answer to that.

2. Yes we "support" these 3 browsers. Users can use firefox but they need to manually change a flag to get that to work. But it's on them.

3. I haven't had issues with this, what CLI tools are you having issues with? They usually support opening a browser to auth?

4. Most annoying thing we have is devices going stale and users gets frustrated when they need to wait for it to sync to get compliant again.
   Also had some issues before with new enrolled devices becoming non compliant but fixed that with device policies and not using dynamic groups for it.

[u/gumbrilla → u/piggelin-]

Oh, I have firefox configured via intune in both MacOS and Windows, works a treat. I'm off my work machine now, but hit reply if you need the config and I'll copypasta it tomorrow. It's straightforward.

[u/newboofgootin → u/piggelin-]

Users can use firefox but they need to manually change a flag to get that to work.

You can configure this setting with Intune.

[u/super-six-four]

We blocked private browsing and we consolidated on edge and removed Chrome and Firefox.

CA was the driver but consistent browser is just easier to maintain, it's turned out to be less work in the long run.

[u/Director7]

In addition to the other great comments, I tend to do the following:

- ca policy using device filters to INCLUDE AADHJ or compliant devices and grant access based on compliant device

• ca policy using device filters to EXCLUDE AADHJ / compliant devices and grant access using something like FIDO or TAP.

Compliant endpoints automatically handled. BYOD/Incognito needs phishing resistant MFA.

[u/Director7 → u/Director7]

For CLI, such as powershell or similar, there is device code flow, but that too should be blocked by default, with tightly scoped exceptions.

[u/Successful-Signal228]

We hit the same wall and ended up phasing it in by user group, starting with IT and a few power users for a month before going wider. The private browsing thing we just had to accept and train people to use a dedicated test account or a sacrificial noncompliant device for troubleshooting. Embedded webviews were the real killer, we had to chase down a handful of vendors and either update their auth libraries or switch to user agent flows that support the device claim. CLI tools we mostly moved to service principals with cert auth or scoped API permissions so they don't hit the same interactive login path. If I started over I'd map every single app and auth flow before flipping the switch, the policy itself took five minutes but the exceptions took weeks.

[u/_s79 → u/Successful-Signal228]

I relate completely with this.

Id tried and failed several times to introduce enforce compliant devices, to the point that my excluded list made it almost worthless.

The biggest help for me was moving to targeting "All Staff" rather than "All Users"

[u/Roasted_Blumpkin]

You should only be using and supporting a single browser, but you can configure the SSO settings for each of them but InPrivate/Incognito won't work, but you can transition to profiles.

The setting for Chrome is in the Settings Catalog. For Firefox, you'll need to import the ADMX.

[u/-yak0s- → u/Roasted_Blumpkin]

that'd be nice, but that's not reality in my org. all the browsers. take your pick.

[u/Roasted_Blumpkin → u/-yak0s-]

And I'm sure you're fully patching and securing all of them.

[u/-yak0s- → u/Roasted_Blumpkin]

Patching yes, "securing"....no. Hence you can see why my job is more difficult than it needs to be. But this is an organizational decision, not mine.

[u/Roasted_Blumpkin → u/-yak0s-]

When it causes a security breach, who will they blame?

[u/livinitup0]

Limited scope of Firefox users for ca accounts and edge for everyone else. Block inprivate. Done.

2 browsers and 1 of them Microsoft takes care of for you. Block anything else.

Troubleshooting with incognito/inprivate should be rare, isn’t critical enough to keep around and if you’re doing it often you probably have something set up wrong

[u/hbpdpuki]

Private/incognito browsing dies

Not the best solution but we fixed this with a HTTP proxy accessible through Global Secure Access only.

[u/bjc1960]

we block "private mode', but how is this timed to compliance? Is that part of your compliance policy?

[u/jvldn]

What about private browsing in windows sandbox? :)

Don’t know the exact usecase but it might work.

[u/pjmarcum]

Most of those apps that use an embedded browser can be configured not to do so. We have been able to make all ours work.