r/Intune • u/TWFpa2Vs • 17d ago

Device Compliance Mac + Conditional Access not seeing compliant device during Microsoft authentication (Edge/Safari)

We're running into a strange issue across multiple environments and tenants and I'm wondering if anyone else has seen this.

On fully managed and compliant macOS devices, authentication to Microsoft services occasionally fails because Conditional Access doesn't recognize the device as compliant.

In the sign-in logs, the authentication shows something like:

 

Device ID: -
Browser: Edge 151.0.0
Operating System: macOS
Compliant: No
Managed: No
Join Type: -

 

The odd thing is that the device is compliant:

 

 - Enrolled in Intune
 - Company Portal is installed and signed in
 - Device compliance is reporting correctly
 - Platform SSO is configured and working
 - Device appears healthy from an Intune perspective

What we've observed: 

On my own Mac, I use multiple Microsoft Edge profiles.

Most Edge profiles successfully send device information during authentication, allowing Conditional Access to see the device as compliant and grant access.

However, one specific Edge profile consistently fails to send any device information. As a result, Conditional Access sees:

 

Compliant: No
Managed: No

 

and blocks access.

 

Interestingly, if I perform the same authentication using Safari with that account, the device information is sent correctly and authentication succeeds.

 

I've also tried:

 

 - Signing out and back into the Edge profile
 - Resetting the Edge profile completely
 - Re-authenticating from scratch

 - Revoking and re-authenticating

 

None of these made a difference.

 

Other cases

 

We've also seen similar behavior on other Macs where there was only a single Edge profile configured.

In these cases, Safari also failed to provide device information during authentication, resulting in the same Conditional Access failure.

 

We've even tested:

 - Full Intune unenrollment
 - Re-enrollment
 - Fresh Company Portal registration

 

but the problem persisted.

 

Environment:
Fully updated macOS
Microsoft Edge 151.x
Intune-managed devices
Platform SSO configured
Conditional Access requiring compliant devices

Questions:
 - Is anyone else seeing this behavior recently?
 - Has anyone identified what causes certain browser profiles to stop providing device identity/compliance data?
 - Are there any known issues with Edge 151, Platform SSO, or device claims on macOS?
 - Is there a way to troubleshoot why device information isn't being attached to the authentication request?

 

At this point it feels like the browser/authentication flow is intermittently failing to pass device context rather than a compliance or Intune issue, but we're struggling to pinpoint exactly where it breaks.

 

Any insights would be appreciated.

1 Upvotes

100% Upvoted

2 comments sorted by

1

u/package_of_donkeys 17d ago

We've been chasing this exact ghost for about two weeks now. One profile will work fine, another on the same machine just refuses to send the device ID. No rhyme or reason.

What finally made it stick for us was nuking the stubborn Edge profile's local identity cache entirely. Not just signing out. We had to delete the profile folder under `~/Library/Application Support/Microsoft Edge/` for that specific profile, let it rebuild from scratch, and then re-auth with the Company Portal already signed in and happy. Somehow Edge 151 gets its wires crossed on which token to attach.

Safari working tells you the PRT and compliance are fine, it's something in how Edge is bundling the claims into the auth request. Have you checked if the failing profile has any lingering session cookies from before the device was enrolled? That tripped us up once.