Global Secure Access for SMB doesn't recognize Windows Hello Authentication or Conditional Access Policies

Rich Bouchard 15 Reputation points
2024-01-24T19:32:08.1233333+00:00

Starting to play around with Global Secure Access, specifically on prem SMB file share access. I'm encountering two problems. One, if I log into my test machine with a username and password the access works seemlessly. If I log in via Windows Hello using a pin I'm prompted to enter credentials to access the SMB share. Two, in both cases it's ignoring my conditional access policy to require MFA to access the resource. Conditional access policies are working with Global Secure Access; a separate application for RDP to an on prem server works with CA as expected.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,366 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Akshay-MSFT 17,641 Reputation points Microsoft Employee
    2024-01-25T10:51:40.8633333+00:00

    @Rich Bouchard

    Thank you for posting your query on Microsoft Q&A, from above description I could understand that you have following queries:

    1. Logging onto test machine with windows hello pin prompts you for credentials when accessing SMB share.
    2. Conditional access policy to require MFA to access the SMB share is ignored by global secure access.

    Please do correct me for any discrepancies by responding in the comments section.

    PFB answers inline:

    • Logging onto test machine with windows hello pin prompts you for credentials when accessing SMB share.

    This could be due to On-prem SMB shares being configured with Kerberos authentication, and windows hello is not configured with cloud Kerberos trust

    You may validate this with event logs on you device by accessing User Device Registration admin log under Applications and Services Logs > Microsoft > Windows.

    Cloud Kerberos trust prerequisite check in the user device registration log

    The cloud Kerberos trust prerequisite check isn't done on Microsoft Entra joined devices. If Microsoft Entra Kerberos isn't provisioned, a user on a Microsoft Entra joined device will still be able to sign in, but won't have SSO to on-premises resources secured by Active Directory.

    • Conditional access policy configured to prompt for MFA while accessing the SMB share is ignored by global secure access.

    This could have been because of known limitation for private access traffic, according to which:

    "Applying Conditional Access policies to Private Access traffic is not currently supported. To model this behavior, you can apply a Conditional Access policy at the application level for Quick Access and Global Secure Access apps. For more information, see Apply Conditional Access to Private Access apps."

    However, if above mentioned is not the case, then kindly share the sign in logs with CA evaluation information by eliminating the PII say username, UPN or tenant id.

    Please "Accept the answer", "Upvote" and rate your experience. This will help us and others in the community as well. Thanks, Akshay Kaushik

    1 person found this answer helpful.