Conditional Access "Token Protection" is blocking access to Microsoft Graph

[EcoELS]

Hi all

I'm testing the Conditional Access Session Control "Require Token Protection for sign-in sessions (Preview)" and it's now blocking access from Intune Manager:

Anyone run into the same situation? I'm thinking about creating a PIM enabled group for a temporary exclusion from the specific CA policy.

Any thoughts?

[Micke-K]

Hello,

I have not tested this myself, but did you try if WAM works better? Go to Settings and enable "Enable WAM for Enhanced Login methods" and then restart the app.

Note that you have to use PowerShell 7+ to be able to use WAM.

Cheers!

[EcoELS]

Please excuse me being a bit slow, but how do I enable this setting? I cant find the option "Enable WAM for Enhanced Login methods".

I'm running the app from a PS 7.5.2 window, using ".\Start-IntuneManagement.ps1"

Btw. the workaround with a PIM enabled group (being set to eligible and activating it for an hour or so) and excluding that group from the CA policy worked.

[Micke-K]

WAM can be enabled via the menu File - Settings.

Which version are you using? You can download the latest from the Development branch.

Cheers!

[EcoELS]

Ah, I wasn't on the dev branch. I see the option now. Unfortunately, same behavior as above.

Under the KB page, the following supported application is listed:

• Microsoft Graph PowerShell version 2.0.0 or newer with EnableLoginByWAM option

But I don't know if this case falls under one of the known limitations.

PS: Thank you for your work on this project and for publishing it!

[Micke-K]

Hello,

I had a quick look, but the conclusion is that I will have to spend more time on this.

Looks like WAM should support this based on the documentation but not sure if I need to add additional options for the PublicClientApplicationBuilder like Proof-of-Possession tokens.

Cheers!

[EcoELS]

Hmm, it seems to be working now!
Don't know what was the issue last time I tried. I also just tried connecting from Powershell with Connect-MgGraph (without using Set-MgGraphOption –EnableLoginByWAM $true) and that one is blocked by Token Protection CA policy.

[John5373]

Do we need to use a different redirect URL if using WAM? I am receiving a mismatch error.