starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-02-03 21:25:34 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

Azure Cloud Shell: Add support for Device Conditional Access #11274

New Issue
Open
opened 2026-01-31 02:43:08 +00:00 by claunia · 7 comments
claunia commented 2026-01-31 02:43:08 +00:00
Owner
Copy Link

Originally created by @lly-unik on GitHub (Nov 4, 2020).

Environment

Windows build number: 10.0.19042.572
Windows Terminal version (if applicable): 1.3.2651.0

Steps to reproduce

Open Azure Cloud shell and attempt to connect with our Azure tenant

Pre-requisite

Our company uses Azure Conditional Access policies and require computers to be domain-joined devices in order to connect with our tenant without multi-factor.

Expected behavior

I would expect the cloud shell to connect once I completed the steps listed in the prompt (i.e. enter pin from device login web site)
https://devblogs.microsoft.com/commandline/the-azure-cloud-shell-connector-in-windows-terminal/

Actual behavior

I receive the following error:
AADSTS53001: Device is not in required device state: domain_joined. Conditional Access policy requires a domain joined device, and the device is not domain joined.
Trace ID: 24bab79e-1e96-4524-abd1-833c53a30d00
Correlation ID: ddbce269-f8ca-41e5-9d92-d9bb4d63320f
Timestamp: 2020-10-30 07:27:02Z

Additional notes

I've been made aware, that we've seen a similar error when using the Azure Storage Explorer.
https://feedback.azure.com/forums/217298-storage/suggestions/36283420-conditional-access-support-for-storage-explorer

Originally created by @lly-unik on GitHub (Nov 4, 2020). <!-- 🚨🚨🚨🚨🚨🚨🚨🚨🚨🚨 I ACKNOWLEDGE THE FOLLOWING BEFORE PROCEEDING: 1. If I delete this entire template and go my own path, the core team may close my issue without further explanation or engagement. 2. If I list multiple bugs/concerns in this one issue, the core team may close my issue without further explanation or engagement. 3. If I write an issue that has many duplicates, the core team may close my issue without further explanation or engagement (and without necessarily spending time to find the exact duplicate ID number). 4. If I leave the title incomplete when filing the issue, the core team may close my issue without further explanation or engagement. 5. If I file something completely blank in the body, the core team may close my issue without further explanation or engagement. All good? Then proceed! --> <!-- This bug tracker is monitored by Windows Terminal development team and other technical folks. **Important: When reporting BSODs or security issues, DO NOT attach memory dumps, logs, or traces to Github issues**. Instead, send dumps/traces to secure@microsoft.com, referencing this GitHub issue. If this is an application crash, please also provide a Feedback Hub submission link so we can find your diagnostic data on the backend. Use the category "Apps > Windows Terminal (Preview)" and choose "Share My Feedback" after submission to get the link. Please use this form and describe your issue, concisely but precisely, with as much detail as possible. --> # Environment ``` Windows build number: 10.0.19042.572 Windows Terminal version (if applicable): 1.3.2651.0 ``` # Steps to reproduce Open Azure Cloud shell and attempt to connect with our Azure tenant ## Pre-requisite Our company uses Azure Conditional Access policies and require computers to be domain-joined devices in order to connect with our tenant without multi-factor. # Expected behavior I would expect the cloud shell to connect once I completed the steps listed in the prompt (i.e. enter pin from device login web site) https://devblogs.microsoft.com/commandline/the-azure-cloud-shell-connector-in-windows-terminal/ # Actual behavior I receive the following error: AADSTS53001: Device is not in required device state: domain_joined. Conditional Access policy requires a domain joined device, and the device is not domain joined. Trace ID: 24bab79e-1e96-4524-abd1-833c53a30d00 Correlation ID: ddbce269-f8ca-41e5-9d92-d9bb4d63320f Timestamp: 2020-10-30 07:27:02Z # Additional notes I've been made aware, that we've seen a similar error when using the Azure Storage Explorer. https://feedback.azure.com/forums/217298-storage/suggestions/36283420-conditional-access-support-for-storage-explorer
claunia added the Help WantedIssue-TaskPriority-3Product-TerminalArea-AzureShell labels 2026-01-31 02:43:08 +00:00
claunia commented 2026-01-31 02:43:09 +00:00
Author
Owner
Copy Link

@Don-Vito commented on GitHub (Nov 5, 2020):

Not an expert, but were you performing the Device Code Flow (entering device code into prompt)? Asking this because there is a known limitation in the Conditional Access, where it is not aware of the device state, as described here.
image

@Don-Vito commented on GitHub (Nov 5, 2020): Not an expert, but were you performing the Device Code Flow (entering device code into prompt)? Asking this because there is a known limitation in the Conditional Access, where it is not aware of the device state, as described [here](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/require-managed-devices). ![image](https://user-images.githubusercontent.com/4639110/98298228-511c7980-1fbe-11eb-8e4a-9a43b083963d.png)
claunia commented 2026-01-31 02:43:09 +00:00
Author
Owner
Copy Link

@lly-unik commented on GitHub (Nov 5, 2020):

Yes, I believe this was what I was trying to do. I just opened the Azure Cloud Shell tab and wanted to authenticate using the flow suggested in the terminal.

What your suggesting is, that we should adjust our conditional access policies according to the above description? So I should be prompted for a multi-factor control when trying to connect through the Azure Cloud Shell?

I'll try and see if I'm able to test this and report back the results.

@lly-unik commented on GitHub (Nov 5, 2020): Yes, I believe this was what I was trying to do. I just opened the Azure Cloud Shell tab and wanted to authenticate using the flow suggested in the terminal. What your suggesting is, that we should adjust our conditional access policies according to the above description? So I should be prompted for a multi-factor control when trying to connect through the Azure Cloud Shell? I'll try and see if I'm able to test this and report back the results.
claunia commented 2026-01-31 02:43:09 +00:00
Author
Owner
Copy Link

@Don-Vito commented on GitHub (Nov 5, 2020):

If it is OK with the security policies of your company, instead of requiring device state related conditions for the relevant apps, you can require user related conditions like MFA. An example can be found https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/untrusted-networks.
Of course you can provide additional scoping of this policy to specific apps, users, etc.

@Don-Vito commented on GitHub (Nov 5, 2020): If it is OK with the security policies of your company, instead of requiring device state related conditions for the relevant apps, you can require user related conditions like MFA. An example can be found https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/untrusted-networks. Of course you can provide additional scoping of this policy to specific apps, users, etc.
claunia commented 2026-01-31 02:43:09 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Nov 20, 2020):

Thanks. This is, as you astutely note, due to us using device login. We will almost certainly have to rearchitect how login works, but we're not equipped to do so.

I'm going to put this up on the backlog. Let me know if your conditional access policy change helps 😄

@DHowett commented on GitHub (Nov 20, 2020): Thanks. This is, as you astutely note, due to us using device login. We will almost certainly have to rearchitect how login works, but we're not equipped to do so. I'm going to put this up on the backlog. Let me know if your conditional access policy change helps :smile:
claunia commented 2026-01-31 02:43:10 +00:00
Author
Owner
Copy Link

@Don-Vito commented on GitHub (Nov 20, 2020):

@DHowett - it's more a feature than a bug. IMHO the device login flow is a good choice for terminal, as it is simple and interactive, though it has some limitations with specific Conditional Access requirements. I guess we simply need to add some addition way to authenticate for users that device login doesn't fit their needs (service principal?)

@Don-Vito commented on GitHub (Nov 20, 2020): @DHowett - it's more a feature than a bug. IMHO the device login flow is a good choice for terminal, as it is simple and interactive, though it has some limitations with specific Conditional Access requirements. I guess we simply need to add some addition way to authenticate for users that device login doesn't fit their needs (service principal?)
claunia commented 2026-01-31 02:43:10 +00:00
Author
Owner
Copy Link

@lly-unik commented on GitHub (Nov 20, 2020):

I was able to test this the other day and managed to get a successful verification using Azure Terminal with our tenant.

My IT-department couldn't tell me if they had changed anything. It appeared to just work out of the blue?! (which of course isn't true - something must have changed)

But I don't know whether a conditional Access rule was changed by IT or if something else changed.
Sorry I can't be of better help :-(

@lly-unik commented on GitHub (Nov 20, 2020): I was able to test this the other day and managed to get a successful verification using Azure Terminal with our tenant. My IT-department couldn't tell me if they had changed anything. It appeared to just work out of the blue?! (which of course isn't true - something must have changed) But I don't know whether a conditional Access rule was changed by IT or if something else changed. Sorry I can't be of better help :-(
claunia commented 2026-01-31 02:43:10 +00:00
Author
Owner
Copy Link

@Don-Vito commented on GitHub (Nov 20, 2020):

At least it works - which is great already!

@Don-Vito commented on GitHub (Nov 20, 2020): At least it works - which is great already!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
⛺ Reserved
A11yCO
A11yMAS
A11ySev1
A11ySev2
A11ySev3
A11yTTValidated
A11yUsable
A11yVoiceAccess
A11yWCAG
Area-Accessibility
Area-AtlasEngine
Area-AzureShell
Area-Build
Area-Build
Area-Chat
Area-CmdPal
Area-CodeHealth
Area-Commandline
Area-CookedRead
Area-DefApp
Area-Extensibility
Area-Fonts
Area-GroupPolicy
Area-i18n
Area-Input
Area-Interaction
Area-Interop
Area-Localization
Area-Output
Area-Performance
Area-Portable
Area-Quality
Area-Remoting
Area-Rendering
Area-Schema
Area-Server
Area-Settings
Area-SettingsUI
Area-ShellExtension
Area-ShellExtension
Area-ShellExtension
Area-Suggestions
Area-Suggestions
Area-TerminalConnection
Area-TerminalControl
Area-Theming
Area-UserInterface
Area-VT
Area-Windowing
Area-WPFControl
AutoMerge
Blocking-Ingestion
Culprit-Centennial
Culprit-WinUI
Disability-All
Disability-Blind
Disability-LowVision
Disability-Mobility
External-Blocked-WinUI3
Fixed
Gathering-Data
good first issue
HCL-E+D
HCL-WindowsTerminal
Help Wanted
Impact-Compatibility
Impact-Compliance
Impact-Correctness
Impact-Visual
In-PR
InclusionBacklog
InclusionBacklog-Windows TerminalWin32
InclusionCommitted-202206
Issue-Bug
Issue-Docs
Issue-Feature
Issue-Feature
Issue-Question
Issue-Samples
Issue-Scenario
Issue-Task
Needs-Attention
Needs-Author-Feedback
Needs-Bisect
Needs-Discussion
Needs-Repro
Needs-Tag-Fix
Needs-Tag-Fix
Needs-Triage
No-Recent-Activity
Priority-0
Priority-1
Priority-2
Priority-3
Product-Cmd.exe
Product-Colortool
Product-Colortool
Product-Colortool
Product-Conhost
Product-Conpty
Product-Meta
Product-Powershell
Product-Terminal
Product-WSL
pull-request
Mirrored from GitHub Pull Request
 Resolution-Answered
Resolution-By-Design
Resolution-Duplicate
Resolution-External
Resolution-Fix-Available
Resolution-Fix-Committed
Resolution-No-Repro
Resolution-Won't-Fix
Severity-Blocking
Severity-Crash
Severity-DataLoss
spam
this-will-be-a-breaking-change
Tracking-External
WindowsTerminal_Win32
Work-Item
zAskModeBug
zInbox-Bug
No Label Area-AzureShell Help Wanted Issue-Task Priority-3 Product-Terminal
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#11274
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?