Enable Entra conditional access for the "Fleet conditional access" group

[noahtalerman]

UPDATE: @noahtalerman: We learned that it's not possible for Fleet to enable Entra conditional access for all users in Entra/Intune. Independent of their group.

Instead, we're following Jamf's lead and asking the user to create a "Fleet conditional access" group in Entra. Required for conditional access to work with Fleet and Entra.

More discussion here: #32228 (comment)

---

• @noahtalerman: We learned that fleetdm.com (proxy) is currently enable Entra conditional access to the first group listed in the response from a Microsoft API. This is a brittle approach. If someone deletes that group, the integration breaks.
  • Instead, we want Fleet to enable Entra conditional access for all users in Entra/Intune. Independent of their group. To do this, we think we want to enable conditional access for the "All Users" group.
• @tux234 started digging into potential solutions here: https://fleetdm.slack.com/archives/C097P4TAPRR/p1755813004309959?thread_ts=1755283810.707229&cid=C097P4TAPRR

[noahtalerman]

Hey @lukeheath I think this deserves a P2. We haven't been able to reliably use Entra conditional access in dogfood.

cc @eashaw

[eashaw]

From Microsoft's documentation:

In addition to the Microsoft Entra groups that you can create and use with Intune, Intune includes two virtual groups that are only available within the context of Intune and from within the Intune admin center:

@noahtalerman I don't think we can do this on the proxy. The proxy needs to assign the created partner compliance policy to an Entra ID group, and the "All users" virtual group is not available to it.

[noahtalerman]

I don't think we can do this on the proxy. The proxy needs to assign the created partner compliance policy to an Entra ID group, and the "All users" virtual group is not available to it.

@eashaw got it.

I checked how Jamf does it and it sounds like creating a special Entra group is the best practice for Jamf + Entra too: https://learn.microsoft.com/en-us/intune/intune-service/protect/jamf-managed-device-compliance-with-entra-id#microsoft-entra-administrative-configurations

The user picks this group when connecting Jamf + Entra up in Intune. I think Jamf is capturing this group somehow. This way, the user is deciding what Entra group to use.

What's the simplest change for us to enable the same?

[eashaw]

What's the simplest change for us to enable the same?

@noahtalerman I will need to see what the response from list groups Graph API endpoint is when the integration is scoped to a specific group and not all users to be sure.
If changing the scope to a single group makes it so only that group appears in the response from the Microsoft Graph API, then the integration will select that group automatically, and we only need to update the setup guide. If the response still contains all groups on the Entra tenant when scoped, then we will need to add a way for the proxy to know what group to select.

@tux234 Can you create a new Entra ID group for the compliance integration, change the scope of the compliance partner to that team, and disconnect and reconnect the integration on dogfood when you get a chance?

[tux234]

Done! I've now associated the compliance connector with a new group. Let me know what else you need!

[eashaw]

@noahtalerman @tux234, Scoping the integration to a single Entra ID group did not affect the groups API response. The response contained every group on the tenant, and the compliance policy was assigned to the first group in the response ("Solutions consultants" team) when it was reconfigured.

We will need a way for the proxy to know which group the policy should be assigned to. I think the simplest change we could make on the proxy to support this is to update it to look for an Entra ID group with a set name (e.g., "Fleet conditional access devices").

[noahtalerman]

look for an Entra ID group with a set name (e.g., "Fleet conditional access devices").

@eashaw I like it! That's a good, simple idea. I think we go with "Fleet conditional access". It's shorter and we don't have to worry about "hosts" v. "devices". Also, we're assigning users in Entra to this group right?

How can we make it so it's hard for users to shoot themselves in the foot? Maybe the proxy can look for group name in "case-insensitive" fashion. Meaning "Fleet Conditional Access" would also work.

Also, what happens if we want to rename the group later? (ex. to "Fleet conditional access devices") Could we tack on support for that group such that we won't break existing setups?

I opened a PR to the guide: #32298

cc @lucasmrod @tux234 @rachaelshaw

[lucasmrod]

Agree. Sounds like a good idea (that won't require Fleet server changes).

Also, what happens if we want to rename the group later? (ex. to "Fleet conditional access devices") Could we tack on support for that group such that we won't break existing setups?

I'm wondering what should happen if the group is deleted...

[eashaw]

Also, we're assigning users in Entra to this group right?

@noahtalerman Yes, this would be a user group.

Maybe the proxy can look for group name in "case-insensitive" fashion. Meaning "Fleet Conditional Access" would also work.

👍 The search is case-insensitive, so we won't need to worry about this.

Also, what happens if we want to rename the group later? (ex. to "Fleet conditional access devices") Could we tack on support for that group such that we won't break existing setups?

I don't think renaming the group would affect anything once the compliance policy is assigned to the group. If we want to test this, the integrations compliance policy is currently assigned to the "Solutions consultants" group, we can change the name and refetch a host with a conditional access policy.