CJJun 28, 2023

In today's edition of “I have no idea what Conditional Access is doing”, somehow the Duo Azure AD Sync enterprise application is matching a policy that only includes the predefined “Office365 app".

@merill @JefTek @nathanmcnulty Is there something I'm missing here that makes 3rd party enterprise apps match the Office365 app in CA policies?

Show threadallthingssec (aka techgrltweeter)
@crh @merill @JefTek @nathanmcnulty I don't think i've ever seen wording like that "office 365 app included" - very odd
Jun 28, 2023 at 12:55amWeb
Show threadMerill Fernando  Jun 28, 2023
@allthingssec @crh @JefTek @nathanmcnulty Maybe it is using one of the Microsoft app ids
Show threadCJJun 28, 2023
@merill @allthingssec @JefTek @nathanmcnulty Is there a list of those somewhere for what’s covered in the Office365 app? I found the list of services covered by it.
Show threadJef Kazimer😶‍🌫️Jun 28, 2023

@crh @merill @allthingssec @nathanmcnulty if I had to guess, it is likely requesting a token for ms graph api and is resolving to the o365 app group which has it?

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/reference-office-365-application-contents

Office 365 App in Conditional Access reference - Microsoft Entra

What are all of the services included in the Office 365 app in Azure AD Conditional Access

Show threadCJJun 28, 2023

@JefTek @merill @allthingssec @nathanmcnulty Oh interesting, it does show the resource in the CA log as Graph which would be covered by 365.

In this scenario, is excluding the Duo app from the CA policy supposed to work?

Show threadNathan McNultyJun 28, 2023
@crh @JefTek @merill @allthingssec If you have the conditions to repro, I have Duo in my tenant that I can use to test ;)
Show threadCJJun 28, 2023

@nathanmcnulty @JefTek @merill @allthingssec Enable the Azure AD user sync. That’s the app which is having the issue.

Oddly the trusted endpoints sync uses a service principal. The user sync seems a little odd how they do it.

Show threadNathan McNultyJun 28, 2023
@crh @JefTek @merill @allthingssec This?
https://duo.com/docs/azuresync
Synchronizing Users and Admins into Duo from Azure AD

Learn how to synchronize Duo users and groups or Duo administrators from your Azure Active Directory (AAD) domain.

Duo Security
Show threadCJJun 28, 2023
@nathanmcnulty @JefTek @merill @allthingssec Yep, for users only.
Show threadJef Kazimer😶‍🌫️Jun 28, 2023

@crh @nathanmcnulty @merill @allthingssec FYI - This is because the Duo Azure AD Sync app/client is making a call to MS Graph API which brings it in scope of policies targeting the Office365 app group. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/reference-office-365-application-contents

For this kind of automation Duo should be using a service principal vs a user account I would think though.

You cannot scope a CA policy to include/exclude the MS Graph API explicitly, but it is included in the O365 App. You can also use CA App Filtering as Caleb explains in this CA Deep Dive Video. https://www.youtube.com/watch?v=HylR3JLUtMs

Office 365 App in Conditional Access reference - Microsoft Entra

What are all of the services included in the Office 365 app in Azure AD Conditional Access

Show threadCJJun 28, 2023

@nathanmcnulty Very weird sign in logs after it’s authorized - it always shows the IP of the original authorization even though it’s obviously running in Duo cloud, the user agent is something like “PageGetter” and the platform is just generic “Windows”.

I almost think they’re doing something like token replay to keep the auth alive.