Unsupported Devices Exploit Microsoft Entra Policy Loophole

Microsoft Entra Conditional Access policies can be bypassed by unsupported devices due to a misconfiguration in Device Platforms, according to a recent discovery. The issue arises when organizations select 'Any device' instead of checking every device platform in the list, causing Conditional Access to fail open rather than fail closed.

This allows unknown and unsupported devices to fall outside the scope of policies targeting specific device platforms. However, users can spoof their user-agent string from a client's desktop, making it difficult for Entra to identify the actual device platform.

To address this issue, experts recommend creating a report-only block policy that includes 'Any device' and excludes only the supported platforms. This change is well-documented in Microsoft Learn articles but often overlooked.

Device Platforms are not a security boundary and can be easily spoofed, making it essential to rely on other controls such as device compliance, filters, authentication strengths, and token protection.