search

Gerenios / AADInternals

AADInternals PowerShell module for administering Azure AD and Office 365
http://aadinternals.com/aadinternals
MIT License
1.24k stars 214 forks source link

Device is not in required device state: compliant #3

Closed Rostes closed 3 years ago

Rostes commented 3 years ago

Hi Nestori Syynimaa, Thanks for your article. It's look really cool. I tested it in a test environment and I encountered some difficulty.

When using Invoke-AadIntPhishing, I successfully received the refresh token but it seems that I only get it for graph.windows.net. And when I want to use the token to send a message (outlook or teams) I have the following error: "Device is not in required device state: compliant." Looking forward to read you.

NestoriSyynimaa commented 3 years ago

First, the function can return only on access token, which in this case is for graph.windows.net. But you can use -SaveToCache switch to get tokens also for Outlook and Teams to be saved to the cache.

Second, seems that your organisation has conditional access policies in place blocking devices that are non-compliant. And the "device" here is referring to the deviceid claim of the access token. If it does not exists, the device is always non-compliant. And you can't get the deviceid claim using device code authentication method.

You can use Read-AADIntAccessToken to see the claims.