search

benwhitis / Jamf_Conditional_Access

Resources and documents for the Jamf Pro/Azure AD Conditional Access integration
MIT License
50 stars 5 forks source link

Query: Difference between the two EAs available to check registration status #5

Closed azgmacos closed 2 months ago

azgmacos commented 5 months ago

I wanted to understand the difference in how you are using the two provides EAs to check registration status?

Trying to understand where the second one that was more recently published comes into play...

Thanks!

benwhitis commented 2 months ago

Hey @azgmacos sorry for the delay!

EA_registrationStatus.sh is the registration status script, it checks whether there is a WPJ certificate and whether or not a jamfAAD gatherAADInfo has completed successfully.

microsoftCAEnabledEA.sh tracks whether or not the value microsoftCAEnabled in the com.jamfsoftware.jamf.plist is configured properly. This boolean is determined by whether or not the computer is a member of the applicable group when using the "Device Compliance" integration. This boolean must be 'true' or the registration flow will bail out after Company Portal closes. In environments with more complex Applicable Group criteria, computers may enter this group and try to register before the com.jamfsoftware.jamf.plist is updated. Running a sudo jamf manage will force it to update if needed.

DuplicateMSALAccountEA.sh tracks an issue that can occur if an end user signs in to multiple different Microsoft accounts on the same registered local user account. This issue was fixed in Jamf Pro 11.3 and is also no longer relevant in 11.5 with the removal of the recurring gatherAADInfo.