Conditional Access in IdP are getting logged out, exclusively on iPhones

On the IdP side, focus on Conditional Access behavior that is specific to iOS/iPadOS and Safari-based flows, because the issue is only seen on iPhones and only for apps behind Conditional Access.

Key checks and actions:

1. Review device platform conditions in Conditional Access
   • Verify whether any Conditional Access policies target iOS (or iOS/iPadOS) differently from other platforms.
   • Confirm that these policies are not configured with shorter sign-in frequency or stricter session controls for iOS than for other platforms, which could cause earlier reauthentication when the Cato session expires.
2. Check for iPadOS/macOS classification behavior (if iPads are involved)
   • For iPadOS devices, Conditional Access can treat Safari-based access as macOS instead of iOS. If any of the affected devices are iPads, ensure there is an appropriate macOS Conditional Access policy in place and that it aligns with the iOS policy. Otherwise, session behavior can differ from what is expected on other platforms.
3. Validate browser and client conditions
   • If access is via Safari on iPhone, confirm that Conditional Access policies that use client apps or browser conditions do not have special rules that would force reauthentication or block sessions for Safari/iOS.
4. Check session lifetime and sign-in frequency settings
   • In Conditional Access session controls, review any configured sign-in frequency or other session management settings that might interact with the Cato VPN session expiration.
   • Avoid overly aggressive reauthentication settings for iOS; frequent prompts can occur when upstream network conditions (like VPN reconnects) change.
5. Use sign-in logs to identify the exact policy causing logout
   • When an affected iPhone user is logged out after the Cato timer expires, open the Microsoft Entra ID sign-in logs for that user and event.
   • On the Conditional Access tab of the sign-in details, identify which policy is applied and whether it is marking the session as non-compliant or requiring reauthentication.
   • Adjust that specific policy’s conditions (platform, client app, or session controls) so that iOS behavior matches other platforms.
6. Validate device state for iOS devices
   • In the sign-in logs, confirm that the device is reported as Managed or Compliant where expected. If the device state is missing or inconsistent for iPhones, Conditional Access may treat those sessions differently and force reauth when network conditions change.

If, after aligning Conditional Access policies across platforms and verifying device compliance, iPhones still behave differently, collect sign-in logs for a failing iPhone session and a working non-iOS session and compare which Conditional Access policies and session controls are evaluated differently.

References:

• Configure adaptive session lifetime policies
• Session timeouts for Microsoft 365
• Action Required: Evaluate and update Conditional Access policies after new iPadOS release
• Error when accessing applications from iOS devices
• Troubleshooting access and session controls for admin users