O365 apps signing from IOS device detected as MAC device

Question

O365 apps signing from IOS device detected as MAC device

Jahfar 0

We have configured our conditional access policies to block access for macOS and Windows devices that are not connected to the domain. We have also whitelisted iOS and Android devices to allow their access. However, we noticed that the Entra ID sign-in logs incorrectly identified the login as coming from a macOS device, which resulted in access being blocked. In reality, the login was attempted from an iOS device, which should have been permitted according to our conditional access policies.

0 comments

1 answer

Your answer

Answer 1

Conditional Access can identify device platform from information provided by the device, such as the user agent string, and that information is not verified because user agent strings can be modified. That is why an iOS sign-in can appear as macOS in sign-in evaluation and trigger the wrong policy.

To validate whether Conditional Access is the reason for the block and which policy matched:

Open the failed sign-in in Microsoft Entra ID sign-in logs.
Select the failed request.
Check Basic info for the failure reason.
Open the Conditional Access tab to see which policy caused the block.

For policy design, Microsoft recommends using device platform as part of a block statement or together with Intune device compliance policies, because platform detection alone is based on unverified device-provided data.

If the current policy blocks macOS broadly, review whether the block is relying only on platform detection. A more reliable approach is to combine platform targeting with device compliance requirements, or test changes in Report-only mode before enforcing them.

If a policy requires device compliance, note these iOS/macOS behaviors:

On iOS, Android, macOS, and some non-Microsoft browsers, device identification can use a client certificate provisioned during Microsoft Entra registration.
When users first sign in through the browser, they can be prompted to select that certificate before continuing.
In report-only mode, policies that require a compliant device can still prompt users on macOS, iOS, and Android to select a device certificate even though compliance is not enforced.

If the immediate goal is to find the exact blocking rule, start with the sign-in log’s Conditional Access tab for the failed event and confirm whether the macOS block policy was applied to that session.