Creating a Custom Scope for Jamf Connect and Conditional Access Policies

Creating a custom scope for Jamf Connect applications ensures that Entra ID Conditional Access policies apply as expected to the Jamf Connect login application and the Resource Owner Password Grant (ROPG) check appears as a successful login on sign-in logs.

Administrators may observe failed login attempts in the log for the enterprise application created in Microsoft Entra ID when using Jamf Connect and a Conditional Access policy that requires multifactor authentication (MFA) for the target of "All cloud apps". While this is expected behavior of the ROPG workflow, it may trigger a user appearing in the Microsoft Entra ID risky sign-ins report.

The target of "All cloud apps" applies policies beyond the logins to specific cloud services and applies policies to non-interactive workflows like those with ROPG. Specifically, the "All cloud apps" target applies to any application requesting a login with the scope of any of the following: openid, profile, or email.

The OpenID Connect 2.0 uses these default scopes to obtain an access or identity token for a client application. Consequently, in its default configuration, Jamf Connect login uses the openid, profile, or email scope. The only way to apply a Conditional Access policy in this default behavior is to apply the policy to "All cloud apps" with no exceptions applied, or the Conditional Access policy will break.

1. Creating an app registration with a custom API

2. Configuring scope for the Jamf Connect deployment file

3. Creating an app registration using a new API permission

4. Creating an Entra ID Conditional Access policy

5. Exempting the Jamf Connect ROPG application from Conditional Access policies applied to "All cloud apps"

6. Creating a Jamf Connect configuration profile