Conditional Access vs. the Shared Lab
A university deploys 80 shared iMacs in a lab, enrolled via ADE and supervised, bound to Active Directory for authentication. They enable a conditional access policy in their identity provider requiring a compliant device to access email and the LMS. Students log in with their own accounts. Within a day, students report they can't reach email from the lab. The IdP shows the devices as 'not compliant.' The MDM compliance policy requires FileVault, a passcode, and OS version 14.4 or later. The lab iMacs are on 14.2 and use a shared local account, not FileVault.
1. Explain why the shared lab Macs fail conditional access and identify the design conflicts.
Read the worked answer
Conditional access evaluates the device's compliance state as reported by MDM to the IdP. Three conflicts:
- OS version: policy requires 14.4; lab is on 14.2 - non-compliant until updated.
- FileVault: shared lab machines typically aren't encrypted with an escrowed institutional key in a way the compliance policy recognizes, so the FileVault check fails.
- Identity model: shared devices with many user accounts don't map cleanly to per-user device compliance; the device compliance is device-scoped, but the shared-account model means the device itself must be compliant, not the user.
Result: every student is blocked because the device is non-compliant, regardless of who they are.
2. Propose a remediation that preserves security without blocking the lab.
Read the worked answer
Options, in order of preference:
- Bring the lab into compliance: update to 14.4+, enable FileVault with institutional key escrow on the shared Macs (feasible with a shared local account and institutional recovery key), and ensure the compliance policy's passcode requirement is satisfiable on a shared account (or exempt shared devices from the passcode clause).
- Scope conditional access: create a policy exception for the lab device group or for the lab's network, so shared devices are evaluated differently than personal devices. This is a risk decision, not a technical fix.
- Separate the shared-device identity: use a shared device mode / kiosk identity so the IdP sees a managed shared device rather than a personal user device.
The correct answer combines updating the fleet and adjusting the compliance policy so a shared, encrypted, managed device can be compliant.
3. A stakeholder asks: can't we just turn off conditional access for students?
Read the worked answer
Recommend against blanket disablement. Conditional access is a primary control against credential theft and unmanaged device access. Disabling it for all students removes protection from personal devices too.
Better: narrow the exception to the specific lab device group, document the compensating controls (supervised, AD-bound, physically controlled lab, network segmentation), and set a review date. This preserves the control for the broader population while unblocking the lab.