Device Compliance policy cannot be satisfied if AllowSingleSignOnUsingOSPrimaryAccount is not used

[akunadze]

Ref: https://github.com/MicrosoftEdge/WebView2Feedback/issues/550

Description We are using WebView2 to facilitate SAML logins to Azure AD. If AllowSingleSignOnUsingOSPrimaryAccount is used everything goes smoothly. However, sometimes we need to force the user to enter his credentials, which can only be accomplished by turning AllowSingleSignOnUsingOSPrimaryAccount off. This seems to disable device information from being passed to the login server, which makes it impossible to sign in if there's a device-based policy in place, even if the entered credentials are the same as the primary OS account. Login fails, listing the device as "unregistered".

Version SDK: 1.0.774.44 Runtime: 95.0.1020.53 Framework: Win32 OS: Win10

AB#37148932

[champnic]

Thanks for the bug report @akunadze - I've added it to our backlog.

[ABSlukrawie]

The issue is two years old, is there any solution?

[ZwergNaseXXL]

Bump. We just ran into this issue with one customer. However, just setting this option globally might create issues with other customers. A related question: While researching this, I discovered Chrome's "CloudAPAuthEnabled" (MS doc, Chrome doc). Does this only apply to actual Chrome browsers or also to WebView2 hosted browsers (since they're based on Chrome)?