Closed Bug 1965984 Opened 1 year ago Closed 10 months ago

Intune Joined Devices on Firefox

Categories

(Core :: Networking, defect)

Product:
Core
Component:
Networking
Version:
Firefox 138
Type:
defect

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: tallen, Unassigned)

Details

Attachments

(3 files)

log.txt-main.27724.moz_log
3.94 MB, application/octet-stream
Details
Firefox Conditional Access Message
50.34 KB, image/png
Details
Intune Firefox Rejection.png
32.21 KB, image/png
Details

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0

Steps to reproduce:

I created a Conditional Access policy to restrict access to certain enterprise apps to only work on Intune joined devices. The error message mentions that I need to enable a setting from within Firefox called Windows SSO, mentioned here: https://support.mozilla.org/en-US/kb/windows-sso. This setting is already enabled and I am still getting an error.

Actual results:

It tells me to enable Windows SSO, which is already enabled.

Expected results:

It should load the website!

I've looked through some old bugs and everything said this should be working.

Are you using containers at all?

We have some new logging for this that's in Firefox 139. Once I get how to enable it, we can test on beta and see if we can understand what's going on.

OK, so if you can test this on Firefox 139, that would help us diagnose.

https://www.mozilla.org/en-US/firefox/channel/desktop/

Enter about:logging on the URL bar
You can use the default logging settings.
Set Logging output to Logging to a file and specify the directory where you would like to store the log file (Where we would like to save your log)
Click "Start Recording" button (on top)
Attempt Microsoft SSO
Log should be available in the directory.

Thanks.

Windows SSO failure on FireFox 139.0b7

Looking at the log, I see the headers being attached. Can you post a screenshot of the error? I'm going to reach out to Microsoft.

FYI, I'm trying to get Conditional Access setup for my machine so I can debug.

So I just tested this and it's working for me.

I had my team setup conditional access for my device when accessing office365.

I created a new profile and tried to access office365 and got the "You can't get there from here" message that you were referring to (attached).

I then went into Firefox settings, turned on Windows Single Sign On and tried again and it worked.

So from what I can tell, it should be working.

Flags: needinfo?(tallen)
Flags: needinfo?(tallen)

Troubleshooting details
If you contact your administrator, send this info to them.
Copy info to clipboard
Error Code: 53001
Request Id:
Correlation Id:
Timestamp: 2025-05-15T18:17:37.791Z
App name:
App id:
IP address:
Device identifier:
Device platform: Windows 10
Device state: Compliant

I've redacted some of the identifiers but the Device is marked as compliant.

I'm at a loss. As I said, I tested this exact scenario, saw the same error, and then when I flipped Windows SSO on, it worked.

And you're not using the Multiaccount containers extension?

Can you try a couple of things?

  • Use a different windows device with Firefox and see if anything is different.
  • Try using Firefox nightly https://nightly.mozilla.org/
  • Try using a different Firefox profile
  • Go to about:config and make sure that cookiebanners.service.mode is 0
Flags: needinfo?(tallen)

(In reply to Mike Kaply [:mkaply] from comment #9)

I'm at a loss. As I said, I tested this exact scenario, saw the same error, and then when I flipped Windows SSO on, it worked.

And you're not using the Multiaccount containers extension?

I am definitely using this extension. Do I need to disable it in order to make this work?

Flags: needinfo?(tallen)

I am definitely using this extension. Do I need to disable it in order to make this work?

Ah, that helps.

You don't need to disable it. You just need to set prefs so that SSO works in specific containers. (We don't have UI in containers yet)

So in about:config (or via policy), you can add a new pref:

network.http.windows-sso.container-enabled.XXXX

where the XXX is the number of the container you want to enable.

and set it to true.

network.http.windows-sso.container-enabled.0 is the "default" container.

You can look at the file "containers.json" in your profile directory to get the actual numbers, or you can just add entries for the numbers of containers you have

network.http.windows-sso.container-enabled.1
network.http.windows-sso.container-enabled.2
network.http.windows-sso.container-enabled.3

(In reply to Mike Kaply [:mkaply] from comment #12)

I am definitely using this extension. Do I need to disable it in order to make this work?

Ah, that helps.

You don't need to disable it. You just need to set prefs so that SSO works in specific containers. (We don't have UI in containers yet)

So in about:config (or via policy), you can add a new pref:

network.http.windows-sso.container-enabled.XXXX

where the XXX is the number of the container you want to enable.

and set it to true.

network.http.windows-sso.container-enabled.0 is the "default" container.

You can look at the file "containers.json" in your profile directory to get the actual numbers, or you can just add entries for the numbers of containers you have

network.http.windows-sso.container-enabled.1
network.http.windows-sso.container-enabled.2
network.http.windows-sso.container-enabled.3

I pulled the userContextId values from my containers.json file from my profile and I'm still getting the same "You can't get there from here" error message (for example, network.http.windows-sso.container-enabled.11 = true) I'm not sure how I can ask end users to do this if we decide to go with Intune based enforcement. It shouldn't be this difficult.

I pulled the userContextId values from my containers.json file from my profile and I'm still getting the same "You can't get there from here" error message (for example, network.http.windows-sso.container-enabled.11 = true) I'm not sure how I can ask end users to do this if we decide to go with Intune based enforcement. It shouldn't be this difficult.

I agree. When this was originally implemented, we believed that containers wasn't greatly used in enterprise and that people wouldn't want SSO in those containers for privacy reasons.

I'm going to prioritize:

  1. A generic preference for using SSO in all containers.
  2. Adding UI to the containers addon.

Thank you.

Even if I attempt the SSO process outside of a container, it's still failing. Could it be something else?

Even if I attempt the SSO process outside of a container, it's still failing. Could it be something else?

So looking more at your error message specifically, it's not about a device condition, it's about joining the domain.

I was specifically testing device (we don't have an AD setup).

I'll check with Microsoft.

Have you also tried with a new profile, without any extensions?
https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles

Flags: needinfo?(tallen)

Mike, did we hear back from microsoft?

Tallen, did you get a chance to test this with new profile without any extensions?

Flags: needinfo?(mozilla)

(In reply to Sunil Mayya from comment #18)

Mike, did we hear back from microsoft?

Tallen, did you get a chance to test this with new profile without any extensions?

What fixed my issue was to remove the checkbox in Conditional Access for requiring a Hybrid joined device.

Flags: needinfo?(tallen)

I never heard back from Microsoft.

Flags: needinfo?(mozilla)

Closing this as I dont see it being actionable anymore from our end.
Feel free to re-open otherwise.

Status: UNCONFIRMED → RESOLVED
Closed: 10 months ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: