CefSharp Browser control not working with Azure AD Conditional access - azure-active-directory

Question

We configured our Azure AD application registration to use “Conditional Access” restrictions to lock down the application to machines that are registered to the domain. Unfortunately, in order to successfully authenticate with Conditional Access enabled on chromium based browsers, a browser extension is required
There is quite a bit of documentation around this on Microsoft’s website
• Conditional Access require managed device - Azure Active Directory | Microsoft Docs
• Conditions in Conditional Access policy - Azure Active Directory | Microsoft Docs
when the user trying to log in with cefsharp browser control we see the following error. Tried enabling the browser extension did not help

Answer 1

Sadly CefSharp will not work with Device Management policy.
To prove device identity on Windows, the Windows broker (WAM) needs to intercept the network traffic and inject the device id. The following browsers are supported: Edge, old IE, Chrome with Windows Accounts extension and I'm not sure about Firefox.
Since CefSharp is based on Chromium but does not have the extension (and, afaik, there is no way to install it), WAM cannot inject the device ID in the requests made to AAD.
Possible workaround:
use WebView2 SDK on Windows, which is based on Edge, which is also based on Chromium... At the time of writing, Mac support is planned but not released.
And use Cef on Mac and Linux.

Answer 2

Due to the nature of this issue and complexity behind it, I had to migrate off CefSharp to use the new WebView2 browser component until there is a supported approach released for CefSharp and other third-party browsers to inject logic like the code below. The EdgeWebView2 works by enabling the SSO flag get_AllowSingleSignOnUsingOSPrimaryAccount
C# .NET example code below using the EdgeWebView2 browser component (as of writing this is the only way I know to defeat the authentication message "You can't get there from here"):
CoreWebView2EnvironmentOptions envOptions = new CoreWebView2EnvironmentOptions()
{
AllowSingleSignOnUsingOSPrimaryAccount = true
};
CoreWebView2Environment env = CoreWebView2Environment.CreateAsync(options: envOptions).Result;
webview.EnsureCoreWebView2Async(env);
webview.Source = new Uri("https://portal.azure.com/");