Devicelogin blocked by unknown device platform conditional access policy

[jorik90]

I'm trying to connect to my AKS cluster using the (default) devicelogin. Since kubelogin is not sending anything to identify the device (like an user-agent), the Azure built-in conditional access policy 'CA010: Block access for unknown or unsupported device platform' blocks the access.

Using kubelogin convert-kubeconfig -l interactive or kubelogin convert-kubeconfig -l azurecli on the same machine works fine.

[weinong]

Hi @jorik90, your observation is correct. Device Login doesn't work with Conditional Access policy. I can update the readme to point this out.

[jorik90]

That would be a nice first step. Maybe it's possible to also provide a user-agent so some policies can comply?

[weinong]

@jorik90 you can update the policy using the client app ID (80faf920-1908-4b52-b5ef-a8e7bedfc67a) or server appID (6dae42f8-4368-4678-94ff-3960e28e3630)