topic Re: Authentication Provider Error with Azure AD connection in ArcGIS Pro Questions

Authentication Provider Error with Azure AD connection

danbecker — Tue, 23 Apr 2024 00:00:52 GMT

Our Azure tenant is deployed in Azure Government.

Followed these steps: Connect to authentication providers from ArcGIS Pro—ArcGIS Pro | Documentation

When I attempt to sign into the connection in Pro, I get this error:

I assigned demo_user permission to access the ArcGIS Pro Azure Enterprise app.

I also edited our conditional access policies to exclude demo_user from any policies requiring MFA.

Even with MFA, I complete the MS Authenticator prompt and still see this error in Pro.

The Azure enterprise app sign-in log shows successful login attempts with both MFA/not, no issues.

Anyone have any ideas?

Here's my concern: Redirect URI (reply URL) restrictions - Microsoft identity platform | Microsoft Learn

Redirect URIs must begin with the scheme https

From the first link, step #1C when you register Pro as an Azure app:

For Redirect URI, choose Mobile and desktop applications as the platform and enter the URI: arcgis-pro://auth

Could this error be caused by the authorization server (Microsoft) not allowing demo_user to be redirected back to Pro because the arcgis-pro:// schema doesn't match the required https:// schema that MS requires?

Re: Authentication Provider Error with Azure AD connection

JonahLay — Tue, 23 Apr 2024 16:40:20 GMT

Hi @danbecker,

Can you please confirm that you configured the redirect uri as "arcgis-pro://auth"? It doesn't need to be https since "arcgis-pro://auth" is not a localhost redirect uri.

Jonah

Re: Authentication Provider Error with Azure AD connection

danbecker — Tue, 23 Apr 2024 16:46:17 GMT

@JonahLay

Yes, that redirect URI is what I have.

We can close this thread, the problem was a CA policy in InTune scoped to demo_user requiring "All users terms of use". This is odd because demo_user has already accepted our all users Terms of Use policy. So, it seems like the ESRI auth. connection doesnt' support that CA grant control.

After excluding demo_user from that CA policy, everything works as expected both with/without MFA.

This is great progress ESRI, thanks!