Issue Description
Microsoft Entra logs present many failed login attempts from Jamf Connect. MFA rules may mark device as non-compliant for Conditional Access.
When a user logs into Jamf Connect a keychain item is created in the Login keychain for the user. Jamf Connect menu bar uses this keychain item to test it against the Identity Provider (IdP) at a regular interval. The default interval is 60 minutes however this can be configured with the NetworkCheck key.
Jamf Connect will receive one of three responses from the IdP:
Invalid password response - which Jamf Connect treats as a failure.
When that failure happens, the user is prompted to sign into Jamf Connect and the keychain item is deleted. It will be regenerated when the user next logs into the application and their accounts are synced.
Success response from the IdP- which Jamf Connect treats as a success.
Request for MFA - which Jamf Connect also treats as a success.
In this scenario, Jamf Connect knows that the password in the keychain is the correct and current password. Because the MFA response is treated as a success, the end user is never prompted to proceed with the MFA request, and the request fails on the IdP logs side.
Troubleshooting Steps
For more information on resolving this expected behavior see:
Jamf Github containing the workaround: https://github.com/jamf/jamfconnect/tree/main/azure_conditional_access