Adobe Acrobat Sign-In with Device-Aware Conditional Access

Hi @OMEGASquad,

Hope you are doing well. Thanks for writing in!

Acrobat desktop applications do not use Microsoft’s MSAL-based authentication flow, which means:

• The app does not pass the Primary Refresh Token (PRT) from the device

• As a result, device compliance and hybrid Azure AD join-state cannot be evaluated

• Azure Conditional Access policies that require:

  • Compliant device

  • Hybrid Azure AD joined device

will block access, even after successful user authentication

In short, the sign-in succeeds, but Conditional Access fails during token evaluation because device claims are missing.

Let's understand why this happens:

• Acrobat uses a browser-based OAuth flow (system browser / embedded webview) rather than native MSAL integration

• Device identity (PRT) is only passed when apps use:

  • MSAL

  • Windows Account Manager (WAM)

Since Acrobat does not currently leverage these, Azure AD cannot validate device state.

You might want to try the steps mentioned below:

Adjust Conditional Access policy

Modify the policy to exclude Adobe Acrobat from strict device-based enforcement:

• Go to Azure Portal → Conditional Access

• Edit the affected policy

• Under Cloud apps or actions, exclude Adobe-related apps (e.g., “Adobe Acrobat” or “Adobe Document Cloud”)

• Or relax the grant control:

  • Replace “Require compliant device” with:

    • Require MFA

    • or Require approved client app (if applicable)

Use Named Locations or Filters

If full exclusion is not acceptable:

• Allow access from:

  • Trusted IP ranges (corporate network)

• Or use device filters to scope the policy more narrowly

Hope this helps.

Regards,
Souvik