Adobe Reader Purview Extension SIgn-in and Entra Conditional Access Support

Question

Hi,

Using Adobe Reader with the Purview Extension enabled to show information protection labels. When the Purview extension prompts for sign-in the user has to perform MFA with our Microsoft Entra tenant because their managed device is not recognized. Is there a way to make Adobe Reader and the Purview extension on MacOS work with Entra Condtional Access so=uch that our managed devices are recognized?

Thanks

AnandSri · Answer

Hello @authentic_Sunrise9487

I hope you are doing well, and thank you for reaching out.

This behavior is expected today, and it’s due to a current limitation in how Adobe Reader + the Microsoft Purview Information Protection (MPIP) extension authenticates on macOS.

When the Purview Extension prompts for sign-in, Adobe Reader uses a browser/CEF‑based authentication flow. On macOS, this flow does not pass device identity or compliance signals to Microsoft Entra ID. As a result, Conditional Access cannot recognize the Mac as a managed/compliant device, so Entra ID enforces MFA even when the device is fully managed.

Microsoft’s own Conditional Access guidance for macOS requires device‑ID‑aware authentication flows (Intune enrollment, Platform SSO, SSO extensions, etc.) to validate compliance. Adobe Reader’s MPIP sign‑in on macOS currently does not support this compliance signal, so Conditional Access falls back to MFA.

For detailed information, please see this article: https://adobe.ly/4qRzwAG

I hope this helps.

Thanks,

Anand Sri.

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded