Cisco ASA DAP & Cloud Native (Azure AD) Windows Devices

[jm777]

Hi All, 

Looking for suggestions on the best way to use DAP on ASA for Cloud Native (specifically Azure AD) Windows devices using AnyConnect VPN. A cloud native Windows device does not have a registry value for domain - so, wondering if anyone else has run into this. 

Thanks!

[Ruben Cocheno · Accepted solution]

@jm777 

Release of Cisco ASA version 9.17, you can now use various SAML Assertion attributes contained in the “SAML ticket” issued to the client (from the IDP) and sent to the ASA when SAML Authentication is taking place in AnyConnect. Using this approach, you can ask your IDP administrator to include AD Group memberships or attributes as “assertions attributes” in the SAML-ticket if the IDP has an integration with the Active Directory, and when this ticket is shown to the ASA inside AnyConnect for authentication purposes, the ASA sees these attributes and you can then use these as parameters in Dynamic Access Policies (DAP) to build your access rules.