1. What is IBM Security Verify Conditional Access?
IBM Security Verify (ISV) Conditional Access is a risk-based access control framework that evaluates contextual signals at authentication time and enforces step-up authentication or blocks access accordingly.
When a user whose Identity Provider is Microsoft Entra ID authenticates, Entra ID delegates MFA to IBM Security Verify via the External Authentication Method (EAM) extension point. IBM Security Verify then evaluates the following signals to make an access decision:
| Signal |
Source |
What it checks |
| Device compliance |
MaaS360 MDM |
Is the device enrolled and compliant with MDM policies? |
| Device management status |
MaaS360 MDM |
Is the device managed by MaaS360? |
The net result is that Entra ID does not handle MFA natively in this flow. Instead, it fully delegates that responsibility to IBM Security Verify, which performs the authentication, evaluates and applies the Conditional Access policy, and returns the result.
2. How the pieces fit together
The authentication flow at a high level:
3. Prerequisites
- An active IBM MaaS360 tenant
- A Microsoft Entra ID (Azure AD) tenant with Conditional Access licences (P1 or P2)
- Devices enrolled in MaaS360 MDM before testing conditional access
4. Enable SSO: Provision an IBM Security Verify instance in MaaS360 and configure SSO
4.1 — Navigate to settings
Log in to the MaaS360 portal and navigate to Setup > Services & Settings > Services > Identity and Access Management > IBM Security Verify.
4.2 — Provision the IBM Security Verify instance
Click the Configure button. Fill in the following fields:
| Field |
Value |
| IBM Security Verify Subscription Hostname |
Your ISV tenant name only — e.g. yourorg (not the full URL) |
| IBM ID |
Your IBM ID (this field is hidden if you are already logged in with your IBM ID) |
Click Save to provision the instance.
4.3 — Add apps to MaaS360 and enable Enterprise SSO
The MaaS360 portal provides an Enable Enterprise single sign-on option that allows the administrator to select which apps use SSO and Conditional Access in MaaS360 policies.
You can configure both new and existing apps deployed through MaaS360 to use SSO and Conditional Access by enabling the Enterprise single sign-on option.
4.4 — Configure MDM policy per platform
Deploy the MDM policy that enables ISV authentication on managed devices. The configuration steps differ per platform:
5. Setup EAM: Integrate Entra ID with IBM Security Verify
The External Authentication Method (EAM) is an Entra ID extension point that allows Entra ID to delegate MFA to an external provider — in this case, IBM Security Verify. Entra ID does not handle MFA natively in this flow; it hands the MFA decision entirely to ISV.
Follow the IBM Security Verify documentation to complete the EAM integration:
IBM Security Verify Docs — Integrating Entra ID EAM
The documentation walks you through registering ISV as an EAM provider in the Entra ID admin center, configuring the required app registration, and completing the identity linking between Entra ID user identities and ISV.
6. Configurations in Entra
Once EAM is configured, complete the following configurations in the Microsoft Entra admin console.
6.1 — Create a new Conditional Access Policy
Navigate to the Microsoft Entra admin center and go to Entra ID > Conditional Access > Policies. Click New policy and complete the following fields:
| Field |
Value / Setting |
| Name |
A descriptive name, e.g. ISV-Conditional-Access-Policy |
| Users |
Select the users or groups this policy applies to |
| Target resources |
Select the applications to protect |
| Grant |
Require multifactor authentication |
| Enable policy |
Set to On |
6.2 — Disable Authentication methods
Navigate to Entra ID > Authentication methods > Policies. Disable the Microsoft Authenticator authentication method.
7. Configurations in IBM Security Verify
After setting up EAM and the Entra Conditional Access policy, complete the following configurations in the IBM Security Verify admin console.
7.1 — Configure MaaS360 Cloud Extender as Identity Provider
Navigate to Authentication > Identity providers > Add identity provider and select MaaS360 Cloud Extender.
Set both the Name and Realm fields to MaaS360 and check the Enabled checkbox. Save the identity provider.
7.2 — Configure global settings
Navigate to Authentication > Identity providers > Configuration > Global settings. Under the IBM MaaS360 section, set the following:
| Setting |
Value |
| Default Identity Provider |
MaaS360 |
| Unique user identifier |
upn |
7.3 — Configure Authentication factors
Navigate to Authentication > Authentication factors and apply the following settings:
| Setting |
Value |
| Require user to enroll a factor |
Enabled |
| Email OTP |
Disabled |
| SMS OTP |
Disabled |
| Voice OTP |
Disabled |
7.4 — Configure Identity linking
Navigate to Applications > Custom token types > Entra ID EAM ID Token Hint and open the Identity linking tab. Configure the following fields:
| Setting |
Value |
| Incoming token claim |
upn |
| Identity source |
MaaS360 |
| Search by |
Username |
| Just-in-time provisioning |
Enabled (checked) |
7.5 — Configure Sign-in options
Navigate to Security > Sign-in options and click Edit. Under the Show for end user setting, disable all identity providers except MaaS360, ensuring that users are only presented with the MaaS360-based sign-in option at the ISV login screen.
8. Validation
Test the end-to-end flow with the following three scenarios to confirm the conditional access policy is working as expected.
- Use a device that is not enrolled in MaaS360.
- Attempt to sign in to a protected application.
- Sign in with the user's credentials; when prompted, select the external authentication method (ISV).
- ISV evaluates the device management signal — device is unmanaged.
- ISV blocks the authentication. The user should see an access denied message.
- Use a device that is enrolled in MaaS360 but not compliant with the MDM policy (e.g. OS version out of date, required app not installed).
- Attempt to sign in to a protected application.
- Sign in with the user's credentials; when prompted, select the external authentication method (ISV).
- ISV evaluates the device compliance signal — device is non-compliant.
- ISV blocks the authentication. The user should see an access denied message.
- Use a device that is enrolled in MaaS360 and compliant with the MDM policy.
- Attempt to sign in to a protected application.
- Sign in with the user's credentials; when prompted, select the external authentication method (ISV).
- ISV evaluates all signals — device is managed and compliant.
- ISV prompts the user for MFA (IBM Verify push or TOTP).
- On successful MFA, ISV grants the authentication. Entra ID issues the token and the user accesses the application.
9. Summary
The complete end-to-end conditional access flow for a user whose IDP is Entra ID:
Reference links