Myriad ways, pretty standard on most corporate networks, to restrict access to corporate devices. I cannot access any of my client's resources, including Web apps, without their laptop.

Simple method is IP whitelisting, easy in some ways painful to keep updated. Vpn is another easy option. But then you can have client side certs, hardware tokens, and endpoint security mechanisms which are probably more robust. Either way, it's not a weird unique thing, it's pretty ubiquitous :)

IP range allowlists, mTLS, any number of conditions on your auth provider, take your choice.

Could you use SSO as a layer for Device whitelisting?

Authenticate with SSO > IDP checks for Device fingerprint > IDP Approves Login if Device is whitelisted

Probably the department's fault for not using (presumably) Entra Conditional Access to restrict SSO to corporate devices / corporate subnets.

This is why if you're building a product, please give SSO for free (see sso.tax) - you shift responsibility, requirements and posture to the tenant's IdP.

In addition to the other things mentioned, some very sensitive applications in my organization must be run from a virtual desktop, which is itself must be run from a locked down corporate laptop.

We typically use VPC Endpoint Services or equivalent for enterprise customers, ie connect our private VPC with their private VPC. Pretty much the best way to do this, no VPNs to manage or IP whitelists to maintain and all traffic is local to the cloud provider.

IDP + MDM, Client certificates, VPNs, tokens/cookies, etc.

I can’t run any web apps from my employer unless I’m on one of their computers. Tokens are only generated on corporate systems. IP access only allowed from corporate VPN.

IP Whitelist, this is standard stuff.

IP whitelists or VPNs

With a VPN for instance

You are not a web app developer, are you?! Please say you are not! Or just doing it for fun and harmless matters.

mTLS with cert in TPM.