topic Re: ISE integration with MS Intune - Auto discovery URL in Network Access Control

ISE integration with MS Intune - Auto discovery URL

mapretty — Wed, 26 Jun 2019 13:06:59 GMT

Hi ISE experts

We have a customer integrating ISE with Intune. The MS supplied "Auto Discovery URL" was "graph.microsoft.com" but I checked around and the suggested URL was "graph.microsoft.net". So the customer tried that, and .net works instead of .com

Supplied https://graph.microsoft.com/xxxxxxxxxx

Working https://graph.windows.net/xxxxxxxxxx

Did anyone get it to work with ".com"

I have no visibility of what Intune is showing, but the ".com" was the MS general recommendation, but clearly didn't work. Is this an error, or is there some pointers in Intune to ".net" also?

This is happening more the once from what I can see. Is there an error in Intune, or is ISE not doing something right with .com?

thanks

Mark

Re: ISE integration with MS Intune - Auto discovery URL

Jason Kunst — Wed, 26 Jun 2019 14:50:32 GMT

ISE doesn’t do anything with that, can you provide more information on where you are doing this and what for? I would suggest asking Microsoft as well as its their service

Re: ISE integration with MS Intune - Auto discovery URL

mapretty — Wed, 26 Jun 2019 21:45:46 GMT

hey Jason

So, from the Intune setup (https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01001.html#id_37138)

step 8, configuring Auto Discovery URL, we get the URL from MS, but it was originally graph.windows.com. The connection to Intune from ISE failed with this configuration, and the log:

>>>>>>

2019-06-17 12:47:01,567 ERROR [admin-http-pool1][] cpm.mdm.auto.discovery.MdmServerAutoDiscoveryManager -::::- Unable to discover MDM server for IntuneMDM.
com.cisco.cpm.mdm.auto.discovery.MdmServerAutoDiscoveryException: Unrecognized field "error" (Class com.cisco.cpm.mdm.auto.discovery.MdmAzureDirectoryServiceErrorResponse), not marked as ignorable
at [Source: java.io.StringReader@abcdef; line: 2, column: 13] (through reference chain: com.cisco.cpm.mdm.auto.discovery.MdmAzureDirectoryServiceErrorResponse["error"])

<<<<<<<

however, I noted in other cases with the same error, specifically the error: Unrecognized field "error" that changing to .net resolved the issue.

I realise this is a URL controlled and published by MS, I just want to understand why ISE may not like the .com, and if there is somewhere else in Intune (as I don't have a login) it show's a .net URL?

cheers
Mark

Re: ISE integration with MS Intune - Auto discovery URL

Nidhi — Thu, 27 Jun 2019 15:00:06 GMT

Allow me sometime to check on this . do you also have a TAC case opened for this ? Thanks, Nidhi

Re: ISE integration with MS Intune - Auto discovery URL

mapretty — Thu, 27 Jun 2019 22:02:41 GMT

hi Nidhi

Not at the moment, I'll open one if it helps

cheers
Mark

Re: ISE integration with MS Intune - Auto discovery URL

packetplumber9 — Fri, 28 Jun 2019 18:47:26 GMT

I don't have an answer for you, but I can say I've had the windows.net autodiscovery URL configured for several years without issue on my deployment

Re: ISE integration with MS Intune - Auto discovery URL

hslai — Sun, 30 Jun 2019 03:00:32 GMT

I just checked the URL you provided and it looked like already corrected.

Both Microsoft Intune as MDM server for Cisco ISE – Rohit Goel’s Blog and How to Integrate Microsoft Intune with ... - Cisco Community show it a string value for "MICROSOFT AZURE AD GRAPH API ENDPOINT" from the MS Azure management portal.

ISE	Intune
Auto Discovery URL	Endpoints > Microsoft Azure AD Graph API Endpoint
Client ID	{Registered-App-Name} > Application ID
Token Issuing URL	Endpoints > OAuth 2.0 Token Endpoint

Re: ISE integration with MS Intune - Auto discovery URL

Nidhi — Mon, 01 Jul 2019 06:53:38 GMT

The config guide also mentions .net .

you might want to verify the url in intune setup as well . Engineering says there is no such limitation from the code

Auto Discovery URL—Enter the value of Microsoft Azure AD Graph API Endpoint from the Microsoft Azure management portal. This URL is the endpoint at which an application can access directory data in your Microsoft Azure AD directory using the Graph API. The URL is of the form: https://<hostname>/<tenant id>, for example, https://graph.ppe.windows.net/47f09275-5bc0-4807-8aae-f35cb0341329. An expanded version of this URL is also in the property file, which is of the form: https://<Graph_API_Endpoint>/<TenantId_Or_Domain>/servicePrincipalsByAppId/<Microsoft Intune AppId>/serviceEndpoints?api-version=1.6&client-request-id=<Guid.NewGuid()>.

Re: ISE integration with MS Intune - Auto discovery URL

mapretty — Tue, 02 Jul 2019 01:21:34 GMT

hi Nidhi

thanks again, the URL supplied by MS via the customer was: https://graph.microsoft.com/........

Our issue here is there are 3 URLs being thrown around.

1. graph.microsoft.com - supplied by customer from Intune. Didn't work

2. graph.ppe.windows.net - Cisco documentation. Didn't work

3. graph.micrsoft.net - found in various TAC cases and not known where it really came from.....Works!

If there's no limitation, why would the first two, well documented, URLs not work?

thanks

Mark

Re: ISE integration with MS Intune - Auto discovery URL

hslai — Tue, 02 Jul 2019 02:23:14 GMT

If there's no limitation, why would the first two, well documented, URLs not work?

Please see my earlier response.

The URL is what set in the MS Azure management portal and the customers need copy from the values I indicated there. The URL string given there is an example and will look different on each Azure account.

To be clear, Microsoft Intune as MDM server for Cisco ISE – Rohit Goel’s Blog says,

7. In ISE, configure the Intune server in ISE

For more information about configuring and external MDM server, see Define Mobile Device Management Servers in ISE. The fields that are important for Intune are described below:

Auto Discovery URL - Enter the value of Microsoft Azure AD Graph API Endpoint from the Microsoft Azure management portal. This the endpoint at which an application can access directory data in your Microsoft Azure AD directory using the Graph API. The URL is of the form: https://<hostname>/<tenant id>, for example, https://graph.ppe.windows.net/47f09275-5bc0-4807-8aae-f35cb0341329. An expanded version of this URL is also in the property file, which is of the form:

...

Re: ISE integration with MS Intune - Auto discovery URL

Freemen — Wed, 18 Nov 2020 02:51:39 GMT

Unrecognized field "error" (Class com.cisco.cpm.mdm.auto.discovery.MdmAzureDi
rectoryServiceErrorResponse), not marked as ignorable at [Source: java.io.StringReader@4810b402; line: 2, column: 13] (through reference chain: com.cisco.cpm.mdm.auto.discovery.MdmAzureDi
rectoryServiceErrorResponse["error"])

I got this error despite i imported alot of CA cert related.. any advise?

Re: ISE integration with MS Intune - Auto discovery URL

najam.shah78 — Wed, 09 Dec 2020 23:14:37 GMT

Have you got any resolution to this ? Cisco documentation is vague at best.

Re: ISE integration with MS Intune - Auto discovery URL

fontenot.garrett — Tue, 20 Jul 2021 17:45:41 GMT

This is a cert issue. Add these into the Cisoc ISE trust certificate store - 4 certs (2 root and 2 intermediate) need to be in there as well as the URL certificates for the following:

DigiCert
DigiCert Sha2 Secure Server CA
DigiCert Global Root G2
Microsoft Azure TLS issuing CA 06

https://login.microsoftonline.com/<Tenat ID>/oauth2/v2.0/token
https://fef.msuc05.manage.microsoft.com/
https://graph.windows.net/

Re: ISE integration with MS Intune - Auto discovery URL

nir-r — Thu, 09 Sep 2021 10:46:51 GMT

Try to add permissions also to Azure Active Directory Graph and not just to Microsoft Graph & Intune.

Azure Active Directory Graph:

=======================

Directory.Read.All- Delegated

Directory.Read.All- Application

User.Read.All- Delegated

Re: ISE integration with MS Intune - Auto discovery URL

Aileron88 — Fri, 10 Sep 2021 09:37:47 GMT

I've integrated Intune successfully recently, with the following settings:

Server Type: Mobile Device Manager

Authentication Type: OAuth – Client Credentials

Auto Discovery: Yes

Auto Discovery URL: https://graph.windows.net/{TenantID}

Client ID: {ClientID}

Token Issuing URL: https://login.microsoftonline.com/{TenantID}/oauth2/v2.0/token

Token Audience: https://api.manage.microsoft.com/

Re: ISE integration with MS Intune - Auto discovery URL

Tim Fairclough — Mon, 28 Mar 2022 07:20:12 GMT

Hi All,

I have also been able to get the Intune integration working using the graph.windows.net URL; however, found a Cisco document that this URL will no longer work after June 2022...:

Microsoft is deprecating Azure Active Directory (Azure AD) Graph and will not support Azure AD Graph-enabled integrations after June 30, 2022. You must migrate any integrations that use Azure AD Graph to Microsoft Graph. Cisco ISE typically uses the Azure AD Graph for integration with the endpoint management solution Microsoft Intune. Any integration between Cisco ISE and Microsoft Intune that still uses Azure AD Graph applications (https://graph.windows.net/ <Directory (tenant) ID>) will not work beyond June 30, 2022.

Source: https://www.cisco.com/c/en/us/td/docs/security/ise/UEM-MDM-Server-Integration/b_MDM_UEM_Servers_CiscoISE/chapter.html#task_gvy_vnj_tnb

Although my recent integration using this URL is 'working', ISE warns that the MDM is using an old API Version (v2) instead of the new Version 3 API. This means I cannot use GUID as a device identifier, only MAC Address. You can see at the bottom where you would normally specify GUID, however it is greyed out / unavailable... I have deleted and re-added to no avail:

I built this as a Lab PoC back in September 2021 on ISE 3.1 (unpatched) with a demo Azure tenancy, and I was able to use GUID (also using the old graph/windows.net endpoint BTW)...

Has anyone else run into this 'API v2' issue?

Re: ISE integration with MS Intune - Auto discovery URL

Tim Fairclough — Mon, 28 Mar 2022 07:26:15 GMT

For anyone interested, here are the debug logs (ise-psc.log):

2022-03-28 17:51:22,235 DEBUG [admin-http-pool15][] cisco.cpm.mdm.authtoken.MdmAzureActiveDirectoryClient -::::- Access token has acquired succesfully from Microsoft Azure.

2022-03-28 17:51:22,235 DEBUG [admin-http-pool15][] cisco.cpm.mdm.api.MdmServerInfoApi -::::- inside the method : callMdmServerInfoApiOnMdmServer()

2022-03-28 17:51:22,235 DEBUG [admin-http-pool15][] cisco.cpm.mdm.apiimpl.MDMVerifyServer -::::- apiVersionSb : 3, mdmApiVersionSb : , tryWithV3 : false

2022-03-28 17:51:22,235 DEBUG [admin-http-pool15][] cisco.cpm.mdm.apiimpl.MDMVerifyServer -::::- MDM Rest API Server Query String -> /ciscoise/mdminfo/?ise_api_version=3

2022-03-28 17:51:22,235 DEBUG [admin-http-pool15][] cisco.cpm.mdm.apiimpl.MDMVerifyServer -::::- MDM Rest API Server Query PATH String -> /ciscoise/mdminfo/?ise_api_version=3

2022-03-28 17:51:22,235 DEBUG [admin-http-pool15][] cisco.cpm.mdm.apiimpl.MDMVerifyServer -::::- 1. Connecting to the MDM server host fef.msuc01.manage.microsoft.com using apiVersion 3

2022-03-28 17:51:22,235 DEBUG [admin-http-pool15][] cisco.cpm.mdm.util.MdmRESTClient -::::- sendGETRequestDom: start HTTP request - connectionsUsed: 2, connectionsAvailable: 198

2022-03-28 17:51:22,235 DEBUG [admin-http-pool15][] cisco.cpm.mdm.util.MdmRESTClient -::::- sendGETRequestDomNonComp: start HTTP request - connectionsUsed: 0, connectionsAvailable: 200

2022-03-28 17:51:22,235 DEBUG [admin-http-pool15][] cisco.cpm.mdm.util.MdmRESTClient -::::- ===mdmFlowInfo===null,=====serverType=====MobileDeviceManager,===serverAuthType===OAuth - Client Credentials

2022-03-28 17:51:22,235 INFO [admin-http-pool15][] cisco.cpm.mdm.util.MdmRESTClient -::::- GET: MDM Server URL: https://fef.msuc01.manage.microsoft.com/StatelessNACService/ciscoise/mdminfo/?ise_api_version=3

2022-03-28 17:51:22,235 DEBUG [admin-http-pool15][] cisco.cpm.mdm.util.MdmRESTClient -::::- Proxy Config in request = [,null,-1,nullnullnull]

2022-03-28 17:51:22,904 INFO [admin-http-pool15][] cisco.cpm.mdm.util.MdmRESTClient -::::- MDM Server Response Code: 200

2022-03-28 17:51:22,906 DEBUG [admin-http-pool15][] cisco.cpm.mdm.util.MdmRESTClient -::::- sendGETRequestDom: end HTTP request - connectionsUsed: 2, connectionsAvailable: 198

2022-03-28 17:51:22,906 DEBUG [admin-http-pool15][] cisco.cpm.mdm.util.MdmRESTClient -::::- sendGETRequestDomNonComp: end HTTP request - connectionsUsed: 0, connectionsAvailable: 200

2022-03-28 17:51:22,906 DEBUG [admin-http-pool15][] cisco.cpm.mdm.api.MdmServerInfoApi -::::- returning from the method : callMdmServerInfoApiOnMdmServer() -> com.cisco.cpm.mdm.api.MdmServerInfoData Object {

apiPath: /StatelessNacService/ciscodeviceinfo/mdm/api

redirectUrl: https://portal.manage.microsoft.com/networkaccesscontrol/index

queryMaxSize: 100

apiVersion: 2

vendor: Microsoft

productName: Microsoft Intune

productVersion: 5.0

COMMA: ,

errorMsg: null

errorOccurred: false

}

2022-03-28 17:51:22,906 DEBUG [admin-http-pool15][] cisco.cpm.mdm.util.MdmServersCache -::::- mdm Guid is null or empty

2022-03-28 17:51:25,377 INFO [Timer-12][] cisco.mnt.common.utility.AlarmMessageDiskQueue -::::- Inside dequeue

Re: ISE integration with MS Intune - Auto discovery URL

najam.shah78 — Mon, 28 Mar 2022 23:09:07 GMT

This is how you call an API according to MS Doco. I don't see any Cisco documentation which says to include version in there.

------------------------------------------------------------------------------------------------------------

Call a REST API method

To read from or write to a resource such as a user or an email message, you construct a request that looks like the following:

HTTPCopy

{HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters}

The components of a request include:

{HTTP method} - The HTTP method used on the request to Microsoft Graph.
{version} - The version of the Microsoft Graph API your application is using.
{resource} - The resource in Microsoft Graph that you're referencing.
{query-parameters} - Optional OData query options or REST method parameters that customize the response.

Version

Microsoft Graph currently supports two versions: v1.0 and beta.

v1.0 includes generally available APIs. Use the v1.0 version for all production apps.
beta includes APIs that are currently in preview. Because we might introduce breaking changes to our beta APIs, we recommend that you use the beta version only to test apps that are in development; do not use beta APIs in your production apps.

Re: ISE integration with MS Intune - Auto discovery URL

najam.shah78 — Wed, 13 Jul 2022 07:49:55 GMT

Finally, got it working

Re: ISE integration with MS Intune - Auto discovery URL

najam.shah78 — Wed, 13 Jul 2022 07:52:29 GMT

ISE 3.1, Patch 3