topic Re: ISE Integration with Intune MDM in Network Access Control

ISE Integration with Intune MDM

ndahemmy — Thu, 28 Nov 2024 13:59:19 GMT

Hello,

We intend to integrate ISE with with Microsoft Intune MDM. all of documentation i have seen, You have to register ISE as an application in Azure AD and use certificates for authentication. I have two questions in my mind if anyone has an answer kindly share.

Q1. Is it possibkle to use shared key or password instead of certificates ? thinking certificates expires am trying to think other alternatives.

Q2. Is it possible to integrate ISE in Intune itself instead of creating ISE as an application in Azure AD then the app use API to talk with ISE ?

Thank you

Re: ISE Integration with Intune MDM

Flavio Miranda — Thu, 28 Nov 2024 14:43:19 GMT

@ndahemmy

Q1- not sure about the PSK but certificate is always the best option.

And you can define how long a certificate last. Althouth the good practice is not too long period

Q2- These are the supported MDM on cisco doc

Supported Unified Endpoint Management and Mobile Device Management Servers

Supported MDM servers include products from the following vendors:

Absolute
Blackberry - BES
Blackberry - Good Secure EMM
Cisco Meraki Systems Manager
Citrix XenMobile 10.x (On-prem)
Globo
IBM MaaS360
Ivanti (previously MobileIron UEM), core and cloud UEM services

Re: ISE Integration with Intune MDM

ndahemmy — Thu, 28 Nov 2024 19:23:20 GMT

You didn't include Intune in supported MDM though it is supported as per below document

https://www.cisco.com/c/en/us/td/docs/security/ise/UEM-MDM-Server-Integration/b_MDM_UEM_Servers_CiscoISE.pdf

Re: ISE Integration with Intune MDM

Flavio Miranda — Thu, 28 Nov 2024 19:31:36 GMT

Sorry. Probably is the doc version.

• Cisco Meraki Systems Manager
• Ivanti (previously MobileIron UEM) core and cloud UEM services
• Microsoft Endpoint Manager Intune
• JAMF Casper Suite
• VMware Workspace ONE (previously AirWatch)

Re: ISE Integration with Intune MDM

Greg Gibbs — Thu, 28 Nov 2024 21:17:30 GMT

A1. No. If you want to use the GUID method, it requires using a certificate with the properly formatted GUID string. The other option is using the MAC address for performing the registration/compliance lookup against Intune, but that has other issues (docks, dongles, randomized MAC Addresses, etc).

A2. Entra ID is the identity store behind Intune and they are tightly coupled. Creating the App Registration in Entra ID provides the Service Principal that is needed to interact with Intune. This is how is works on the MS side and is not specific to ISE.