Cisco ISE - Intune Integration

[hs08]

I'm try to integrate Cisco ISE to Intune with following this article, and i got this error. Anyone know why?

How to: Integrate Cisco ISE MDM with Microsoft Intune - Cisco Community

[Aref Alsouqi]

Seems InTune is not happy with the certificate being used.

[hs08]

Lol. But are you know which certificate should be download from intune?

I already download and import below certificate:

• Microsoft Azure RSA TLS Issuing CA 03
• Microsoft Azure RSA TLS Issuing CA 04
• Microsoft Azure RSA TLS Issuing CA 07
• Microsoft Azure RSA TLS Issuing CA 08
• Microsoft TLS RSA Root G2

[Aref Alsouqi]

Good question ;). I think it's more the certificate on InTune side. Have you exported ISE cert and imported it into InTune?

[Aref Alsouqi]

They are steps 5 through 7 on the link you shared.

[hs08]

yes i already create app registration and certificate from ise already imported to this app.

[Aref Alsouqi]

No sure what else to suggest, sorry. Maybe @Greg Gibbs or @thomas could suggest something.

[Greg Gibbs]

See my blog post regarding the certificate changes and requirements related to the Intune MDM integration:
https://cs.co/ise-entraid#Intune

"

Please note that the Microsoft TLS Issuing CA certificates formerly used by the ISE Intune MDM integration function will expire on 27 June 2024. However, Microsoft has already completed the rotation of the certificates used for the Compliance Retrieval (NAC 2.0) API endpoints.

With those changes, ISE is now only required to have the DigiCert Global Root G2 CA certificate in Trusted Certificates store for the MDM lookups to work properly. Although this Root Certificate is installed in the Trusted Certificates store by default, you should ensure that the option for 'Trust for authentication within ISE' is enabled under the Usage options."

If this certificate setting has been confirmed but it is still not working, you might need to open a TAC case to investigate further via the debug logs.