Intune - MDM

[jim.thomas]

This question is more of an architecture question. Intune integration has been working fine with no  issues. However, looking at this closer, I'm seeing that the PAN's cert is uploaded/trusted by the OATH app on the Azure-side of the connection. This infers that if the PAN is rebooted or goes down and the secondary PAN is NOT in auto-failover mode, the MDM interrogation will fail. Is that correct? In other words, we cannot have the PSN interrogate Intune, only the active PAN?

[saxenanitesh8522 · Accepted solution]

Hi,

There was document with regards to the same:-

Step 1: Download/export ISE PAN certificate (only one cert incase of wild card cert, both
primary PAN and secondary PAN cert incase of CA signed public certificates)

https://community.cisco.com/t5/security-documents/how-to-integrate-microsoft-intune-with-ise-2-1-presentation/ta-p/3619502  --> page 18.

Now the certificate which is exported is wildcard or ca signed.

[anilraj_003]

I have similar kind of problem, whereas, we replace PAN admin cert and my MS Intune broken, non of PSN detected that Intune integration attribute, and in Radius log, that claiming MDM server retries in PIP query. Meanwhile, new cert is also uploaded before hand on MS intune side as well. In PAN Intune test is fine, but none of endpoint querying our Intune. resultant, all endpoint moved to guest network and has big outage. 

[anilraj_003]

As a solution, given earlier by someone, I am not able to open that URL. By the way, I am using ISE 3.2 patch-7. If anyone has any ideas, pls let me know. Thanks. 

[Greg Gibbs]

The link referenced below is from 5 years ago and is no longer current. The following guide is the most current documentation on integration with Intune.
https://www.cisco.com/c/en/us/td/docs/security/ise/UEM-MDM-Server-Integration/b_MDM_UEM_Servers_CiscoISE/m_integrate-microsoft-endpoint-manager-intune.html

If your PAN and PSNs use different Admin certificates (have different thumbprints), they all need to be added to the App Registration  used for the Intune integration.

If you have confirmed that has been done and are still having issues, you should open a TAC case to investigate further.

[anilraj_003]

Hello Gibbs,

Here our story is a bit different, After replacing the admin certificate on PAN, the MDM connections for PSN stopped working, with most of them showing “MDM Server unreachable” and some of PSN is working fine with partial endpoint and some of the endpoint still unreachable to pip MDM query. 

TAC case already opened and Cisco is unable to provide RCA, with why it happened. They simply say, delete the endpoint and it will re-catch the mdm attribute. That is not a good approach. Currently still a case with the cisco BU Team.