ISE 3.2 using Intune as external MDM

[Jonathan-Vellturo]

Hi,

We recently migrated from 2.6 to 3.2 and running patch 7.  We are using Intune as an external MDM server and have reconfigured ISE using GUID    My understanding is that Intune stopped supporting UDID based queries.  Our Windows machines are showing "true" under MDM registration status although we don't have a cert with a GUID.  Our MacBook's are also showing "True" when Private Wi-Fi address is set to none.  We don't get any MDM stats when set to fixed or randomized which is causing the MacBook's to fail.  My 1st question is why is this working if I don't have GUID in the SAN field on my machine cert and my second question is why the macbooks are failing when set to fixed or randomized 

[Greg Gibbs]

There was a short time when Microsoft removed support for MAC Address based lookups, but the current Compliance Retrieval API does support it.
https://learn.microsoft.com/en-us/intune/intune-service/protect/network-access-control-integrate#data-shared-with-nac-partners

If you have no GUID being presented to ISE for the lookups, you would have to be performing those using the MAC address. Lookups using MAC address would be impacted by randomised MAC addresses and docks/dongles.

[Jonathan-Vellturo]

Thanks!  I have the SAN field URI set for ID:Microsoft Endpoint Manager:GUID {{DeviceID}}.  I still cannot connect when set to Randomize.  When I'm set to off it works.  How can I verify that ISE is using the GUID and not the mac address?

[arane0001]

when you say SAN field URI ..this part you mentioned is on the Intune , correct ? Let me check I can find this out for you.

I recently did the Intune and had lot of issues with it. But to tell you ISE does check for MAC address in Intune for it to be verified

[Greg Gibbs]

First, you should ensure that your Intune and ISE environment is configured as per the documentation here:
https://cs.co/ise-mdm

If setup correctly, you should see the following in your ISE External MDM configuration indicating the use of APIv3.

Also in the MDM configuration, ensure that you have the SAN URI option enabled and set as the first priority.

The only way to confirm which identity is used for the MDM lookup would be to use the Debug Wizard (Operations > Troubleshoot > Debug Wizard) to set the necessary debugs to Debug or Trace level.

You can see an example of the debug logs in the Webinar I delivered here:
https://www.youtube.com/watch?v=iAKyIHFqbgE
53:39 Troubleshooting with ISE `external-mdm` Log

[ahollifield]

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/identity-service-engine-software-3-1-3-2.html