Hi Fred,
Your efforts have been the most helpful, as you stated the Azure Portal has changed considerably from any official documentation.
I have just managed to pull the integration together with the help of many articles So I thought I might put my procedure up as I have to do this again in production.
I also hope it helps others.
Disclaimer, I have not actively tested that this works with an ISE authorization or authentication policy and additional permissions and policies may have to be added.
***** Install the Azure Certificate into ISE *****
Download the Baltimore Certificate from https://portal.azure.com
Click the Padlock Icon on address bar
Click Certificate (valid)
Change to Certification Path Tab
Select the Baltimore Certificate
Click View Certificate
Change to the Details Tab
Click Copy to File...
Save the Certificate and close all Certificate windows.
login to ISE Portal
Navigate to Administration -> System -> Certificate
Navigate to Trusted Certificates
Import the Downloaded Baltimore Certificates
Proceed through the SHA1 Warning and Duplicate warning to complete the install.
***** Generate ISE Key for upload to Azure *****
Login to ISE Portal
Navigate to Administration -> System -> Certificates
Navigate to System Certificates
Select the Default Self Signed or other Signed Certificate
Export the certificate
***** Generate and record the base64 Certificate details *****
Open Powershell ISE
Add the following power command to the script pane:-
$certpath = "<<Path to certificate>>"
$cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cer.Import("$certpath")
$bin = $cer.GetRawCertData()
$base64Value = [System.Convert]::ToBase64String($bin)
$bin = $cer.GetCertHash()
$base64Thumbprint = [System.Convert]::ToBase64String($bin)
$keyid = [System.Guid]::NewGuid().ToString()
"KeyThumbprint: $base64Thumbprint" | Out-Host
"keyID: $keyid" | Out-Host
"keyValue: $base64Value" | Out-HostReplace <<path to certificate>> with you certificate and path like C:\Certs\ISE.cer
Record the KeyThumbprint, KeyID and KeyValue
Note: when used the keyValue need to be on a single line without line breaks.
***** Create New Azure Application *****
Login to Azure
Navigate to Azure Active Directory
Navigate to App registrations
Add New Registration
Name: ISE
Supported Account types: Single Tenant
Redirect URI: Web
URI: "blank"
***** Upload ISE Certificates into ISE Application *****
Navigate to Azure Active Directory
Navigate to App registrations
Select ISE Application
Navigate to Manifest
Download Manifest (Do not rename)
Modify Line:
From:
"keyCredentials": [],
To:
"keyCredentials": [
{
"customKeyIdentifier": "<<KeyThumbprint>>",
"keyId": "<<KeyID>>",
"type": "AsymmetricX509Cert",
"usage": "Verify",
"value": "<<KeyValue>>"
}
],Replace <<KeyThumbprint>> with ISE Certificate KeyThumbprint recorded earlier
Replace <<KeyID>> with ISE Certificate KeyID recorded earlier
Replace <<KeyValuet>> with ISE Certificate KeyValue recorded earlier
If a 2nd Certificate is needed download and obtain the base64 values and modify the Manifest file with an additional customKeyIdentifier
"keyCredentials": [
{
"customKeyIdentifier": "<<KeyThumbprint1>>",
"keyId": "<<KeyID1>>",
"type": "AsymmetricX509Cert",
"usage": "Verify",
"value": "<<KeyValue1>>"
},
{
"customKeyIdentifier": "<<KeyThumbprint2>>",
"keyId": "<<KeyID2>>",
"type": "AsymmetricX509Cert",
"usage": "Verify",
"value": "<<KeyValue2>>"
}
],Finally Upload New Manifest File to ISE App
***** Configure Azure Permissions *****
Navigate to Azure Active Directory
Navigate to App registrations
Select ISE Application
Navigate to API Permissions
Remove existing - Microsoft Graph - Delegated - User.Read
Add the Following Permissions
Microsoft Graph
Delegated
offline_access - Maintain access to data you have given it access to
openid - View users basic profile
Application
Directory.Read.All - Read directory data
Intune
Application
get_device_compliance - Get device state and compliance information from Microsoft Intune
Grant admin consent if required.
***** Record Required Values for ISE *****
Navigate to Azure Active Directory
Navigate to App registrations
Select ISE Application
Navigate to Overview
Record Values for Application (client) ID:
Select Endpoints
Copy Values for:
Microsoft Graph API endpoint:
OAuth 2.0 token endpoint (v1):
***** Create External MDM In ISE *****
Login to ISE Portal
Navigate to Administration -> Network Resources -> External MDM
Add New MDM Server
Name: Azure_Intune_MDM
Server Type: Mobile Device Manager
Authentication Type: OAuth - Client Credentials
Auto Discovery: Yes
Auto Discovery URL: Use the Value from Microsoft Graph API endpoint
Client ID: Use the Value from the Application (client) ID
Token Issuing URL: Use the value from the OAuth 2.0 token endpoint (v1)
Token Audience: Leave at default (prepopulated - https://api.manage.microsoft.com/)
Description: Azure Intune MDM
Polling Interval: 240
Time Interval for Compliance Device ReAuth Query: 1
Status: Enabled
Notes: Microsoft Graph API endpoint may need to be adjusted if not working with recorded value.
Use https://graph.windows.net/<<tenant-id>>
<<tenant-id>> can be found on OAuth 2.0 token endpoint (v1) URL
https://login.microsoftonline.com/<<tenant-id>>/oauth2/token
