Defender for Endpoint onboarding for iOS using Intune

In the last 8 months, I have seen an increased demand for securing company assets against ransomware and other threat\attack vectors. While organizations typically look at protecting Workstations and Servers from vulnerabilities and attacks, mobile devices often go unnoticed and rarely get prioritised. This is particulary worrisome as technology has come a long way and mobile devices are regularly used as an extension to a primary work device to access corporate data. As convenient it may be, this increases the chance of data leak of sensitve information, especially in today's time when cyber attacks are becoming increasingly sophisticated. This is where the need for a strong Mobile threat defense solution comes into picture. 

Defender for Endpoint for iOS & Android devices is the current MTD solution by Microsoft. Just last month on Jan 25 2022, Microsoft announced the general availability of threat and vulnerability management support for Android & iOS. This means that in addition to existing vulnerability management capabilities in Windows platform, now organizations can monitor, identify impacted devices, assess associated risks in the environment, and use built-in supported workflows to seamlessly remediate vulnerabilities in mobile devices. 

Note: TVM is current only included as part Microsoft Defender for Endpoint Plan 2.

Here is a quick comparision between the offering of Plan 1 and Plan 2 -

In this blog, I will cover steps for onboarding iOS\iPadOS devices onto MDE using MDM (Company Portal) + MAM policies.

System Requirements & Pre-requisites

1. iOS\iPads device need to be running iOS 12.0 and above. Note that starting 31-March-2022, the minimum supported iOS version by Microsoft Defender for Endpoint will be iOS 13.0.

2. The device is either enrolled with the Intune Company Portal app or is registered with Azure Active Directory through Microsoft Authenticator with the same account.

3. Microsoft Defender for Endpoint & Intune licenses assigned to the end users.

Enable Microsoft Intune connection from Microsoft 365 Defender to share device information. (Skip if already configured)

1. On Microsoft 365 Defender Portal navigate to Settings > Endpoints > General > Advanced features > Microsoft Intune connection.

2. Toggle the Microsoft Intune setting to On.

3. Click Save preferences.

4. Head over to Microsoft Endpoint Manager admin center.

5. Select Tentant Administration > Connectors and Tokens > Microsoft Defender for Endpoint and toggle on compliance policy for Android and iOS.

Now compliance policy based on the device threat level will use data from these connectors for evaluation.

Setup compliance policy in Intune with MDE risk level (Applies to Enrolled devices in Intune)

1. On Microsoft Endpoint Manager admin center navigate to Devices > Compliance Policy.

2. Click on Create policy and select Platform as iOS\iPadOS.

3. Give a name and other details and click next.

4. Configure the setting as Low or as needed according to you security requirements. Note: Microsoft recommends using Low or Clear values to ensure maximum security.

5. Next up is to configure the action for device non-compliance. By default the device will be marked non-compliant immediately. But if you want to add any addition action like sending a push notification, then you can do so by adding in the list of actions.

6. Assign to a group of devices or users.

Add MDE application from Appstore in Intune

1. In Microsoft Endpoint manager admin center, go to Apps > iOS/iPadOS > Add > iOS store app and click Select.

2. On the Add app page, click on Search the App Store and type Microsoft Defender for Endpoint in the search bar. In the search results section, click on Microsoft Defender for Endpoint and click Select.

3. Leave defaults and assign to device or user based group as required (recommended).

Device Restriction policy for Zero touch MDE onboarding for Intune enrolled devices.

At the time of writing this blog, Zero touch onboarding for MDE is in preview. Using this, Defender for Endpoint is automatically installed &  configured without the need for the user to open the app.

1. In Microsoft Endpoint manager admin center, go to Devices > Configuration Profiles > Create Profile.

2. Choose Platform as iOS/iPadOS and Profile type as VPN. Select Create.

3. Type a name for the profile and select Next.

4. Select Custom VPN for Connection Type and in the Base VPN section, enter the following:

• Connection Name = Microsoft Defender for Endpoint
• VPN server address = 127.0.0.1
• Auth method = "Username and password"
• Split Tunneling = Disable
• VPN identifier = com.microsoft.scmx
• In the key-value pairs, enter the key SilentOnboard and set the value to True.
• Type of Automatic VPN = On-demand VPN
• Select Add for On Demand Rules and select I want to do the following = Establish VPN, I want to restrict to = All domains.

5. Assign to a group.

Setup App Protection Policies (APP) with Device Threat Level Conditional launch.

Microsoft Defender for Endpoint can be configured to send threat signals to be used in App Protection Policies (APP, also known as MAM) on iOS/iPadOS. With this capability, you can use Microsoft Defender for Endpoint to protect access to corporate data from unenrolled devices as well.

While MAM protection is optional for Intune enrolled devices, it is generally a good practice to apply the App Protection Policies (APP) to add an additional layer of security on your Intune enrolled devices. One can set device launch control to ensure that access to the application on a managed device is only allowed, when MDE threat level has been evaluated. The same can be configured for MAM without enrollment or MAM-WE devices.

1. On Microsoft Endpoint Manager admin center navigate to Apps > App protection policies.

2. Click on Create policy and select iOS\iPadOS.

3. Give a name and other details and click next.

4. You have the option to select all device types, although I recommend to create separate APP for managed devices and managed apps for iOS devices. (You can refer to my previous blog for details.)

5. For target apps, you can select apps individually or select preset bundle for All Microsoft apps or just Microsoft core apps. I am selecting Core Apps as per my requirements.

6. Select the rest of the settings until your reach Conditional Launch section as per your requirement or you can refer to my previous blog for details.

7. Once you reach Conditional Launch, select the Device threat level as Low. Again, Microsoft doesn't recommend Medium or High values, but you can set them up if needed.

8. Assign as normal.

End User Experience

During enrollment or on an enrolled device, if MDE is not installed, then the device will be evaluated as non-compliant and the user will see the following in Company Portal.

Since we are pushing the MDE application, it should automatically install along with other required apps. When it does, it will auto configure as per the Zero-touch device restriction configuration.

On a MAM-WE device, the APP will kick in. When a application is detected as managed application by Intune based on user's corporate identity, MAM policies will apply and user will be asked to install the MDE application.

The same behavior will take place on an Intune enrolled device incase the MDE application does not install automatically or if there is a race condition. It is because of the configuration of MDM + MAM policies that MDE will install one way or the other.

To test for the working of MDE, you can launch smartscreentestratings2.net. Also, even though demo.smartscreen is scheduled to be retired, I was able to test for URL phishing as well.

At this stage you can head over to Microsoft 365 Defender Portal to check for Device inventory and alerts. The above test cases will create Informational alerts in Defender.

Conclusion

To sum up, in addition to Windows devices, now organizations can extend vulnerability management capabilities to mobile devices. What's even better is the flexbility and options around onboarding the devices onto MDE. One thing I left out from the onboarding process is the use of Conditional Access policies. While an option, please note that it works well for devices that are already enrolled in Intune as it grants access using Device compliance state. However, the same cannot be achieved for MAM-WE devices even if you grant access using APP. This is because MDE access on mobile actually takes place using Defender for Mobile application which is currently not supported for APP. If you do configure this, then chances are that you will run into onboarding issues. I did test and ran into some issues on both iOS and Android.

So there you have it. I am drafting another post on the onboarding process for Android and will be posting that very soon. Thank you for reading.

If you have any questions or concerns, then please feel free to connect with me at rjindal@outlook.ie or my Twitter handle @rahulj1906.

Cheers!