New Microsoft Defender app and bulk tagging for iOS\iPadOS using Intune

 

Credits: Microsoft

In my recent blog about device tagging for macOS devices in Defender, I had mentioned about covering tagging feature for iOS\iPadOS platform as well. In this blog, I will cover the specifics for achieving this and my experience overall.

The new Microsoft Defender apps

Before we get into tagging, I want to touch base upon the recent change involving the renaming and feature offering of the MDE app both in Apple and Google Play stores. The MDE app is now called Microsoft Defender: Security in Apple store and is called Microsoft Defender: Antivirus in Google Play store, thus enabling All-in-one security functionality across both personal and work accounts. 

Under the personal account, Microsoft Defender will function as a multidevice security app 'Microsoft Defender for individuals' allowing individuals and families to protect their data and devices by offering malware protection, timely security notifications, security tips, and recommendations.

Microsoft Defender for individuals includes the features below.

- Monitor online security status in a single, centralized view.

- See your and your family's devices in one place.

- Add or remove devices.

- Help prevent and detect malware.

- Continuously scans for new and existing threats.

- Gives you control over what is scanned by enabling you to identify apps and files that you consider safe.

- Timely alerts about changes to your device status.

- Recommendations to help keep your data and devices secure.

- Tips that help improve your overall security.

Under a work account, Microsoft Defender will function as a standard 'Microsoft Defender for Endpoint ' application.

For all intents and purposes, I am going to only cover the Apple store app in this blog.

Importing the App in Intune

Note: You need to make sure that your Intune tenant is configured for Apple enrollment.

To import the app in Intune, follow these steps:

1. Navigate to Microsoft Intune admin center.

2. Go to Apps -> iOS\iPadOS apps.

3. Click on Add Apps and select iOS store App

4. Search for Microsoft Defender in the App store and select Microsoft Defender: Security

5. Select the app and accept the defaults.

6. Assign the App to your managed iOS\iPad devices.

Intune App Configuration for tagging

While it is possible to tag a device directly in Defender portal, it is not really practical as one cannot do this for devices in bulk. Now organizations can do bulk-tagging of mobile devices during onboarding using Microsoft Intune. Once the user installs and activates the Microsoft Defender client application, the mobile device begins receiving policies. The Microsoft Defender client application then passes the device tags to the Defender portal. This is supported for both MDM and MAM scenarios.

MDM (Mobile Device Management aka Managed Devices)

1. Navigate to Microsoft Intune admin center.

2. Go to Apps > App configuration policies > Add > Managed devices

3. Select Platform > iOS/iPadOS,

4. Select Microsoft Defender: Security as the target app. 

5. In Settings page, select Use configuration designer and add DefenderDeviceTag as the key, value type as String and the Configuration value as shown below.

6. Click Next and assign this policy to targeted devices.

MAM (Mobile Managed Apps aka Managed Apps)

1. Navigate to Microsoft Intune admin center.

2. Go to Apps > App configuration policies > Add > Managed apps

3. Select Microsoft Defender Endpoint under Public apps as the target app for iOS\iPadOS (Note: As of writing this blog,  in case of Managed apps, the MDE app currently retains its existing name)

4. Under General configuration settings, add DefenderDeviceTag as the key and the value as shown below.

6. Click Next and assign this policy to targeted users.

Testing

In case of MDM, when the device is enrolled, the Microsoft Defender: Security App will automatically install and the user will be required to open to allow the rest of configuration to take place. Note: If you are looking for other Defender settings, then you can refer to my earlier post that covers the details.

In case of MAM, Defender App will be required to be installed through the MAM channel. For this to work, ensure that you have configured the App Protection Policies correctly. Note: If you are looking for the MAM & other settings, then you can refer to my earlier post that covers these details.

Upon successful onboarding, the device tag received from Intune’s policy is passed on to the Defender portal. Note: The Microsoft Defender client application needs to be opened for tags to be synced with Intune and passed to the Defender Portal.

At this stage, the tagging can be used to create device groups, device inventory filter, run advanced hunting queries and RBAC (Role Based Access Control)

Device Group

Device Inventory Filter

Advanced Hunting

// Get latest information on user/device

DeviceInfo

| where RegistryDeviceTag has "Intune-iOS-iPadOS-MAM" or RegistryDeviceTag has "Intune-iOS-iPadOS-MDM"

Lastly, the compliance for the policies can be checked in Intune.

In case of MDM, one can check the status directly under App configuration policies.

In case of MAM, one can check the status under App Configuration Status report.

Final thoughts..

With bulk tagging made possible through Intune, admins can assign, modify, and even delete the Defender tag. It can take up to 18 hours for data to reflect on Defender Portal, but this is a welcome additional to Intune arsenal. I am still exploring other capabilities within MDE, including the tagging functionality for Android so keep a lookout for my blog space.

Until next time..