Onboarding and Managing iOS and Android

You’ve reached the last chapter on onboarding and managing MDE devices! Last but by no means least, in this chapter, we will describe how you can protect the most mobile of all devices: those running iOS and Android. For iOS and Android, MDE is described as a mobile threat defense (MTD) solution, so keep reading to learn about the following:

• How to deploy MDE to iOS and Android with Microsoft Intune
• How to configure MDE’s iOS and Android features

MDE for Android and iOS includes capabilities such as web protection, vulnerability reporting, unified alerting in the Microsoft 365 Defender portal, and integration with mobile application management (MAM) services. Both iOS and Android can benefit from MDE across the management spectrum, from fully owned and managed by the organization to bring-your-own-device (BYOD) with very limited management.

So, let’s get on with things. As before, we will start with...

Onboarding mobile devices

Both iOS and iPadOS are supported and must be version 14 or later. For readability, this book simply refers to iOS, due to it being treated identically by Intune and MDE. Android support is limited to mobile phones, and they must be running version 6 or later.

This section focuses on onboarding devices that are fully Intune mobile device management (MDM)enrolled. This implies device-level control by the administrator so that you can deploy MDE en masse. Ideal for BYOD scenarios, you will learn about the app-level control option — mobile application management (MAM) — in the Working with mobile protection features section.

iOS

In this section, you will learn how to get Intune-enrolled iOS devices into MDE. We will do this with a capability referred to as zero-touch onboarding. This does not apply to devices without user affinity, such as shared iPads.

Zero-touch onboarding is achieved by deploying the MDE app and a VPN profile. Web...

Working with mobile protection features

Just as with other operating systems, onboarding Android and iOS is only the start. To suit the needs of your organization, you’ll want to make customizations and changes to MDE’s features. In this section, we look at how to do that across app protection policies, app configuration policies, and our tenant connectors.

Integration with app protection policies

Intune is both a MAM and MDM service. When you learned about automatically onboarding devices to MDE with Intune, you experienced its MDM capabilities – that is, the ability to control things at the device level, which we used to deploy applications and manage settings such as the VPN. However, MAM focuses on application-level control.

Using MAM, we can even extend MDE to devices that aren’t MDM enrolled. This is most commonly appropriate for BYOD scenarios, where we want a heightened level of protection if personal devices access corporate resources,...

Summary

The end of this chapter also marks the end of several chapters about onboarding and managing MDE devices. You are now aware of how to create a scalable approach to onboarding Intune-managed iOS and Android. You have also learned about the different capabilities each offers and the intricacies of configuring their deployment.

After deploying MDE to your iOS and Android devices, you can now configure their integration with app protection policy conditional launch, manage web protection for Microsoft-managed and custom web resources, manage app vulnerability assessment, and control privacy settings.

In the next chapter, we will venture beyond MDE and start to look at securing our on-premises and hybrid identities with Microsoft Defender for Identity.

Questions

Now that you understand the onboarding and management processes for MDE, test your knowledge with the following questions:

1. True or false: Microsoft Defender Vulnerability Management integrates with MDE on iOS and Android to report vulnerable app?.
   1. True
   2. False
2. What VPN server address should be used in a VPN configuration profile for iOS?
   1. 169.254.0.1
   2. 127.0.0.0
   3. 127.0.0.1
   4. 169.254.0.0
3. All iOS devices in your environment are enrolled in Intune MDM. Some are in supervised mode and others are not. To protect them from phishing websites, you plan to onboard them to MDE. What is unique to these supervised devices compared to unsupervised devices regarding onboarding? Choose all that apply.
   1. Supervised devices support mobile application policies
   2. Supervised devices will route all device traffic through a remote proxy
   3. Supervised devices support zero-touch onboarding for shared devices
   4. Supervised devices do not require a local VPN to be configured
4. Which permissions should you assign...

Further reading

There may be some specific scenarios regarding onboarding that this book has not discussed. You can find useful information on examples of these by looking at the following links:

• You can find the December 2020 announcement of MDE on iOS here: techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-for-endpoint-on-ios-is-generally-available/ba-p/1962420https://techcommunity.microsoft.com/t5/m.
• The announcement of what was called Microsoft Defender ATP for Android at the time is also worth referencing: techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-microsoft-defender-atp-for-android/ba-p/1480787.
• You learned about the permissions required by MDE for Android. Additional information on this due to platform changes with Android 11 is available here: techcommunity.microsoft.com/t5/intune-customer-success/upcoming-permissions-changes-for-microsoft-defender-for-endpoint/ba-p/2945750.
• Microsoft’...