Integrate with Microsoft Intune

Overview

Microsoft Intune Endpoint Management uses Device Compliance Policies to check for the presence of an antivirus software, account for firewall rules, check clients for the latest security patches, and so on. Juniper Mist™ Access Assurance can leverage the compliance state of Intune-managed device for additional posture assessment according to the Auth Policies you create.

Figure 1: Microsoft Intune Integration for Getting Compliance State of the Device

You can integrate Access Assurance with the Intune for use in the Mist portal. For example, you can use the integration to create a client authorization policy in Mist that segregates non-compliant clients to a quarantine VLAN while letting compliant ones access the corporate network. To do so, you need to be running firmware version 0.14 or later on the Juniper Mist APs, and have an administrator account on Microsoft Entra ID (this is to grant read privileges to Mist Access Assurance to get the Intune device data).

As wireless clients log on and are authorized on a Juniper Mist AP, the cloud-based Mist Access Assurance service learns the client's security compliance status from Intune. It then uses that information in an authentication policy to connect the client to a selected VLAN based on the results. In the figure above, which shows the Insights tab on the Monitor portal page, Intune has classified one of the clients as non-compliant.

How it Works

The Access Assurance API polls Microsoft Intune every two hours for a list of authenticated Intune-managed clients, and makes any necessary updates. The default polling interval for Microsoft Intune to its managed devices is every eight hours. Mist Access Assurance caches the retrieved compliance state data to optimize retrieval times.

Whenever a device if found to be out of compliance, Mist Access Assurance issues a Change Of Authorization command and re-runs the policy. The policy then triggers the required corrective actions, as needed, to bring the device back in to compliance.

The communication flow between the two services is shown in the following illustration.

Figure 2: Authentication and Authorization for Microsoft Intune

Mist Access Assurance uses the following information during client authentication to match a client with a device record in Microsoft Intune:

• Non-randomized MAC address—If you want to show non-randomized MAC addresses under Client Events, you need to disable MAC randomization in the Intune Wi-Fi settings. This display supports both EAP-TTLS and EAP-TLS authentication, and uses the client MAC address from Intune.

  Figure 3: Disable MAC Address Randomization
• DeviceName or DeviceName.FQDN—Under Client Events, the name shown for Certificate CN comes from the Intune SCEP certificate configuration (it's the Subject name format field). The Client Events name shown for Certificate SAN (DNS Name) comes from the Intune SCEP profile variable used to encode the Intune Device ID in the SAN:DNS certificate field
  Figure 4: Certificate CN Details
  .

  In Intune SCEP profile, use the variables to create this certificate.

  

• Intune Device ID encoded in SAN:DNS certificate attribute in Juniper Mist portal client events as shown in the following illustration.

  

• In Intune SCEP profile, use the variable to encode Intune Device ID in the SAN:DNS certificate field.

  

Adding Intune to the Mist Portal

To add Microsoft Intune to the Mist Access Assurance portal:

1. From the left menu of the Juniper Mist portal, select Organization | Access > Identity Providers
2. In the Linked Accounts section, click Link Account .
3. Select Microsoft Intune.
   

4. You will be redirected to Microsoft Entra ID / Intune for the Single Sign On (SSO) login, and then prompted to grant permission for the Mist Access Assurance portal to read Microsoft Intune device data.

   Figure 5: Permissions for Intune Integration

   After linking the Intune account, connected Intune account status is displayed on the Identity Providers page.

   Figure 6: Linked Intune Account Status
   Figure 7: Linked Intune Account Details
5. (Optional) After linking the Intune account, you can see the Intune account status on the Identity Providers page: Organization | Access > Identity Providers.

Creating Policy Rules

With the Intune account linked to Mist, you can leverage managed the device compliance status in your Mist Auth Policies. For example, you can put non-compliant clients into a quarantine VLAN, while allowing compliant devices to connect to the corporate VLAN. You do this by creating a pair of labels for compliance and non-compliance, and another pair for corp and quarantine VLANs. Then you use these labels in a pair of Auth Policy rules to automatically govern network access.

Create compliance and quarantine labels:

1. From the left menu of the Juniper Mist portal, select Organization > Access > Auth Policies.
2. Click the Create Label button and give the label a name, for example, Intune-Compliant.
3. Under Label Type, choose MDM Compliance.
4. Under Label Values, select Compliant.
   

5. Click the Create button.

6. Repeat these steps to create the remaining labels, as shown here:

   • Label Name: Intune-Non-Compliant, Label Type: MDM Compliance, Label Value: Non Compliant

     
   • Label Name: Quarantine, Label Type: AAA, Label Value: VLAN, 1

   • Label Name: Corp VLAN, Label Type: AAA, Label Value: VLAN, 750

     

Create Auth Policy Rules:

1. Click the Add Rule button and give the rule a name, for example, Corp Compliant.
2. In the Match Criteria column, click the + icon and then select Intune-Compliant from the list that appears.
3. In the Policy column, select Allow.
4. In the Assigned Policies column, click the + icon and then select Corp VLAN.
   Figure 8: Compliance Rules Based on Intune

5. Repeat these steps to create the quarantine rule.

6. When finished, click Save.

Viewing Client Events

As shown in the following illustration, in the Client Events section on the Insights tab of the Monitor portal page, the values show for some parameters depend on how you have configured Microsoft.

Figure 9: Monitor Intune-based Access Assurance Policy Events in the Mist Portal