This is a step-by-step guide on how to get your iOS/iPadOS device MDM-manage via Intune, and push the profile via Apple Configurator
Note: this method shows you how to MDM your devices via Intune and Apple Configurator
If you are MDM-ing your supervised devices via the Company Portal App, then you may start at Step 14.
This article is provided as-is as of 04/12/2023, Umbrella support does not guarantee these instructions will remain valid after this date and is subject to change based on updates from Microsoft Intune and Apple iOS.
- Log into the Azure Portal and search for "Intune". Alternatively, go to https://endpoint.microsoft.com and login
- Once you're on the Intune homepage, go to Devices --> iOS/iPadOS --> iOS/iPadOS enrollment --> Apple MDM Push certificate and click "Download your CSR"
- Then, click on "Create your MDM push Certificate", which will redirect you to https://identity.apple.com/pushcert/
- On the Apple Push Certificates Portal, go to "Create a Certificate" and upload the IntuneCSR.csr file you just downloaded. Once the CSR file has been uploaded successfully, click "Download" to download the Privacy Enhanced Mail (.pem file) and proceed to the next step
- Enter the email address of your Apple ID account that you used to sign into the Apple Push Certificates Portal and upload the .pem file under "Apple MDM push certificate" and press "Upload". If the upload is successful, you should see the other options for the "Bulk enrollment methods" unlock
- Go to Apple Configurator --> Profiles --> Create and create a new profile. Give it a meaningful name and for User affinity select "Enroll without user affinity". Once that profile has been created, click into your newly created profile and select "Export Profile" and then "Download Profile" on the right hand side
- Download and launch "Apple Configurator" on your macOS from the App Store and connect your phone via Lightning Cable. Right click on your device within Apple Configurator select Add --> Profiles and then select the profile.mobileconfig file you just downloaded Windows alternate: iPhone Configuration Utility
- Once the sync has finished, on your iOS/iPadOS device go to Settings app and go to General --> VPN & Device Management --> Management Profile
- On the top right, click Install
- If you get a Remote Management prompt, hit Trust and let the profile finish installing
- To confirm the profile was exported and installed successfully on your iOS device, go back to Intune and under "Devices" you should now see your new iOS device added
- Now that your device is MDM enrolled, go to Groups --> All Groups --> New Group and create a new group and assign your device. Make sure your Group type is "Security" and not Microsoft 365
- Click into the group you've just created and go to Members --> Add Members. Find your MDM-device you want to install the Cisco Security Connector app on, on the list and add it to the group you've just created
- Go to Apps --> All apps --> Add. Then for App type, select "iOS store app" and confirm by clicking "Select"
- Select "Search for App Store" and enter "Cisco Security Connector" in the search bar and select the "Cisco Security Connector" app by clicking "Select"
- Under Assignments, add the group you've created in the earlier steps which contains your MDM-device then proceed with Review and Create
- [Optional step] Go to Devices --> iOS/iPadOS --> iOS/iPadOS devices --> Properties --> Device Category, create a profile and assign it to the device
- Log into your Cisco Umbrella dashboard, under Deployments --> Core Identities --> Mobile Devices --> top right: Manage --> Managed by MDM
- Then go to iOS --> Microsoft Intune Config download. Enter your email address that you want emails to go to when users select "Report a problem" within the Cisco Security Connector app
- Go back to your Intune portal, under Devices --> iOS/iPadOS --> Configuration Profiles --> Create Profile --> Templates --> Custom
- Give it a meaningful name for your configuration profile. In Step 2 - Configuration settings, upload the XML file you've just downloaded from your Cisco Umbrella dashboard
- Under Assignments, assign the group you've created earlier that contains your MDM-device and select "Review and Create"
- Go back to iOS/iPadOS devices and select your MDM-device and hit sync at the top and you should get a pop-up on your MDM iOS/iPadOS device to install the Cisco Security Connector app
- Launch the Cisco Security Connector app on your iOS/iPadOS device. You may see the "Not Protected by Umbrella"
- When you click into it the IPv4 Status and IPv6 Status may show "Limited". You may need to turn on/off your WiFi or LTE cellular network in order to see a status change. The next steps involves deploying the Cisco Umbrella Root Certificate - it is required in order for block pages to be properly displayed.
- Go to your Umbrella dashboard, under Deployments --> Root Certificate, download the Umbrella Root Certificate (.cer file)
- Go back to your Intune portal, under Devices --> iOS/iPadOS --> Configuration Profiles, create a new profile (just like in Step 21) for the Umbrella Root Certificate
- For "Profile type", select Templates --> Trusted certificate
- In Step 2 - Configuration settings, upload the Umbrella Root Certificate you've just downloaded from Step 27
- For Step 3 - Assignments, select the group that contains your MDM iOS/iPadOS device and click "Next" and "Create"
- Go back to iOS/iPadOS devices and select your MDM-device and hit sync at the top once again (like step 24)
- Close and relaunch the Cisco Security Connector app again. You should now see the status as "Protected by Umbrella"
- You can verify you're being protected by Cisco Umbrella by going to welcome.umbrella.com in Safari
NOTE: you may have to disconnect and reconnect to WiFI to see the change in status. Alternatively, connect to your mobile hotspot and/or a different WiFi network, then back to the same one to see a change in status
if you've removed your iOS/iPadOS device from Intune MDM within the last 24 hours, and try to re-add it, it will not populate under "Members" for when you're trying to locate the device for your "Groups" in Step 14
- How to Collect Cisco Security Connector Diagnostics Logs
- CSC Log "Report A Problem" Function "No Admin Email" Error
- CSC: "Unprotected" status on mobile networks
if you're getting an Error: "User Name not recognized. This user is not authorized to use Microsoft Intune", go to the Azure Portal, under "Users" and select the username or account you're using to configure Intune, go to "Licenses" and make sure you have an active Intune License assigned to the user
By default, the logs password will be bypass_email_filters . This can also be located in the UmbrellaProblemReport.txt