Comments on: Secure personal mobile devices with Microsoft Intune and Defender for Endpoint https://inthecloud247.com/secure-personal-mobile-devices-with-microsoft-intune-and-defender-for-endpoint/ Intune, Windows, Office 365, Microsoft 365, Azure, Automation Fri, 30 Jun 2023 12:49:37 +0000 hourly 1 By: Tariq Jameel https://inthecloud247.com/secure-personal-mobile-devices-with-microsoft-intune-and-defender-for-endpoint/#comment-203243 Fri, 30 Jun 2023 12:49:37 +0000 https://inthecloud247.com/?p=8061#comment-203243 In my test env. A device can go through enrolment successfully but if they signout out of defender or uninstall it. They still gain access to outlook email, teams and other m365 apps. How do you stop access once defender is removed or signedout on byod devices

]]> By: Terry Hugill https://inthecloud247.com/secure-personal-mobile-devices-with-microsoft-intune-and-defender-for-endpoint/#comment-171272 Sun, 15 Aug 2021 16:31:26 +0000 https://inthecloud247.com/?p=8061#comment-171272 In reply to Peter Klapwijk.

I have totally taken over your comment section but I can report that I have tested it after ironing out those wrinkles and it works perfectly. Thank you for the article and for taking the time to test the iOS configuration.

]]> By: Terry Hugill https://inthecloud247.com/secure-personal-mobile-devices-with-microsoft-intune-and-defender-for-endpoint/#comment-171271 Sun, 15 Aug 2021 16:03:26 +0000 https://inthecloud247.com/?p=8061#comment-171271 In reply to Peter Klapwijk.

Yes, I found the same. I think between a change in the CA policy and troubleshooting it got itself in a twist. A reset sorted that side of it.

]]> By: Peter Klapwijk https://inthecloud247.com/secure-personal-mobile-devices-with-microsoft-intune-and-defender-for-endpoint/#comment-171127 Thu, 12 Aug 2021 08:40:25 +0000 https://inthecloud247.com/?p=8061#comment-171127 In reply to Terry Hugill.

You probably used an existing iPhone I guess?
When you just remove the apps and start testing again, it doesn’t ask for the Authenticator app. Do a factory reset and it does ask to install the app.

]]> By: Terry Hugill https://inthecloud247.com/secure-personal-mobile-devices-with-microsoft-intune-and-defender-for-endpoint/#comment-171126 Thu, 12 Aug 2021 08:34:42 +0000 https://inthecloud247.com/?p=8061#comment-171126 In reply to Peter Klapwijk.

That’s great, thanks for testing that. I will continue testing on my new tenancy and let you know if I find anything interesting. Thanks again.

]]> By: Terry Hugill https://inthecloud247.com/secure-personal-mobile-devices-with-microsoft-intune-and-defender-for-endpoint/#comment-171125 Thu, 12 Aug 2021 08:33:15 +0000 https://inthecloud247.com/?p=8061#comment-171125 Hi Peter, I have setup a new test tenancy. It looks like Microsoft called time on my previous test tenancy about a week early so the mailboxes were no longer provisioned, but there were no signs of it in the tenancy. I am assuming it was affecting other services too. Having tested it with my new tenancy I can confirm it works without the need for authenticating in Authenticator. In fact, it didn’t ask me to download Authenticator. I will continue testing and let you know what I find.

]]> By: Peter Klapwijk https://inthecloud247.com/secure-personal-mobile-devices-with-microsoft-intune-and-defender-for-endpoint/#comment-171124 Thu, 12 Aug 2021 08:23:40 +0000 https://inthecloud247.com/?p=8061#comment-171124 In reply to Terry Hugill.

Hi Terry,

I was able to get an iPhone for testing;
After authenticating in Outlook, I’m asked to register the device. I install the Authenticator app and I do need to sign in to Authenticator. When that’s done I can finish the setup of Outlook. But it takes pretty long (compared to Android) before I’m asked to provide a PIN (as part of the APP) and install Defender. Installing and configuring a second app seems to speed up that process (probably a new sync to the back-end is done).
When I’ve some time, I’ll expand the post with the end-user experience on iOS.

Regards,

Peter

]]> By: Terry Hugill https://inthecloud247.com/secure-personal-mobile-devices-with-microsoft-intune-and-defender-for-endpoint/#comment-171120 Thu, 12 Aug 2021 07:24:20 +0000 https://inthecloud247.com/?p=8061#comment-171120 Hi Peter, thanks for your reply. I have found a problem with provisioning on this account (it would be the account I picked for testing 🙂 ) I will try again today and let you know what happens.

]]> By: Peter Klapwijk https://inthecloud247.com/secure-personal-mobile-devices-with-microsoft-intune-and-defender-for-endpoint/#comment-171103 Wed, 11 Aug 2021 18:42:37 +0000 https://inthecloud247.com/?p=8061#comment-171103 In reply to Terry Hugill.

I’ve not tested this particular setup (don’t have an iPhone on my desk atm), but tested App Protection Policies in the past on iOS. I doubt if you also need to authenticate in the Authenticator app. You don’t have to authenticate in the Company Portal app on Android and if I remember correctly that’s the same for the Authenticator app on iOS. But unfortunately not able to verify at this moment.

Regards,

Peter

]]> By: Terry Hugill https://inthecloud247.com/secure-personal-mobile-devices-with-microsoft-intune-and-defender-for-endpoint/#comment-171093 Wed, 11 Aug 2021 13:04:11 +0000 https://inthecloud247.com/?p=8061#comment-171093 Have you tried this with iOS? It does not seem to work with the “Require App Protection Policy” option in CA. I noted your instructions were created using Android. I have some notes I am happy to pass over. Briefly, Authenticator kicked in and asked for my account details. I added them then received an access denied error. It seems like this process kicks in before the App Protection policy is applied. I think I have followed the instructions correctly.

]]>