This week the second part about the integration between Microsoft Intune and Zimperium. A quick reminder, Zimperium is one of the available third-party Mobile Threat Defense connectors for Microsoft Intune. The first part, which is available here, was mainly about integrating Zimperium with Microsoft Intune. Including an overview of the total solution. In this second part, I’ll be providing a short introduction about the mobile threat defense levels and I’ll show how to configure conditional access in combination with these threat levels. Including how the different configurations are related. I’ll end this post with the end-user experience.
Introduction
Like last week, I’ll start with short introduction. Last week this introduction was about providing an overview about the integrated solution. This week is all about looking at the Mobile Threat Response Policy, the Conditional access policy and the Device compliance policy. To understand how these policies work together, it’s important to know how the Severity of a Mobile Threat Response Policy in Zimperium is related to the Mobile Threat Level of a Device compliance policy in Microsoft Intune. Below is an overview of how these two are related and how it’s used within the Require the device to be at or under the Mobile Threat Level setting of a Device compliance policy in Microsoft Intune.
| Intune | Zimperium | Explanation from Intune-perspective |
| Secured | Normal | This is the most secure. The device is compliant only if no threats are found. If any threats are found, the device is evaluated as non-compliant. |
| Low | Low | The device is compliant if only low level threats are present. If anything higher is found, the device is evaluated as non-compliant. |
| Medium | Elevated | The device is compliant if only low or medium level threats are present. If high level threats are found, the device is evaluated as non-compliant. |
| High | Critical | This is the least secure. The device is compliant, no matter what threats are found. It only requires devices to have the MTD app installed and activated. |
Configuration
Now let’s have a look at the configuration. The configuration flow basically contains three configuration levels. First configure the Mobile Threat Response Policy in Zimperium to specify the Severity of a threat, second configure the Device compliance policy in Microsoft Intune to specify the minimal Mobile Threat Level of the device and third, configure the Conditional access policy in Azure AD to require a compliant device to connect to cloud apps.
Zimperium configuration
Let’s start with the first configuration, the Mobile Threat Response Policy in Zimperium. The following 2 steps show how to locate the Mobile Threat Response Policy and how the configurations in that policy can influence the compliance state of device.
| 1 | Open the Zimperium zConsole and navigate to POLICY and select a group to open the related Mobile Thread Response Policy; |
| 2 | In the Mobile Threat Response Policy, there are 2 important configurations (see below) that impact the mobile threat defense level of a device in Microsoft Intune.
|
Microsoft Intune configuration
Let’s continue with the second configuration, the Device compliance policy in Microsoft Intune. The following 4 steps show the minimum configuration of a Device compliance policy that is required to use the Mobile Threat Level in the compliance state of a device.
| 1 | Open the Azure portal and navigate to Intune > Device compliance > Policies; |
| 2 | On the Device compliance – Policies blade, click Create Policy to open the Create Policy blade; |
| 3 | On the Create Policy blade, provide a unique Name select a Platform (iOS or Android) and click Configure > Device Health to open the Device Health blade; |
| 4 | On the Device Health blade, configure Require the device to be at or under the Mobile Threat Level setting and click OK;
Note: As mentioned in the introduction, this Mobile Threat Level corresponds to the different Severity levels that are sent by Zimperium. |
Azure AD configuration
Let’s finish with the third configuration, the Conditional access policy in Azure AD. This can also be done via the Microsoft Intune section, but I like to use the Azure AD section for conditional access (related) configurations. The following 4 steps show the minimum configuration of a Conditional access policy that is required to use the compliance state of a device to grant or block access to cloud apps.
| 1 | Open the Azure portal and navigate to Azure Active Directory > Conditional access; |
| 2 | On the Conditional access – Policies blade, click New Policy to open the New blade; |
| 3 | On the New blade, provide a unique Name, configure the Assignment (Users and groups and Cloud apps) and click Grant to open the Grant blade; |
| 4 | On the Grant blade, there are 2 important configurations (see below) that are required to require a compliant device;
|
End-user experience
Now let’s have a look at the end-user experience, from a Microsoft Intune perspective. Basically the end-user can receive two separate compliance issues related to Zimperium. Below are those examples for an Android device. On the left is an example of when the Zimperium connector is active, the Require the device to be at or under the Mobile Threat Level setting is configured and the Zimperium app (zIPS) is not installed. On the right is an example of when zIPS is installed and a threat is detected with a higher threat level as configured in the Require the device to be at or under the Mobile Threat Level setting. In that case, the end-user will be advised to look at zIPS for more information.
 |
 |
For iOS the end-user will receive similar messages. Below are the same examples, in the same order, for an iOS device.
 |
 |
More information
For more information about Mobile Treat Defense, Zimperium and Microsoft Intune, please refer to the following articles:
- Mobile Threat Defense integration with Intune: https://docs.microsoft.com/en-us/intune/mobile-threat-defense
- Zimperium Mobile Threat Defense connector with Intune: https://docs.microsoft.com/en-us/intune/zimperium-mobile-threat-defense-connector
- Integrate Zimperium with Intune: https://docs.microsoft.com/en-us/intune/zimperium-mtd-connector-integration
Discover more from All about Microsoft Intune
Subscribe to get the latest posts sent to your email.