Understanding the NetScaler Gateway MDM Integration with Intune
The following is an example flow of events in a typical NetScaler Gateway MDM Integration with Intune:
-
Enroll a mobile device with Intune.
-
Corporate approved applications and device policies are pushed to the device.
-
Browse SharePoint (on-premises application) from the device.
-
The browser request goes to NetScaler Gateway.
-
The NetScaler Gateway appliance checks with Intune for the enrollment status of the device.
-
If a compliant device is enrolled successfully, the SharePoint access is granted.
When a device doesn't meet a conditional access policy, the NetScaler Gateway VPN client displays an error message. The message provides a link from the device to a page hosted by Intune that gives the user the option to enroll or to remediate the device's compliance status.
Note:
Administrators must ensure the following while pushing the certificates to Intune so that the users can differentiate between the various certificates on their device.
-
Certificates must have a subject summary.
-
The subject summaries for different certificates must be distinct.
Intune NAC v2 API support
As part of Intune NAC v2 API support, you must bind a Certificate Authority file (CA certificate) to ensure that the NetScaler appliance gets a valid certificate from mobile devices. In Intune NAC v2, the mobile devices send device IDs as part of the CA certificate. The CA certificate bound here must be the one used to issue client certificates to the end-user iOS and Android devices. If there are intermediate certificates, those must also be bound here.
For more details, see Intune NAC v2 API support