GSA iOS client deployment
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 3d1ad03 · +93 −58 lines · also on GitHub
⋯ 12 unchanged lines
1313
1414
# Install the Global Secure Access client for iOS
1515
16
−This article explains how to set up and deploy the Global Secure Access client app on iOS and iPadOS devices. For simplicity, this article refers to both iOS and iPadOS as **iOS**.
16
+This article explains how to set up and deploy the Global Secure Access client app on iOS and iPadOS devices. For simplicity, this article refers to both iOS and iPadOS as *iOS*.
1717
18
+The Global Secure Access client is deployed through Microsoft Defender for Endpoint on iOS. The Global Secure Access client on iOS uses a VPN that isn't a regular VPN. Instead, it's a local/self-looping VPN.
19
+
1820
> [!CAUTION]
1921
> Running other third-party endpoint protection products alongside Defender for Endpoint on iOS is likely to cause performance problems and unpredictable system errors.
20
−> [!NOTE]
21
−> - The Global Secure Access client is deployed through Microsoft Defender for Endpoint on iOS.
22
−> - The Global Secure Access client on iOS uses a VPN. This VPN isn't a regular VPN. Instead, it's a local/self-looping VPN.
2322
2423
## Prerequisites
24
+
2525
- To use the Global Secure Access iOS client, configure the iOS endpoint device as a Microsoft Entra registered device.
26
−- To enable Global Secure Access for your tenant, refer to the [Licensing requirements](overview-what-is-global-secure-access.md#licensing-overview). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
26
+- To enable Global Secure Access for your tenant, refer to the [Licensing requirements](overview-what-is-global-secure-access.md#licensing-overview). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
2727
- Onboard the tenant to Global Secure Access and configure one or more traffic forwarding profiles. For more information, see [Access the Global Secure Access area of the Microsoft Entra admin center](quickstart-access-admin-center.md).
2828
- To enable a Kerberos SSO experience, create and deploy a profile for the iOS [Single sign-on app extension](/intune/intune-service/configuration/ios-device-features-settings#single-sign-on-app-extension).
2929
3030
## Requirements
31
+
3132
### Network requirements
32
−For Microsoft Defender for Endpoint on iOS (available in the [Apple App Store](https://apps.apple.com/us/app/microsoft-defender-security/id1526737990)) to function when connected to a network, you must configure the firewall/proxy to [Enable access to Microsoft Defender for Endpoint service URLs](/defender-endpoint/configure-environment#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server).
3333
34
+For Microsoft Defender for Endpoint on iOS (available in the [Apple App Store](https://apps.apple.com/us/app/microsoft-defender-security/id1526737990)) to function when connected to a network, you must configure the firewall/proxy to [Enable access to Microsoft Defender for Endpoint service URLs](/defender-endpoint/configure-environment#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server).
35
+
3436
> [!NOTE]
3537
> Microsoft Defender for Endpoint on iOS isn't supported on userless or shared devices.
3638
3739
### System requirements
40
+
3841
The iOS device (phone or tablet) must meet the following requirements:
42
+
3943
- The device runs iOS 16.0 or newer.
4044
- The device has the Microsoft Authenticator app or the Intune Company Portal app.
4145
- For the supervised devices, the device must be enrolled to enforce Intune device compliance policies.
⋯ 2 unchanged lines
4448
4549
[!INCLUDE [known-limitations-include](../includes/known-limitations-include.md)]
4650
47
−## Installation Steps
51
+## Installation steps
52
+
4853
### Deploy on Device Administrator enrolled devices with Microsoft Intune
49
−1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **iOS/iPadOS** > **Add** > **iOS store app** and select **Select**.
50
−:::image type="content" source="media/how-to-install-ios-client/ios-client-add-ios-store-app.png" alt-text="Screenshot of the Microsoft Intune admin center with the steps to add an iOS store app highlighted.":::
5154
52
−1. On the **Add app** page, select **Search the App Store** and type **Microsoft Defender** in the search bar.
55
+1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **iOS/iPadOS** > **Add** > **iOS store app** and choose **Select**.
56
+
57
+ :::image type="content" source="media/how-to-install-ios-client/ios-client-add-ios-store-app.png" alt-text="Screenshot of the Microsoft Intune admin center with the steps to add an iOS store app highlighted.":::
58
+
59
+1. On the **Add app** page, select **Search the App Store** and type **Microsoft Defender** in the search bar.
60
+
5361
1. In the search results, select **Microsoft Defender** and select **Select**.
62
+
5463
1. Select **iOS 15.0** as the minimum operating system. Review the rest of the information about the app, and select **Next**.
55
−1. In the **Assignments** section, go to the **Required** section and select **Add group**.
56
−:::image type="content" source="media/how-to-install-ios-client/ios-client-add-group.png" alt-text="Screenshot of the Add App screen with the Add group option highlighted.":::
64
+
65
+1. In the **Assignments** section, go to the **Required** section and select **Add group**.
66
+
67
+ :::image type="content" source="media/how-to-install-ios-client/ios-client-add-group.png" alt-text="Screenshot of the Add App screen with the Add group option highlighted.":::
5768
5869
1. Choose the user groups to target with the Defender for Endpoint on iOS app.
59
−> [!NOTE]
60
−> The selected user group should consist of Microsoft Intune enrolled users.
6170
62
−7. Select **Select** and then **Next**.
71
+ > [!NOTE]
72
+ > The selected user group should consist of Microsoft Intune enrolled users.
73
+
74
+1. Select **Select** and then **Next**.
75
+
6376
1. In the **Review + Create** section, verify that all the information entered is correct and then select **Create**. After a few moments, the Defender for Endpoint app is created successfully, and a notification appears at the top-right corner of the page.
64
−1. On the app information page, in the **Monitor** section, select **Device install status** to verify that the device installation is completed successfully.
65
−:::image type="content" source="media/how-to-install-ios-client/ios-client-device-install-status.png" alt-text="Screenshot of the Device install status screen showing a list of installed devices.":::
6677
78
+1. On the app information page, in the **Monitor** section, select **Device install status** to verify that the device installation is completed successfully.
79
+
80
+ :::image type="content" source="media/how-to-install-ios-client/ios-client-device-install-status.png" alt-text="Screenshot of the Device install status screen showing a list of installed devices.":::
81
+
6782
### Create a VPN profile and configure Global Secure Access for Microsoft Defender for Endpoint
68
−1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Devices** > **Configuration** > **Create** > **New Policy**.
69
−1. Set the **Platform** to **iOS/iPadOS**, the **Profile type** to **Templates**, and the **Template name** to **VPN**.
70
−1. Select **Create**.
71
−1. Type a name for the profile and select **Next**.
83
+
84
+1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Devices** > **Configuration** > **Create** > **New Policy**.
85
+
86
+1. Set the **Platform** to **iOS/iPadOS**, the **Profile type** to **Templates**, and the **Template name** to **VPN**.
87
+
88
+1. Select **Create**.
89
+
90
+1. Type a name for the profile and select **Next**.
91
+
7292
1. Set the **Connection Type** to **Custom VPN**.
73
−1. In the **Base VPN** section, enter the following:
93
+
94
+1. In the **Base VPN** section, enter the following:
95
+
7496
- **Connection Name**: Microsoft Defender for Endpoint
7597
- **VPN server address**: 127.0.0.1
7698
- **Auth method**: "Username and password"
7799
- **Split Tunneling**: Disable
78100
- **VPN identifier**: com.microsoft.scmx
79
−1. In the key-value pairs fields:
101
+
102
+1. In the key/value pairs fields:
103
+
80104
- Add the key **SilentOnboard** and set the value to **True**.
81105
- Add the key **EnableGSA** and set the appropriate value from the following table:
82106
83
− |Key |Value |Details |
84
− |---------|---------|---------|
85
− |EnableGSA |No value | Global Secure Access isn't enabled and the tile isn't visible. |
86
− | |0 | Global Secure Access isn't enabled and the tile isn't visible.|
87
− | |1 | Global Secure Access tile is visible and defaults to disabled state. User can enable or disable using the toggle.|
88
− | |2 | Global Secure Access tile is visible and defaults to enabled state. User can enable or disable using the toggle from the app. |
89
− | |3 | Global Secure Access tile is visible and defaults to enabled state. User **can't** disable Global Secure Access. |
107
+ |Key |Value |Details |
108
+ |---------|---------|---------|
109
+ |EnableGSA |No value | Global Secure Access isn't enabled and the tile isn't visible. |
110
+ | |0 | Global Secure Access isn't enabled and the tile isn't visible.|
111
+ | |1 | Global Secure Access tile is visible and defaults to disabled state. User can enable or disable using the toggle.|
112
+ | |2 | Global Secure Access tile is visible and defaults to enabled state. User can enable or disable using the toggle from the app. |
113
+ | |3 | Global Secure Access tile is visible and defaults to enabled state. User **can't** disable Global Secure Access. |
90114
91
− - Add more key-value pairs as required (optional):
115
+ - Add more key/value pairs as required (optional):
92116
93
− |Key |Value |Details |
94
− |---------|---------|---------|
95
− |EnableGSAPrivateChannel |No value |Use the EnableGSA configured option. |
96
− | |0 |Private Access isn't enabled and the toggle option isn't visible to user. |
97
− | |1 |The Private Access toggle is visible and defaults to disabled state. User can enable or disable. |
98
− | |2 |The Private Access toggle is visible and defaults to enabled state. User can enable or disable. |
99
− | |3 |The Private Access toggle is visible but grayed out, and defaults to enabled state. The user **can't** disable Private Access. |
117
+ |Key |Value |Details |
118
+ |---------|---------|---------|
119
+ |EnableGSAPrivateChannel |No value |Use the EnableGSA configured option. |
120
+ | |0 |Private Access isn't enabled and the toggle option isn't visible to user. |
121
+ | |1 |The Private Access toggle is visible and defaults to disabled state. User can enable or disable. |
122
+ | |2 |The Private Access toggle is visible and defaults to enabled state. User can enable or disable. |
123
+ | |3 |The Private Access toggle is visible but grayed out, and defaults to enabled state. The user **can't** disable Private Access. |
100124
101
−1. Continue filling out the VPN form:
102
− - **Type of Automatic VPN**: On-demand VPN
103
− - **On Demand Rules**: select **Add** and then:
104
− - Set **I want to do the following** to **Connect VPN**.
105
− - Set **I want to restrict** to **All domains**.
106
−:::image type="content" source="media/how-to-install-ios-client/ios-client-set-up-vpn.png" alt-text="Screenshot of the VPN screen showing example setup parameters.":::
125
+1. For **Type of Automatic VPN**, select **On-demand VPN**.
126
+
127
+1. For **On Demand Rules**, select **Add** and then:
128
+
129
+ - Set **I want to do the following** to **Connect VPN**.
130
+ - Set **I want to restrict** to **All domains**.
131
+
132
+ :::image type="content" source="media/how-to-install-ios-client/ios-client-set-up-vpn.png" alt-text="Screenshot of the VPN screen showing example setup parameters.":::
133
+
107134
1. To prevent end users from disabling VPN, set **Block users from disabling automatic VPN** to **Yes**. By default, this setting isn't configured, and users can disable VPN only in the settings.
135
+
108136
1. Select **Next** and assign the profile to targeted users.
137
+
109138
1. In the **Review + Create** section, verify that all the information is correct and then select **Create**.
110
−
111
−Once the configuration is complete and synced with the device, the following actions take place on the targeted iOS devices:
139
+
140
+After the configuration is complete and synced with the device, the following actions take place on the targeted iOS devices:
141
+
112142
- Microsoft Defender for Endpoint is deployed and silently onboarded.
113143
- The device is listed in the Defender for Endpoint portal.
114144
- A provisional notification is sent to the user device.
115
−- Global Secure Access and other Microsoft Defender for Endpoint (MDE)-configured features are activated.
145
+- Global Secure Access and other Microsoft Defender for Endpoint-configured features are activated.
116146
117147
## Confirm Global Secure Access appears in the Defender app
118
−Because the Global Secure Access client for iOS is integrated with Microsoft Defender for Endpoint, it's helpful to understand the end user experience. The client appears in the Defender dashboard after onboarding to Global Secure Access.
119
−:::image type="content" source="media/how-to-install-ios-client/ios-defender-dashboard-1.png" alt-text="Screenshot of the iOS Microsoft Defender dashboard.":::
120148
121
−You can enable or disable the Global Secure Access client for iOS by setting the **EnableGSA** key in the [VPN profile](#create-a-vpn-profile-and-configure-global-secure-access-for-microsoft-defender-for-endpoint). End users can enable or disable individual **Services** or the client itself based on the configuration settings, using the appropriate toggles.
122
−:::image type="content" source="media/how-to-install-ios-client/ios-client-enabled-disabled-1.png" alt-text="Screenshot of the Global Secure Access client on iOS showing both the Enabled and Disabled status screens.":::
149
+Because the Global Secure Access client for iOS is integrated with Microsoft Defender for Endpoint, it's helpful to understand the end user experience. The client appears in the Defender dashboard after onboarding to Global Secure Access.
123150
151
+:::image type="content" source="media/how-to-install-ios-client/ios-defender-dashboard-1.png" alt-text="Screenshot of the iOS Microsoft Defender dashboard.":::
152
+
153
+You can enable or disable the Global Secure Access client for iOS by setting the **EnableGSA** key in the [VPN profile](#create-a-vpn-profile-and-configure-global-secure-access-for-microsoft-defender-for-endpoint). End users can enable or disable individual **Services** or the client itself based on the configuration settings, using the appropriate toggles.
154
+
155
+:::image type="content" source="media/how-to-install-ios-client/ios-client-enabled-disabled-1.png" alt-text="Screenshot of the Global Secure Access client on iOS showing both the Enabled and Disabled status screens.":::
156
+
124157
## Troubleshooting
158
+
125159
- The Global Secure Access tile doesn't appear in the Defender app after onboarding the tenant:
126
− - Relaunch the Defender app.
127
−- Access to the Private Access application shows a connection time-out error after a successful interactive sign-in.
128
− - Reload the application (or refresh the web browser).
160
+ - Relaunch the Defender app.
161
+- Access to the Private Access application shows a connection time-out error after a successful interactive sign-in:
162
+ - Reload the application (or refresh the web browser).
129163
130164
## Related content
131
−- [Troubleshoot the Global Secure Access Mobile Client: Advanced Diagnostics](troubleshoot-global-secure-access-mobile-client-advanced-diagnostics.md)
165
+
166
+- [Troubleshoot the Global Secure Access mobile client: Advanced diagnostics](troubleshoot-global-secure-access-mobile-client-advanced-diagnostics.md)
132167
- [Troubleshoot the Global Secure Access mobile client with Health check utility](troubleshoot-global-secure-access-mobile-client-health-check-utility.md)
133168
- [Microsoft Defender for Endpoint on iOS](/defender-endpoint/microsoft-defender-endpoint-ios)
134169
- [Deploy Microsoft Defender for Endpoint on iOS with Microsoft Intune](/defender-endpoint/ios-install)
135
−- [Global Secure Access client for macOS](how-to-install-macos-client.md)
136
−- [Global Secure Access client for Microsoft Windows](how-to-install-windows-client.md)
137
−- [Global Secure Access client for Android](how-to-install-android-client.md)
170
+- [Install the Global Secure Access client for macOS](how-to-install-macos-client.md)
171
+- [Install the Global Secure Access client for Windows](how-to-install-windows-client.md)
172
+- [Install the Global Secure Access client for Android](how-to-install-android-client.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.