ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 257/260 feeds/APIs · 416/439 docs · checked 21:54 UTC Customize Public modeDiscuss ChangeIntel on Discord

GSA iOS client deployment

This page's changes and edits · All guidance changes

Microsoft's edit ·

edit pass: installing-the-global-secure-access-client

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 6bec23f · +47 −46 lines · also on GitHub

⋯ 22 unchanged lines
2323 ## Prerequisites
2424
2525 - To use the Global Secure Access iOS client, configure the iOS endpoint device as a Microsoft Entra registered device.
26 −- To enable Global Secure Access for your tenant, refer to the [Licensing requirements](overview-what-is-global-secure-access.md#licensing-overview). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
27 −- Onboard the tenant to Global Secure Access and configure one or more traffic forwarding profiles. For more information, see [Access the Global Secure Access area of the Microsoft Entra admin center](quickstart-access-admin-center.md).
28 −- To enable a Kerberos SSO experience, create and deploy a profile for the iOS [Single sign-on app extension](/intune/intune-service/configuration/ios-device-features-settings#single-sign-on-app-extension).
26 +- To enable Global Secure Access for your tenant, refer to the [licensing requirements](overview-what-is-global-secure-access.md#licensing-overview). If necessary, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
27 +- Onboard the tenant to Global Secure Access, and configure one or more traffic forwarding profiles. For more information, see [Access the Global Secure Access area of the Microsoft Entra admin center](quickstart-access-admin-center.md).
28 +- To enable a Kerberos single sign-on (SSO) experience, create and deploy a profile for the iOS [SSO app extension](/intune/intune-service/configuration/ios-device-features-settings#single-sign-on-app-extension).
2929
3030 ## Requirements
3131
3232 ### Network requirements
3333
34 −For Microsoft Defender for Endpoint on iOS (available in the [Apple App Store](https://apps.apple.com/us/app/microsoft-defender-security/id1526737990)) to function when connected to a network, you must configure the firewall/proxy to [Enable access to Microsoft Defender for Endpoint service URLs](/defender-endpoint/configure-environment#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server).
34 +For Microsoft Defender for Endpoint on iOS to function when it's connected to a network, you must configure the firewall/proxy to [enable access to Microsoft Defender for Endpoint service URLs](/defender-endpoint/configure-environment#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server). Microsoft Defender for Endpoint on iOS is available in the [Apple App Store](https://apps.apple.com/us/app/microsoft-defender-security/id1526737990).
3535
3636 > [!NOTE]
3737 > Microsoft Defender for Endpoint on iOS isn't supported on userless or shared devices.
⋯ 4 unchanged lines
4242
4343 - The device runs iOS 16.0 or newer.
4444 - The device has the Microsoft Authenticator app or the Intune Company Portal app.
45 −- For the supervised devices, the device must be enrolled to enforce Intune device compliance policies.
45 +- If the device is supervised, it must be enrolled to enforce policies for Intune device compliance.
4646
4747 ## Known limitations
4848
⋯ 3 unchanged lines
5252
5353 ### Deploy on Device Administrator enrolled devices with Microsoft Intune
5454
55 −1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **iOS/iPadOS** > **Add** > **iOS store app** and choose **Select**.
55 +1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **iOS/iPadOS** > **Add** > **iOS store app**. Then choose **Select**.
5656
5757 :::image type="content" source="media/how-to-install-ios-client/ios-client-add-ios-store-app.png" alt-text="Screenshot of the Microsoft Intune admin center with the steps to add an iOS store app highlighted.":::
5858
59 −1. On the **Add app** page, select **Search the App Store** and type **Microsoft Defender** in the search bar.
59 +1. On the **Add app** page, select **Search the App Store** and enter **Microsoft Defender** on the search bar.
6060
61 −1. In the search results, select **Microsoft Defender** and select **Select**.
61 +1. In the search results, select **Microsoft Defender** and then choose **Select**.
6262
63 −1. Select **iOS 15.0** as the minimum operating system. Review the rest of the information about the app, and select **Next**.
63 +1. Select **iOS 15.0** as the minimum operating system. Review the rest of the information about the app, and then select **Next**.
6464
6565 1. In the **Assignments** section, go to the **Required** section and select **Add group**.
6666
67 − :::image type="content" source="media/how-to-install-ios-client/ios-client-add-group.png" alt-text="Screenshot of the Add App screen with the Add group option highlighted.":::
67 + :::image type="content" source="media/how-to-install-ios-client/ios-client-add-group.png" alt-text="Screenshot of the Add App page with the option for adding a group highlighted.":::
6868
6969 1. Choose the user groups to target with the Defender for Endpoint on iOS app.
7070
7171 > [!NOTE]
72 − > The selected user group should consist of Microsoft Intune enrolled users.
72 + > Selected user groups should consist of Microsoft Intune enrolled users.
7373
74 −1. Select **Select** and then **Next**.
74 +1. Choose **Select**, and then select **Next**.
7575
76 −1. In the **Review + Create** section, verify that all the information entered is correct and then select **Create**. After a few moments, the Defender for Endpoint app is created successfully, and a notification appears at the top-right corner of the page.
76 +1. In the **Review + Create** section, verify that all the entered information is correct and then select **Create**. After a few moments, the Defender for Endpoint app is created successfully, and a notification appears at the upper-right corner of the page.
7777
78 −1. On the app information page, in the **Monitor** section, select **Device install status** to verify that the device installation is completed successfully.
78 +1. On the app information page, in the **Monitor** section, select **Device install status** to verify that the device installation finished successfully.
7979
80 − :::image type="content" source="media/how-to-install-ios-client/ios-client-device-install-status.png" alt-text="Screenshot of the Device install status screen showing a list of installed devices.":::
80 + :::image type="content" source="media/how-to-install-ios-client/ios-client-device-install-status.png" alt-text="Screenshot that shows a list of installed devices on the pane for device installation status.":::
8181
8282 ### Create a VPN profile and configure Global Secure Access for Microsoft Defender for Endpoint
8383
8484 1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Devices** > **Configuration** > **Create** > **New Policy**.
8585
86 −1. Set the **Platform** to **iOS/iPadOS**, the **Profile type** to **Templates**, and the **Template name** to **VPN**.
86 +1. Set **Platform** to **iOS/iPadOS**, **Profile type** to **Templates**, and **Template name** to **VPN**.
8787
8888 1. Select **Create**.
8989
90 −1. Type a name for the profile and select **Next**.
90 +1. Enter a name for the profile, and then select **Next**.
9191
92 −1. Set the **Connection Type** to **Custom VPN**.
92 +1. Set **Connection Type** to **Custom VPN**.
9393
94 −1. In the **Base VPN** section, enter the following:
94 +1. In the **Base VPN** section, enter the following information:
9595
96 − - **Connection Name**: Microsoft Defender for Endpoint
97 − - **VPN server address**: 127.0.0.1
98 − - **Auth method**: "Username and password"
99 − - **Split Tunneling**: Disable
100 − - **VPN identifier**: com.microsoft.scmx
96 + - **Connection Name**: **Microsoft Defender for Endpoint**
97 + - **VPN server address**: **127.0.0.1**
98 + - **Authentication method**: **Username and password**
99 + - **Split tunneling**: **Disable**
100 + - **VPN identifier**: **com.microsoft.scmx**
101101
102 −1. In the key/value pairs fields:
102 +1. In the boxes for key/value pairs:
103103
104 − - Add the key **SilentOnboard** and set the value to **True**.
105 − - Add the key **EnableGSA** and set the appropriate value from the following table:
104 + - Add the `EnableGSA` key and set the appropriate value from the following table:
106105
107106 |Key |Value |Details |
108107 |---------|---------|---------|
109 − |EnableGSA |No value | Global Secure Access isn't enabled and the tile isn't visible. |
110 − | |0 | Global Secure Access isn't enabled and the tile isn't visible.|
111 − | |1 | Global Secure Access tile is visible and defaults to disabled state. User can enable or disable using the toggle.|
112 − | |2 | Global Secure Access tile is visible and defaults to enabled state. User can enable or disable using the toggle from the app. |
113 − | |3 | Global Secure Access tile is visible and defaults to enabled state. User **can't** disable Global Secure Access. |
108 + |`EnableGSA` |No value | Global Secure Access isn't enabled and the tile isn't visible. |
109 + | |`0` | Global Secure Access isn't enabled and the tile isn't visible.|
110 + | |`1` | Global Secure Access tile is visible and defaults to a disabled state. The user can enable or disable the tile by using the toggle.|
111 + | |`2` | Global Secure Access tile is visible and defaults to an enabled state. The user can enable or disable the tile by using the toggle from the app. |
112 + | |`3` | Global Secure Access tile is visible and defaults to an enabled state. The user *can't* disable Global Secure Access. |
114113
115 − - Add more key/value pairs as required (optional):
114 + - Add the `SilentOnboard` key and set the value to `True`.
116115
116 + - Add more key/value pairs as required (optional). If you add the `EnableGSAPrivateChannel` key, select one of the following values:
117 +
117118 |Key |Value |Details |
118119 |---------|---------|---------|
119 − |EnableGSAPrivateChannel |No value |Use the EnableGSA configured option. |
120 − | |0 |Private Access isn't enabled and the toggle option isn't visible to user. |
121 − | |1 |The Private Access toggle is visible and defaults to disabled state. User can enable or disable. |
122 − | |2 |The Private Access toggle is visible and defaults to enabled state. User can enable or disable. |
123 − | |3 |The Private Access toggle is visible but grayed out, and defaults to enabled state. The user **can't** disable Private Access. |
120 + |`EnableGSAPrivateChannel` |No value |Use the `EnableGSA` configured option. |
121 + | |`0` |Private Access isn't enabled and the toggle option isn't visible to the user. |
122 + | |`1` |The Private Access toggle is visible and defaults to a disabled state. The user can enable or disable it. |
123 + | |`2` |The Private Access toggle is visible and defaults to an enabled state. The user can enable or disable it. |
124 + | |`3` |The Private Access toggle is visible but unavailable, and it defaults to an enabled state. The user *can't* disable Private Access. |
124125
125126 1. For **Type of Automatic VPN**, select **On-demand VPN**.
126127
⋯ 2 unchanged lines
129130 - Set **I want to do the following** to **Connect VPN**.
130131 - Set **I want to restrict** to **All domains**.
131132
132 − :::image type="content" source="media/how-to-install-ios-client/ios-client-set-up-vpn.png" alt-text="Screenshot of the VPN screen showing example setup parameters.":::
133 + :::image type="content" source="media/how-to-install-ios-client/ios-client-set-up-vpn.png" alt-text="Screenshot of example setup parameters in VPN configuration settings.":::
133134
134 −1. To prevent end users from disabling VPN, set **Block users from disabling automatic VPN** to **Yes**. By default, this setting isn't configured, and users can disable VPN only in the settings.
135 +1. To prevent users from disabling the VPN, set **Block users from disabling automatic VPN** to **Yes**. By default, this setting isn't configured, and users can disable the VPN only in the settings.
135136
136137 1. Select **Next** and assign the profile to targeted users.
137138
⋯ 8 unchanged lines
146147
147148 ## Confirm Global Secure Access appears in the Defender app
148149
149 −Because the Global Secure Access client for iOS is integrated with Microsoft Defender for Endpoint, it's helpful to understand the end user experience. The client appears in the Defender dashboard after onboarding to Global Secure Access.
150 +Because the Global Secure Access client for iOS is integrated with Microsoft Defender for Endpoint, it's helpful to understand the user experience. The client appears in the Defender dashboard after you onboard to Global Secure Access.
150151
151 −:::image type="content" source="media/how-to-install-ios-client/ios-defender-dashboard-1.png" alt-text="Screenshot of the iOS Microsoft Defender dashboard.":::
152 +:::image type="content" source="media/how-to-install-ios-client/ios-defender-dashboard-1.png" alt-text="Screenshot of the Microsoft Defender dashboard for iOS.":::
152153
153 −You can enable or disable the Global Secure Access client for iOS by setting the **EnableGSA** key in the [VPN profile](#create-a-vpn-profile-and-configure-global-secure-access-for-microsoft-defender-for-endpoint). End users can enable or disable individual **Services** or the client itself based on the configuration settings, using the appropriate toggles.
154 +You can enable or disable the Global Secure Access client for iOS by setting the `EnableGSA` key in the [VPN profile](#create-a-vpn-profile-and-configure-global-secure-access-for-microsoft-defender-for-endpoint). Users can enable or disable individual services or the client itself based on the configuration settings, by using the appropriate toggles.
154155
155 −:::image type="content" source="media/how-to-install-ios-client/ios-client-enabled-disabled-1.png" alt-text="Screenshot of the Global Secure Access client on iOS showing both the Enabled and Disabled status screens.":::
156 +:::image type="content" source="media/how-to-install-ios-client/ios-client-enabled-disabled-1.png" alt-text="Screenshot of the Global Secure Access client on iOS that shows both the Active and Not Connected status screens.":::
156157
157158 ## Troubleshooting
158159
159 −- The Global Secure Access tile doesn't appear in the Defender app after onboarding the tenant:
160 − - Relaunch the Defender app.
160 +- The Global Secure Access tile doesn't appear in the Defender app after you onboard the tenant:
161 + - Restart the Defender app.
161162 - Access to the Private Access application shows a connection time-out error after a successful interactive sign-in:
162163 - Reload the application (or refresh the web browser).
163164
⋯ 9 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 21:54 UTC · 257 of 260 readable · 255 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.