Configuring UEM

Unified Endpoint Management (UEM) enables Central NAC to manage and secure an organization's end-user devices such as smartphones, tablets, laptops, desktops, and IoT devices—from a single platform.

Microsoft Intune is a cloud-based UEM solution that helps organizations manage and secure their devices, applications, and data.

To configure an Unified Endpoint Management (UEM) provider, complete the following steps:

  1. In the HPE Aruba Networking Central landing page, click the Menu icon.

  2. Navigate to the Extensions card and click Manage.

    The Extensions page is displayed which lists the Available Extensions and Installed Extensions tabs.

  3. Navigate to the Microsoft Intune UEM card and click Install.

  4. In the Microsoft Intune configuration panel, configure the following parameters:

    • Name—Enter a name to identify the intune extension.

    • URL—Enter the graph endpoint URL. Copy the URL displayed under Microsoft Graph API endpoint under the Endpoints tab in the App registration screen on Microsoft Entra portal.

    • Client ID—Enter the Client ID from the App registration screen.

    • Secret—Enter the secret from the App registration screen.

    • Token Server URL—Enter the token server URL. Copy this URL displayed under OAuth 2.0 token endpoint (v2) under the Endpoints tab in the App registration screen.

      Note:

      Ensure to enter correct token URL. If this is incorrect, Central NAC authentication profile will not be able to use Microsoft Intune.

DeviceID support for Intune UEM

We have improved support for Subject Alternative Name (SAN) URI formats in certificate requests from Intune-managed devices. While using a standard format is recommended for consistency and optimal compatibility, the system now accommodates a wider range of SAN URI patterns. This ensures backward compatibility with existing certificates and supports diverse enrollment scenarios.

For Android devices, include the User Principal Name (UPN) in the SAN field and configure the SSID as the RADIUS server name.

Recommended Format

The preferred and recommended SAN URI format is:

SANURI: cnac+intune:///?DeviceId={{DeviceId}}

The following SAN URI formats are also supported for flexibility and backward compatibility:

SANURI: DeviceId:{{DeviceId}} SANURI: DeviceId:{{DeviceId}},AAD_Device_ID:{{AzureDeviceId}} SANURI: DeviceId:{{DeviceId}},AAD_Device_ID:{{AzureDeviceId}},UserPrincipalName:{{UPN}} SANURI: {{DeviceId}} SANURI: DeviceId={{DeviceId}}

API Permissions for Intune

The following API permissions must be granted to the app registration to enable Intune integration with Central NAC:

scep_challenge_provider 
Application.Read.All
DeviceManagementManagedDevices.Read.All

Profiles

The following profiles must be created in Microsoft Intune for iOS, Windows, Android, and OSX devices:

  • Trusted certificate

  • SCEP certificate

  • Wi-Fi/Wired

    • Note:

    • The Radius or Certificate Server Name for EAP-TLS will be same as the SSID name.

    • Subject Name Format must have CN={{UserPrincipalName}}