Configure MDM Posture Checks for Prisma Agent

1. In Strata Cloud Manager, go to Access Agent Setup by selecting ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetup.
2. Set up an MDM integration.

   1. Edit the Global Agent Settings by selecting the gear icon.

   2. Select MDM Integration.

   3. Add an MDM integration or select an existing integration to edit.

      The Add MDM Integration panel opens.
   4. Enter a descriptive Name for the MDM integration profile.
   5. For Mobile Device Management (MDM), choose your MDM vendor: Microsoft Intune for Windows devices or Jamf for macOS devices.

   6. If you chose Microsoft Intune, enter the Tenant DeviceID.

      If you chose Jamf, enter the Host URL for your Jamf instance (for example, https://yourcompany.jamfcloud.com/).

   7. Enter the Client DeviceID from your MDM vendor.

      For Microsoft Intune, the Client DeviceID is the application (client) ID of the Azure AD app registration that the Endpoint Manager uses to authenticate to the Microsoft Graph API. The Endpoint Manager queries the following endpoint: https://graph.microsoft.com/v1.0/deviceManagement/managedDevices

      For Jamf, the Client DeviceID is the client ID from your Jamf API role and client credentials.
   8. Enter the Client Secret.
   9. For Confirm Client Secret, re-enter the client secret.
   10. Enter the Polling Frequency to set how often the Endpoint Manager performs bulk device queries against your MDM tenant.

       The default polling interval is 8 hours. You can set a value between 1 and 24 hours.

       For Microsoft Intune, the Endpoint Manager performs bulk queries at each polling interval by calling the Microsoft Graph API (https://graph.microsoft.com/v1.0/deviceManagement/managedDevices), filtering by the lastSyncDateTime field and paginating through results in batches of 100 devices to sync the full managed device inventory into the Endpoint Manager cache.

       In addition to these scheduled bulk queries, the Endpoint Manager performs real-time queries when a device is not found in the cache or when its cached status is non-compliant. For Microsoft Intune, real-time queries are filtered by device serial number. Real-time queries allow the system to verify current device state immediately at tunnel establishment without waiting for the next polling cycle.

       For Jamf, the Endpoint Manager performs bulk queries at each polling interval by calling the Jamf Pro API (api/v1/computers-inventory) to sync the managed device inventory into the Endpoint Manager cache. Real-time queries are filtered by device serial number and allow the Endpoint Manager to verify current device state at tunnel establishment without waiting for the next polling cycle.

       By default, the Endpoint Manager checks whether the device is managed in Jamf. If you have configured smart groups in your agent settings, the Endpoint Manager also enforces smart group membership as a compliance criterion.
   11. Click Add.
   12. Click Save.
3. Enable the compliance enforcement setting in your agent configuration.

   1. In Access Agent Setup, click Add Agent Settings or select an existing agent setting to edit.

   2. Scroll to the Authorization section and enable MDM Compliance Check. (Default: Disabled)

      Agent settings are evaluated in top-down order. If a user matches multiple agent settings, only the first matching setting applies. If MDM Compliance Check is enabled on a lower-priority setting that the same user also matches, the compliance check is not enforced for that user. Reorder your agent settings so that the setting with MDM Compliance Check enabled appears above any other settings that the same users may match.
   3. Configure other agent settings as needed.
   4. Click Save and push the configuration to Prisma Access.
4. Select ConfigurationEndpoint Management to monitor the compliance status of your agents.

   The Devices table includes two columns that reflect MDM compliance data:

   • Compliance Status—Shows the MDM compliance status of each device: compliant, non_compliant, or N/A if the device is not enrolled in your MDM tenant.
   • Last Sync Time—Shows the last time the Endpoint Manager synced the device's compliance status from your MDM tenant. Devices show N/A if they have not yet been synced.
5. (Optional) To verify MDM compliance enforcement is active, run the pacli mdm command on an endpoint and check the Device MDM Compliant field.

   For example, on a device that fails the MDM compliance check, the Device MDM Compliant field returns Not Compliant, and the Prisma Agent displays a banner stating that the connection could not be established because the device is not compliant.