GlobalProtect App for iOS and Android MDM Integration for
HIP-Based Policy Enforcement
Software Support
: Starting with GlobalProtect™
App 5.0
OS Support
: iOS 10 and later releases and Android 4.4
and later releases
The GlobalProtect app for iOS and Android endpoints can now obtain
the following attributes from mobile device management (MDM) systems
for use in HIP-based policy enforcement:
| | | Unique device identifier (UDID) of the endpoint. |
| | | Value that indicates whether the endpoint
is managed. If this value is Yes , the endpoint
is managed. If this value is No , the endpoint
is unmanaged. |
| | | Compliance status that indicates whether
the endpoint is compliant with the MDM compliance policies that
you have defined (for example, Compliant ).
This value is appended to the Tag attribute
in the HIP report. |
| | | Ownership category of the endpoint (for
example, Employee Owned ). This value is appended
to the Tag attribute in the HIP report. |
| | | Tags to match against other MDM-based attributes. |
For iOS endpoints, MDM systems send these attributes to the GlobalProtect
app as part of the VPN profile. For Android endpoints, MDM systems
send these attributes as part of the App Restrictions. After the
GlobalProtect app receives these attributes, it sends this data
to the GlobalProtect gateway in the HIP report. Based on these attributes,
the gateway can then enforce specific HIP-based security policies
for fine-grained access control.
If the MDM system sends an update to any of these attributes
(for example, if the compliance status of an endpoint changes from
Compliant
to
NonCompliant
),
the GlobalProtect app sends the gateway a new HIP report with the
updated attribute value.
If you are using MobileIron, please refer to the following knowledge
base article for information on how to configure this integration:
