GlobalProtect App for iOS and Android MDM Integration for HIP-Based Policy Enforcement

Software Support: Starting with GlobalProtect™ App 5.0
OS Support: iOS 10 and later releases and Android 4.4 and later releases
The GlobalProtect app for iOS and Android endpoints can now obtain the following attributes from mobile device management (MDM) systems for use in HIP-based policy enforcement:
MDM Attribute
HIP Report Attribute
HIP Report Category
Description
mobile_id
Host ID
General
Unique device identifier (UDID) of the endpoint.
managed
Managed
General
Value that indicates whether the endpoint is managed. If this value is Yes, the endpoint is managed. If this value is No, the endpoint is unmanaged.
compliance
Tag
Mobile Device
Compliance status that indicates whether the endpoint is compliant with the MDM compliance policies that you have defined (for example, Compliant). This value is appended to the Tag attribute in the HIP report.
ownership
Tag
Mobile Device
Ownership category of the endpoint (for example, Employee Owned). This value is appended to the Tag attribute in the HIP report.
tag
Tag
Mobile Device
Tags to match against other MDM-based attributes.
For iOS endpoints, MDM systems send these attributes to the GlobalProtect app as part of the VPN profile. For Android endpoints, MDM systems send these attributes as part of the App Restrictions. After the GlobalProtect app receives these attributes, it sends this data to the GlobalProtect gateway in the HIP report. Based on these attributes, the gateway can then enforce specific HIP-based security policies for fine-grained access control.
If the MDM system sends an update to any of these attributes (for example, if the compliance status of an endpoint changes from Compliant to NonCompliant), the GlobalProtect app sends the gateway a new HIP report with the updated attribute value.
If you are using MobileIron, please refer to the following knowledge base article for information on how to configure this integration:

Related Documentation