Mobile Device Management Overview
As mobile endpoints become more powerful, end users increasingly rely on them to perform business tasks. However, these same endpoints that access your corporate network also connect to the internet without protection against threats and vulnerabilities.
A mobile device management (MDM) system or enterprise mobility management (EMM) system simplifies the administration of mobile endpoints by enabling you to automatically deploy your corporate account configuration and VPN settings to compliant endpoints. You can also use your mobile device management system for remediation of security breaches by interacting with an endpoint that has been compromised. This protects both corporate data as well as personal end user data. For example, if an end user loses an endpoint, you can remotely lock the endpoint from the mobile device management system or even wipe the endpoint (either completely or selectively).
In addition to the account provisioning and remote device management functions that a mobile device management system can provide, when integrated with your existing GlobalProtect™ VPN infrastructure, you can use host information that the endpoint reports to enforce security policies for access to apps through the GlobalProtect gateway. You can also use the monitoring tools that are built into the Palo Alto next-generation firewall to monitor mobile endpoint traffic.
GlobalProtect Integration With an MDM or EMM System
You can integrate your GlobalProtect deployment with an MDM or EMM system using one of the following methods:
Firewall Integration With an MDM or EMM System (AirWatch only)
You can configure the Windows User-ID agent to communicate with the AirWatch MDM server to collect host information from connecting endpoints. The User-ID agent sends this host information to the GlobalProtect gateway as part of the HIP report for use in HIP-based policy enforcement.
Firewall integration is supported with PAN-OS 8.0 and later releases.
Firewall integration is supported only with VMware AirWatch.
GlobalProtect App Integration With an MDM or EMM System
Starting with version 5.0, the GlobalProtect app for iOS and Android endpoints can obtain vendor data attributes and tags from MDM systems. For iOS endpoints, MDM systems send these attributes to the GlobalProtect app as part of the VPN profile. For Android endpoints, MDM systems send these attributes as part of the App Restrictions configuration. The GlobalProtect app can then send these attributes and tags to the GlobalProtect gateway as part of the HIP report for use in HIP-based policy enforcement.
GlobalProtect app integration is qualified with VMware AirWatch, MobileIron, and Microsoft Intune. However, this integration method is also supported with any MDM or EMM system that supports vendor data attributes in the VPN profile.
The following table describes the supported vendor data attributes:
HIP Report Attribute
HIP Report Category
Unique device identifier (UDID) of the endpoint.
Value that indicates whether the endpoint is managed. If this value is Yes, the endpoint is managed. If this value is No, the endpoint is unmanaged.
Compliance status that indicates whether the endpoint is compliant with the MDM compliance policies that you have defined (for example, Compliant). This value is appended to the Tag attribute in the HIP report.
Ownership category of the endpoint (for example, Employee Owned). This value is appended to the Tag attribute in the HIP report.
Tags to match against other MDM-based attributes.
Set Up a Mobile Endpoint Management System
Set Up the MDM Integration With GlobalProtect To set up the MDM integration with GlobalProtect, use the following workflow: Set up the GlobalProtect Infrastructure. Create ...
Mobile Endpoint Management
Mobile Device Management Mobile Device Management Overview Set Up the MDM Integration With GlobalProtect ...
Manage the GlobalProtect App Using a Supported Third-Party MDM
Manage the GlobalProtect App Using a Qualified Third-Party MDM Refer to the following sections for information on how to deploy, configure, and manage the GlobalProtect ...
HIP Objects Mobile Device Tab
HIP Objects Mobile Device Tab Objects GlobalProtect HIP Objects Mobile Device Select the Mobile Device tab to enable HIP matching on data collected from mobile ...
Configure Windows User-ID Agent to Collect Host Information
Configure Windows User-ID Agent to Collect Host Information The Windows-based User-ID agent has been extended to support a new AirWatch MDM integration service. This service ...
MDM Integration Overview
MDM Integration Overview The MDM integration service included with the Windows-based User-ID agent performs a full HIP query to the AirWatch MDM server to retrieve ...
What Data Does the GlobalProtect App Collect?
What Data Does the GlobalProtect App Collect? By default, the GlobalProtect app collects vendor-specific data about the end user security packages that are running on ...
Configure a Per-App VPN Configuration for iOS Endpoints Using AirWatch
Configure a Per-App VPN Configuration for iOS Endpoints Using AirWatch You can enable access to internal resources from your managed mobile endpoints by configuring GlobalProtect ...
Configure an Always On VPN Configuration for iOS Endpoints Using AirWatch
Configure an Always On VPN Configuration for iOS Endpoints Using AirWatch In an Always On VPN configuration, the secure GlobalProtect connection is always on. Traffic ...