Support third-party device compliance partners in Intune

Article
07/22/2024

Several third-party device compliance partners have been evaluated as a supported partner solution that you can integrate with Microsoft Intune. When you use a third-party device compliance partner, the partner adds the compliance state data it collects to Microsoft Entra ID. You can then use the device compliance data from the partner along side the compliance results you collect with Intune to power your Conditional Access policies that help to protect your organization and data.

Third-party partners support one or more of the following platforms:

Android
iOS/iPadOS
macOS

By default, Intune is set up to be the Mobile Device Management (MDM) authority for your devices. When you add a compliance partner to Microsoft Entra ID and Intune, you're configuring that partner to be a source of Mobile Device Management (MDM) authority for the devices you assign to that partner through a Microsoft Entra user group.

To enable user data from device compliance partners, complete the following tasks:

Configure Intune to work with the device compliance partner, and then configure groups of users whose devices are managed by that compliance partner.
Configure your compliance partner to send data to Intune.
Enroll your devices to your device compliance partner.

With these tasks complete, the device compliance partner sends device state details to Intune. Intune adds this information to Microsoft Entra ID. For example, devices in a noncompliant state have a not compliant status added to their device record in Microsoft Entra ID.

Supported device compliance partners

The following compliance partners are supported as generally available:

42Gears SureMDM
7P
Addigy
BlackBerry UEM
Citrix Workspace device compliance
IBM MaaS360
Jamf Pro
Kandji
MobileIron Device Compliance Cloud
MobileIron Device Compliance On-prem
Mosyle Fuse
Mosyle Onek12
SOTI MobiControl
VMware Workspace ONE UEM (formerly AirWatch)

Note

If you offer an MDM product and would like to onboard as a device compliance partner, fill out this Form: Intune partner compliance onboarding.

Prerequisites

A subscription to Microsoft Intune, and access to the Microsoft Intune admin center.
Device users must be assigned a license for Intune.
A subscription to the device compliance partner.
Review documentation for your compliance partner for supported device platforms and that partners prerequisites.

Configure Intune to work with a device compliance partner

Enable support for a device compliance partner to use compliance state data from that partner with your Conditional Access policies.

Add a compliance partner to Intune

Sign in to Microsoft Intune admin center.
Go to Tenant Administration > Connectors and Tokens > Partner Compliance management > Add Compliance Partner.
On the Basics page, expand the Compliance partner drop-down and select the partner you're adding.
- To use VMware Workspace ONE as the compliance partner for iOS or Android platforms, select VMware Workspace ONE mobile compliance.
Next, select the drop-down for Platform, and select the platform.

You're limited to a single partner per platform, even if you have added multiple compliance partners to Microsoft Entra ID.
On Assignments, select the user groups that include devices that are managed by this partner. With this assignment, you change the MDM authority for applicable devices to use this partner. Users who have devices managed by the partner must also be assigned a license for Intune.
On the Review + create page, review your selections, and then select Create to complete this configuration.

Your configuration now appears on the Partner compliance management page.

Modify the configuration for a compliance partner

Sign in to Microsoft Intune admin center.
Go to Tenant Administration > Connectors and Tokens > Partner Compliance management, and then select the partner configuration you want to modify. Configurations are ordered by platform type.
On the partner configuration Overview page, select Properties to open the Properties page where you can edit the assignments.
On the Properties page, select Edit to open the Assignments view where you can change the groups that will use this configuration.
Select Review + save and then Save to save your edits.
This step only applies when you use VMware Workspace ONE:

From within the Workspace ONE UEM console, you must manually synchronize the changes you saved in the Microsoft Intune admin center. Until you manually sync changes, Workspace ONE UEM isn’t aware of configuration changes, and users in new groups you’ve assigned won’t successfully report compliance.

To manually sync from Azure Services:
1. Sign in to your VMware Workspace ONE UEM console.
2. Go to Settings > System > Enterprise Integration > Directory Services.
3. For Sync Azure Services, select SYNC.
  
  All the changes you’ve made since the initial configuration or the last manual synchronization are synchronized from Azure Services to UEM.

Configure your compliance partner to work with Intune

To enable a device compliance partner to work with Intune, you must complete configurations specific to that partner. For information on this task, see the documentation for the applicable partner:

Enroll your devices to your device compliance partner

Refer to the documentation from your device compliance partner for how to enroll devices with that partner. After devices enroll and submit compliance data to the partner, that compliance data is forwarded to Intune and added to Microsoft Entra ID.

Monitor devices managed by third-party device compliance partners

After you configure third-party device compliance partners and enroll devices with them, the partner will forward compliance details to Intune. After Intune receives that data, you can view details about the devices in the Azure portal.

Next steps

Use the documentation from your third-party partner to create compliance policies for devices.

Share via