Configure Microsoft InTune for iOS
This document provides the configuration flow of pushing VPN profile to mobile device from Intune MDM (Mobile Device Management).
Assumption: Device already managed with Intune.
Creation of custom VPN Profile
- Login to the Intune MDM account using the URL: https://devicemanagement.microsoft.com/
- Once logged into the account, click Device Configuration.
- In the Device Configuration, click Profiles to create the new VPN profile.
- Click Create Profile in the Profiles section. Refer how to create the apple configurator VPN profile.
Create the profile by completing the required information in the fields.
- Once Profile Type is selected as Custom, a window will be opened to upload the Apple Configurator profile file.
Provide the Custom configuration profile name and upload the apple configurator (.mobileconfig) file.
[Refer Step#4 to how to create the apple configurator VPN profile]
When you use apple configurator to create mobileconfig file, it adds the following key value pair which causes certificate installation failure. Delete this key pair to make the certificate work.
<key>DNS</key>
<dict>
<key>SupplementalMatchDomainsNoSearch</key>
<integer>0</integer>
</dict>
- File content looks like in below image. click OK.
- Click Create.
An example of a saved profile is shown below:
Assign the Profile to a Managed Device
- In the Saved profile page, click Assignments.
- From the Assign to drop down list, select the specific groups to distribute the profile.
3. Click Save. In the profile, click Device status in the Monitor section. Click the device in which profile got pushed.
- Once the device page is opened, click Sync to activate the profile distribution action immediately.
- In the profile, now device’s deployment status is Succeeded.
Inside the Device after Publishing the Profile
- In the device, in Settings > General > Profiles & Device Management > <MDM Profile> >More Details > VPN SETTINGS, our distributed profile will be visible.
- Go to Settings > VPN, tick mark the profile which got pushed from Intunes. Now, click status to enable VPN connection.
Create a VPN Profile using Apple Configurator
- Install Apple Configurator 2 application in MAC machine. and click New Profile.
- Give specific name in the General > Name field.
- Click Certificates and upload the device certificate.
- Click on VPN and configure it with the required fields. Please refer the table at the end of the page to configure VPN profile fields.
Save the file. It will be saved with .mobileconfig extension.
VPN Profile Info
| Fields | Values |
| Connection Name | IOSTestProfile |
| Connection Type | IKEv2 |
| Server |
c<customer ID>.smcs.skyhigh.cloud The following information is required to configure an SMCS app in the MDM of your choice. VPN gateway address: c<customer ID>.smcs.skyhigh.cloud |
| Remote Identifier | vpn.skyhigh.cloud (This string is SAN (Subject Alternate Name) of server certificate) |
| Connection Name | IOSTestProfile |
| Connection Type | IKEv2 |
| Local Identifier | XXXXX (This string is SAN-(Subject Alternate Name) of client certificate) |
| Machine Authentication | Certificate |
| Certificate Type | RSA |
| Server Certificate Issuer Common Name | XXXX [OPTIONAL] (This string is CN-Common Name of server root certificate) |
| Server Certificate Common Name | vpn.skyhigh.cloud (This string is CN-Common Name of server certificate) |
| Enable EAP | True |
| Disconnect on Idle | Never |
| EAP Authentication | Certificate |
| Identity Certificate | Select the identity certificate |
| Dead Peer Detection Rate | Medium |
| Enable Perfect Forward Secrecy (PFS) | True |
| IKE SA Params & Child SA Params |
Encryption Algorithm: AES-256 Encryption Algorithm: SHA2-256 Diffi e Hellman Group: 14 or, 15 Lifetime In Minutes: 1440 |
| Connection Name | IOSTestProfile |
| Connection Type | IKEv2 |
| Proxy Setup | None |