Field Notice: FN72427 - Identity Services Engine: End of Support for UDID-Based Queries for Microsoft Intune MDM Integrations - Software Upgrade Recommended

Across all affected releases, Cisco Identity Services Engine (ISE) uses the Microsoft network access control (NAC) API for Microsoft Intune Mobile Device Management (MDM) / Unified Endpoint Management (UEM) integration. Microsoft will deprecate the NAC API on March 31, 2024 (deprecation date was postponed from December 31, 2023).

This will impact Cisco ISE customers using Microsoft Intune for MDM for wired, wireless, and VPN deployment scenarios in the following ways:

• Cisco ISE releases 3.0 and earlier will no longer be able to obtain registration or compliance information from the Microsoft Intune MDM integration.
• Cisco ISE releases 3.1 and later will no longer be able to obtain registration or compliance information from Microsoft Intune using Unique Device Identifier (UDID)-based queries used in VPN and in some Wi-Fi deployments.

For further information, refer to New Microsoft Intune service for NAC.

Microsoft will deprecate the Intune NAC service API on March 31, 2024. This API supports the method for Cisco ISE to determine corporate asset ownership or registration and retrieve endpoint security compliance using MAC address and UDID-based queries. Once deprecated, all queries from Cisco ISE to Intune will need to utilize the Microsoft Compliance Retrieval API. Microsoft’s Compliance Retrieval API supports Global Unique Identifier (GUID) as the unique identifier and, as of July 31, 2023, also supports MAC address-based queries.

In Cisco ISE releases earlier than Release 3.1, the integration between Cisco ISE and Intune was done with the Cisco ISE MDM APIv2 using the Intune NAC service, which used the MAC address or UDID (in the case of VPN flows where the MAC address was not available) of the endpoint as the means of endpoint identification. Cisco ISE Release 3.1 introduced MDM APIv3, which also supports the use of a GUID for endpoint identification. Microsoft Intune supports MDM APIv3 with their Compliance Retrieval API.

Microsoft and Cisco strongly recommend the use of Cisco ISE Release 3.1 or later together with GUID embedded in the certificate. As some operating system vendors begin to limit the ability of applications to access MAC addresses due to privacy concerns, it becomes more of a challenge for MDM vendors to collect and rely on MAC addresses. As a result, although MAC address-based queries are supported by Microsoft’s Compliance Retrieval API, due to limitations imposed by the operating system vendors with later versions of operating systems, there will likely be more endpoints without MAC addresses known to the MDM. And, for wired and wireless-based endpoints, if the MAC address is not known to Intune, then no valid response will be received by Cisco ISE.

This limitation is also seen for VPN-based endpoints where the MAC address is discovered by the VPN client and not passed on to Cisco ISE. For these endpoints, it will not be possible to check their registration or compliance status with Intune after the deprecation of the NAC Service API.

Once Microsoft deprecates the NAC service API, Cisco ISE API queries to Intune will fail, and Intune-managed endpoints will appear as not-registered. Cisco ISE will also trigger an alarm indicating that the Intune API is unreachable.

For Wi-Fi scenarios, complete the following steps to continue the use of the Microsoft Intune MDM integration:

1. Upgrade Cisco ISE to Release 3.1 or later.
2. Configure the use of MDM APIv3 Microsoft Intune integration. This includes the deployment of GUID-embedded certificates to all Intune-registered wired and wireless connected endpoints and confirmation that those certificates are used for network authentication. For more information, see the Integrate MDM and UEM Servers with Cisco ISE Configuration Guide.

For VPN scenarios or for Wi-Fi scenarios where authentication does not use GUID-embedded certificates, upgrade to any of the following Cisco ISE release patches:

• ISE 3.2 P4
• ISE 3.1 P8
• ISE 3.3 P1 (estimated release date: first half of Dec 2023)

Microsoft’s Compliance Retrieval API does not currently support “Ethernet MAC” for MAC Address-based APIs. This will affect Cisco ISE customers using Microsoft Intune for MDM for wired infrastructure. This limitation will be addressed by Microsoft in January 2024. For wired infrastructure scenarios, it is strongly recommended to migrate to GUID-embedded certificates before upgrading to Cisco ISE 3.1 P8, 3.2 P4, or ISE 3.3 P1.

There is no plan to backport the fixes to Cisco ISE releases 3.0 and earlier.