Multi-factor authentication configuration for Ivanti EPMM

The user should be capable of using multi-factor authentication by enabling multi-factor authentication setting on Azure.

To support multi-factor authentication in Sentry OAuth, you must configure one Sentry for OAuth and another Sentry for multi-factor authentication using Tunnel.

Sentry 9.14 and 9.15 supports Azure AD Conditional Access Policy.
For more information, see Configuring conditional access rules in Azure.

Configuring multi-factor authentication on Azure

Before you begin 

  • Verify that you have Sentry 9.15.0 and newer versions.

Procedure 

  1. Login to Azure portal with admin credentials.
    The admin must be a super admin with premium features to configure multi-factor authentication for other users.

  2. Click Users and search for the user to enable multi-factor authentication.

  3. Select Per-user MFA.
    The multi-factor authentication page opens to configure the user.

  4. Select the checkbox to enable the user.
    If multi-factor authentication is not enabled, the status of multi-factor authentication shows disabled.

  5. Select Enable in the menu on the right.

  6. Enabling the user displays a prompt to enable multi-factor authentication for the specific user.

  7. Click enable multi-factor auth.

    A confirmation message displays after enabling multi-factor authentication.

  8. The user OAuth status is now changed to Enabled.

Configuring native email on Ivanti EPMM for multi-factor authentication

Procedure 

  1. On one Sentry, configure OAuth. See OAuth for Sentry on Ivanti EPMM.

  2. On a different Sentry, configure VPN on Ivanti EPMM UEM.

    1. On Ivanti EPMM, click Policies and Config.

    2. Create a local Scep using local CA.

    3. Under Add, select VPN from the drop-down .

    4. Configure the following fields on Add VPN Setting window.

      • Connection Type: MobileIron Tunnel

      • Sentry - Select the second Sentry from the drop-down.

      • Sentry service: TCP

      • Provider type: App Proxy

      • Identity certificate: Local Scep from drop-down.

      • Open Safari domain section, add the following MS domains:

        • login.windows.net

        • login.microsoftonline.com

      • Save the settings and apply the label.



  3. Configure Ivanti Tunnel application in Apps > App Catalog.


  4. Register the device with Office 365 user and complete the MDM enrollment.

  5. Download Ivanti Tunnel application from Apps@work and complete the device registration.

  6. Launch Native mail application and click on Edit settings option.
    The user is now redirected to Microsoft online to enter the password.

  7. Enter the password.
    The user is now prompted for MFA on the device.


  8. After selecting MFA option, authentication is successful and user is redirected back to the mailbox.

Configuring OAuth for Android Email+ on Ivanti EPMM

Before you begin 

  • Verify that you use Office 365 and have an Office 365 certificate.

Procedure 

  1. On Core, click Policies and Configs > Configurations > Add New > Certificate Enrollment > Single File Identity.

  2. Add the Office 365 certificate.

  3. On Core, click Apps and perform the following steps:

  1. Select Google Play and search for Ivanti Email+ application.

  2. Under App Configurations, select Email+ application:

    • Enable Install this App for Android Enterprise.

    • Under Configuration choices, select the default configuration :

      • Configure Email address

      • Device ID

      • Exchange host: Sentry 1 server hostname

      • Exchange username

      • Email Password

      • Enable SSL required and Trust all Certificate options

      • Configure email login certificate

      • Configure email signing certificate

    • Select Authorization mode

      • Authorization mode: Modern Authentication

      • EWS Authentication mode: Basic Authentication

      • Configure Modern Auth Authority URL

      • Configure Modern Auth resource URL



      • Apply the configuration and click Finish.

      • Register the device with MDM and install Android Enterprise Work Profile.

      • Install Tunneland Email+

      • Download Tunnel application.

      • Launch Email+ application and authenticate.

      • Enter the password to authenticate.
        The user is now prompted for MFA on the device.

Configuring OAuth for Android Enterprise Email+ on Ivanti EPMM

  1. On the first Sentry, configure OAuth. See OAuth for Sentry on Ivanti EPMM.

  2. Configure another Sentry hostname on Tunnel application and complete the following steps on Ivanti EPMM:

  1. On Ivanti EPMM, click Apps.

  2. Click Add > Google Play > select Ivanti Tunnel.

  3. Enable Install this app for Android Enterprise.

  4. Configure Sentry server hostname as Sentry 2.

  5. Configure Client CertAlias.

  6. Save the configuration and apply the labels.

Configuring OAuth for iOS Email+ on Ivanti EPMM

Before you begin 

  • Verify that you have a second Sentry with appconfig.

Procedure 

  1. On the first Sentry, configure OAuth. See OAuth for Sentry on Ivanti EPMM.

  2. On the second Sentry, configure Email+ for iOS.

  • On Ivanti EPMM, click Services > Sentry > Add new Sentry.

  • On Sentry configuration, update the following fields:

    1. Enable App Tunnel.

    2. Upload Identity Certificate (local CA) for Device Authentication.

    3. Under Services, click Configure ANY service.

    4. Save Sentry settings.

  • Click Policies and Config and update the following:

  • Click Policies and select Default App Connect global policy.

  • Edit the policy and enable App Connect.

  • Enable Authorize security policy and save the settings.

  • Click Policies and Config and select Configuration. Update the following:

  • In Add New, select AppConnect > App Configuration.

  • Configure Application Bundle ID for Email+.

  • Enable Split Tunnel rules.

  • Under Tunneled hosts and configured services:

    • Add Sentry 2 from the drop-down.

    • Select Any Service.

    • URL wildcard: login.windows.net

      • Port: 443

      • Add another Sentry and select the Sentry and Service Name same as above.

    • URL wildcard: login.microsoftonline.com

      • Port: 443

Configure Email+KVPs under App specific configurations: