Configuring Authenticator Only on Ivanti Neurons for MDM

An Authenticator Only deployment requires an Ivanti Access deployment with UEM, as well as additional configurations for Zero Sign-on in Ivanti Access and in the UEM. The configurations for Authenticator Only are done in UEM. The following steps provide an overview of the configuration steps for deploying Authenticator Only and pointers to the relevant content in the Ivanti Neurons for MDM Guide.

Before you begin 

• Ensure that you have an Ivanti Access deployment with UEM.
  See Overview of configuration with Ivanti Neurons for MDM.
  

• Ensure that Zero Sign-on is configured.

  See "Zero Sign-on" in the Ivanti Access Guide.

Procedure: Overview of steps

1. Create a user group to deploy Authenticator Only and manually add users to the group.
   See "Creating a manually managed user group" in the Ivanti Neurons for MDM Guide.

2. Create a dynamically managed device group with the rule "user group," which equals to the user group created for Authenticator Only.
   

   See "Adding a device group" in the Ivanti Neurons for MDM Guide.

   If devices had been previously enrolled in an Ivanti Neurons for MDM tenant, users will not be able to register with the same Ivanti Neurons for MDM tenant using Authenticator Only. Delete the devices from the Ivanti Neurons for MDM tenant, then register again with the same Ivanti Neurons for MDM tenant using Authenticator Only.

3. Create an Authenticator Only configuration and assign it to the dynamically managed device group created for Authenticator Only.
   See Adding an Authenticator Only configuration on Ivanti Neurons for MDM.

4. Sync with Ivanti Access.

   See Syncing with Ivanti Access

5. Download and register Go.
   If Always require client registration is enabled in Users > User Settings > Device Registration Setting in Ivanti Neurons for MDM, users automatically get emails for registering their device using Go. Device users download Go to their device directly from the Apple App Store or from Google Play Store.
   See What users see for Authenticator Only for information about how device users can register their devices to your Ivanti Neurons for MDM instance.

Related topics 

• About Authenticator Only with Ivanti Access
• What users see for Authenticator Only

Adding an Authenticator Only configuration on Ivanti Neurons for MDM

Create an Authenticator Only configuration on Ivanti Neurons for MDM.

Before you begin 

You can create the Authenticator Only configuration only if a SaaS Sign on configuration is available. Therefore, verify that a SaaS Sign on configuration has been created. The SaaS Sign on configuration is created for a Zero Sign-on deployment. See "Zero Sign-on" in the Ivanti Access Guide.

Procedure 

1. In Ivanti Neurons for MDM, go to Configurations > + Add > Authenticator Only.

   Figure 1. Authenticatory only configuration

   

2. In the Name field, enter a name for the configuration.
3. (Optional) Expand + Add Description, to add a description for the configuration.

4. For SaaS Sign-On config, select a SaaS sign on configuration.

   The selected SaaS Sign-On configuration is pushed to the device. Ivanti Access uses the SaaS sign-on configuration to authenticate the device.

5. Click Next.

6. Verify that the the check box for Enable this configuration is selected.

   The option is selected by default.

7. Select the distribution group created for Authenticator Only.
   The configuration is distributed to the devices in the selected option.
8. Click Done.

Next steps 

Syncing with Ivanti Access

Syncing with Ivanti Access

Sync with Ivanti Access to pull the UEM configurations.

Procedure 

1. In Ivanti Access, navigate to the UEM tab.
2. Select the Ivanti Neurons for MDM UEM and click the Sync UEM icon.
3. Enter the UEM administrator credentials and click Verify.
4. Click Done.

Next steps 

See Registration workflow for Authenticator Only devices