Using Microsoft Intune to Deploy Imprivata MDA

Use Microsoft Intune to deploy Imprivata Mobile Device Access.

The following sections detail how to:

• Set up Android Enterprise Device Management in one of the following scenarios:

  • Set up devices to be corporate-owned, fully managed devices or

  • Set up devices to be corporate-owned, dedicated devices.

• Enroll devices

• Add Imprivata Mobile Device Access to Intune

Prerequisites

Standalone Tenant

You must have a standalone tenant in Microsoft Intune to manage Android Enterprise devices as one of the following enrollment types:

• Corporate-owned, fully managed user devices. For corporate-owned, single user devices used exclusively for work and not personal use. Administrators can manage the entire device and enforce policy controls.

• Corporate-owned, dedicated devices. For corporate-owned, single use devices. Administrators lock down the usage of a device for a limited set of apps and web links.

To manage Android enterprise devices, link your managed Google Play account to Microsoft Intune.

Important Considerations for Corporate Owned Dedicated Devices with Managed Home Screen

Consider the following items for corporate owned dedicated devices with Managed Home Screen:

• For all Imprivata Android mobile app profiles in Imprivata Enterprise Access Management (formerly OneSign), all apps should be configured to Do Nothing for logout, because logout would not succeed and would only make the logout time longer, as Imprivata MDA will spend time attempting to log out of apps.

  The Mobile policy setting for Web Browser Management should be set to Do Nothing.

  NOTE:

  Both the Android mobile app profiles and the Mobile policy are required to be set to Do nothing because Imprivata MDA cannot run Clear data/Clear cache/Force stop on a device enrolled as an Intune dedicated device (with optional MHS).

• Apps that need to have data cleared on logout should be listed in the Intune policy. For more information, see Step 4: Configure Device Restrictions Profile to Clear Data from Apps.

• Clear cache and Force stop cannot be configured for Intune Managed Home Screen because neither actions are handled by Imprivata MDA nor by Intune policy.

• Apps that support MSAL (primarily Microsoft apps) don't require additional configuration for logout because MSAL logout is enabled by default.

• Imprivata MDA Countdown to Lock mode is not supported with Intune dedicated devices, as it is not supported with Intune's Managed Home Screen deployment.

• Android 8 and 9 devices support Intune's Managed Home Screen with NFC authentication methods, and require additional configuration steps to work with Imprivata MDA.

• Imprivata MDA configured with Intune's Managed Home Screen on Android 10, 11, and 12 does not support NFC authentication methods.

• Android 13 and later devices support Intune's Managed Home Screen with NFC authentication methods.

  Android version	NFC tap	Imprivata MDA handled Clear data/cache, Force stop	Imprivata MDA handled logout	Intune handled logout
  Android 13 and later	Works	Not allowed by Intune Dedicated deployed (including MHS)	Imprivata MDA SDK integrated apps x-callback-url Universal links MSAL logout	Clear all data defined by Dedicated device app actions profile
  Android 12 and earlier	Doesn't work	Not allowed by Intune Dedicated deployment (including MHS)	Imprivata MDA SDK integrated apps x-callback-url Universal links MSAL Logout	Clear all data defined by Dedicated device app actions profile

Device Requirements

Devices must meet the following requirements as an Android Enterprise device:

• Android OS version 8 or later

• Run an Android build that has Google Mobile Services (GMS) connectivity. Devices must have GMS available and must be able to connect to GMS.

Group Assignment

The configuration tasks contain tasks for creating user groups of the Security group type, and device groups dependent on the mobile device enrollment type.

Enrollment Profiles

Set up the Intune enrollment of devices to one of the following enrollment profiles, depending on your deployment needs:

• Corporate-owned, fully managed enterprise devices.

• Corporate-owned, dedicated devices.

Set Up Android Enterprise Fully Managed Device Management

For corporate-owned, fully managed devices, perform the following tasks:

Set Up Android Enterprise Dedicated Device Management

For corporate-owned, dedicated devices, perform the following tasks:

Adding Imprivata MDA to Microsoft Intune

Create and deploy an application for Imprivata Mobile Device Access to Intune.

To deploy an application for Imprivata Mobile Device Access:

1. Log in to the Microsoft Intune admin center.

2. Select Apps > Android Apps and click Add.

3. Select Managed Google Play app from the App type dropdown and click Select.

4. In Managed Google Play, search for "Imprivata MDA" and click Approve.

5. Select Keep approved when app requests new permissions.

6. Click Sync. The app is added to the Android apps list.

To assign the Imprivata Mobile Device Access app to a user group, click the item in the list.

1. Click Properties.

2. In the Assignments section, click Edit.

3. Depending on your needs, specify the mode in which to assign the application:

   • Required. After enrollment, the application is installed on the device automatically.

   • Available for enrolled devices. The application is available but not automatically installed after enrollment.

4. Add the needed user groups to the app assignment and click Review + save.

Deploying with the Intune Launcher

This task assumes that you have created one or more user groups to assign the Microsoft Launcher and Imprivata Mobile Device Access apps to.

1. Log in to the Microsoft Intune admin center.

2. Select Apps > Android Apps and select Microsoft Launcher from the list of apps.

   If Microsoft Launcher is not displayed in the list of apps, click Add and search for it from Managed Google Play apps, click Approve and click Sync.

3. Assign the Microsoft Launcher application to the required user groups:

   1. Click Microsoft Launcher application, and click Properties.

   2. In the Assignments section, click Edit.

   3. Depending on your needs, specify the mode in which to assign the application:

      • Required. After enrollment, the application is installed on the device automatically.

      • Available for enrolled devices. The application is available but not automatically installed after enrollment.

   4. Add the needed user groups to the app assignment and click Review + save.

Configure Microsoft Launcher as the Default Launcher

Create a device configuration profile that makes the Microsoft Launcher the default, so users will not need to choose between the native launcher and Microsoft Launcher.

1. Select Devices > Configuration profiles > Create profile.

2. Select Android Enterprise for the platform.

3. Select Fully managed and dedicated devices.

4. Select Device restrictions and click Create.

   1. On the Device restrictions page, enter a name in the Name box and click Next.

   2. On the Configuration settings page, expand the Device experience section, and select Fully managed from the Enrollment profile type list.

   3. For Make Microsoft Launcher the default launcher, click Enable. Click Next.

   4. On the Assignments page, select the user groups to include and click Create.

Add Imprivata Mobile Device Access to the Home Screen of Microsoft Launcher

To add Imprivata Mobile Device Access to the home screen of Microsoft Launcher:

1. Select Apps > App configuration policies.

2. Click Add and select Managed devices.

3. On the Create app configuration policy page, specify the information for the policy:

   1. Enter a name for the policy in the Name box.

   2. Select Android Enterprise from the Platform list.

   3. Select Full Managed, Dedicated, and Corporate-Owned Work Profile Only from the Profile Type list.

   4. For the Targeted app, click Select app and select Microsoft Launcher from the list.

   5. On the Settings page, in the Configuration Settings section, select Enter JSON data from the Configuration settings format list.

      The JSON data format is displayed.

   6. Scroll down or search for the "com.microsoft.launcher.HomeScreen.Applications" key.

   7. Update the key and value pairs in the JSON for com.microsoft.launcher.HomeScreen.Applications for the Imprivata Mobile Device Access package:

      Copy

      "key": "com.microsoft.launcher.HomeScreen.Applications",
          "valueBundleArray": [
              {
                  "managedProperty": [
                      {
                          "key": "package",
                          "valueString": "com.imprivata.imda"
                      },
                      {
                          "key": "class",
                          "valueString": ""
                      }
                  ]
              }
          ]

   8. Click Next.

   9. On the Assignments page, select the user groups to include, and click Next and Create.

      Imprivata Mobile Device Access is added to the home screen of Microsoft Launcher on devices.

User Permissions

The following permissions cannot be turned on remotely, as granting them requires user interaction:

• Accessibility

• AutoFill permission

• Notifications service

• Drawing over other apps

Automatic Granting Permissions — All Corporate Apps

To allow permissions automatic granting for all corporate apps on the device, create a device restrictions profile and change the default permissions to Auto grant.

Automatic Granting Permissions — Specific App

To allow permissions automatic granting for a specific app, create an app config policy and add the necessary permissions for the app.