- Platforms
- iOSiPadOSAndroid
- Products
- IntuneMicrosoft TunnelDefender for Endpoint
- Result
- Users reach on-premises resources through Microsoft Tunnel from the Defender app, with web protection on the same device
Overview
Use one app, Microsoft Defender, as both the Microsoft Tunnel VPN client and the Mobile Threat Defense app on iOS and Android: create a Microsoft Tunnel VPN profile in Intune and switch the Defender features on or off with custom settings.
Microsoft Tunnel is a VPN gateway solution for Microsoft Intune that runs in a container on a Linux server (hosted in a DMZ). It gives mobile devices such as iOS/iPadOS and Android Enterprise access to on-premises resources with modern authentication and Conditional Access. For a lab setup of Microsoft Tunnel, see my post Deploy Microsoft Tunnel Gateway (VPN) in DMZ for iOS/Android.
Microsoft Defender for Endpoint is a Mobile Threat Defense (MTD) solution for mobile devices (iOS/Android). Together with Microsoft Intune and Microsoft Entra ID (formerly Azure Active Directory), it enforces device compliance and Conditional Access policies based on the device risk level (low, medium, high).
The Microsoft Defender for Endpoint and Microsoft Tunnel apps were combined into a single Microsoft Defender app for Android and iOS (in preview in 2022, now the only Tunnel client). Its features depend on the platform and the deployed custom settings:
- Dashboard: This tab displays a summary of the device’s overall health, app security status, web protection status, and Tunnel status.
- Web Protection: This tab shows whether administrators enabled or disabled the feature, with details on flip cards.
- Tunnel: This tab is where users connect to the Tunnel Gateway and can view connection statistics and client configuration settings. The Tunnel tab is available after a device receives a VPN profile for Microsoft Tunnel that supports Defender for Endpoint.
- App Security (Android only): On this tab, users can view the status of automatic scans on the device. Users can also uninstall the apps identified as threats and run a manual scan.
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Microsoft Intune Plan 1 and an Azure subscriptionMicrosoft Tunnel for MAM (unenrolled devices) needs Intune Plan 2 or the Intune Suite. | TunnelLicensing |
| Microsoft Defender for Endpoint Plan 1 or Plan 2, or Microsoft Defender for Business, for the Defender features such as web protection | Licensing | |
| Admin role | Intune Administrator (Entra ID role) with an Intune licence to register the Tunnel Gateway; to manage Tunnel later, a custom role with the Microsoft Tunnel Gateway permissions also works | Permissions |
| Application Manager and Policy and Profile Manager in Intune, to deploy the Defender app and the VPN profile | Roles | |
| Intune | A Microsoft Tunnel Gateway server and site, see my post Deploy Microsoft Tunnel Gateway (VPN) in DMZ for iOS/Android | Prerequisites |
| Devices enrolled in Intune: iOS/iPadOS, or Android Enterprise fully managed, corporate-owned work profile or personally owned work profile, on Android 11 or laterDedicated Android devices aren't supported. Microsoft Tunnel and Global Secure Access can't run on the same device. | Platforms | |
| Security | The Microsoft Defender app deployed with Intune (App Store for iOS, Google Play for Android) | Client appMTD |
| Defender for Endpoint connected to Intune, for the Mobile Threat Defense features | Connect | |
| Auto-onboarding of the local VPN on iOS optional, so users aren't asked to add the VPN, see my post iOS/iPadOS auto-onboarding into Defender for Endpoint | Custom settings |
Configuration
With the prerequisites in place, create the VPN profile first, then add the Defender custom settings to it.
Create a Microsoft Tunnel VPN profile
Create a new VPN profile from the templates for iOS/iPadOS or Android:
Configure the mandatory Base VPN settings:
- Connection type: Microsoft Tunnel (my 2022 screenshot still shows the preview name)
- Connection name (visible to users)
- Microsoft Tunnel site (an existing site)
Other settings, such as Per-app VPN, On-Demand VPN Rules and Proxy, are optional and may depend on additional app configuration or infrastructure.
Add custom settings for the Defender app
The Microsoft Defender for Endpoint (MDE) app can be customized with custom settings that differ by platform (iOS/iPadOS or Android Enterprise). Most of them are enabled by default, but an admin can still enforce them. On Android Enterprise devices that use Defender as both the Tunnel client and the MTD app, these custom settings replace a separate app configuration profile, and on personally owned work profiles they are required.
Android Enterprise custom settings:
| Configuration key | Value type | Value | What it does |
|---|---|---|---|
vpn |
Integer | 1 | Lets Defender anti-phishing use a local VPN (1 = on, the default) |
antiphishing |
Integer | 1 | Turns Defender anti-phishing on (default) |
defendertoggle |
Integer | 1 | Turns Defender for Endpoint on; 0 leaves only the Tunnel client (default 1) |
iOS/iPadOS custom settings:
| Key | Value | What it does |
|---|---|---|
AutoOnboard |
True | Adds the local VPN for web protection without asking the user; needs a Connect VPN on-demand rule |
WebProtection |
True | Turns web protection (anti-phishing) on (default) |
SingleSignOn |
True | Row that the 2022 VPN profile added by default; it isn't one of the documented Defender settings |
If needed, you can disable the Web protection feature of the Defender app for iOS and configure TunnelOnly mode instead:
Note: In TunnelOnly mode, all Defender for Endpoint features are turned off and only the Tunnel features stay. On Android, set defendertoggle to 0 for the same result.
User Experience
Finally, check the VPN and web protection on a phone.
In the video below, an iPhone (iOS 15) user is auto-onboarded to Microsoft Defender for Endpoint and then uses Microsoft Edge with an on-demand per-app VPN connection to an on-premises IIS web server (192.168.1.101). The VPN connects when the user opens a specific URL in the browser.
Note: No separate Microsoft Tunnel app is needed, only the Defender app.
Another short video shows an Android 12 user (VM) opening a malicious test website and getting a warning from Defender SmartScreen. The alert also appears in the Microsoft Defender portal. smartscreentestratings2.net is still the test site that Microsoft uses for network protection demos.