Integrate with Microsoft Intune
Microsoft Intune Endpoint Management uses Device Compliance Policies to check for the presence of an antivirus software, account for firewall rules, check clients for the latest security patches, and so on. Juniper Mist™ Access Assurance can leverage the compliance state of Intune-managed device for additional posture assessment according to the Auth Policies you create.
You can integrate Access Assurance with the Intune for use in the Mist portal. For example, you can use the integration to create a client authorization policy in Mist that segregates non-compliant clients to a quarantine VLAN while letting compliant ones access the corporate network. To do so, you need to be running firmware version 0.14 or later on the Juniper Mist APs, and have an administrator account on Microsoft Entra ID (this is to grant read privileges to Mist Access Assurance to get the Intune device data).

As wireless clients log on and are authorized on a Juniper Mist AP, the cloud-based Mist Access Assurance service learns the client's security compliance status from Intune. It then uses that information in an authentication policy to connect the client to a selected VLAN based on the results. In the figure above, which shows the Insights tab on the Monitor portal page, Intune has classified one of the clients as non-compliant.
Adding Intune to the Mist Portal
To add Microsoft Intune to the Mist Access Assurance portal:
- From the left menu of the Juniper Mist portal, select Organization | Access > Identity Providers
- In the Linked Accounts section, click Link Account .
- Select Microsoft Intune. You will be redirected to Microsoft Entra ID / Intune for the Single Sign On (SSO) login, and then prompted to grant permission for the Mist Access Assurance portal to read Microsoft Intune device data.
- (Optional) After linking the Intune account, you can see the Intune account status on the Identity Providers page: Organization | Access > Identity Providers.
Creating Policy Rules
With the Intune account linked to Mist, you can leverage managed the device compliance status in your Mist Auth Policies. For example, you can put non-compliant clients into a quarantine VLAN, while allowing compliant devices to connect to the corporate VLAN. You do this by creating a pair of labels for compliance and non-compliance, and another pair for corp and quarantine VLANs. Then you use these labels in a pair of Auth Policy rules to automatically govern network access.
Create compliance and quarantine labels:
- From the left menu of the Juniper Mist portal, select Organization > Access > Auth Policies.
- Click the Create Label button and give the label a name, for example, Intune-Compliant.
- Under Label Type, choose MDM Compliance.
- Under Label Values, select Compliant.
Click the Create button.
Repeat these steps to create the remaining labels, as shown here:
Label Name: Intune-Non-Compliant, Label Type: MDM Compliance, Label Value: Non Compliant
- Label Name: Quarantine, Label Type: AAA, Label Value: VLAN, 1
Label Name: Corp VLAN, Label Type: AAA, Label Value: VLAN, 750

Create Auth Policy Rules:
- Click the Add Rule button and give the rule a name, for example, Corp Compliant.
- In the Match Criteria column, click the + icon and then select Intune-Compliant from the list that appears.
- In the Policy column, select Allow.
- In the Assigned Policies column, click the + icon and then select Corp VLAN.
Repeat these steps to create the quarantine rule.
When finished, click Save.
Viewing Client Events
As shown in Figure 1, in the Client Events section on the Insights tab of the Monitor portal page, the values show for some parameters depend on how you have configured Microsoft.
- Non-randomized MAC address—If you want to show non-randomized MAC addresses under Client Events, you need to disable MAC randomization in the Intune Wi-Fi settings. This display supports both EAP-TTLS and EAP-TLS authentication, and uses the client MAC address from Intune.
- DeviceName or DeviceName.FQDN—Under Client Events, the name shown for Certificate CN comes from the Intune SCEP certificate configuration (it's the Subject name format field). The Client Events name shown for Certificate SAN (DNS Name) comes from the Intune SCEP profile variable used to encode the Intune Device ID in the SAN:DNS certificate field.
How it Works
The Access Assurance API polls Microsoft Intune every two hours for a list of authenticated Intune-managed clients, and makes any necessary updates. The default polling interval for Microsoft Intune to its managed devices is every eight hours. Mist Access Assurance caches the retrieved compliance state data to optimize retrieval times.
Whenever a device if found to be out of compliance, Mist Access Assurance issues a Change Of Authorization command and re-runs the policy. The policy then triggers the required corrective actions, as needed, to bring the device back in to compliance.
The communication flow between the two services is shown in the following illustration.
