Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

SOTI MobiControl Integration

Follow these steps to understand SOTI MobiControl integrations, link your SOTI MobiControl account to your HPE Mist organization, create policy rules, and view client events.

HPE Mist Networking Access Assurance supports native integration with SOTI MobiControl, enabling comprehensive evaluation of endpoint compliance across devices such as laptops and mobile phones. Using predefined policies, SOTI MobiControl assesses device compliance based on security parameters such as antivirus presence, firewall status, and OS patch levels. HPE Mist Networking Access Assurance retrieves the latest device compliance status from SOTI MobiControl and applies it to authentication policies to enforce access control decisions.

Flow diagram of SOTI MobiControl integration with HPE Mist Networking Access Assurance for device compliance and network access.

Compliance Data Retrieval from SOTI MobiControl

HPE Mist Networking Access Assurance uses an API-based polling mechanism to query SOTI MobiControl every two hours for each managed client that has been authenticated. The compliance status information is cached for quick retrieval.

To prevent any additional delays, the compliance information is retrieved after the authentication process is complete. After the initial onboarding of a device is complete, its compliance status is refreshed every 2 hours.

If a device’s compliance state changes, HPE Mist Networking Access Assurance automatically triggers a Change of Authorization (CoA) to re-evaluate the policy and enforce the appropriate access control measures. This automatic triggering of CoA ensures that compliance changes are promptly addressed, maintaining security and policy adherence without requiring manual intervention.

Figure 1 illustrates how HPE Mist Networking Access Assurance retrieves SOTI MobiControl-managed device compliance data for authentication.

Figure 1: Authentication and Authorization Process for SOTI MobiControl Flow diagram showing the process of network access control and device compliance verification using HPE Mist Networking Access Assurance and SOTI MobiControl. Key steps include EAP-TLS authentication, device compliance check via MDM lookup, and authorization update for secure network access.
Note:

To support the CoA functionality, APs must run firmware version 0.14 or later

HPE Mist Networking Access Assurance uses the following information during client authentication to match a client with a device record in SOTI MobiControl:

Note:

Some of the screenshots included in this topic are sourced from third-party applications. Be aware that these screenshots might change over time and might not always match the current version of the applications.

  • Non-randomized MAC address—For authentication using EAP-TTLS or EAP-TLS, the MAC address of the client device is matched against a managed device record in SOTI MobiControl. To ensure accurate MAC-based device matching, you must disable MAC address randomization in the Wi-Fi configuration profiles on client devices. At the time of this writing, SOTI MobiControl supports disabling MAC address randomization in Wi-Fi configuration profiles for only iOS and Android devices.

    Network configuration interface with sections for Network Settings and Security Settings. Network name set to CompanyNet. Auto Join Network enabled, Hidden Network disabled, and Disable Association MAC Randomization enabled. Security type set to Any Enterprise with options for Protocols, Authentication, and Trust.

  • SOTI MobiControl Device ID encoded in SAN:DNS certificate attribute—In SOTI MobiControl Certificate templates, use the %DeviceIdentifier% variable to encode the Device ID in the SAN:DNS certificate field.

    Certificate Authority setup screen with MobiControl template name SAN-DNS-Lookup. Subject name is CN=%DEVICENAME%. DNS Name alternative set as %DeviceIdentifier%. Options for adding or modifying entries.

Configure SOTI MobiControl

To integrate SOTI MobiControl with HPE Mist Networking, you'll need to set up a SOTI MobiControl API client ID.

Note:

The screenshots from third-party applications are correct at the time of publishing. We have no way to know when or if the screenshots will be accurate at any future time. Please refer to the third-party website for guidance about changes to these screens or the workflows involved.
  1. In SOTI MobiControl, navigate to Global Settings>Services API Client. Click + to generate a new Client ID and Client Secret. Copy these values.
    User interface for adding an API client in MobiControl with fields for Name, Grant Type as Password, Client ID, and partially visible Client Secret. Reminder to copy Client Secret immediately, as it will not be shown again. Includes buttons to copy credentials and confirm action.
  2. Create user credentials with view-only access for the MobiControl WebConsole. Navigate to Users and Permissions > Users and click + to add a user.
    User interface for adding a new user in MobiControl with fields for username, password, email, user type selection, role assignment, and save or cancel options.
  3. Ensure that the user has access to the device group where the devices will be enrolled.
    Users and Permissions section in SOTI MobiControl with tabs for Roles, Groups, and Users; selected user NAC-Viewer shows permission options and device group NAC LAB Devices under My Company.

Add SOTI MobiControl as an Identity Provider

To add SOTI MobiControl as an Identity Provider:

  1. From the left menu of the HPE Mist management portal, select Organization> Access>Identity Providers.
  2. In the Linked Accounts section, click Link Account.
    User interface for managing linked accounts with message stating no linked accounts and dropdown menu labeled Link Account listing options including Microsoft Intune, Jamf Pro, VMware Workspace ONE UEM, and SOTI MobiControl highlighted in yellow.
  3. Select SOTI MobiControl.
  4. In the Link Account page, provide the Client ID, Client Secret, Username, Password and SOTI MobiControl Instance URL (for example, https://ABC.mobicontrol.cloud).
    Link Account configuration window for SOTI MobiControl with fields for Instance URL, Client ID, Client Secret, Username, Password, and buttons to Show hidden fields, Link Account, or Cancel.
    After linking the SOTI MobiControl account, you can see the SOTI MobiControl account status on the Identity Providers page.

    You can click the account to view the details of the last sync.

    SOTI MobiControl dashboard showing linked identity provider details: last sync July 22 2025 at 3:57:41 PM, status success, partially redacted account ID, linked by partially redacted email, partially redacted company name, linked timestamp July 22 2025 at 3:57:41 PM, and application name SOTI MobiControl.

Verify SOTI MobiControl

The initial MDM lookup for a new client occurs after the device has been authenticated for the first time. To facilitate this lookup, you'll need to create an auth rule that allows first-time device connections and assigns the devices to a quarantine VLAN.

Note: Do not include the Compliant or Non-Compliant MDM compliance labels in the match conditions for this rule. You can optionally use the Unknown Compliant label as a match criterion. Ensure this rule is placed at a lower priority than your standard access policies.

User interface for managing authentication policies in a network access control system. Features title Auth Policies, description of policy rule evaluation, buttons for adding rules, viewing NAC events, and selecting hit count time range. Includes a policy table with columns for policy number, name, match criteria, policy status, assigned actions like VLAN assignments, and hit counts. Save and cancel buttons allow changes to be saved or discarded.

When the client is connected, you'll see the NAC Client Access Allowed event in the Insights page.

Network monitoring interface showing data usage graph with activity spikes, client events like authorization and session start, and detailed authentication info for a device.

After the client connects, HPE Mist Networking Access Assurance:

  1. Retrieves the device's compliance status from SOTI MobiControl

    Network monitoring dashboard showing data usage graph, client events, and device compliance. Highlights Galaxy S24 details, MDM status as compliant, and wireless port type.

  2. Triggers a Change of Authorization (CoA) to reauthenticate the client

    Network monitoring interface showing data usage graph with timestamps and data rates, client events listing event types and statuses, and details panel with client info and compliance status.

  3. On re-authentication, the client is matched against the appropriate policy based on its updated compliance status.

    Network monitoring dashboard showing a graph of data usage and events over time, client events log, and detailed information about a connected device including SSID, certificate details, user group, and authentication type.

For all subsequent authentications, HPE Mist Networking Access Assurance uses the cached MDM data, which is automatically refreshed every two hours to capture any compliance changes.