Microsoft Intune Integration with AuthPoint Logon App for Windows

Microsoft Intune is a cloud-based endpoint management tool that organizations can use to manage users and devices. The Intune Company Portal app enables members of an organization to download and install organization-approved apps.

This document describes how to configure Microsoft Intune to make the AuthPoint Logon app for Windows available to devices in your organization through the Company Portal.

Contents

• Microsoft Intune Integration with AuthPoint Logon App for Windows
• • Contents
  • Integration Summary
  • Before You Begin
  • Configure Microsoft Intune
  • • Create an .intunewin File
    • Add a Group in Microsoft Intune
    • Add the App in Microsoft Intune
  • Configure AuthPoint
  • • Add a Group in AuthPoint
    • Add an Authentication Policy in AuthPoint
    • Add Users in AuthPoint
  • Test the Integration

Before You Begin

Before you begin these procedures, make sure that you:

• Download the AuthPoint Logon app for Windows installer and configuration file. For more information, go to Download and Install the Logon App.
• Have a global administrator or user management administrator account to log in to Microsoft Intune.
• Create a user in Microsoft Intune or synchronize an on-premises Active Directory user to Microsoft Entra ID and assign the user an Intune Plan 1 license.
• Download the Microsoft Win32 Content Prep Tool from GitHub as a .ZIP file and extract the contents to your computer.
• Enroll your Windows devices in Microsoft Intune.

Configure Microsoft Intune

To configure Microsoft Intune, you must:

1. Create an .intunewin File.
2. Add a Group in Microsoft Intune.
3. Add the App in Microsoft Intune.

Create an .intunewin File

To add the Logon app as an app in Microsoft Intune, you must first use the Microsoft Win32 Content Prep Tool to convert the Logon app installer to the .intunewin format.

To create an .intunewin file:

1. On your computer, create a new folder and copy the AuthPoint Logon App installer and configuration file to the folder. In our example, we name the folder Logon App.
2. Create a new folder for the output. This is the folder where the .intunewin file is created when the process completes. In our example, we name the folder Logon App Output.
3. From a Command Prompt window, go to the folder you extracted the contents of the Microsoft Win32 Content Prep Tool .ZIP file to.
4. Run the IntuneWinAppUtil.exe file with no parameters.
   
5. Type the path of the source folder you created in Step 1. In our example, we type:
   C:\Users\<username>\Documents\Logon App
6. Press Enter.
7. Type the file name of the AuthPoint Logon app installer. In our example, we type:
   AuthPoint_Agent_for_Windows_x64-3.0.1.643.msi
8. Press Enter.
9. Type the path of the output folder you created in Step 2. In our example, we type:
   C:\Users\<username>\Documents\Logon App Output
10. Press Enter.
11. Type N.
12. Press Enter.
    The .intunewin file is created in the output folder.

Add a Group in Microsoft Intune

When you add the Logon app as an app in Microsoft Intune in the next section, you can assign the app to user groups. Create a group of users that you want to assign the Logon app to.

To add a group in Microsoft Intune:

1. Log in to Microsoft Intune as an administrator.
2. Select Groups > All Groups > New Group.
   The New Group page opens.
3. In the Group Name text box, type a group name.
4. Click No Members Selected.
5. Select the users you want to assign the Logon app to, then click Select.
6. Keep the default values for all other settings.

7. Click Create.
   The group is created in Microsoft Intune.

Add the App in Microsoft Intune

When you add an app to Intune, you define the details shown for the app in Company Portal and configure settings such as device requirements, detection rules, and user assignments.

To add the Logon app as an app in Microsoft Intune:

1. Log in to Microsoft Intune as an administrator.
2. Select Apps > All Apps > Add.
   The Select App Type page opens.
3. From the App Type drop-down list, select Windows App (Win32).

4. Click Select.
   The Add App page opens.
5. Click Select App Package File.
   The App Package File page opens.
6. From the App Package File drop-down list, select the .intunewin file you created in Create an .intunewin File.

7. Click OK.
   The Add App page opens with additional tabs.
8. On the App Information page, in the Publisher text box, type a name. In our example, we type AuthPoint Agent for Windows.

8. Click Next.
   The Program page opens.
9. From the Device Restart Behavior drop-down list, select Intune Will Force a Mandatory Device Restart.

10. Click Next.
    The Requirements page opens.
11. From the Operating System Architecture drop-down list, select one or more operating system architectures, depending on the devices used at your organization. In our example, we select 64-bit.
12. From the Minimum Operating System drop-down list, select the minimum operating system used at your organization. In our example, we select Windows 10 1607.

13. Click Next.
    The Detection Rules page opens.
14. From the Rules Format drop-down list, select Manually Configure Detection Rules.
15. Click Add.
    The Detection Rule page opens.
16. From the Rule Type drop-down list, select File.
17. In the Path text box, type:
    C:\Windows\System32\
18. In the File or Folder text box, type:
    wlconfig.cfg
19. From the Detection Method drop-down list, select File or Folder Exists.

20. Click OK.
21. To open the Assignments page, click Next three times.
22. On the Assignments page, select an assignment type. In our example, we select Add Group from the Available For Enrolled Devices section.
23. Select the group you created in Add a Group in Microsoft Intune, then click Select.

24. Click Next.
25. Click Create.
    The Intune package uploads.

Configure AuthPoint

For information on how to add a Logon app resource and download the Logon app installer and configuration file, go to Configure MFA for a Computer or Server.

To configure AuthPoint, you must:

1. Add a Group in AuthPoint
2. Add an Authentication Policy in AuthPoint
3. Add Users in AuthPoint

Add a Group in AuthPoint

You must have at least one user group in AuthPoint to configure MFA. If you already have a group, you do not have to add another group.

To add a WatchGuard Cloud-hosted group to the WatchGuard Cloud Directory:

1. Go to Configure > Directories and Domain Services.
2. Click the WatchGuard Cloud Directory domain name. If you have not yet added the WatchGuard Cloud Directory, click Add Authentication Domain and select the WatchGuard Cloud Directory.
   The New Group page appears.

3. In the Groups tab, click Add Group.
4. In the Group Name text box, type a descriptive name for the group.
5. (Optional) In the Description text box, type a description of the group.

6. Click Save.
   Your group is added to the WatchGuard Cloud Directory and to AuthPoint.

Add an Authentication Policy in AuthPoint

Authentication policies specify which resources users can authenticate to and which authentication methods they can use (Push, QR code, and OTP).

You must have at least one authentication policy in AuthPoint that includes the Logon app resource. If you already have authentication policies, you do not have to create a new authentication policy. You can add this resource to your existing authentication policies.

Users that do not have an authentication policy for a specific resource cannot authenticate to log in to that resource.

To configure an authentication policy:

1. From the navigation menu, select Authentication Policies.
2. Click Add Policy.

3. Type a name for this policy.
4. From the Select the Authentication Options drop-down list, select Authentication Options and select which authentication options users can choose from when they authenticate.

   For SAML resources, if you select more than one authentication option, users must select one of the available options when they authenticate. For example, if you select OTP and Push, users can choose to type their OTP or approve a push to authenticate. You cannot require that they do both.

5. Select which groups this policy applies to. You can select more than one group. To configure this policy to apply to all groups, select All Groups.
6. Select the resource that you created in the previous section. If you want this policy to apply to additional resources, select each resource this policy applies to. To configure this policy to apply to all resources, select All Resources.

7. (Optional) If you have configured policy objects such as a Network Location, select which policy objects apply to this policy. When you add a policy object to a policy, the policy only applies to user authentications that are the same as the conditions of the policy objects. For example, if you add a Network Location to a policy, the policy only applies to user authentications that come from that Network Location. Users who only have a policy that includes a Network Location do not get access to the resource when they authenticate outside of that Network Location (because they do not have a policy that applies, not because authentication is denied).

   If you configure policy objects, we recommend that you create a second policy for the same groups and resources without the policy objects. The policy with the policy objects should have a higher priority.

8. Click Save.
   Your policy is created and added to the end of the policy list.

   When you create a new policy, we recommend that you review the order of your policies. AuthPoint always adds new policies to the end of the policy list.

Add Users in AuthPoint

Before you assign users to a group, you must add the users to AuthPoint. There are two ways to add AuthPoint user accounts:

• Sync users from an external user database
• Add WatchGuard Cloud-hosted AuthPoint users

Each user must be a member of a group. You must add at least one group before you can add users to AuthPoint.

Test the Integration

To test the integration:

1. On your Windows device, install the Company Portal from the Microsoft Store.
2. Open the Company Portal and log in with the Microsoft Entra ID user.

3. Select the published app, then click Install.
   Wait a few moments. After the installation completes, the computer restarts.
4. Log in to the Windows device with the user credentials.
5. Authenticate with AuthPoint MFA.