Many Microsoft Intune customers use network access control (NAC) partner solutions to manage access to their on-premises resources. Our networking partners use the Intune NAC service to integrate Intune device compliance checks into their NAC solutions. This integration allows a NAC solution to receive a device’s enrollment and compliance state from Intune to manage access control.
In June, we released the Compliance Retrieval service. This service will replace the Intune NAC service, offering improved security and reliability for our customers. We are working with our partners to help transition existing NAC solutions to this new framework, and to ensure you receive the support you need.
What improvements does the Compliance Retrieval service include?
The new service includes changes to improve the security, reliability, and privacy of the NAC service. For example, it uses lookup by Intune device ID only, which removes the dependency on internal identifiers, such as serial numbers, which are not consistently accessible. It also eliminates MAC address identifiers, which are problematic because devices can have multiple or randomized MAC addresses. The new service is also streamlined to return only enrollment and compliance data from Intune. Any other device data not related to access control is eliminated from this service.
What do I need to do to accommodate the new service?
You must use certificate-based authentication for NAC-enabled networks with the new service. You will also need to include the Intune device ID in the subject alternative name (SAN) of your certificate profiles. To do this, add a Uniform Resource Identifier (URI) attribute with the format defined by your NAC provider, for example: IntuneDeviceId://{{DeviceID}}. For detailed instructions, see your VPN partner's documentation after they adopt the new service.
Each NAC partner is working with Intune on their own migration schedule and instructions, so timelines and specific instructions will vary based on product. Work directly with your NAC provider to understand what other changes are needed to accommodate the Compliance Retrieval service.
We’ll continue to update this post as our partners decide how to move forward with the Compliance Retrieval service.
Will the Compliance Retrieval service replace the original Intune NAC service?
Yes, we will stop supporting the Intune NAC service at the end of 2022. Our networking partners are working to move off the Intune NAC service. If you have questions about your specific use case, contact your NAC solution provider.
When do I need to transition to the new service?
We will take down the original Intune NAC service at the end of 2022 to give our partners and customers time to transition to the Compliance Retrieval service and/or adopt the Microsoft Graph solution. Work with your NAC partner to determine what changes you need to make and when to maintain NAC availability.
How does this affect my users?
Users should not notice any changes with the new service. However, if you don’t make the required modifications to your environment, it might affect user access to corporate resources on NAC-enabled networks. Work with your NAC partner to understand what changes are needed for your environment and get them implemented prior to the end of service for the Intune NAC Service.
We will continue to update this post as we continue to transition away from the Intune NAC service. If you have questions or comments for the Intune team, reply to this post or reach out to @IntuneSuppTeam on Twitter.
Posted at https://sl.advdat.com/3B8Snhq