topic Re: Global Protect on Android vs Compliance requirements from Intune in GlobalProtect Discussions

Global Protect on Android vs Compliance requirements from Intune

ITSpravia — Tue, 25 Mar 2025 13:35:23 GMT

Hello

We'd like to use Global Protect on Android (latest Samsung). There devices are managed by Intune in Full Management profile.

For Global Protect we use SAML profile with MFA and Conditional Access.

All our users have compliance requirements (by conditional access policies) to use SAML only on compliant devices.

Global protect cannot bypass this info for AAD.

Of course, we can remove compliance requirements for Global Protect App in AAD, but this will create huge security hole in our security.

What to do ?

Re: Global Protect on Android vs Compliance requirements from Intune

BPry — Wed, 26 Mar 2025 21:59:31 GMT

@ITSpravia,

Can you provide more detail about what the actual issue is? I've re-read your post a couple times and I'm kind of lost on what you're actually running into and what the actual problem is in your post.

Re: Global Protect on Android vs Compliance requirements from Intune

ITSpravia — Thu, 27 Mar 2025 08:58:59 GMT

Ok, Lets clarify.

We have some mobile based on Android. We want to use global protect client to start our internal web site.

Our Global protect uses SAML profile for authentication (Office365).

But we have Intune for management of devices, they are in fully management profile. In our conditional access policies (Azure Active Directory) we require that all apps must be connnected from COMPLIANT devices. All office apps and edge works fine.

The problem is that Global Protect client started on Android devices cannot pass this information to Azure Active Directory).

On Windows works fine. I think that it is limitation of global protect client on Android.

Re: Global Protect on Android vs Compliance requirements from Intune

ITSpravia — Mon, 07 Apr 2025 08:32:05 GMT

Official support said that the only way to enable it in our environment is to add global protect app as exception in Conditional access polisy in Azure Active Directory.