Enforce GlobalProtect Access Based on Microsoft Intune Compliance Status

[S.Jayathunge241341]

Hello Palo Alto Community,

One of my customers previously used on-premises Active Directory and has now migrated to Microsoft Entra ID and Microsoft Intune.

All endpoints in the environment are Windows 11 computers.

They have a requirement to allow access to sensitive internal destinations through GlobalProtect only from Intune-compliant devices. Devices that are not compliant with Intune policies should be blocked from accessing these resources.

I would like to know whether this requirement can be achieved using HIP checks in GlobalProtect . Specifically, is there a way to validate Microsoft Intune device compliance status through HIP and use that information in security policies to allow or deny access ?

Has anyone implemented a similar setup with GlobalProtect , Entra ID, and Intune compliance-based access control ?

Any guidance, recommended approach, or reference documentation would be highly appreciated.

Thank you.

[BPry]

@S.Jayathunge241341,

What exactly are you checking for compliance on the Intune side of things? I would generally recommend maintaining the same within HIP checks if you're in a more legacy environment as you'll find it easier than trying to incorporate Intune Compliance via other means. If you want to analyze Intune compliance however, you would need to do so via conditional access policies on the Azure side of things through an SSO/SAML integration. 

[S.Jayathunge241341]

Hi @BPry ,

The customer is currently validating HIP checks such as domain, disk encryption, anti-malware status, and device OS. After moving to entra Domain info isn't available on HIP. Due to this, customer has an additional requirement where the HIP profile should only match devices that are enrolled and managed through Microsoft Entra ID and Microsoft Intune.

If we rely only on standard HIP checks like disk encryption, anti-malware, and device OS (Without Domain Check), then personal devices that meet those conditions could also gain access to sensitive destinations. To avoid this, the customer wants the compliance status to be retrieved directly from Intune and passed to the firewall through HIP, so that access is granted only to Intune-compliant and Entra ID-managed devices.

[BPry]

@S.Jayathunge241341,

So this is perhaps a larger conversation, but you actually can check to see if a device is Entra registered via a custom HIP check. If you look under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\TenantInfo\ you'll find the GUID of your tenant ID and validate that the value 'DisplayName' matches what you would expect on your tenant. This would replace what you traditionally had as the domain check.

You're not going to get Intune compliance information as a HIP check to the best of my knowledge. There's just nothing returned that would allow you to get that level of information and there's no registry entry for whether or not the device is compliant. That would need to be done via Conditional Access controls and authenticating for the sensitive resource. You would essentially need something capable of front-ending authentication to those resources to be able to get that information.