Security

Hello, Danny,

Are there any updates, according this topic?

Currently we are looking for basically same functionality – to get additional User attributes with Intune Extension to enforce different user access rights.

With Intune Extension we have some User attributes. One of it is "Intune User ID", it would be useful to also get User "Groups" or "Department" for the same "Intune User ID".

Thanks!

Hello, Danny,

Are there any updates, according this topic?

Currently we are looking for basically same functionality – to get additional User attributes with Intune Extension to enforce different user access rights.

With Intune Extension we have some User attributes. One of it is "Intune User ID", it would be useful to also get User "Groups" or "Department" for the same "Intune User ID".

Thanks!

Hi Tim,

Thanks for your reply,

I do understand that MS Intune is for device identity.

But according to Aruba ClearPass Intune integration guide (V5), we have to grant "User.Read" (Sing in and read user profile) permission in Azure Microsoft Graph API, that is used for Intune Extension. And indeed, when Intune extension creates Endpoint there is information about curent User in the Endpoint Attributes:

Thanks!

Hello, Danny,

Are there any updates, according this topic?

Currently we are looking for basically same functionality – to get additional User attributes with Intune Extension to enforce different user access rights.

With Intune Extension we have some User attributes. One of it is "Intune User ID", it would be useful to also get User "Groups" or "Department" for the same "Intune User ID".

Thanks!

Hi Tim,

Thanks for your reply,

I do understand that MS Intune is for device identity.

But according to Aruba ClearPass Intune integration guide (V5), we have to grant "User.Read" (Sing in and read user profile) permission in Azure Microsoft Graph API, that is used for Intune Extension. And indeed, when Intune extension creates Endpoint there is information about curent User in the Endpoint Attributes:

Thanks!

Hello, Danny,

Are there any updates, according this topic?

Currently we are looking for basically same functionality – to get additional User attributes with Intune Extension to enforce different user access rights.

With Intune Extension we have some User attributes. One of it is "Intune User ID", it would be useful to also get User "Groups" or "Department" for the same "Intune User ID".

Thanks!

Hi Tim,

Thanks for your reply,

I do understand that MS Intune is for device identity.

But according to Aruba ClearPass Intune integration guide (V5), we have to grant "User.Read" (Sing in and read user profile) permission in Azure Microsoft Graph API, that is used for Intune Extension. And indeed, when Intune extension creates Endpoint there is information about curent User in the Endpoint Attributes:

Thanks!

Hello, Danny,

Are there any updates, according this topic?

Currently we are looking for basically same functionality – to get additional User attributes with Intune Extension to enforce different user access rights.

With Intune Extension we have some User attributes. One of it is "Intune User ID", it would be useful to also get User "Groups" or "Department" for the same "Intune User ID".

Thanks!

Hi, Andreas,

Thanks for your reply,

As Tim mentioned, User attributes in Intune Extension is for user who the device is assigned, so it is irrelevant to use it for user authorization..

I know, that Azure AD User group information "memberOf" can be called from MS graph API using "GET https://graph.microsoft.com/v1.0/users/{id}/memberOf" after OAuth2 authentication. As I understand and can see from Guest Application logs, ClearPass Guest Social login use OAuth and get User group membership this way.

I found this post of Danny about ClearPass Universal Authentication Proxy Extension: https://community.arubanetworks.com/community-home/digestviewer/viewthread?MID=18935

Maybe it could be adapted for OAuth communication with Azure AD. And then use the extension as HTTP Auth source like it is done with Intune.

Unfortunately, I haven't found much information according cppm UAP Extension.

Regards

Hi Tim,

Thanks for your reply,

I do understand that MS Intune is for device identity.

But according to Aruba ClearPass Intune integration guide (V5), we have to grant "User.Read" (Sing in and read user profile) permission in Azure Microsoft Graph API, that is used for Intune Extension. And indeed, when Intune extension creates Endpoint there is information about curent User in the Endpoint Attributes:

Thanks!

Hello, Danny,

Are there any updates, according this topic?

Currently we are looking for basically same functionality – to get additional User attributes with Intune Extension to enforce different user access rights.

With Intune Extension we have some User attributes. One of it is "Intune User ID", it would be useful to also get User "Groups" or "Department" for the same "Intune User ID".

Thanks!

Hi Tim,

Thanks for your reply,

I do understand that MS Intune is for device identity.

But according to Aruba ClearPass Intune integration guide (V5), we have to grant "User.Read" (Sing in and read user profile) permission in Azure Microsoft Graph API, that is used for Intune Extension. And indeed, when Intune extension creates Endpoint there is information about curent User in the Endpoint Attributes:

Thanks!

Hello, Danny,

Are there any updates, according this topic?

Currently we are looking for basically same functionality – to get additional User attributes with Intune Extension to enforce different user access rights.

With Intune Extension we have some User attributes. One of it is "Intune User ID", it would be useful to also get User "Groups" or "Department" for the same "Intune User ID".

Thanks!