Security

 View Only
last person joined: 15 hours ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Android devices in Intune all have the same MAC 02:00:00:00:00:00

This thread has been viewed 12 times
  • 1.  Android devices in Intune all have the same MAC 02:00:00:00:00:00

    Posted May 25, 2022 07:55 AM
    Hi all

    I have a customer who has CPPM making an API call to Intune and sucking in all the endpoint data to the endpoint database. Using this, his laptops can all auth using EAP-TLS while also checking a couple of intune attributes before receiving an allow-all rule or an internet-only rule depending on what is in Intune.

    Adroid devices, however, auth with EAP-TLS happily but fail as they all present the same MAC address, 02:00:00:00:00:00. So when Clearpass looks it up in the endpoint database, it's viewing completely the wrong device. Intune's sync seems to import a different device every time it syncs.

    Any ideas how I can resolve this?



  • 2.  RE: Android devices in Intune all have the same MAC 02:00:00:00:00:00

    Posted May 25, 2022 11:56 PM
    What sort of enrolment are the Android devices using? Since October 2021:
    Intune will no longer display a Wi-Fi MAC address for newly enrolled personally-owned work profile devices and devices managed with device administrator running Android 9 and above.
    https://docs.microsoft.com/en-us/mem/intune/fundamentals/whats-new#removal-of-wi-fi-mac-address-on-specific-android-enterprise-devices

    ------------------------------
    James Andrewartha
    ------------------------------



  • 3.  RE: Android devices in Intune all have the same MAC 02:00:00:00:00:00

    Posted May 26, 2022 01:27 AM
    Also have a look in the graph explorer and see what MAC address is returned for those devices - for my newly enrolled personally-owned work profile device it has "wiFiMacAddress": null and "wifiMac": null (don't ask me why Intune reports it twice).

    https://developer.microsoft.com/en-us/graph/graph-explorer with this Query URL https://graph.microsoft.com/beta/deviceManagement/managedDevices/{Intune Device ID}

    I had a look and couldn't find my recently-enrolled personally-owned work profile device in the endpoint database, but I did find an older one which has multiple MAC addresses since it has per-SSID MAC address privacy enabled.

    ------------------------------
    James Andrewartha
    ------------------------------