Deploy Client On Android Using Intune

This documents illustrates the procedure to deploy Netskope Client in Android devices using Intune.

Prerequisites

• In the Netskope UI, go to Settings > Manage > Certificates > Signing CA. Download the Netskope Root and Intermediate Certificates.

• To locate Organization ID, go to Settings > Security Cloud Platform > MDM Distribution. Scroll down to Create VPN Configuration section to find your Organization ID.

• User accounts provisioned within MDM/EMM platform must match those provisioned in the Netskope tenant.

  Bind Android for Enterprise with Intune

  Before you begin, ensure that you have configured Android for Enterprise binding for Microsoft Intune. This is done from the MS Endpoint Manager (https://endpoint.microsoft.com/).

1. Log into the Endpoint Manager admin center, go to Devices > Android and select Android Enrollment.
   

   

   
   

   

2. Click Managed Google Play.

   Select the I agree checkbox and click the Launch Google to Connect now button. In the Google Play pop-up window, complete the business registration steps.

3. After registration is complete, go to MS Endpoint Manager admin center, click Devices > Android > Android Enrollment > Managed Google Play to verify the registration process. If successful, the Status label will display Setup with a green tick.
   

   

4. In the Android Enrollment page, select the Enrollment Profile to get the token that you can share with users for enrollment.
   

   

Approve Netskope Client

1. Log in to your Google Play Store account and search for Netskope Client.

2. Click Approve send authorization to MS Endpoint Manager.

Setting up Apps in MS Endpoint Manager

1. In the MS Endpoint Manager admin center, go to Tenant Administration > Connectors and Token page.
   

   

2. Select Managed Google Play and click Sync to get all approved apps listed in Intune Apps > All Apps.
   

   

Deploy Netskope Client

Netskope Client can be deployed to users or user groups as an optional or mandatory deployment action.

1. In the MS Endpoint Manager admin console, go to Apps > All Apps and select Netskope Client.
   

   

2. Click Properties and then click Assignments.
   

   

3. Select the user groups or users to which the app is to be deployed in the Required section (options +Add group, +Add all users, +Add all devices) and click Review+Save, and then click Save.
   

   

4. Select the appropriate deployment action and click Save.

Create App Configuration and Deploy

In the following sections, create app configuration policies using UPN and IDP modes:

• UPN – All enrollment data is supplied by Intune. No action is required from the user since they are enrolled using zero touch enrollment.
• IDP – The user needs to click on the Netskope Client to authenticate.

Perform the following instructions to create an app configuration policy using:

UPN

To create app configuration policy:

1. In the MS Endpoint Manager admin center, go to Apps > App Configuration Policy and click + Add and select Managed Devices.

2. In the Basics section of the Create app configuration policy page, enter the following details and click Next.
   

   • Name: Give a name to the policy.

   • Platform: Android Enterprise

   • Associated App: Select Netskope Client

3. In the Settings section of the Create app configuration policy page, locate Configuration Settings and select the Use configuration designer option from the Configuration settings format dropdown list.

   1. Click Add and select the following mandatory values and click OK.

      • User Email Address: {{mail}}

        If UPN is being synced to Netskope from AD, use the key:value pair – User Email Address: {{userPrincipalName}}.

        • For environments where user context is not available (i.e. shared devices, kiosks) static email addresses should be used. This email should match provisioned user account email in Netskope tenant

      • Host: <addon-<tenant-URL>

      • Token: <Organization Key>

      • enrollauthtoken: <Secure Enrolment Authentication Token>

      • enrollencryptiontoken: <Secure Enrolment Encryption Token>

        

      – The Organization ID is case-sensitive.
      – ns_mdm_check is an optional value that is used for Android device classification purposes. If you are not doing device classification for Android, you can safely ignore this field.

      For more information, see Netskope Client Deployment Parameter.

4. In the Assignments section of the Create app configuration policy page, select groups from the Assign to dropdown menu to which the policy is applied. Assuming the option selected was Selected Groups, select include the Microsoft Entra ID groups that this policy will apply to and click Next.
   

   

   You can also select groups that can be excluded from this configuration policy.

5. In the Review + create section of the Create app configuration policy page, review the configuration and click Create.
   

   

6. Enroll the Android devices to the Intune Company Portal application available on Google Play.

IDP

To create app configuration policy:

1. In the MS Endpoint Manager admin center, go to Apps > App Configuration Policy and click + Add and select Managed Devices.

2. In the Basics section of the Create app configuration policy page, enter the following details and click Next.

   • Name: Give a name to the policy.

   • Platform: Android Enterprise

   • Associated App: Select Netskope Client

3. In the Settings section of the Create app configuration policy page, locate Configuration Settings and select the Use configuration designer option from the Configuration settings format dropdown list.

4. Click Add and select the following mandatory values and click OK.

   Tenant: Enter tenant name as <tenant-name>.goskope.com

   

5. In the Assignments section of the Create app configuration policy page, select groups from the Assign to dropdown menu to which the policy is applied. Assuming the option selected was Selected Groups, select include the Microsoft Entra ID groups that this policy will apply to and click Next.

   

   
   You can also select groups that can be excluded from this configuration policy.

6. In the Review + create section of the Create app configuration policy page, review the configuration and click Create.

7. Enroll the Android devices to the Intune Company Portal application available on Google Play.

Enable Zero-touch Enrollment

The following steps enable zero-touch enrollment of Android devices with Microsoft Intune after the deployment of Netskope Client. This also enables SSL inspection with the presence of the trusted CA certificates in the user store. 

1. Create Trusted Netskope Root Certificate Profile

2. Create Device Restrictions Profile

Create a Trusted Netskope Root Certificate Profile

Download the Netskope Root and Intermediate certificates from the Netskope UI to complete these steps. To get the certificate, go to Settings > Manage > Certificates > Signing CA.

To create a trusted Netskope certificate profile:

1. In Intune UI proceed to Devices > Android > Configuration profiles.

2. Click Profile > Create Profile. Enter and select these parameters:

   • Name: Enter a unique name.

   • Platform: Android Enterprise

   • Profile type: Trusted certificate

3. In the Trusted Certificate panel, provide a name in the Basics tab and click Next.

4. In the Configurations settings tab, upload the Netskope Root certificate.

5. Review your settings, and click Create.

Create Device Restriction Profile

Adding a device restriction profile helps administrators to set policies to control and manage Android devices in their organization. To learn more, view Device Restriction.

To add a device restriction profile:

1. Go to Devices > Android > Configuration Profiles > Create Profile.

2. In Create a Profile, select the following:

   • Platform: Android Enterprise

   • Profile Type: Device Restrictions

3. Click Create.

4. In Basics, enter a descriptive name for the profile and click Next.

5. In Configuration settings, expand Connectivity and enter the following:

   • Always-On VPN: Toggle Enable to select this option.

   • VPN Client: Select Custom.

   • Package ID: com.netskope.netskopeclient

   • Lockdown mode: Toggle Not configured to select this option.

6. Click Next.

7. Add the appropriate profile assignments  and click Next.

8. Review the configuration and click Create.

   

Enrollment Workflow

After the deployment is complete, Netskpe Client can enroll silently(assuming the enrollment data is correct and is matching the user information provisioned in the tenant). The VPN profile serves as the binding mechanism between source mobile applications and Netskope Client as secure connectivity provider.

Uninstall Netskope Client

This section describes the steps to uninstall Netskope Client from your Android devices.

Create a Security Group

Netskope recommends creating a security group adding the desired devices or users before you uninstall Netskope Client.

To create a security group:

1. Go to Groups > All Groups.

2. Click New Group.

3. Enter the following information:

   • Group Type: Security

   • Group Name: For example, Android Uninstall

   • Membership Type: Assigned

     

4. Add members by clicking No members selected.

   Another window Add Members appears. 

5. Add the desired users or groups or devices here.

6. Click Select to close this window.

7. The New Group screen displays the selected members.

   

8. Click Create.

Uninstall Managed App

After you create the security group, navigate to the uninstall section of the managed app that you wish to remove.

To uninstall:

1. Go to Apps > Android.

2. Select the already installed app. Select Netskope Client.

   

3. Click Properties.

4. Click Edit in the Assignments section.

   

5. From Uninstall, click +Add Group and include the security group that you created earlier.

   

6. Click Review+Save.

7. Wait for the device to sync and verify that the app is uninstalled.