Skip to content

Defender for Endpoint on iOS


  • Intune and Defender correctly set up. See Fresh Tenant Setup for how to prepare a test tenant.
  • Test devices. You'll want at least 2 iOS devices to compare unsupervised vs supervised on iOS.

The deployment and configuration varies based on if the iOS devices are supervised or unsupervised.

Deploy Defender Endpoint App to iOS devices

🔗 Portal
📘 Docs

Applies to: Supervised and unsupervised devices

  1. Add the iOS store app for Microsoft Defender, target all users you want to have Defender for Endpoint. As of writing, the name in the App Store is Microsoft Defender: Security.

Configure Defender for Endpoint

App Supervision Policy

🔗 Portal
📘 Docs

Applies to: Supervised and unsupervised devices

This is confusing in the docs, but because it uses a token that will be resolved on the device, you can safely deploy this policy to both supervised and unsupervised devices.

  1. Create an app configuration policy for Managed Devices for platform iOS and targeted app Microsoft Defender: Security
  2. Use the configuration designer to set a string key/value pair Key: issupervised
    Type: string
    Value: {{issupervised}}
  3. Target both supervised and unsupervised devices.

Onboarding Profiles

🔗 Portal
📘 Docs

*Applies to: Unsupervised devices

For unsupervised devices, there are two ways to finalize the configuration of Defender for Endpoint after its been deployed.

Zero-Touch onboarding: This automatically configures Defender for Endpoint without any user interaction. Recommended.
Simplified onboarding: This requires users to open Defender to finalize onboarding before the VPN functions.

  1. Create an device configuration policy for iOS/iPadOS devices with the template type VPN with the following settings Connection Name = Microsoft Defender for Endpoint
    VPN server address =
    Auth method = Username and password
    Split Tunneling = Disable
    VPN identifier =
    For Zero-Touch onboarding:
    Key/Value Pairs:
    Key: SilentOnboard
    Value: True
    For Simplified onboarding:
    Key/Value Pairs:
    Key: AutoOnboard
    Value: True
    Type of Automatic VPN = On-demand VPN
    Add a on-demand rule:
    I want to do the following: Connect VPN
    I want to restrict to: All domains
  2. To prevent users from disabling the VPN in iOS Settings, set
    Block users from disabling automatic VPN: Yes
  3. To disable the On/Off Toggle for the VPN in the Defender app itself, add the following key/value pair:
    Key: EnableVPNToggleInApp
    Value: TRUE
  4. Target unsupervised devices

Control Filter

🔗 Portal
📘 Docs

Applies to: Supervised devices

The Control Filter allows Defender for Endpoint's Web Protection without the loopback VPN whatsoever. This does not work with other always-on VPNs.

  1. Create a Device Config profile with the following settings:
    Platform: iOS/iPadOS
    Profile Type: Templates
    Template Name: Custom
  2. Download the ControlFilterZeroTouch .mobileconfig profile and upload it.
  3. Target supervised devices. If you accidently target unsupervised it won't apply on those.