Integrating Aurora Endpoint Security with Microsoft Intune to respond to mobile threats

You can connect Aurora Endpoint Security to Microsoft Intune so that Aurora Endpoint Security can report the risk level of devices to Intune. The device risk level is calculated based on the detection of mobile threats by the Aurora Protect Mobile app on Intune managed devices. Intune can execute mitigation actions based on the device risk level.

When you connect Aurora Endpoint Security to Intune, you create app configuration policies that define the device types and Intune groups that the integration applies to. Aurora Protect Mobile policies map events detected by the Aurora Protect Mobile app to the risk level of your choosing (high, medium, or low). When the Aurora Protect Mobile app on an Intune managed device detects a threat (for example, a malicious app or sideloaded app), the risk level that is mapped to that threat is factored into an overall risk level that Aurora Endpoint Security calculates for the device. Aurora Endpoint Security reports the device risk level to Intune, and Intune carries out the mitigation actions that have been configured for that risk level.

Note that all Intune managed devices that you want to use this feature must be included in an app configuration policy in the Endpoint Defense console. This feature requires the Aurora Protect Mobile app version 2.0.1.1099 or later.

Aurora Endpoint Security also supports using Microsoft Intune app protection policies to allow or restrict access to specific Microsoft apps based on the device threat level reported by Aurora Protect Mobile. To enable this functionality, see Use Intune app protection policies with Aurora Protect Mobile.