Deploy Cortex XDR Agent App for Android with zero-touch installation

This section outlines the configuration required to facilitate the zero-touch installation of the Cortex XDR agent app on Android devices using the Always-On VPN trigger. Since only one VPN can be active at a time, this configuration must be disabled once the app has successfully registered.

This solution is applicable only for managed devices configurations under MDM solutions; company owned and fully managed or own devices with a work profile.

The zero-touch deployment is for installation only, permissions for notifications must be set per device.

How to deploy Cortex XDR agent using Workspace One (WS1) zero-touch

1. Create a profile for Android with Custom Settings XML that sets the EnableAlwaysOnVPN parameter.

   • Set the Permissions policy to Grant all permissions for the Cortex XDR app.
   • Assign the profile to the correct Smart groups or devices so that it will be automatically assigned.
2. Set the profile to Auto deployment to install the Cortex XDR app.

The process should start automatically and a VPN connection icon will appear on the device(s).

1. Once the Cortex XDR app is running, disable the VPN by removing the AlwaysOn VPN setting.

   • Create a second profile with the same settings as above, but with EnableAlwaysOnVPN parameter set to False.
   • Assign the profile to the same Smart groups or devices so that it will be automatically assigned.
   • Set the profile to Auto deployment and the VPN connection icon will disappear on the device(s).

Alternatively, set another VPN app as the always-on VPN, if required.

Note:

The order of Installation of profiles is important; the last installed profile settings will override the configuration.

1. Manually enable malicious application notifications for each device.

See Configure and View Settings for the Cortex XDR Agent App for Android for the required device settings and notifications.

Creating an automated workflow for zero-touch in WS1

You can create a workflow to handle the Cortex XDR agent installation on device enrollment and trigger the zero-touch installation automatically.

1. In the WS1 console navigate to the Orchestration tab and create a new Freestyle Orchestrator Workflow.
2. Build a New workflow that first installs the Zero-Touch profile, using Step 1 of the procedure above, then check if the App is installed (verifying the specific app version to ensure it supports zero-touch capability) and installs the latest version (if not installed), and finally, installs the Post-Zero-Touch profile Step 3 to disable the VPN functionality.

How to deploy Cortex XDR agent using Microsoft Intune zero-touch

Intune requires a manual transition between groups to move devices from the activation state to the operational state.

1. In the Intune admin center, navigate to Groups and select New group.

Create two Assigned security groups:

• 0-Touch Enabler: This group includes the devices/users that start the zero-touch registration.
• 0-Touch Disabler: This group includes the devices/users that finish the zero-touch registration.

1. In Devices+Configuration create a New Policy profile for Android Enterprise platform. Select Templates as the profile type and search for the Device restrictions template.

Select the template and click Create

Note:

There are two options for Device Restrictions in the templates list. Select the one that is relevant for the Device setup (Fully managed/Personally owned).

1. Give the profile a name such as 0-touch profile and click Next.
2. In the Configuration settings tab, expand Connectivity and enable Always-on VPN with Custom VPN client.

Type in the app's package name as Package ID (com.paloaltonetworks.trapsa). Click Next to continue.

1. Add an inclusion group in the Assignments tab.

Click Add groups under the Included groups section and add the "0-touch Enabler" group that was defined in step 1.

1. Continue to the final step to review and create the 0-touch profile.
2. Create a second profile with a name such as Post 0-touch profile.

Use the same parameters, except for this profile set the Always-on VPN setting to Not configured, or configure it for any other VPN service, if required.

1. Add an inclusion group in the Assignments tab.

Click Add groups under the Included groups section and add the "0-touch Disabler" group.

1. Add an exclusion group.

Click Add groups under the Excluded groups section and add the "0-touch Enabler" group.

1. Continue to the final step to review and create the Post 0-touch profile.

Intune Zero-Touch activation

Intune does not offer any automatic flow orchestration, so the 0-touch activation and deactivation must be done manually by an administrator.

• The App settings should include Auto-Grant settings for notification permissions.
• Custom MDM settings with distributionId and auto-registration parameters must be set.
• The Cortex XDR agent app in Intune must be assigned to both the 0‑Touch Enabler and the 0‑Touch Disabler groups.

1. Setup users/devices to initiate 0-touch registration

Step 1 to step 5 above

1. When the assigned users/devices are assigned to the 0-Touch Enabler group and are found compliant the Cortex XDR agent app is installed and the 0-touch profile was synced.

This is validated via the tenant - the assigned agents become Connected, confirming that the app was activated, registration completed, and a heartbeat performed.

1. At this stage, admin must move the users/devices to the 0-Touch Disabler group, to disable the always-on VPN setting.

When moving the users to the disabler group, first assign the group and only then remove the users/devices from enabler group Step 7 to step 10 above.

Note:

Manually enable malicious application notifications for each device.