> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/administrator-tasks/prepare-for-installation-administrator-task/install-the-cortex-xdr-agent-app-on-ios-using-microsoft-intune.md). # Install the Cortex XDR agent app on iOS using Microsoft Intune **Install the app using Microsoft Intune** **Prerequisites** Before beginning the deployment, ensure the following requirements are met: * Microsoft Intune Environment: Access to the Microsoft Intune admin center. * Apple VPP Token: An active connection between your Apple Business Manager account and Intune (Tenant Administration > Apple VPP Tokens). * Managed Devices: Devices must be enrolled and managed by Intune. * Distribution ID: Your unique Cortex XDR Distribution ID. * Target Groups: User or device groups (for example, "Cortex XDR Sales Org Iphones") created in Intune. * Cortex XDR agent app for iOS requires iOS 15.0 or later. * The notifications payload is only available for supervised devices. * The content filter payload is only available for supervised devices running iOS 17.0 or later. **Add Cortex XDR app using Apple VPP** Instead of adding the Cortex XDR app directly from the store, use the Apple Volume Purchase Program (VPP) to manage licenses and syncing. 1. Verify VPP Integration: 1. Go to **Tenant administration**+**Connector and tokens**+**Apple VPP tokens**. 2. Ensure the status of your token is **Active**. 2. Add the app in Apple VPP: 1. Log in to your Apple Business Manager (or VPP) portal. 2. Search for and add the **Cortex XDR** app. 3. **Important:** When prompted for the quantity, enter a number significantly higher than your current device count (for example, 1000 or 5000) to avoid running out of licenses. If the limit is reached later, you will need to update the quantity and re-sync. 3. Sync with Intune: 1. Return to the Intune Admin Center. 2. Go to **Tenant administration**+**Connector and tokens**+**Apple VPP tokens**. 3. Select your active token. 4. Scroll to the right to find the options menu (three dots button) and select **Sync**. 5. Wait 5-10 minutes for the synchronization to complete. 4. Verify app presence: 1. Go to **Apps**+**iOS/iPadOS**. 2. Confirm that **Cortex XDR** appears in the list with the **App type** listed as **iOS volume purchase program plan**.

Note

Do not assign the app to groups yet. This will be performed in the final step after all the configurations are ready.

For more information, see: [Manage VPP apps in Intune](https://learn.microsoft.com/en-us/mem/intune/apps/vpp-apps-ios) **Create the app configuration policy** This policy pre-configures the app with your Distribution ID (distributionID value) and user details. 1. Go to **Apps**+**Manage Apps**+**Configuration**+**Create**+**Managed devices**. 2. Configure the **Basics** tab: 1. For **Name**, enter Cortex XDR App Config. 2. For **Platform**, select iOS/iPadOS. 3. For **Targeted app**, select the **Cortex XDR** app (verify it is the VPP version if multiple exist). 4. Click **Next**. 3. Configure the **Settings** tab: 1. For **Configuration settings format**, select **Enter XML data**. 2. In the **XML property list** area, paste the following code, and then replace **ENTER YOUR DISTRIBUTION ID HERE** with your actual Distribution ID. ```programlisting mdmVendor InTune distributionId ENTER YOUR DISTRIBUTION ID HERE username {{username}} fullName {{userprincipalname}} serialNumber {{serialnumber}} udid {{udidlast4digits}} ``` 4. Click **Next**. 5. On the **Assignments** tab, select your target group, and click **Select** to create the policy. **Configure notification settings** Enforce notification settings to ensure the Cortex XDR agent can alert users. On iOS, the system only allows one global notifications payload for the entire system. Depending on your current configuration, if there is already a profile to allow notifications to other apps, we advise you to edit that same profile and add a new entry for the Cortex XDR app. {% hint style="info" %} ### Note If there are multiple notification profiles assigned to the same device, the first profile to arrive at the device will be installed, and all subsequent ones will fail to install, in line with Apple requirements. {% endhint %} If this is the first notification profile, you can import the pre-configured Intune policy supplied here. This profile was created manually in Intune, and then exported to JSON format. You can import this policy directly into iOS configuration profiles, create, import policy, save. You can also create your own profile, manually. Import a policy from JSON If you have a pre-configured JSON file (such as the `Cortex XDR Notifications` file shown below), you can import it directly to create a new policy without manually selecting settings. 1. Navigate to **Devices**+**iOS/iPadOS**+**Configuration profiles**. 2. In the top menu bar, click **Create**+**Import Policy**. 3. An **Import policy (preview)** pane will open. Be aware that importing creates a new, distinct policy, and original assignments will not be copied. 4. Under **Policy file**, browse for and upload your JSON configuration file (for example, `Cortex XDR Notifications_2024-05-23T19_26_27.648Z.json`). 5. For **New name**, enter a name for the policy (for example, `Cortex XDR Notifications`). 6. For **New description**, enter a meaningful description for the policy. 7. Click **Save** to create the policy. 8. Click the name of the policy you just imported (for example, **Cortex XDR Notifications**). 9. In the policy overview, scroll down to the **Assignments** section and click **Edit**. 10. Under **Included groups**, click **+ Add groups**. 11. Search for, and select your target group (for example, "Cortex XDR Sales Org Iphones"). 12. Click **Select**, then click **Review + save**. 13. Click **Save** again to confirm. The policy is now applied to the selected devices. ```programlisting { "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/configurationPolicies/$entity", "createdDateTime": "2024-05-23T10:23:01.9842189Z", "creationSource": null, "description": "", "lastModifiedDateTime": "2024-05-23T10:23:22.026505Z", "name": "Cortex XDR Notifications", "platforms": "iOS", "priorityMetaData": null, "roleScopeTagIds": [ "0" ], "settingCount": 1, "technologies": "mdm,appleRemoteManagement", "id": "09a11c3a-4cbe-4c1e-85e3-e4c8a4e8e57c", "templateReference": { "templateId": "", "templateFamily": "none", "templateDisplayName": null, "templateDisplayVersion": null }, "settings": [ { "id": "0", "settingInstance": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance", "settingDefinitionId": "com.apple.notificationsettings_com.apple.notificationsettings", "settingInstanceTemplateReference": null, "groupSettingCollectionValue": [ { "settingValueTemplateReference": null, "children": [ { "@odata.type": "#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings", "settingInstanceTemplateReference": null, "groupSettingCollectionValue": [ { "settingValueTemplateReference": null, "children": [ { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings_item_alerttype", "settingInstanceTemplateReference": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "com.apple.notificationsettings_notificationsettings_item_alerttype_1", "children": [] } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings_item_badgesenabled", "settingInstanceTemplateReference": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "com.apple.notificationsettings_notificationsettings_item_badgesenabled_true", "children": [] } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings_item_bundleidentifier", "settingInstanceTemplateReference": null, "simpleSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationStringSettingValue", "settingValueTemplateReference": null, "value": "com.paloaltonetworks.cortex.ios" } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings_item_criticalalertenabled", "settingInstanceTemplateReference": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "com.apple.notificationsettings_notificationsettings_item_criticalalertenabled_false", "children": [] } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings_item_groupingtype", "settingInstanceTemplateReference": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "com.apple.notificationsettings_notificationsettings_item_groupingtype_0", "children": [] } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings_item_notificationsenabled", "settingInstanceTemplateReference": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "com.apple.notificationsettings_notificationsettings_item_notificationsenabled_true", "children": [] } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings_item_previewtype", "settingInstanceTemplateReference": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "com.apple.notificationsettings_notificationsettings_item_previewtype_0", "children": [] } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings_item_showincarplay", "settingInstanceTemplateReference": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "com.apple.notificationsettings_notificationsettings_item_showincarplay_true", "children": [] } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings_item_showinlockscreen", "settingInstanceTemplateReference": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "com.apple.notificationsettings_notificationsettings_item_showinlockscreen_true", "children": [] } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings_item_showinnotificationcenter", "settingInstanceTemplateReference": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "com.apple.notificationsettings_notificationsettings_item_showinnotificationcenter_true", "children": [] } }, { "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance", "settingDefinitionId": "com.apple.notificationsettings_notificationsettings_item_soundsenabled", "settingInstanceTemplateReference": null, "choiceSettingValue": { "settingValueTemplateReference": null, "value": "com.apple.notificationsettings_notificationsettings_item_soundsenabled_true", "children": [] } } ] } ] } ] } ] } } ] } ``` Create your own profile 1. Navigate to **Devices**+**iOS/iPadOS**+**Configuration profiles**+**Create**+**New Policy**. 2. For **Platform**, select **iOS/iPadOS**. 3. For **Profile type**, select **Settings catalog**. 4. For **Name**, enter the profile **Cortex XDR Notifications**. 5. In the **Settings** picker, select **User Experience**+**Notifications**. 6. Check **Notification Settings**, configure **Bundle Identifier** as `com.paloaltonetworks.cortex.ios`, accept the defaults for all the other fields, and save the policy. 7. On the **Assignments** tab, click on the name of your policy (for example, **Cortex XDR Notifications**). 8. In the policy overview, scroll down to the **Assignments** section and click **Edit**. 9. Under **Included groups**, click **+ Add groups**. 10. Search for, and select your target group (for example, "Cortex XDR Sales Org Iphones"). 11. Click **Select**, then click **Review + save**. 12. Click **Save** again to confirm. The policy is now applied to the selected devices. **Configure the network content filter** Deploy the custom profile for network protection.This step is required because Intune does not include all the available payload fields in the settings catalog in its user interface. Step 1: Create the .mobileconfig file Using a text editor, copy the XML code below, replace `ENTER YOUR DISTRIBUTION ID HERE` with your Distribution ID, and save as `CortexXDR_NetworkContentFilter.mobileconfig`. ```programlisting PayloadContent FilterBrowsers FilterSockets FilterType Plugin PayloadDescription Configures content filtering settings PayloadDisplayName Cortex XDR Network Data Filter PayloadIdentifier com.apple.webcontent-filter.2EF1184F-FC41-4477-BA81-D46AB318D8BB PayloadOrganization Palo Alto Networks PayloadType com.apple.webcontent-filter PayloadUUID 2EF1184F-FC41-4477-BA81-D46AB318D8BB PayloadVersion 1 PluginBundleID com.paloaltonetworks.cortex.ios UserDefinedName Cortex XDR VendorConfig distributionId ENTER YOUR DISTRIBUTION ID HERE username {{username}} fullName {{userprincipalname}} serialNumber {{serialnumber}} udid {{udidlast4digits}} PayloadDescription PayloadDisplayName Cortex XDR Network Content Filter With DistID PayloadEnabled PayloadIdentifier 0921C926-7798-4BEB-9D19-14D3C3E2D912 PayloadOrganization Palo Alto Networks PayloadRemovalDisallowed PayloadScope System PayloadType Configuration PayloadUUID 6D5B9C87-FA3D-4C2D-9FEA-478A10250D26 PayloadVersion 1 ``` Step 2: Upload the .mobileconfig file to Intune 1. Navigate to **Devices**+**iOS/iPadOS**+**Configuration profiles**+**+ Create**+**New Policy**. 2. Under **Create a profile**, set the following: * **Platform**: iOS/iPadOS * **Profile type**: Templates * **Template name:** Custom 3. Click **Create**. 4. Name the profile `Cortex XDR Network Content Filter`. 5. Upload the `.mobileconfig` file created in **Step 1**. 6. Click **Next**. 7. On the **Assignments** tab, for **Included groups**, assign the profile to your target group, and click **Next**. 8. Click **Review + save**. **Assign and deploy the app** Now that the app is synced and all configurations (App Config, Notifications, Network Filter) are in place, you can assign the app to your device users. 1. Navigate to **Apps**+**iOS/iPadOS**. 2. Click the **Cortex XDR** app (**Type**: iOS volume purchase program plan). 3. Select **Properties**+**Assignments**+**Edit**. 4. Under the **Required** section, click **+ Add group**. 5. Select your target group (for example, "Cortex XDR Sales Org Iphones"). 6. Set the **Install as removable** option to false/no. 7. Review the configuration, and click **Save**. **Verify configuration and app installation** Verify that configuration and deployment were successful. On the Intune console Verify configuration profiles (Notifications and Network Filter) For the profiles configured under **Configuration profiles** (for example, Cortex XDR Notifications or Cortex XDR Network Content Filter): 1. Go to **Devices**+**iOS/iPadOS**+**Configuration profiles**. 2. Click the specific policy name you want to check (for example, Cortex XDR Notifications or Cortex XDR Network Content Filter). 3. On the **Overview** page, check the statuses on the **Device status** and **User status** charts. 4. Ensure that the status bar shows a green indicator for **Succeeded**. * You can also view the **Device install status** report to see all devices targeted by the policy. * The **Per setting status** report allows you to view the success of each individual setting within the policy. Verify app configuration policy (XML settings) For the policy configured under **App configuration policies** (where the Distribution ID and user tokens were added): 1. Go to **Apps**+**App configuration policies**. 2. Click the policy name (for example, **Cortex XDR**). 3. In the **Overview** section, check the status on the **Device Status** ring chart. 4. Verify that the **Device status** shows **Succeeded** (indicated by a green section in the chart). Verify app installation status To ensure the app itself is installed (which is a prerequisite for the configurations to apply): 1. Go to **Apps**+**iOS/iPadOS**+**iOS/iPadOS apps**, and select **Cortex XDR**. 2. To check installation status, in the **Monitor** section, click **Device install status**. 3. To confirm installation, look for the **Installed** status in the device list. On the iOS devices After the policies are deployed from Intune, perform the following checks on the managed iOS device, to confirm they have been applied successfully. Check device management profiles 1. Open the **Settings** app on the iOS device. 2. Go to **General**+**VPN & Device Management**. 3. Verify that **Content Filter** is listed under **Restrictions and Proxies**. 4. Ensure the status shows **Running** (Note: It might initially appear as **Invalid** before the app fully initializes). 5. Tap **Content Filter** to confirm it is actively managed by Cortex XDR. Verify notification settings 1. In the **Settings** app, scroll down, and select the **Cortex XDR** app. 2. Tap **Notifications**. 3. Confirm that **Allow Notifications** is toggled **ON**. 4. Verify that **Critical Alerts** and **Time-Sensitive Notifications** are enabled. 5. Ensure all alert styles (**Lock Screen**, **Notification Center**, **Banners**) are checked and active. 6. Confirm that **Show Previews** is set to **Always** (Default). Validate app installation and protection status 1. Open the Cortex XDR app from the home screen. 2. The app should launch and automatically connect without requiring manual login credentials. 3. Wait for the app to complete its initial checkup. You will see a progress circle indicating **Contacting Server**, **Performing Checkup**, and **Updating Policies**. 4. Confirm the status updates to a green shield icon displaying **Checkup performed!** or **Protected**. 5. Tap the **Settings** tab (bottom right) to view details such as the **Distribution ID** and **Endpoint ID**, confirming the policy values were successfully received. Verify module activation 1. Inside the Cortex XDR app, tap the **Modules** tab (bottom left). 2. Verify that **Basic requirements** (Notifications & Background app refresh) and **Network Shield** are marked as **Active** with a green dot. Test app removal restriction 1. Attempt to remove the Cortex XDR app from the home screen. 2. You should see a system alert stating **Uninstall Not Allowed**, confirming that the app is managed and required by your organization. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/administrator-tasks/prepare-for-installation-administrator-task/install-the-cortex-xdr-agent-app-on-ios-using-microsoft-intune.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.