Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.
Cortex XDR agent iOS 9.2

Install the Cortex XDR agent app on iOS using Microsoft Intune

Install the app using Microsoft Intune

Prerequisites

Before beginning the deployment, ensure the following requirements are met:

  • Microsoft Intune Environment: Access to the Microsoft Intune admin center.

  • Apple VPP Token: An active connection between your Apple Business Manager account and Intune (Tenant Administration > Apple VPP Tokens).

  • Managed Devices: Devices must be enrolled and managed by Intune.

  • Distribution ID: Your unique Cortex XDR Distribution ID.

  • Target Groups: User or device groups (for example, "Cortex XDR Sales Org Iphones") created in Intune.

  • Cortex XDR agent app for iOS requires iOS 15.0 or later.

  • The notifications payload is only available for supervised devices.

  • The content filter payload is only available for supervised devices running iOS 17.0 or later.

Add Cortex XDR app using Apple VPP

Instead of adding the Cortex XDR app directly from the store, use the Apple Volume Purchase Program (VPP) to manage licenses and syncing.

  1. Verify VPP Integration:

    1. Go to Tenant administration+Connector and tokens+Apple VPP tokens.

    2. Ensure the status of your token is Active.

  2. Add the app in Apple VPP:

    1. Log in to your Apple Business Manager (or VPP) portal.

    2. Search for and add the Cortex XDR app.

    3. Important: When prompted for the quantity, enter a number significantly higher than your current device count (for example, 1000 or 5000) to avoid running out of licenses. If the limit is reached later, you will need to update the quantity and re-sync.

  3. Sync with Intune:

    1. Return to the Intune Admin Center.

    2. Go to Tenant administration+Connector and tokens+Apple VPP tokens.

    3. Select your active token.

    4. Scroll to the right to find the options menu (three dots button) and select Sync.

    5. Wait 5-10 minutes for the synchronization to complete.

  4. Verify app presence:

    1. Go to Apps+iOS/iPadOS.

    2. Confirm that Cortex XDR appears in the list with the App type listed as iOS volume purchase program plan.

      Note

      Do not assign the app to groups yet. This will be performed in the final step after all the configurations are ready.

For more information, see: Manage VPP apps in Intune

Create the app configuration policy

This policy pre-configures the app with your Distribution ID (distributionID value) and user details.

  1. Go to Apps+Manage Apps+Configuration+Create+Managed devices.

  2. Configure the Basics tab:

    1. For Name, enter Cortex XDR App Config.

    2. For Platform, select iOS/iPadOS.

    3. For Targeted app, select the Cortex XDR app (verify it is the VPP version if multiple exist).

    4. Click Next.

  3. Configure the Settings tab:

    1. For Configuration settings format, select Enter XML data.

    2. In the XML property list area, paste the following code, and then replace ENTER YOUR DISTRIBUTION ID HERE with your actual Distribution ID.

  4. Click Next.

  5. On the Assignments tab, select your target group, and click Select to create the policy.

Configure notification settings

Enforce notification settings to ensure the Cortex XDR agent can alert users.

On iOS, the system only allows one global notifications payload for the entire system. Depending on your current configuration, if there is already a profile to allow notifications to other apps, we advise you to edit that same profile and add a new entry for the Cortex XDR app.

Note

If there are multiple notification profiles assigned to the same device, the first profile to arrive at the device will be installed, and all subsequent ones will fail to install, in line with Apple requirements.

If this is the first notification profile, you can import the pre-configured Intune policy supplied here. This profile was created manually in Intune, and then exported to JSON format. You can import this policy directly into iOS configuration profiles, create, import policy, save.

You can also create your own profile, manually.

Import a policy from JSON

If you have a pre-configured JSON file (such as the Cortex XDR Notifications file shown below), you can import it directly to create a new policy without manually selecting settings.

  1. Navigate to Devices+iOS/iPadOS+Configuration profiles.

  2. In the top menu bar, click Create+Import Policy.

  3. An Import policy (preview) pane will open. Be aware that importing creates a new, distinct policy, and original assignments will not be copied.

  4. Under Policy file, browse for and upload your JSON configuration file (for example, Cortex XDR Notifications_2024-05-23T19_26_27.648Z.json).

  5. For New name, enter a name for the policy (for example, Cortex XDR Notifications).

  6. For New description, enter a meaningful description for the policy.

  7. Click Save to create the policy.

  8. Click the name of the policy you just imported (for example, Cortex XDR Notifications).

  9. In the policy overview, scroll down to the Assignments section and click Edit.

  10. Under Included groups, click + Add groups.

  11. Search for, and select your target group (for example, "Cortex XDR Sales Org Iphones").

  12. Click Select, then click Review + save.

  13. Click Save again to confirm. The policy is now applied to the selected devices.

Create your own profile

  1. Navigate to Devices+iOS/iPadOS+Configuration profiles+Create+New Policy.

  2. For Platform, select iOS/iPadOS.

  3. For Profile type, select Settings catalog.

  4. For Name, enter the profile Cortex XDR Notifications.

  5. In the Settings picker, select User Experience+Notifications.

  6. Check Notification Settings, configure Bundle Identifier as com.paloaltonetworks.cortex.ios, accept the defaults for all the other fields, and save the policy.

  7. On the Assignments tab, click on the name of your policy (for example, Cortex XDR Notifications).

  8. In the policy overview, scroll down to the Assignments section and click Edit.

  9. Under Included groups, click + Add groups.

  10. Search for, and select your target group (for example, "Cortex XDR Sales Org Iphones").

  11. Click Select, then click Review + save.

  12. Click Save again to confirm. The policy is now applied to the selected devices.

Configure the network content filter

Deploy the custom profile for network protection.This step is required because Intune does not include all the available payload fields in the settings catalog in its user interface.

Step 1: Create the .mobileconfig file

Using a text editor, copy the XML code below, replace ENTER YOUR DISTRIBUTION ID HERE with your Distribution ID, and save as CortexXDR_NetworkContentFilter.mobileconfig.

Step 2: Upload the .mobileconfig file to Intune

  1. Navigate to Devices+iOS/iPadOS+Configuration profiles++ Create+New Policy.

  2. Under Create a profile, set the following:

    • Platform: iOS/iPadOS

    • Profile type: Templates

    • Template name: Custom

  3. Click Create.

  4. Name the profile Cortex XDR Network Content Filter.

  5. Upload the .mobileconfig file created in Step 1.

  6. Click Next.

  7. On the Assignments tab, for Included groups, assign the profile to your target group, and click Next.

  8. Click Review + save.

Assign and deploy the app

Now that the app is synced and all configurations (App Config, Notifications, Network Filter) are in place, you can assign the app to your device users.

  1. Navigate to Apps+iOS/iPadOS.

  2. Click the Cortex XDR app (Type: iOS volume purchase program plan).

  3. Select Properties+Assignments+Edit.

  4. Under the Required section, click + Add group.

  5. Select your target group (for example, "Cortex XDR Sales Org Iphones").

  6. Set the Install as removable option to false/no.

  7. Review the configuration, and click Save.

Verify configuration and app installation

Verify that configuration and deployment were successful.

On the Intune console

Verify configuration profiles (Notifications and Network Filter)

For the profiles configured under Configuration profiles (for example, Cortex XDR Notifications or Cortex XDR Network Content Filter):

  1. Go to Devices+iOS/iPadOS+Configuration profiles.

  2. Click the specific policy name you want to check (for example, Cortex XDR Notifications or Cortex XDR Network Content Filter).

  3. On the Overview page, check the statuses on the Device status and User status charts.

  4. Ensure that the status bar shows a green indicator for Succeeded.

    • You can also view the Device install status report to see all devices targeted by the policy.

    • The Per setting status report allows you to view the success of each individual setting within the policy.

Verify app configuration policy (XML settings)

For the policy configured under App configuration policies (where the Distribution ID and user tokens were added):

  1. Go to Apps+App configuration policies.

  2. Click the policy name (for example, Cortex XDR).

  3. In the Overview section, check the status on the Device Status ring chart.

  4. Verify that the Device status shows Succeeded (indicated by a green section in the chart).

Verify app installation status

To ensure the app itself is installed (which is a prerequisite for the configurations to apply):

  1. Go to Apps+iOS/iPadOS+iOS/iPadOS apps, and select Cortex XDR.

  2. To check installation status, in the Monitor section, click Device install status.

  3. To confirm installation, look for the Installed status in the device list.

On the iOS devices

After the policies are deployed from Intune, perform the following checks on the managed iOS device, to confirm they have been applied successfully.

Check device management profiles

  1. Open the Settings app on the iOS device.

  2. Go to General+VPN & Device Management.

  3. Verify that Content Filter is listed under Restrictions and Proxies.

  4. Ensure the status shows Running (Note: It might initially appear as Invalid before the app fully initializes).

  5. Tap Content Filter to confirm it is actively managed by Cortex XDR.

Verify notification settings

  1. In the Settings app, scroll down, and select the Cortex XDR app.

  2. Tap Notifications.

  3. Confirm that Allow Notifications is toggled ON.

  4. Verify that Critical Alerts and Time-Sensitive Notifications are enabled.

  5. Ensure all alert styles (Lock Screen, Notification Center, Banners) are checked and active.

  6. Confirm that Show Previews is set to Always (Default).

Validate app installation and protection status

  1. Open the Cortex XDR app from the home screen.

  2. The app should launch and automatically connect without requiring manual login credentials.

  3. Wait for the app to complete its initial checkup. You will see a progress circle indicating Contacting Server, Performing Checkup, and Updating Policies.

  4. Confirm the status updates to a green shield icon displaying Checkup performed! or Protected.

  5. Tap the Settings tab (bottom right) to view details such as the Distribution ID and Endpoint ID, confirming the policy values were successfully received.

Verify module activation

  1. Inside the Cortex XDR app, tap the Modules tab (bottom left).

  2. Verify that Basic requirements (Notifications & Background app refresh) and Network Shield are marked as Active with a green dot.

Test app removal restriction

  1. Attempt to remove the Cortex XDR app from the home screen.

  2. You should see a system alert stating Uninstall Not Allowed, confirming that the app is managed and required by your organization.

PreviousConfiguration for Installation by JAMF (Administrator Task)
NextDevice User Tasks

Last updated

Was this helpful?