WS - USS Mobile app deployment via Intune for Personal / BYOD Deployment (Unsupervised)

Updated 13 hours ago by admin

WS - Deploying the USS Mobile Agent via Intune (Personal / BYOD Device)

Overview

This guide covers deploying the USS Mobile app to a personally-owned or unmanaged iPhone via Microsoft Intune Company Portal. This method does not require wiping the device and is suitable for BYOD scenarios.

Because the device is not supervised, the VPN cannot be technically locked — users can in theory disable it. Part 5 of this guide covers compensating controls to enforce USS Mobile usage through policy instead.

If you need full VPN enforcement where users cannot disable USS Mobile, see the companion guide: WS - Deploying the USS Mobile Agent via Intune (Fully Managed / Supervised Device).

Part 1 — Before You Start: Prerequisites

Apple MDM Push Certificate

Intune requires a valid Apple MDM Push Certificate to communicate with iOS devices. Without it, device enrolment will fail with an APNSCertificateNotValid error in Company Portal.

To check: go to Intune → Devices → Enrolment → Apple → Apple MDM Push Certificate. The status must show Active. If it shows Expired or is missing, you must resolve this before continuing.

To renew an expired certificate: download the CSR from Intune, go to identity.apple.com/pushcert, sign in with the same Apple ID used to create the original certificate, click Renew on the existing Microsoft Corporation entry (do not click Create), upload the CSR, download the .pem, and upload it back to Intune.

Important: always renew using the same Apple ID that created the original certificate. Using a different Apple ID creates a new certificate with a different Subject ID and will break management of any already-enrolled devices.
The certificate expires annually. Note the expiry date and set a renewal reminder for one month before it expires.

Company Portal App

The user must install the Microsoft Intune Company Portal app on their iPhone before enrolment. It is available free on the App Store.

Part 2 — Enrol the Device

  1. Open Company Portal on the iPhone and sign in with the user's work account
  2. Follow the Set up access wizard
  3. When prompted, tap Download Management Profile
  4. Go to Settings → General → VPN & Device Management → tap the downloaded profile → Install → enter passcode → Install again to confirm
  5. Return to Company Portal and complete the enrolment

The device will appear in Intune under Devices → All devices within 5 to 15 minutes. To force an immediate sync, open Company Portal → Devices → tap the device → Check Status.

To confirm enrolment succeeded on the device, go to Settings → General → VPN & Device Management. You should see a Management Profile entry under Mobile Device Management.

Part 3 — Deploy USS Mobile

Recommendation: Deploy the Hosted Gateway CA for iOS devices before deploying the USS Mobile App - KB Article
  1. In Intune, go to Apps → iOS/iPadOS → Create
  1. Select iOS store app
  1. Search for USS Mobile by TrustLayer
  2. Click Next → Assignments
  3. Under Required, add the group containing your target device or user
  4. Click Next → Review + create → Create
Assign as Required rather than Available. Required causes Intune to install the app silently without any user interaction. Available only adds it to the Company Portal catalogue for optional install.

Part 4 — How USS Mobile Configures Itself

Once installed, USS Mobile handles its own VPN and relay setup automatically. After the user authenticates via SSO:

  • USS Mobile contacts the TrustLayer CloudUSS service
  • It installs its own configuration profiles directly on the device
  • These appear in Settings → General → VPN & Device Management → Configuration Profiles as clouduss.com entries. This will need enabling.
  • All HTTP/HTTPS traffic is then routed through TrustLayer enforcement points
Do not attempt to remove these clouduss.com profiles. They will reinstall automatically. Do not create a separate VPN profile in Intune alongside these, as it will conflict with the app's own configuration.

Part 5 — Compensating Controls for VPN Enforcement (optional)

On unsupervised devices, Intune cannot technically prevent a user from disabling the USS Mobile VPN. The following controls provide a policy-based alternative that creates a strong incentive to keep USS Mobile running.

Intune Compliance Policy
  1. In Intune, go to Devices → Compliance → Create policy → iOS/iPadOS
  2. Configure minimum requirements such as minimum OS version (iOS 17.0 or later)
  3. Assign the policy to the group containing the device
Conditional Access in Microsoft Entra ID
  1. Go to Entra ID → Security → Conditional Access → New policy
  2. Under Users, select the relevant user or group
  3. Under Cloud apps, select Exchange Online, SharePoint Online, and Microsoft Teams
  4. Under Conditions → Device platforms, select iOS
  5. Under Grant, select Require device to be marked as compliant
  6. Enable the policy

If a user disables USS Mobile or removes its profiles and the device falls out of compliance, they will lose access to corporate email and apps until the issue is resolved. This provides a strong operational incentive to keep USS Mobile active without requiring device supervision.

How did we do?