Deploying the USS Mobile Agent via Intune (Fully Managed / Supervised Device)

Updated 11 hours ago by admin

This guide covers deploying USS Mobile to a corporate-owned iPhone that is fully supervised via Apple Business Manager (ABM) and Microsoft Intune Automated Device Enrolment (ADE). This method allows the VPN to be locked so users cannot disable it.

This process requires the device to be wiped. Always take a full encrypted backup before proceeding.

If you have a personally-owned or existing device that cannot be wiped, see the companion guide: Deploying the USS Mobile Agent via Intune (Personal / BYOD Device).

Part 1 — Before You Start: Prerequisites

You will need the following before beginning:

  • An active Apple Business Manager account (business.apple.com)
  • Apple Configurator 2 installed on a Mac (free, Mac App Store) — required only if the device was not originally purchased through ABM
  • A Mac with a USB cable to connect the iPhone
  • Your Intune tenant with a valid Apple MDM Push Certificate (see below)
  • An Intune Enrolment Program Token linked to your ABM account
Apple MDM Push Certificate

Intune requires a valid Apple MDM Push Certificate to communicate with iOS devices. Go to Intune → Devices → Enrolment → Apple → Apple MDM Push Certificate and confirm the status shows Active.

To renew an expired certificate: download the CSR from Intune, go to identity.apple.com/pushcert, sign in with the same Apple ID used originally, click Renew on the existing Microsoft Corporation entry, upload the CSR, download the .pem, and upload it back to Intune. Always use the same Apple ID — a different one will break existing enrolled devices.

The certificate expires annually. Set a renewal reminder for one month before expiry.

Enrolment Program Token

In Intune, go to Devices → Enrolment → Apple → Enrolment Program Tokens and confirm a token linked to your ABM account is present and not expired. This token also expires annually and must be renewed at the same time as the APNS certificate.

Part 2 — Back Up the iPhone

Before wiping the device, take a full encrypted backup. An encrypted backup captures everything including passwords, Health data, and saved Wi-Fi credentials. A plain unencrypted backup does not.

  1. Connect the iPhone to a Mac via USB
  2. If prompted on the iPhone, tap Trust and enter the passcode
  3. Open Finder and select the iPhone in the left sidebar
  4. Under the General tab, select Back up all of the data on your iPhone to this Mac
  5. Tick Encrypt local backup and set a password — store this password safely as you will need it to restore
  6. Click Back Up Now and wait for it to complete
  7. Verify the backup via Finder → Manage Backups — confirm the timestamp matches

Part 3 — Add the Device to Apple Business Manager

If the device was purchased directly through Apple or an authorised reseller and already appears in ABM, skip to Part 4.

If the device was not originally purchased through ABM, use Apple Configurator 2 to add it manually. Note this will erase the device.

  1. Open Apple Configurator 2 and sign in with your ABM Managed Apple ID via Preferences → Accounts
  2. Connect the iPhone to the Mac via USB
  3. Put the iPhone into Recovery Mode:
    • Quickly press and release Volume Up
    • Quickly press and release Volume Down
    • Press and hold the Side button until the recovery screen appears (cable and laptop icon) — do not release when the Apple logo appears, keep holding
  4. The device appears in Apple Configurator 2 — right-click it → Advanced → Add to Apple Business Manager
  5. Follow the prompts. The device will be erased and registered in ABM.
  6. In ABM go to Devices, find the newly added device, click Edit MDM Server and assign it to your Intune MDM server

Part 4 — Create and Assign an ADE Enrolment Profile in Intune

  1. In Intune go to Devices → Enrolment → Apple → Enrolment Program Tokens
  2. Select your token → Profiles → Create profile → iOS/iPadOS
  3. Configure the following key settings:

Setting

Value

User affinity

Enrol with User Affinity (if user has an Entra ID / M365 account)

Supervised

Yes

Locked enrolment

Yes

Allow user to remove management profile

No

Sync with computers

Deny all

  1. Save the profile
  2. Go back to the token → Devices → find the device by serial number → Assign profile → select the profile you just created

Part 5 — Complete Setup on the iPhone

  1. Power on the iPhone — it will boot into Setup Assistant
  2. Connect to Wi-Fi
  3. The device will automatically pull the ADE enrolment profile from Apple and Intune — you will see a Remote Management screen
  4. Complete Setup Assistant
  5. The device enrols into Intune as supervised

Intune will then automatically push assigned apps and configuration profiles to the device. Allow 5 to 15 minutes for policies to apply fully.

Part 6 — Deploy USS Mobile

The USS Mobile app Bundle ID is com.trustlayer.uss (App Store ID: 6752286030).

  1. In Intune go to Apps → iOS/iPadOS → Add
  2. Select iOS store app
  3. Search for USS Mobile by TrustLayer
  4. Click Next → Assignments
  5. Under Required, add the group containing your target device or user
  6. Click Next → Review + create → Create

Assign as Required rather than Available. Required causes Intune to install the app silently without any user interaction.

Part 7 — Enforce the VPN (Always-on, User Cannot Disable)

On supervised devices you can lock the VPN so users cannot disable it. There are two approaches — choose the one that suits your deployment.

Option A — Intune VPN Profile (IKEv2 Always-on)

Use this if you want to configure the VPN directly through Intune without a custom profile file.

  1. Go to Devices → Configuration profiles → Create → New policy
  2. Platform: iOS/iPadOS
  3. Profile type: Templates → VPN
  4. Connection type: IKEv2

Key settings:

Setting

Value

Connection name

TrustLayer USS

VPN type

Always-on VPN

Tunnelling mode

All traffic

Allow user to disable VPN

No

Lock VPN configuration

Enabled

Because USS Mobile installs its own VPN profiles, the cleanest approach is to pre-deploy the TrustLayer VPN and certificate configuration via a custom Intune profile using the TrustLayer-provided .mobileconfig file. This avoids any conflict between Intune's VPN profile and the app's own profiles.

Contact TrustLayer support at support@trustlayer.co.uk to request the MDM deployment package for your tenant. This includes the .mobileconfig file and CA certificate ready for Intune import.

To import it:

  1. Go to Devices → Configuration profiles → Create → New policy
  2. Platform: iOS/iPadOS
  3. Profile type: Templates → Custom
  4. Upload the .mobileconfig file provided by TrustLayer
  5. Assign to the supervised device group

Set the profile assignment to required and ensure PayloadRemovalDisallowed is set to true in the profile — users will then be unable to remove it.

Part 8 — Restore the Backup

Once the device has fully enrolled and Intune policies have applied:

  1. Connect the iPhone to the Mac via USB
  2. Open Finder and select the iPhone
  3. Click Restore Backup
  4. Select the encrypted backup taken in Part 2
  5. Enter the encryption password
  6. Wait for the restore to complete and the device to reboot

Part 9 — Verify the Deployment

Allow 5 to 10 minutes after restore for Intune policies to fully settle, then verify:

  • Settings → General → VPN & Device Management — the Intune MDM profile should be listed and the remove button should be greyed out
  • Settings → VPN — the TrustLayer VPN should show as connected with no option to disable it
  • USS Mobile should be present on the home screen and authenticating via SSO
  • In the TrustLayer admin console, the device should appear as an active endpoint with policies applying

Reference Information

Item

Value

USS Mobile Bundle ID

com.trustlayer.uss

USS Mobile App Store ID

id6752286030

Minimum iOS version

iOS 17.0

Enrolment type

ADE via Apple Business Manager (supervised)

VPN lock possible

Yes

Apple Push Certs Portal

identity.apple.com/pushcert

Apple Business Manager

business.apple.com

TrustLayer Support

support@trustlayer.co.uk

How did we do?