--- title: Other Features slug: isac/admin-guide/ios/other-features docTags: createdAt: 2026-08-03T06:47:15.480Z --- ## Conditional Access on iOS ISAC Client Conditional Access feature allows to use identity-driven signals as part of the access control decisions. Conditional access brings signals together, to make decisions, and enforce organizational policies. This feature allows administrators to restrict access to approved client apps using Intune app protection policies. For detailed information refer [What is Conditional Access in Microsoft Entra ID?](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview) To enable conditional access: 1. Configure a SAML cloud app on Azure IdP and Connect Secure. See, [Deploying a BYOD Policy for Microsoft Intune Managed Devices (ivanti.com)](https://help.ivanti.com/ps/help/en_US/ICS/vNow/INTmdmsdg/ms_intune_intergration.htm) and [Client application configuration](https://learn.microsoft.com/en-us/entra/identity-platform/msal-client-application-configuration). 2. Create Device Feature policy configuration in Intune MDM under **Devices > Manage devices > Configuration > Create > New policy**. 3. Under Device feature configuration, edit “Single sign-on app extension configuration" and add below three key value pairs: | Field | Value | Value Type | | ---------------------------------- | --------------------------- | ---------- | | browser\_sso\_interaction\_enabled | 1 | Integer | | AppAllowList | net.pulsesecure.pulsesecure | String | | disable\_explicit\_app\_prompt | 1 | Integer | 4. Configure conditional access policy, See [Plan a Microsoft Entra Conditional Access deployment](https://learn.microsoft.com/en-us/entra/identity/conditional-access/plan-conditional-access#conditional-access-policy-components). 5. Create Conditional access policy on Azure IdP. 1. Select the user to apply the policy. 2. Select the target resource. 3. Choose conditions. 6. Select Device platform as iOS for iOS devices. 7. Select Client apps as **Browser**. Mobile devices use browser for login. 8. Block or grant access to the resources based on the above conditions and device compliance state. :::hint{type="info"} \- Identity based restriction is configured from MDM. \- Conditional access policy gets applied based on the compliance state fetched from Intune MDM. ::: ## Device Validation Support for VoD and Per-App VPN Apps can be configured to automatically connect to VPN when they are launched. Using this feature, only the corporate-managed apps will transfer the data over the VPN. Personal data of employees such as personal web browsing, and connections to gaming and social networks will not use the VPN. When the VPN On Demand profile is applied to the device, VPN will be started automatically in the following two conditions: - When the applications are launched. - When the application sends traffic in the background. In VPN On Demand, a blocking interface is set up on the device which monitors the configured apps for the network traffic. Whenever an application whose network access type is "require VPN" tries to perform any network activity, the blocking interface detects this. It thereafter authenticates the user, tears down the blocking interface, and establishes the VPN connection. ## EMM Configuration The configuration needed to be enabled on EMMs. Following Parameters should be configured by the EMM Vendor to set up a VPN On-Demand profile: | Parameters | Value | | ------------------- | ------------------------------------------------------------------------------------- | | AppVPN Action | 0 (To allow) 1 (To deny) | | AppVPN Packages | CSV for package identifiers to Allow/Deny eg. com.chrome.android, com.android.dropbox | | Authentication Type | 1 (Certificate Based) | | Certificate Alias | The client certificate alias | | Profile Name | Any | | Route Type | 1 (Per App) | | URL | ICS URL | | VPN Trigger Type | 1(On Demand) | ## VPN On Demand Limitations - No Support for FQDN based Split Tunneling ## Device ID Validation This feature allows an app registration in MDM application configuration and pass to Ivanti Connect Secure. On validation, Connect Secure initiates authentication. The required configuration values are: :::Paragraph{listStyleType="disc" indent="2"} Tenant ID ::: :::Paragraph{listStyleType="disc" indent="2"} Client ID ::: :::Paragraph{listStyleType="disc" indent="2"} Client Secret ::: ## FaceID for Secondary Authentication This feature allows FaceID/Touch ID to be enabled while using secondary Authentication. ## TLS 1.3 ISAC supports TLS 1.3. To configure TLS 1.3, see [TLS 1.3 support](https://help.ivanti.com/ps/help/en_US/ICS/25.1.x/ag/security-hardening.htm?Highlight=tls%201.3#TLS). ## SAML as Secondary Authentication ISAC supports MFA auth on Mobile client with SAML as secondary authentication. This feature enables ISAC Mobile client to connect to ICS profile where the Primary Authentication is certificate and Secondary Authentication is SAML. ## Derived Credential Support This feature provides certificate-based authentication support for classic L3 VPN profiles where certificates are installed and managed by another application. These applications install digital certificates in device keystore for Android, or the MDM appconfig for iOS, and replace the need of physical smartcards for authentication. :::hint{type="info"} Ivanti secure Access Client 22.5R1 supports Ivanti Neurons for MDM (Ivanti EPMM and Ivanti MDM) and Entrust application as certificate provider. ::: ## Supported Platforms - Ivanti Secure Access client 22.5.1 - PIV-D manager application - Ivanti Mobile\@Work 8.6/ Ivanti Go 3.1 for core and cloud respectively - iOS 14 / Android 10 onwards ## Configuration of Derived Credentials The configuration includes initial setting up by admin and then end user enrolment. 1. Admin configures the CA root certificates, and the User certificates provided by the vendor in the MDM. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/AiHl_uvs6V_WOjokJPo3l_configcert.png" position="flex-start" size="80" width="985" height="216" initialPath="img/config_cert.png" githubPath="iOS-ag/img/config_cert.png" darkWidth="985" darkHeight="216" showCaption="false" indent="1"} 2. Admin adds appconfig policy to config ISAC client details in the MDM. 3. Admin installs corresponding CA root certificates on ICS for cert chain validation. 4. End user enrolls to MDM to fetch the appconfig policy. 5. End users browse the Entrust portal and select **I’d like to enroll for a derived mobile smart credential**. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/-DYnuYl8mGBYnLfWleMx8_enrollderivecred.png" position="flex-start" size="80" width="867" height="510" initialPath="img/enroll_derive_cred.png" githubPath="iOS-ag/img/enroll_derive_cred.png" darkWidth="867" darkHeight="510" showCaption="false" indent="1"} 6. In the next screen, select the option **I’ve successfully downloaded and installed the Smart Credential enabled application**. Then click **Next**. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/uFhWZW_YA6hgn-bW5aU1R_smartcredenabled.png" position="flex-start" size="80" width="1024" height="454" initialPath="img/smart_cred_enabled.png" githubPath="iOS-ag/img/smart_cred_enabled.png" darkWidth="1024" darkHeight="454" showCaption="false" indent="1"} 7. Enter the name for the derived credential and click OK. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/GuC1_SE8EITXCSxk05In0_derivedcredname.png" position="flex-start" size="80" width="1246" height="489" initialPath="img/derived_cred_name.png" githubPath="iOS-ag/img/derived_cred_name.png" darkWidth="1246" darkHeight="489" showCaption="false" indent="1"} 8. A QR code displays, use the PIV-D Manager application to scan and enter the password to install the certificates. :::Paragraph{indent="1"} The certificates are installed in the MDM and ISAC fetches the user certificate from MDM client application. ::: ## VPN Configuration One method of creating VPN configurations is to use a Configuration Profile to define Ivanti Secure Access Client configurations for the iOS device, and then distribute the configuration profiles by e-mail or by posting them on a Web page. When users open the e-mail attachment or download the profile using Safari on their iOS device, they are prompted to begin the installation process. You use the iPhone Configuration Utility to create configuration profiles and specify Ivanti SSL as the Connection Type for the VPN Payload. You can download the iPhone Configuration Utility (3.0 or later) from the Apple support Web. For details about the utility and how to create Configuration Profiles, see the iPhone OS Enterprise Deployment Guide, available from the Apple website ([www.apple.com](http://www.apple.com/)). ## Collecting Log Files from Ivanti Secure Access Client for iOS The iOS device user can use the following procedure to e-mail the Ivanti Secure Access Client log files: 1. On the iOS device, start the Ivanti Secure Access Client app. 2. Navigate to **Support > Share email** or **Share with other medium**. 3. Enter an e-mail address, then tap **Send**. ## Dark Theme Support Ivanti Secure access client supports Dark mode or bright mode as per mobile settings. ## Voice Over Support Ivanti Secure Access Client supports voice over instructions as per mobile settings. ## UI Mode Switching Ivanti Secure Access Client supports switching between classic UI and New-UX. Use Menu and UI mode to switch between the modes. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/o3CNBB0Zt0-oM3Bc1-Odr_uimode.png" position="flex-start" size="80" width="973" height="646" initialPath="img/ui_mode.png" githubPath="iOS-ag/img/ui_mode.png" darkWidth="973" darkHeight="646" showCaption="false"} ## FIDO2 Passwordless Authentication Enables passwordless authentication using hardware security keys or passkeys and two-factor authentication for SAML based login in Ivanti Secure Access Client. Existing SAML users can enable passworless authentication in MS Azure or OKTA. The following SAML authentications are supported: - SAML Authentication - SAML as primary and the System Local (password) as secondary - Certificate as primary and SAML as secondary :::hint{type="info"} Ensure the feature is enabled in Ivanti Connect Secure. Navigate **System** > **Configuration** > **Mobile**: ::: - In MS Azure, navigate to **Manage Security** > **Authentication methods** > create passkey or security key.. For more information, see [MS Entra](http://teams.public.onecdn.static.microsoft/evergreen-assets/safelinks/2/atp-safelinks.html). - In OKTA, to set FIDO 2 see [FIDO2 WebAuthn](https://help.okta.com/en-us/content/topics/security/mfa-webauthn.htm). ## In-App feedback This feature provides a mechanism for users to provide a detailed In-app feedback for the ISAC mobile client. This helps to collate user-experience and improve user experience. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/7jGwIO2IVkuC53S05yYbk_image.png" size="30" isUploading="false" width="376" height="725" darkWidth="376" darkHeight="725" showCaption="false"} ## Multi-Factor Authentication (MFA) support This feature supports Multi-Factor Authentication for VOD and Per-App VPN on mobile. The VPN connection requires a primary certificate authentication. If additional authentication is required, the user is guided through the MFA process to seamlessly resume the VPN connectivity. :::hint{type="info" indent="2"} Once the L3/L4/L7 access feature status is changed from disable to enable. On Android, reboot the device to connect successfully to VOD/Always On in Android. On iOS manually connect VOD/Always On profile to reset. ::: **** ## Added Support for Freja eID authenticator This feature ensures there is no login failure during SAML authentication. This occurs when there is an app to app authentication. .