---
title: Integrating Ivanti Neurons for MDM with nZTA
slug: ps/help/en_us/nsa/22x/nsa-zta/ag/1015
docTags: 
createdAt: 2026-07-22T14:00:51.300Z
---

- [Introduction](docId\:nBi7HQ0-HC1m7NGgTCmix)
- [Configuring Ivanti NMDM Cloud](docId\:nBi7HQ0-HC1m7NGgTCmix)
- [Integrating Ivanti NMDM with nZTA](docId\:nBi7HQ0-HC1m7NGgTCmix)
- [End User Experience](docId\:nBi7HQ0-HC1m7NGgTCmix)

## Introduction

Ivanti Neurons for MDM enables to securely access and protect data. It validates the device to ensure that only authorized users, devices, apps, and services can access business resources.

Ivanti NMDM is an independent entity which has a tenant running on the cloud and the same will be used to communicate to the nZTA by adding the details of the NMDM in the nZTA, see [Integrating Ivanti NMDM with nZTA](docId\:nBi7HQ0-HC1m7NGgTCmix).

Neurons for MDM integration with Neurons for ZTA achieves the below goals:

- Supports compliance check for mobile devices during login and application access.

This section explains steps involved in setting up NMDM cloud and configuring NMDM in nZTA.

### Prerequisites

- [Configuring Ivanti NMDM Cloud](docId\:nBi7HQ0-HC1m7NGgTCmix)

## Configuring Ivanti NMDM Cloud

As a prerequisite, an admin needs to configure Ivanti NMDM cloud configuration.

To configure Ivanti NMDM cloud:

1. Log in to Ivanti NMDM server.
2. In the Ivanti Neurons for MDM menu, select **Apps > App Catalog**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/qLwMBcCR7TAWYwtmOM2uK_nmdmcloudconfig-1.png" position="flex-start" size="36" width="361" height="442" initialPath="img/nmdm_cloud_config-1.png" githubPath="img/nmdm_cloud_config-1.png" darkWidth="361" darkHeight="442" showCaption="false"}

3. Search for Ivanti Secure Access Client iOS app. Select the app and click **Next**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/ZrDbpO2BMm4hOFFDhlbRA_nmdmcloudconfig-11.png" position="flex-start" size="80" width="912" height="684" initialPath="img/nmdm_cloud_config-1.1.png" githubPath="img/nmdm_cloud_config-1.1.png" darkWidth="912" darkHeight="684" showCaption="false"}

4. In the App Information page, specify **Launch URL** and click **Next**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/KQJwslxh6lygfD3jxnu2j_nmdmcloudconfig-12.png" position="flex-start" size="70" width="703" height="568" initialPath="img/nmdm_cloud_config-1.2.png" githubPath="img/nmdm_cloud_config-1.2.png" darkWidth="703" darkHeight="568" showCaption="false"}

5. In the App Delegation page, select the **Do not delegate the app** option and click **Next**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/kAjXjGzQVyUbEdEb49Qdx_nmdmcloudconfig-13.png" position="flex-start" size="71" width="709" height="571" initialPath="img/nmdm_cloud_config-1.3.png" githubPath="img/nmdm_cloud_config-1.3.png" darkWidth="709" darkHeight="571" showCaption="false"}

6. Choose a distribution level for this configuration of the app and click **Next**.
   - To Everyone with App - The app is added to all the user compatible devices.
   - To No One - The app is staged for distribution at a later date.
   - Custom distribution - Select one of the options from "User/User Groups" or "Device/Device Groups".

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/--mMnJmDEWOYr_xu-yMQ-_nmdmcloudconfig-14.png" position="flex-start" size="71" width="709" height="571" initialPath="img/nmdm_cloud_config-1.4.png" githubPath="img/nmdm_cloud_config-1.4.png" darkWidth="709" darkHeight="571" showCaption="false"}

7. In the Configuration Setup page, create a new configuration using plistfile/device attribute $ of type string. Click **Next**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/X482BUnJHedczHejeAOqX_nmdmcloudconfig-141.png" position="flex-start" size="71" width="712" height="688" initialPath="img/nmdm_cloud_config-1.4.1.png" githubPath="img/nmdm_cloud_config-1.4.1.png" showCaption="false"}

8. In the App Configuration page, select **Apple Application Management Configuration Settings** and click **Done**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/9mKbFtUUAzoXhiYAO6KeE_nmdmcloudconfig-15.png" position="flex-start" size="69" width="688" height="568" initialPath="img/nmdm_cloud_config-1.5.png" githubPath="img/nmdm_cloud_config-1.5.png" showCaption="false"}

The app is listed in the Apps/App Catalog.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/W3lm2optQc5mcXHOv1rIH_nmdmcloudconfig-16.png" position="flex-start" size="80" width="1308" height="408" initialPath="img/nmdm_cloud_config-1.6.png" githubPath="img/nmdm_cloud_config-1.6.png" showCaption="false"}

## Integrating Ivanti NMDM with nZTA

To link Ivanti NMDM with nZTA:

1. From the nZTA menu, select **Integrations > MDM**.
2. The MDM Configuration page appears.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/iTZvGLjPIKuKNNi1B-Fbd_mdmconfig.png" position="flex-start" size="80" width="829" height="570" initialPath="img/mdm_config.png" githubPath="img/mdm_config.png" showCaption="false"}

Specify a unique name for the MDM configuration.

3. Select **Type** as Ivanti (default).
4. Select **Server Type** as Ivanti Neurons for MDM (default), and enter its URL for connecting to the server.
5. Specify the URL for the MDM report viewer.
6. Specify a timeout period (0-60 seconds) for queries to the MDM server.
7. Specify the Administrator user name and corresponding password that has privileges to access MDM RESTful Web API.
8. Enter your **Device UUID**, and click **Test Connection**. A pop up shows the supported device attributes.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/xTPIc-gXvNzqtYg1hxKrs_mdmdevattribs.png" position="flex-start" size="80" width="835" height="613" initialPath="img/mdm_devattribs.png" githubPath="img/mdm_devattribs.png" showCaption="false"}

1. The **Device Identifier Type** for MDM certificate configuration is set as Universal Unique Identifier.
2. Click **Create**.

### Creating Device Policy

You can create Device policies and then create / associate one or more Device Rules as required.

To configure device policy:

1. Select **Secure Access**, and then select **Manage Devices > Device Policies**.
2. Click **Create Device Policy**.
3. Enter policy name and description.
4. Click **Create Device Rule**.
   The Create Device Rule dialog appears.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/1pAEbX_L7ByT1lkeFTvFo_mdmcreatedevicerule.png" position="flex-start" size="80" width="879" height="607" initialPath="img/mdm_create_devicerule.png" githubPath="img/mdm_create_devicerule.png" showCaption="false"}

1. Select **MDM** as Rule Type.
2. Enter rule name and description.
3. Select **iOS** from the **Platform** drop-down list.

:::hint{type="info"}
The 22.6R1.2 release supports only iOS platform.
:::

Select **MobileMDM** as Authentication Server.

9. Select a device attribute from the drop-down list, then enter a matching value for the selected attribute, and then click **Add**.
   Repeat the step to add more device attributes. The list of supported device attributes\:deviceIddeviceNameisBlockedisCompliantisCompromisedisEnrolledisQuarantinedIMEIlastSeenmacAddressmodelosVersionownershipphoneNumberplatformserialNumberUDIDUUIDuserIduserEmailuserName    

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/OkBoEYNePwk1VRPA2gIXb_mdmdevpolattribs.png" position="flex-start" size="69" width="685" height="252" initialPath="img/mdm_devpol_attribs.png" githubPath="img/mdm_devpol_attribs.png" showCaption="false"}

:::hint{type="info"}
\- The lastSeen attribue is supported with the unix timestamp.
\- The isBlocked/isEnrolled/isCompliant/isQuarantined/isCompromised attributes support only 0(false) and 1(true) values in the configuration.
:::

To learn more about creating device rules, see [Creating Device Policy Rules](docId:_nvGswHhwlgHDsmRPBWyz).

10. Select **Mode** and select one of the following from the drop-down list.
    - **Allow**: Enforces the policy rule.
    - **Deny**: Denies the policy rule.
11. Click **Create Rule**.
12. In the Device Policies page, click **Create Device Policy**.

### Creating User Policy

To create a user policy:

1. From the *nZTA* menu, select **Secure Access** and then select **Manage Users > User Policies**.
2. Click **Create User Policy**. For details, see [Configuring Default Device Policy for Users](docId:_nvGswHhwlgHDsmRPBWyz).

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/b0qJk614ciqKl2bpTohyr_mdmuserpol.png" alt="Manage User Policy" position="flex-start" size="80" width="916" height="534" initialPath="img/mdm_userpol.png" githubPath="img/mdm_userpol.png" showCaption="false"}

Manage User Policy

### Creating Secure Access Policy

To create a secure access policy:

1. From the *nZTA* menu, select **Secure Access > Secure Access Policies**.
   The **Secure Access Policies** page appears. This lists all current secure access policies.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/T-n6BUQxmgxpi3XspbP_q_mdmsap.png" alt="Viewing the Secure Access Policies page" position="flex-start" size="80" width="910" height="373" initialPath="img/mdm_sap.png" githubPath="img/mdm_sap.png" showCaption="false"}

Creating Secure Access Policies page

2. Click **Create**. For details, see [Creating a Secure Access Policy](docId\:ndGVDPLKGsRFI6krD7rok).

## End User Experience

Ivanti Neurons for MDM provides compliance check and simplified onboarding experience for nZTA end users connecting via mobile.

- When MDM policies are not enforced, both Enrollment and Authentication are successful.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/5obtWNq5Krd7MiIP8XZvj_mdmauthsuccess.png" size="27" isUploading="false" initialPath="img/mdm_auth_success.png" githubPath="img/mdm_auth_success.png" width="270" height="348" showCaption="false"}

- If MDM policy is Deny for Enrollment, then Enrollment fails.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/lGGWwIJob4SrJArRsnMEe_mdmenrollfail.png" size="27" isUploading="false" initialPath="img/mdm_enroll_fail.png" githubPath="img/mdm_enroll_fail.png" width="265" height="328" showCaption="false"}

- If MDM policy is Allow for Enrollment, but Deny for Authentication, then Enrollment is successful but Authentication fails.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/lr2f9EQBPWx54y5ePPoLy_mdmauthfail.png" size="37" isUploading="false" initialPath="img/mdm_auth_fail.png" githubPath="img/mdm_auth_fail.png" width="367" height="649" showCaption="false"}

- If MDM policy for a certain application is Deny application access, then access to that application is blocked.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/YsDZv5-DusW-TzdM0tc7S_mdmappfail.png" size="36" isUploading="false" initialPath="img/mdm_app_fail.png" githubPath="img/mdm_app_fail.png" width="363" height="645" showCaption="false"}