Harmony Mobile with Microsoft Intune and other MDMs

In short: Harmony Mobile MDM integration connects Check Point Mobile Security to a UEM such as Microsoft Intune, Workspace ONE, Jamf Pro, IBM MaaS360 or BlackBerry UEM. Mobile Security syncs devices from the UEM, sets each device's threat level there, and the UEM's compliance and conditional access policies block risky devices. The UEM can also install the Protect app without user action.

How Harmony Mobile and your MDM work together

Harmony Mobile and an MDM do different jobs. The MDM (or UEM, unified endpoint management) owns the device: enrolment, apps, settings and access rules. Harmony Mobile looks for threats: malicious apps, phishing, network attacks and risky OS settings. The integration joins the two:

1. Mobile Security connects to the UEM and synchronises the device groups you choose, together with optional details such as device name, number and email address.
2. The UEM pushes the Mobile Security Protect app to those devices, and with zero-touch deployment activates it without the user opening it.
3. When the app finds a threat, Mobile Security raises the device's risk level and updates it in the UEM.
4. The UEM's compliance policy marks the device non-compliant at the risk level you set, and conditional access blocks corporate apps such as Microsoft 365 until the threat is removed.
5. When the user removes the threat, the risk level drops and access returns automatically.

You can connect more than one UEM at the same time, and manage UEM-enrolled and manually registered devices on the same dashboard in separate device groups.

Supported MDM and UEM platforms

Check Point's Mobile Security UEM Integration Guide (updated October 2026) lists these as supported UEMs:

A further group of UEMs are tested and supported by their own vendors: mdport, SevenPrinciples (7P), Essentials MDM (Techstep/FAMOC), Hexnode, ManageEngine, Scalefusion and Codeproof. These connect through Check Point's generic UEM API, which other UEM vendors can also implement. If your UEM is on-premises and cannot be reached from Check Point's cloud, the Mobile Security Connector relays the connection.

Microsoft Intune integration in detail

Intune is the natural pairing for organisations already on Microsoft 365. Check Point's guide sets out these prerequisites and building blocks:

• Licences: Microsoft Intune Plan 1, Microsoft Entra ID P1 and Conditional Access. Check Point recommends Enterprise Mobility + Security (EMS) E3 or E5, which come as part of Microsoft 365 E3 and E5.
• Platform set-up: Intune configured as the MDM authority, with an Apple push certificate for iOS and Android Enterprise enrolment.
• The MTD connector: in the Intune admin centre, under Tenant administration, Connectors and tokens, Mobile Threat Defense, you add the Check Point connector so device threat levels flow into compliance evaluation.
• Compliance and conditional access: a compliance policy sets the maximum allowed device threat level, and a Conditional Access policy blocks non-compliant devices from Microsoft 365.
• App protection (MAM) for BYOD: for devices you do not enrol, an app protection policy can block Microsoft 365 apps unless the Protect app is installed and the device is below a set threat level. Users are prompted to install the app.
• Zero-touch deployment: Intune pushes a VPN profile that the Protect app uses, so it installs and activates without the user opening it. On Android Enterprise, app permissions can be granted automatically.

Forever Group's Microsoft Intune team can set up or tidy Intune first if your enrolment is not ready.

Deployment steps

This is how we roll out Harmony Mobile with an MDM. Timings depend on your device numbers and how ready the MDM is. It follows the same pilot-first approach as our Harmony Endpoint deployment guide.

1. Check prerequisites: confirm your UEM is on the supported list, the licences are in place (for Intune, Plan 1, Entra ID P1 and Conditional Access) and devices are enrolled.
2. Create the tenant: set up Mobile Security in the Check Point Portal and attach the licence, or start the 30-day trial.
3. Connect the UEM: add the integration in Mobile Security's settings, choose the device groups to synchronise, decide which personal details to import and set the sync intervals.
4. Plan policy: decide which findings mark a device low, medium or high risk, and whether to turn on BYOD Privacy Mode.
5. Deploy the app: push the Mobile Security Protect app through the UEM, with zero-touch activation where supported.
6. Set compliance rules: in the UEM, set the threat level at which devices become non-compliant and link it to conditional access.
7. Pilot and test: enrol a small group, trigger a test detection (Check Point's guide uses a deliberately blocked app) and confirm the device is marked non-compliant and then recovers.
8. Roll out and tune: extend to all users, then review events and adjust risk levels to avoid needless blocks.

Tell users before the app arrives what it does and does not see. It reduces support tickets and builds trust in BYOD schemes.

Using Harmony Mobile without an MDM

You do not need an MDM to use Harmony Mobile. Without one:

• Registration is by invitation. Mobile Security sends a registration email or SMS, which you can customise, and the user installs the Protect app from the App Store or Google Play. On Android the registration details are filled in automatically from the link.
• Protection is the same on the device: app, file, network, phishing and OS risk detection all work.
• Access control uses Mobile Security's built-in conditional access, which stops high-risk devices reaching corporate IP addresses and host names you list, independent of any UEM.

What you lose is zero-touch installation and UEM compliance enforcement, such as blocking Microsoft 365 apps. Many smaller organisations start without an MDM and add Intune later; the two models can run side by side on one dashboard.

How Forever Systems helps

We handle both sides of the integration: the Check Point tenant and policy, and the MDM configuration. That avoids the common gap where security and device management teams each assume the other has set up compliance rules. We also advise on BYOD wording for staff, Android Enterprise work profiles and how mobile risk fits your wider Microsoft 365 security set-up.

Licensing is per device; ask us for a quote. Contact us to plan your integration.

How Forever Systems supplies and supports Check Point Harmony

We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.

• Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
• Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
• Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
• Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
• Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal

Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.

Frequently asked questions

Explore Check Point Harmony

Related from Forever Group

• Microsoft 365 security
• Zero trust network access explained
• Microsoft Intune
• Mobile device management
• Microsoft 365