Intune app config - Smoothwall browser iPad

[steveg]

Currently migrating all our iPads to intune, as part of the new deployment I want to deploy the smoothwall browser.

 

I have created an app config, which is applying as when I open the browser it tried to open the correct homepage, however not much else seems to be working. config is:

 

Configuration key Value type Configuration value

SmoothwallSerialNumber String 123412341234 - (Actual serial number entered)

User String {{username}}

UniqueDeviceID String {{serialnumber}}

HomePageURL String http://ourintranetsite/

 

 

When I open the browser, it gives the error Invalid Smoothwall Configuration. The MDM configuration for the device is invalid.

 

Are the variables for username and serial correct? The iPads are signed in using the company portal app, so intune knows the user details associated with the iPad.

[bknaggs]

This is my config from Jamf

 

SmoothwallSerialNumber
xxx
UserID
%Email%
UniqueDeviceID
%SerialNumber%

[matt_shakespeare]

Just checking you have worked through this KB article https://kb.smoothwall.com/hc/en-us/articles/4404006049810-Installing-Cloud-Filter-for-iOS

If you are still having issues, please can you let me know the support ticket number and I'll try to get someone to help.

[steveg]

That's the KB article I used. I noticed from what bknaggs posted above that I'd put User rather than UserID, I've corrected that and just waiting for the profile to re-apply now (seems to take much longer in Intune than it ever did with Airwatch?) to see if that resolves the error.

 

Thanks

[Joeloman]

We have had some customers use the firewall serial number instead of the UNCL serial number...

Can't remember what error the system showed though...

[jadzea]

On 22/02/2024 at 09:24, steveg said:

Currently migrating all our iPads to intune, as part of the new deployment I want to deploy the smoothwall browser.

 

I have created an app config, which is applying as when I open the browser it tried to open the correct homepage, however not much else seems to be working. config is:

 

Configuration key Value type Configuration value

SmoothwallSerialNumber String 123412341234 - (Actual serial number entered)

User String {{username}}

UniqueDeviceID String {{serialnumber}}

HomePageURL String http://ourintranetsite/

 

 

When I open the browser, it gives the error Invalid Smoothwall Configuration. The MDM configuration for the device is invalid.

 

Are the variables for username and serial correct? The iPads are signed in using the company portal app, so intune knows the user details associated with the iPad.

We’ve got the same issue - did you find a resolution to this?

[tom_newton]

Have you both got support tickets in I can point at the right people? It's a while since I provisioned an ipad, and my brain hurts

[CHiLL]

On 03/04/2025 at 06:15, jadzea said:

We’ve got the same issue - did you find a resolution to this?

After having a ticket open for months, we resolved this with having to use {{devicename}} for the UserID as well as replacing SmoothwallOrgID with SmoohwallLegacyOrdID, since we're using Smoothwall Monitor too. I believe this is only applicable to Intune.

 

<dict>
<key>SmoothwallSerialNumber</key>
<string>EnterYourSerialNumber</string>
<key>SmoothwallLegacyOrgID</key>
<string>EnterYourOrgIDNumber</string>
<key>UserID</key>
<string>{{devicename}}</string>
<key>UniqueDeviceID</key>
<string>{{devicename}}</string>
<key>HomePageURL</key>
<string>https://www.schoolwebsite.sch.uk</string>
<key>SSOProvider</key>
<string>Microsoft</string>
<key>UsersIDsAllowedToSSOSignIn</key>
<array>
<string>@schoolwebsite.sch.uk</string>
</array>
<key>CanStoreSSOUserIDInCloud</key>
<true/>
</dict>

 

We are not yet able to get SSO working, as it says my users are not permitted to use it. I have checked the Smoothwall Browser for iPad in the Enterprise Application section of Entra, ensuring that all users are specified (both by group and explicitly for my test user) in the Users and groups section. The app on the iPad states:

 

Quote

Single Sign-On Required

Your administrator requires you to sign-in to use this app.

You may not use [email protected]

Try again

Quit

I know SSO is working, as SSO works for other apps with Microsoft Authenticator installed, such as Microsoft Word, PowerPoint, Excel, Outlook, etc for the same user on the same iPad.

 

I also have the Single Sign-On Extension settings configured as such:

 

Quote

SSO app extension type: Microsoft Entra ID

Enable shared device mode: Not configured

App bundle IDs: com.smoothwall.ios.Firefox

 

We also have an app policy for Microsoft Authenticator to specifically tell the iPad not to use Shared Device Mode:

 

Quote

Configuration key: intune.mam.shareddevicemode

Value type: Boolean

Configuration value: false

 

We are using Apple's Shared iPad and will not be using Shared Device Mode.

 

I currently have a ticket open for this.

Edited April 4, 2025 by CHiLL

[jadzea]

Thanks for this - very helpful.

 

We've gone back to the start somewhat to the enrolment profile and switched to enrolling with user affinity (these are 1 to 1 devices assigned to the individual students) so during enrolment they authenticate as themselves (the student, or we do it on their behalf using their credentials) and then use dynamic security group based on enrolment profile used to then assign settings and apps. 

 

We've started to use the Microsoft authenticator app and are working on the SSO for this. We get company portal installed, but just hide this as not sure we really need it.

 

We've found though, without even setting up the Microsoft Authenticator app (need for the SSO extensions) Smoothwall now works correctly as the primary user for the device is now set in inTune and thusly pushed to the device. I think I just made the mistake/assumption that it read the userprinciaplname variable from the device somehow, when in actual fact the app config is pushed onto the device from InTune with this value configured. 

 

We also didn't use the XML, and just set the values using the configuration designer (as shown on the screenshot attached).

 

Smoothwall Browser works with it straight away and to be fair quite nicely. 

 

Next bit we need to sort is the general filter extension for the device so in-app browsers have some level of filtering to them too (disappointing that it isn't the same user level filtering, but at least it's something).

 

 

[CHiLL]

9 minutes ago, jadzea said:

<snip>

At least it's working for you. If I'm reading your post right, you're deploying 1-1 iPads, if you're setting primary users to devices? We are using Shared iPad for a multiclass/shared environment, which would require students to log into an iPad, similar to logging into Windows.

[jadzea]

On 04/04/2025 at 11:33, CHiLL said:

At least it's working for you. If I'm reading your post right, you're deploying 1-1 iPads, if you're setting primary users to devices? We are using Shared iPad for a multiclass/shared environment, which would require students to log into an iPad, similar to logging into Windows.

yes that’s correct.

 

we have used shared iPads in areas before we went full one to one. We federated our AppleIDs with Office365 so it worked very well (same email and password they’re used to).

 

not sure how a shared iPad would fair as effectively the payload is generated on intune and pushed to the device with all the information configured (ie their username rather than the wildcard) and it picks this up from the primary user field for the device in intune. 
 

Perhaps in shared iPad mode that primary user changes? I guess issue is sync frequency then, as I tune I think is every 6 hours..!

[tom_newton]

Can you fish out any thickets which are still open (not able to SSO with MS sounds like its still an issue) and I will go get them escalated properly

[jadzea]

On 04/04/2025 at 11:33, CHiLL said:

At least it's working for you. If I'm reading your post right, you're deploying 1-1 iPads, if you're setting primary users to devices? We are using Shared iPad for a multiclass/shared environment, which would require students to log into an iPad, similar to logging into Windows.

Hi Tom,

 

we don’t have the issue now with one to one assigned devices.

 

could I feedback though, that while we do have the iPad platform web filter extension installed for apps other than the smoothwall web browser, it would be soooo much better if this extension did the proper filtering thus negating the need for the smoothwall browser…. Like lightspeed can do.

[tom_newton]

Unfortunately other vendors using those systems are limited to pure URL filtering and search term alerting - no content filtering or monitoring. We will be releasing an agent for ipad that does some additional URL filtering alongside the browser though.

[giblet]

Hi

 

I'm trying to get the Smoothwall Browser working with new iPads.

 

When filling in the App Configuration Policy in InTune for the browser I cannot enter a UniqueDeviceID or UserID with any of these parameters:

{{DeviceName}}  / {{DeviceSerial}} I get the same Invalid token.  Does anyone know what I am doing wrong?

Thanks

[tom_newton]

I presume its intune giving you these errors?

Have you tried all lower case?

[giblet]

Yes InTune is giving these errors.  Invalid Token.

 

Is there a list of allowable parameters you can input into those fields?

 

 

Same with Lower Case

Edited November 13, 2025 by giblet

[tom_newton]

Think you might be mixing things up - try "serialnumber" rather than deviceserial, for example

 

All about Microsoft Intune | Quick tip: Available token types for app configuration policies

[giblet]

On 13/11/2025 at 16:11, tom_newton said:

Think you might be mixing things up - try "serialnumber" rather than deviceserial, for example

 

All about Microsoft Intune | Quick tip: Available token types for app configuration policies

 

I must be doing something fundamentally wrong because that gives me invalid token too

 

 

[giblet]

This is from Copilot... so I guess it's probably wrong

 

Intune supports tokens like {{username}}, {{email}}, {{deviceid}}, and {{serialnumber}} only for apps integrated with Intune App SDK or using Managed App Configuration (e.g., Microsoft Edge, Outlook). Smoothwall Browser is not listed as an Intune-protected app, so these tokens won’t resolve automatically.

 

Any ideas how I can resolve this and get the Smoothwall Browser deployed on the iPads using InTune with some sort of way to identify them?

Edited November 18, 2025 by giblet

[giblet]

I have realised that I was trying to set a configuration file type as a 'Managed App'.... but actually I needed to create the configuration policy under type 'Managed devices' as XML file targetting the app. (See screenshots)

 

Not confusing at all.

 

I have now successfully set the XML file up and sent it out to the iPads...

 

Now to test whether the actual app works as intended (I'll probably be back)  

 

 

Edited November 18, 2025 by giblet

[Driftingashore]

On 04/04/2025 at 09:51, CHiLL said:

After having a ticket open for months, we resolved this with having to use {{devicename}} for the UserID as well as replacing SmoothwallOrgID with SmoohwallLegacyOrdID, since we're using Smoothwall Monitor too. I believe this is only applicable to Intune.

 

Thanks for this - we were getting the "invalid config" error with Smoothwall Browser for shared iPads deploying via Intune, but switching to {{devicename}} rather than {{userprinciaplname}} as UserID fixed it. Smoothwall's support article shows the value to be {{userprinciaplname}} for Intune, but that seems to be the cause 🤷‍♂️

 

For whatever it's worth, we don't have either SmoothwallOrgID with SmoohwallLegacyOrdID configured and we have Smoothwall Monitor. 

 

 

 

 

[Planehazza]

On 21/11/2025 at 12:46, Driftingashore said:

 

Thanks for this - we were getting the "invalid config" error with Smoothwall Browser for shared iPads deploying via Intune, but switching to {{devicename}} rather than {{userprinciaplname}} as UserID fixed it. Smoothwall's support article shows the value to be {{userprinciaplname}} for Intune, but that seems to be the cause 🤷‍♂️

 

For whatever it's worth, we don't have either SmoothwallOrgID with SmoohwallLegacyOrdID configured and we have Smoothwall Monitor. 

 

 

 

 

Having this same issue too. We've moved to (well I was planning to) Shared iPad mode in order to make students log into iPads to monitoring, but I can't seem to find a way of getting 'logged in' user or current manage apple ID to forward through to Smoothwall Browser.

 

AppleId, userId, userprincipalname etc all fail. I can get SSO against Google to work, but then that defeats the purpose of shared ipad mode especially given that Smoothwall can only filter and monitor their browser - I might as well abandon shared iPad mode and have them sign into the browser.

 

iPads for KS1 are an utter nightmare but we cannot get the schools to give them up...

[Driftingashore]

On 06/07/2026 at 17:09, Planehazza said:

Having this same issue too. We've moved to (well I was planning to) Shared iPad mode in order to make students log into iPads to monitoring, but I can't seem to find a way of getting 'logged in' user or current manage apple ID to forward through to Smoothwall Browser.

 

AppleId, userId, userprincipalname etc all fail. I can get SSO against Google to work, but then that defeats the purpose of shared ipad mode especially given that Smoothwall can only filter and monitor their browser - I might as well abandon shared iPad mode and have them sign into the browser.

 

iPads for KS1 are an utter nightmare but we cannot get the schools to give them up...

For what it’s worth we went with shared iPad and having people manually sign in to the browser - never managed to get SSO working with Shared iPad / Smoothwall browser. 
 

Very very far from perfect, but I don’t think people would remember to sign out, and then there’s signing in to other apps to consider. At least with Shared iPad they only have to sign in to everything once and then it’s just a passcode. The big negative being the first sign in

 is a royal PITA. 

[Planehazza]

20 hours ago, Driftingashore said:

For what it’s worth we went with shared iPad and having people manually sign in to the browser - never managed to get SSO working with Shared iPad / Smoothwall browser. 
 

Very very far from perfect, but I don’t think people would remember to sign out, and then there’s signing in to other apps to consider. At least with Shared iPad they only have to sign in to everything once and then it’s just a passcode. The big negative being the first sign in

 is a royal PITA. 

 

It really is. What age range was this with? We're trying to find a solutions for KS1 and it's a nightmare