VMware AirWatch Containerization with Samsung Knox Guide Deploying Samsung Knox Containerization

Transcription

1 VMware AirWatch Cntainerizatin with Samsung Knx Guide Deplying Samsung Knx Cntainerizatin AirWatch v9.2 Have dcumentatin feedback? Submit a Dcumentatin Feedback supprt ticket using the Supprt Wizard n supprt.air-watch.cm. This prduct is prtected by cpyright and intellectual prperty laws in the United States and ther cuntries as well as by internatinal treaties. VMware prducts are cvered by ne r mre patents listed at VMware is a registered trademark r trademark f VMware, Inc. in the United States and ther jurisdictins. All ther marks and names mentined herein may be trademarks f their respective cmpanies. 1

2 Revisin Table The fllwing table displays revisins t this guide since the release f AirWatch v9.2. Date Reasn September 2017 Initial uplad. 2

3 Table f Cntents Chapter 1: Overview 5 What's New 6 Cntainerizatin With Samsung Knx Overview 6 Devices and OS Versins Supprted by Samsung Knx 6 Enable Samsung Knx Cntainer 7 Chapter 2: Prfiles with Samsung Knx 8 Knx Prfiles Overview 9 Device Prfiles and Cntainer Prfiles 9 Passcde Prfile (Knx) 10 Enfrce Brwser Restrictins (Knx) 12 Enable Per App VPN fr Knx Cntainer Applicatins 13 Activate s (Knx) 15 Cnfigure Exchange Active Sync Mail Client (Knx) 16 Cnfigure Single Sign-On (Knx) 18 Deply Credentials (Knx) 18 Cnfigure Applicatin Cntrl (Knx) 19 Implement Smart Card Authenticatin (Knx) 21 Cnfigure Firewall Rules 21 Set Restrictins (Knx) 21 Create Custm s (Knx) 25 Bkmarks (Knx) 26 Set Date/Time (Knx) 26 Chapter 3: Samsung Knx Cntainer Management 28 Knx Management Overview 29 Knx Cntainer Passcde Management 29 Audit Lgs 29 Chapter 4: Samsung Knx fr the End User 32 Knx fr the End User Overview 33 Create Knx Cntainer n a Device 33 3

4 User Interface 33 Accessing Other Dcuments 35 4

5 Chapter 1: Overview What's New 6 Cntainerizatin With Samsung Knx Overview 6 Devices and OS Versins Supprted by Samsung Knx 6 Enable Samsung Knx Cntainer 7 5

6 Chapter 1: Overview What's New This guide has been updated with the latest features and functinality frm the mst recent release f AirWatch v9.0, which supprts the integratin f Samsung Knx. The list belw includes these new features and the sectins and pages n which they appear. Added supprt fr S/MIME certificates in the Samsung KNOX Credentials prfile. S/MIME Certificates. S/MIME certs allw yu t encrypt s and digitally sign them helping the peple wh receive that message t be certain that what they see in their inbx is the exact message that started with the sender. See Deply Credentials (Knx) n page 18. Cntainerizatin With Samsung Knx Overview Samsung Knx is making it easier t use persnal devices fr wrk purpses fr Bring Yur Own Device (BYOD) prgrams and deply truly crprate- dedicated devices t end-users. Samsung Knx is a feature that allws yu t use yur phne as an enterprise and persnal device, by using an enterprise cntainer. Within this cntainer, all enterprise functins are securely managed. Outside f the enterprise cntainer, yu can use yur phne as a persnal device with an uninterrupted end-user experience. In sme scenaris, a device can be enrlled as Cntainer Only Mde which lcks the devices int the Knx cntainer with n access t the persnal side f the device. This is a slutin fr crprate dedicated devices wh d nt want that end-users use devices fr persnal use. The key benefits f cntainerizatin with Samsung Knx are: Tw Devices in One - Switch between the passwrd-prtected Knx Wrkspace and the persnal side f the device with the tap f an icn. Pwerful Apps - A full cllectin f ready t use applicatins are pre-laded and pushed t the Samsung Knx Wrkspace. Secure Data - Data is secure using n-device encryptin and SmartCard authenticatin. Andrid Lckdwn - Yu are allwed t have a device passwrd and Samsung Knx cntainer passwrd t keep yur sensitive enterprise infrmatin safe. Devices and OS Versins Supprted by Samsung Knx The fllwing devices and OS versins are cmpatible with Samsung Knx. Different OS versins may supprt different versins f the Knx cntainer. Supprted Operating Systems Jelly Bean 4.3 Jelly Bean 4.4.X Kit Kat 5.0.X Lllipp 6

7 Chapter 1: Overview 6.0.X Marshmallw 7.0.X Nugat Supprted Devices Fr an exhaustive list f supprted devices, visit the Samsung Knx web site Enable Samsung Knx Cntainer Befre yu can cnfigure Knx fr yur devices, yu must first enable the Knx cntainer. 1. Navigate t Devices > Device s > Andrid > Agent s. 2. Select Enable Knx Cntainers under Samsung Knx. 3. Enter yur Knx License Key yu btained frm Samsung. The license key is stred in the cnsle, but is nt visible. It is nly viewable ne time by selecting Shw Passwrd buttn during initial entry. The license key is nly validated during the enrllment prcess nt upn input int the cnsle. This key is part f the Samsung Knx License Management System. Fr mre infrmatin n btaining a license key, see the Samsung Knx web site. 4. Select Save t enable the creatin f cntainer prfiles. 5. Navigate t Devices > List View > Details View > Summary and see the Cntainer sectin f the page t view the creatin status. The status is listed as Success, Failed r N Cntainer. 7

8 Chapter 2: Prfiles with Samsung Knx Knx Prfiles Overview 9 Device Prfiles and Cntainer Prfiles 9 Passcde Prfile (Knx) 10 Enfrce Brwser Restrictins (Knx) 12 Enable Per App VPN fr Knx Cntainer Applicatins 13 Activate s (Knx) 15 Cnfigure Exchange Active Sync Mail Client (Knx) 16 Cnfigure Single Sign-On (Knx) 18 Deply Credentials (Knx) 18 Cnfigure Applicatin Cntrl (Knx) 19 Implement Smart Card Authenticatin (Knx) 21 Cnfigure Firewall Rules 21 Set Restrictins (Knx) 21 Create Custm s (Knx) 25 Bkmarks (Knx) 26 Set Date/Time (Knx) 26 8

9 Knx Prfiles Overview Cntainerizatin f enterprise cntent prvides yu with a dual device experience, successfully splitting the enterprise functins f yur device int an encrypted cntainer. Cnfiguring prfiles helps yu secure the crprate cntainer with yur Samsung Knx-enabled device. This allws yu t use yur phne as a persnal and wrk device withut threatening security. Certain crprate-wned device scenaris supprt the creatin f Cntainer Only Mde which lcks the device int t Knx cntainer with n dual persna r persnal side t the device. In this case, prfiles nly applies t the cntainer. The prmpt fr cnfiguring the device in Cntainer Only Mde is selected during enrllment and the user cannt change this setting. Device Access Sme device prfiles cnfigure the settings fr accessing an Knx device. Use these prfiles t ensure that access t a device is limited nly t authrized users. Sme examples f device access prfiles include: Secure a device with a Passcde prfile. Fr mre infrmatin, see Passcde Prfile (Knx) n page 10. Specify and cntrl hw, when and where yur emplyees use their devices. Fr mre infrmatin, seeset Restrictins (Knx) n page 21. Device Security Ensure that yur Knx devices remain secure thrugh device prfiles. These prfiles cnfigure the native Knx security features r cnfigure crprate security settings n a device thrugh AirWatch. Access internal resurces such as , files, and cntent. Fr mre infrmatin, see Enable Per App VPN fr Knx Cntainer Applicatins n page 13. Take administrative actins when a user installs r uninstalls certain applicatins. Fr mre infrmatin, see Cnfigure Applicatin Cntrl (Knx) n page 19. Device Cnfiguratin Cnfigure the varius settings f yur Knx devices with the cnfiguratin prfiles. These prfiles cnfigure the device settings t meet yur business needs. Access a URL directly frm an icn n the device's menu. Fr mre infrmatin, see Bkmarks (Knx) n page 26. Set the date and time and the display frmat t prvide yur fleet with the apprpriate reginal frmat. Fr mre infrmatin, see Set Date/Time (Knx) n page 26. Device Prfiles and Cntainer Prfiles Yu can create prfiles fr tw mdes n Knx-enabled devices. The first is fr devices, and applies t the entire device. The secnd is fr cntainers, and nly applies t the crprate cntainer created n the device. 9

10 With cntainerizatin fr Samsung Knx, it is still pssible t have tw different prfiles n yur device. Yu can deply a device prfile t a Knx- enabled device and this prfile will nly apply t the persnal side f the device and nt affect the Knx cntainer. Passcde Prfile (Knx) As an extra line f defense fr yur crprate data and cntent, yu can enfrce a Knx passcde t secure the islated business cntainer n a Knx enabled device. Yu can allw fingerprint unlcking n the Knx cntainer s that the end user can pen the Knx cntainer with a single swipe t recgnize their fingerprint. Users have t specify a PIN r passwrd as a backup unlck methd. Yu can enable multifactr authenticatin which requires a pattern, PIN, r passcde in additin t a fingerprint. If fingerprint r multifactr is enabled, users create a passcde based n standard requirements such as minimum passcde length, passcde cntent, and ther settings in the cnsle. Admins can clear r change the passcde frm the AirWatch Cnsle withut affecting the device passcde. See the Knx Management Overview n page 29 Deply Passcde (Knx) a passcde plicy requires yur end-users t enter a passcde, prviding a first layer f defense fr sensitive data n devices. 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 10

11 4. Access the Passcde tab and cnfigure the fllwing settings: Fingerprint Authenticatin Enable this ptin t allw user t unlck the Knx cntainer using their fingerprint. The available settings, if enabled are: Multifactr Authenticatin Maximum Number f Failed Attempts Device Lck Timeut (in Minutes) Multifactr Authenticatin Minimum Passcde Length Maximum Number f Failed Attempts Imprtant: Samsung requires users t have a backup PIN. Enable this ptin t require a tw-step unlck prcess. The cntent must include a PIN r pattern and a fingerprint as the secnd authenticatin factr. This ptin nly displays when Fingerprint Authenticatin is enabled. Enter the minimal number f passcde characters allwed. Enter the number f times a passcde can be entered incrrectly befre the Knx cntainer is disabled. Passcde Cntent Determine the strength f the passcde. Mre text bxes display based n the selectin chsen. Imprtant: Fr Knx v2.2 and abve, if the minimum number f cmplex characters in the passwrd set by the prfile is greater than 4, then at least ne lwercase character and ne uppercase character are required. Maximum Passcde Age Passcde Histry Device Lck Timeut (in Minutes) Maximum Length f Numeric Sequences Enter the maximum number f days befre a passcde must be changed. Determines the number f passwrds stred fr a user accunt befre an ld passwrd can be reused. Set hw much time can lapse befre the Knx cntainer autmatically lcks. Set the allwed length f a passcde sequence. 11

12 Minimum Number f Characters Changed Frbidden Strings Passwrd Visibility Set hw many characters can be reused frm a previus passcde. Enter the characters that cannt be used in a passcde. Select Addt insert mre settings. Enable t allw users t view passcde as it is entered. If disabled, the passcde shws as asterisks when entered. 5. Select Save & Publish. Enfrce Brwser Restrictins (Knx) Knx brwser restrictins helps t minimize vulnerability and maximize security as end-users access the crprate cntainer using the brwser t view and use internal cntent. T cnfigure Knx Brwser Restrictins: 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the Brwser paylad and cnfigure the settings accrdingly. Allw Pp- Ups Allw Ckies Allw Aut Fill Allw JavaScript Frce Fraud Warning Enables Pp-up brwser setting t allw r prevent any web site frm launching a new brwser windw when the user navigates t a web site that invkes such actin. Applies t the native Andrid brwser t allw r prevent any web site frm string ckies related t the web site n the device. Applies t the native Andrid brwser t allw r prevent any web site frm prviding autfill suggestins when a user is filling in frm data n the webpage, even if the user has previusly filled in the frm. Applies t the native Andrid brwser t allw r prevent the brwser frm running JavaScript cde fr a web site. Applies t the native Andrid brwser t frce the brwser t shw an untrusted certificate security warning t the user when applicable 5. Select Save & Publish. 12

13 Enable Per App VPN fr Knx Cntainer Applicatins A virtual private netwrk (VPN) cnnectin prvides devices a secure and encrypted tunnel t an internal netwrk, effectively allwing each device t functin as seamlessly as if they were using the netwrk n-site. Fr Samsung Knx enabled devices, cnfiguring Per App VPN fr cntainer applicatins secures the netwrk traffic specifically fr thse applicatins inside the Knx cntainer. 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the VPN paylad. 5. Cnfigure the VPN prfile as desired. These text bxes defined in the table vary depending n the Client Type selected frm the Cnnectin Inf sectin. This table details all cnfiguratins available. Client Type Cnnectin Name Server Enfrce Service Validatin Server Suffix Use Authenticatin Determine the VPN prvider. Cnnectin Inf Enter the name f the cnnectin displayed n the device. Specify the Hstname r IP address fr the server. Establish trust relatinship between server and device. Designate the dmain in which the authenticating server must belng. Authenticatin Enable this text bx t require user credentials fr VPN access. The selected Client Type determines applicable text bxes displayed in this sectin. The fllwing text bxes displays upn selectin: Username Enter the username users are required t enter at setup. Passwrd Enter a passwrd prvided t users. Cnnectin Type Identity Certificate Select the type f certificate used t authenticate the VPN. Us e the drp dwn t select the credentials fr authenticating the cnnectin. 13

14 Rt Certificate Enable Advanced Cnfiguratins Backup Server Name Default Rute Enabled IKE Versin Dead Peer Detectin PFS Exchange Suite B Phase 1 Mde DH Grup Split Tunnel Type Frward Rutes Authenticatin Type Prxy Type PAC URL Server Prt Username Passwrd Specify the trust certificate authrity. Advanced Select the check bx t display mre ptins t cnfigurable yur VPN prfile based n the selected client type. Enter the name f the server t cnnect t in the event the primary VPN gateway fails. Enable t ensure that all netwrk traffic ges thrugh the tunnel. Internet Key Exchange (IKE) prtcl versin fr setting up security assciatin. Enable dead peer detectin t allw the KeyVPN client t detect a dead IKE peer. PFS Exchange (Perfect Frward Secrecy) t be enabled if the sessin key shuld be prtected. Use Suite B cryptgraphy fr cnnecting t VPN fr higher security. Sets up a secure tunnel t authenticate and secure the IKE tunnel. (Diffie-Hellman (DH) Grup) Sets the key strength used in phase 1 during key exchange. The higher the grup number, the mre secure the key exchange. Yu can select Default r a specific DH grup: 1, 2, 5, 14, 15, 16, 17, 18, and 24. Allw/disallw VPN user t access a public netwrk and a lcal WAN/LAN at the same time using the same physical netwrk. Enter an alternate destinatin fr the split tunnel t be directed. This text bx nly displayd if Split Tunnel Type is set t Manual. Select the authenticatin types t be used with enterprise applicatins as certificate based r CAC based. Prxy Select whether the prxy cnnects by Static Prxy r Prxy Aut Cnfiguratin This text bxdisplays when Prxy Aut Cnfiguratin is selected frm the Prxy Type text bx. Enter the Hst name f IP address fr the prxy server. Specify the target prt fr the prxy server. Enter user credentials. Enter user credentials. 14

15 Assignment Assignment Level Select the assignment level as All Cntainer Applicatins r Individual Applicatins. Fr Individual Applicatins, enter the applicatin package name (app identifier) fr the apps yu want t have app level VPN. Examples include: Cntainer applicatin sec_cntainer_1.airwatch client.xxx Applicatin utside the cntainer cm.airwatch.andridagent Lgs and Warnings Enable Debug Lgging Shw Warnings Include mre detailed infrmatin in the diagnstics reprts fr trubleshting. Shw message in case f cnnectivity prblems r when server name can nt be reslved. 6. Select Save & Publish. Activate s (Knx) Yu can cnfigure settings externally frm Exchange Active Sync (EAS) by deplying an s prfile paylad. 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the paylad. 5. Cnfigure the settings: Accunt Address Sender s Name Signature Set As Default Accunt Allw Frwarding Define hw the accunt is labeled in the mail client. Enter the address used fr the accunt. Specify hw the sender's name appears. Determine the default signature that appears n all utging s. Set the specified as the primary accunt. Allw end-users t share frwarded cntent and HTML . 15

16 Use SSL Prtcl Hst Name Prt Username Passwrd Ignre SSL Errrs Use SSL Prtcl Hst Name Prt Username Passwrd Ignre SSL Errrs Incming Mail Enable t encrypt EAS data. Set which server the client uses t receive and send s. Enter the hstname r IP address fr the server. Set the prt number. Define the Username fr the authenticatin credentials using lkup values Leave the Passwrdblank t allw end-users t set their wn passwrd. Enable t ignre certificate errrs. Outging Mail Enable t encrypt EAS data. Set which server the client uses t receive and send s. Enter the hstname r IP address fr the server. Set the prt number. Define the Username fr the authenticatin credentials using lkup values Leave the Passwrdblank t allw end-users t set their wn passwrd. Enable t ignre certificate errrs. 6. Select Save & Publish. Cnfigure Exchange Active Sync Mail Client (Knx) T guarantee a secure cnnectin t internal , calendars, and cntacts, AirWatch uses the native client t access EAS mail frm the crprate cntainer n Knx devices. Once each user has an address and user name yu can create an EAS prfile with the fllwing steps: 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the Exchange ActiveSync (EAS) paylad. 5. Enter the Exchange Active s: Mail Client Select the native client t be used n the device frm the drp-dwn menu. 16

17 Accunt Name Exchange Active Sync Hst Dmain User Address Passwrd Path Prefix Identity Certificate Past Days f Mail t Sync Sync Interval Sync Schedule fr Raming Retrieval Size Perid Calendar Accept Certificates Enable HTML Allw Frwarding Signature Peak Days Peak Start Time Peak End Time Sync Schedule Peak Use SSL Always Vibrate On Ntificatin Default Accunt Enter a label fr the accunt. Enter the public hst name fr the server. Lgin Infrmatin Use lkup values t define the dmain fr authenticatin credentials. Use lkup values t define the user fr authenticatin credentials. Use lkup values t define the address fr authenticatin credentials. Leave this text bx blank t allw end-users t create their wn passwrd. Enter yur path prefix. Select an Identity Certificate frm the drp-dwn if yu require the end-user t pass a certificate t cnnect t the Exchange ActiveSync, therwise selectnne (default). s Specify the number f past days f mail t sync. Set t define hw ften EAS Mail Sync ccurs. Determine the sync frequency while raming using the drp-dwn menu Indicate the maximum size that is autmatically delivered t yur device withut having t dwnlad the message. Select frequency frm the drp-dwn menu. Enable t allw certificates fr authenticatin. Enable t allw HTML frmatted s. Enable t allw s t be frwarded. Enter a default signature that displays n utging s. Peak Days fr Sync Schedule Schedule peak days fr sync schedule. Determine the hur the peak time starts. Determine the hur the peak time ends. Select the time t sync schedule settings. Enable SSL t encrypt EAS data enable Enable t set the alert ptin fr ntificatins. Assign the EAS accunt as the default fr sending messages. 17

18 6. Select Save & Publish. Cnfigure Single Sign-On (Knx) Single Sign-n (SSO) allws yur emplyees t mve frm applicatin t applicatin within the cntainer withut the hassle f repetitively signing in. 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the Single Sign-On paylad. 5. Cnfigure the Bkmarks settings, including: Single Sign-On Vendr Select yur SSO vendr frm the drp-dwn menu. Cmpany Name Icn Custmer ID SSO Applicatins 6. Select Save & Publish. Prvide a cmpany name. Uplad an icn. Prvide a frm f identificatin. Select Add t add applicatins that are included with SSO Deply Credentials (Knx) Credentials prfiles deply crprate certificates fr user authenticatin t managed devices. T deply a credentials prfile: 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the Credentials paylad. 5. Cnfigure the Credentials settings: 18

19 Enable TIMA Keystre Credential Surce Credential Name Stres all certificates sent t the Knx cntainer in the TIMA Key Stre, if enabled. Enter the surce f yur credential. When yu cnfigure Credential Surce, the remaining text bxes are surce-dependent. If yu select Uplad, yu must enter a Credential Name and uplad a new certificate. If yu select Defined Certificate Authrity, yu must chse a predefined Certificate Authrity and Template. If yu select User Certificate,select an S/MIME certificate r S/MIME Encryptin Certificate. Enter the name f the credential. Certificate Select the certificate used fr authenticatin. 6. Select Save & Publish. Cnfigure Applicatin Cntrl (Knx) Set parameters arund yur applicatin deplyments n devices by Preventing Installatin f Blacklisted Apps and Only Allwing installatin f Whitelisted Apps. 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer t deply yur prfile t a cntainer within a Samsung Knx device. 3. Cnfigure the General prfile settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the Applicatin Cntrl paylad. 5. Enable r disable the fllwing settings t set the level f cntrl fr yur applicatin deplyments: Prevent Installatin f Blacklisted Apps Only Allw installatin f Whitelisted Apps Prevent Un-installatin f Required Apps Enable t prevent blacklisted apps and enfrce the autmatic remval f these apps defined in Applicatin Grups. Enable t prevent the installatin f any applicatin that is nt a whitelisted app defined in Applicatins Grups. Enable t prevent the un-installatin f required apps defined in Applicatins Grups. This ptin is nly available fr Knx 2.0 r higher. T find ut mre abut Applicatin Grups, see Applicatin Grups n page Select Save. 19

20 Applicatin Grups Applicatin Grups lets yu grup applicatins int blacklisted, whitelisted, and required applicatins. Use applicatin grups t give access t desired users and t restrict access t unnecessary users. Using the AirWatch Cnsle yu can ensure users have access t the apprpriate applicatins based n their rganizatinal rles. 1. Navigate t Apps & Bks > Applicatins > Applicatins s > App Grups. 2. Select Add Grup. List tab: Select Type as Whitelist, Blacklist, Required r MDM Applicatin. On selecting the Type, the Name field gets autmatically ppulated. Imprtant: Select MDM Applicatin fr custm MDM applicatins. Select applicable Platfrm. Imprtant: Selecting Windws Phne 8.1 remves the Assignment tab, displays an ptin t Add Publishers, and prevents the ability t create cmpliance plicies fr this applicatin grup. Enter the Applicatin Name and the Applicatin ID. The Applicatin ID autmatically cmpletes when yu use the search functin t search fr the app frm an app stre. Select Add Applicatin t add multiple applicatins and then select Next t navigate t the Assignment tab. Add exceptins t yur applicatin grup t create detailed whitelists and blacklists. Select Add Publisher fr Windws Phne 8.1 t add multiple publishers t applicatin grups. Publishers are rganizatins that create applicatins. Cmbine this ptin with Add Applicatin entries and exceptins t create detailed whitelists and blacklists fr yur Windws Phne 8 applicatins. Select Next t navigate t an applicatin cntrl prfile. Yu must cmplete and apply an applicatin cntrl prfile fr Windws Phne 8.1. Assignment tab: Enter a fr the applicatin grup. Define the Device Ownership as Crprate-Dedicated, Crprate-Shared, Emplyee Owned, r Undefined. Assign the device Mdel and the Operating System. Select the Organizatin Grup and User Grup fr the applicatin grup t be assigned t and then select Finish t cmplete the prcess. Yu must add and apply an Applicatin Cntrl prfile fr Andrid and Windws Phne 8.1 applicatin grups. See the applicable platfrm guide fr mre details. 20

21 Implement Smart Card Authenticatin (Knx) Yu can require end-user identity verificatin using SmartCard authenticatin fr brwser and access. End-users wh try t authenticate withut a Smart Card after this feature is enabled, cannt access their Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the SmartCard paylad. 5. Enable Require SmartCard Authenticatin fr and Require SmartCard Authenticatin fr Brwser. Enter lkup values fr the Addressrequired fr SmartCard authenticatin. 6. Select Save & Publish. Cnfigure Firewall Rules The Firewall paylad allws admins t cnfigure firewall rules within the Knx cntainer. The available rules are: Allw, Deny, Rerute. Each firewall rule type allws yu t add multiple rules. 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the Firewall tab. 5. Select the Add buttn under the desired rule t cnfigure the setting: s Allw Rules Deny Rules Rerute Rules Allws the device t send and receive frm a specific netwrk lcatin. Blcks the device frm sending and receiving traffic frm a specific netwrk lcatin. Redirects traffic frm a specific netwrk lcatin t an alternate netwrk. 6. Select Save & Publish. Set Restrictins (Knx) Prevent data leaks by enabling listed restrictins in the Knx cntainer. 21

22 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the Restrictins paylad. 5. Enable r disable the Device Functinality settings: Allw Camera Allw Vide Recrding if Micrphne is Allwed Allw Micrphne Allw Audi Recrding if Micrphne is Allwed Allw Display f Share Via List Frce Secure Keypad Usage Allw Cntact Inf Outside the Cntainer Allw Accunt Additin Allw Ggle Accunt Activatin Allw Screen Capture Enable t allw users t use their camera inside the Knx cntainer. If Allw Camera has been turned ff fr the device side, then the camera will be disabled fr all the cntainers and users created n the device. Enable which allws vide recrding within the Knx cntainer. Enable t allw use f the micrphne inside the Knx cntainer. If Allw Micrphne has been turned ff fr the device side, then the micrphne will be disabled fr all the cntainers and users created n the device. Enable t give users access t audi recrding. Disable t prevent yur end-users frm accessing their share ptins fr sensitive cntent. Enable t prevent end-users frm dwnlading and using third-party keybard applicatins. Enable t allw cntact infrmatin frm the cntainer t sync with persnal cntact infrmatin. Enable t allw users the ability add new accunts within the Knx cntainer. Enable t let users activate their Ggle accunt inside the Knx cntainer. Disable t prevent users frm taking screenshts inside the Knx cntainer. 22

23 Enable Allw Clipbard Allw Wallpaper Change Allw Hme Key Allw Pwer Key Allw Status Bar Expansin Allw Mck Lcatins Allw Bluetth Enfrce Cntainer Keyguard Enable ODE Trusted Bt Verificatin Prevent New Admin Activatin Set Cmmn Criteria CC Mde Enable Applicatin Mve Enable File Mve Enable OCSP Check Enable t give users the ability t cpy cntent t their clipbard. The Allw Clipbard plicy nly takes effect ver native Andrid clipbard. Enable t allw users the ability t custmize the wallpaper within the Knx cntainer. Disable t prevent hme key functinality such as lng press t display recently pened applicatins. Fr devices running KNOXv2.3+, Allw Hme Key applies t Cntainer Only Mde Disable t prevent the user frm turning ff the device by pressing the pwer buttn. Fr devices running KNOXv2.3+, Allw Pwer Off applies t Cntainer Only Mde Enable t give users access t the cntrls lcated in the ntificatin tray. The ntificatins and cntrls are visible even if the feature is disabled. Fr devices running KNOXv2.3+, Allw Status Bar Expansin applies t Cntainer Only Mde Enable t allw users t change their lngitude and latitude in the GPS applicatin t shw false crdinates. Enable t allw Bluetth inside the Knx cntainer. Security Enable t require authenticatin t enter the Knx cntainer. Enable t allw device access t the decrypted data partitin nly when the binary and kernel is fficial. Enable t prevent activatin f anther administratr applicatin unless the applicatin is part f the whitelisted applicatins. Enable t allw the device t be placed in the cmmn criteria cnfiguratin. T enable Set Cmmn Criteria CC Mde, admins have t enable t prerequisite plicies: Enable Device Encryptin, Enable SD Card Encryptin, and Number f attempts befre device wipe. Disable t prevent apps frm being installed inside the Knx cntainer. Disable t prevent files frm being mved inside the Knx cntainer. Turn n t allw use f OCSP during certificate revcatin fr applicatin SSL cnnectins. 23

24 Allw Ggle Crash Reprt Allw S Vice Allw User t Stp System Signed Applicatins Blck Nn- Trusted Applicatin Installatin Allw GMS Applicatins in Cntainer Allw Ggle Accunts Aut Sync Allw Change Data Sync Plicy Allw SD Card Mve Allw s Change Allw Reset Cntainer n Rebt Applicatin Enable t allw crash reprts t be sent t Ggle. Enable s users can run the S Vice applicatin which allws the use f wake-up cmmands. Disable t prevent users frm the frce stp buttn fr system applicatins inside the Knx cntainer. Enable t blck all applicatins that are nt identified as Trusted. Enable t allw Ggle Service applicatins t be dwnladed inside the Knx cntainer. Sync and Strage Enable which lets Ggle accunts autmatically sync within the Knx cntainer. Enable t allw users t change Data Sync plicies specific t applicatins. Fr devices running Knx v2.3+, Allw Change Data Sync Plicy will always enable ntificatin sanitizatin fr the app nly, in case f MDFPP(Mbile Device Fundamentals Prtectin Prfile) SDP enabled cntainer. Disable t stp users frm mving applicatins t the SD card. Hardware Disable t prevent users frm changing settings r system preferences within the Knx cntainer. Enable t allw user t reset the Knx cntainer after restart. 6. Select Save & Publish. Cmmn Criteria (CC) Mde (Knx) Cmmn Criteria (CC) Mde internatinal standard fr defining security requirements fr IT prducts and t assess vendr cmpliance with these requirements. The current CC certificatin targets the new Mbile Device Fundamentals Prtectin Prfile (MDFPP) f the Natinal Infrmatin Assurance Partnership (NIAP), which addresses the security requirements f mbile devices fr use in 24

25 business. Samsung Knx is apprved by the United States gvernment as the first NIAP-validated cnsumer mbile devices t handle the full range f classified infrmatin. An administratr can enable the device t be placed int the Cmmn Criteria cnfiguratin. When enabled, btlader will blck KIES dwnlad mde, enfrce t check integrity f kernel, and self-test crypt-mdules. In additin, device will verify additinal signature n FOTA update using RSA-PSS signature and enfrce t use FIPS validated crypt mdule fr EAP-TLS Wi-Fi cnnectin. T fully enable Cmmn Criteria-evaluated cnfiguratin, belw prerequisites shuld be satisfied: Strage Encryptin shuld be enabled n the Device Passcde prfile. This means a full encryptin f the device - Fast Encryptin ptin will nt wrk. SD Card Encryptin shuld be enabled. Maximum Number f Failed Attempts shuld be cnfigured t a value f 10 r fewer n the Device Passcde prfile. Passcde Histry must be set t zer n the device passcde prfile. Create Custm s (Knx) The Custm s prfile can be used when new Knx functinality r features that the AirWatch Cnsle des nt currently supprt r if there are any custm device changes yu want implemented. T create custm settings: 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Cnfigure the apprpriate paylad (fr example, Restrictins r Passcde). Yu can wrk n a cpy f yur prfile, saved under a "test" rganizatin grup, t avid affecting ther users befre yu are ready t Save and Publish. 5. Save, but d nt publish, yur prfile. 6. Select the radi buttn frm the Prfiles List View fr the rw f the prfile yu want t custmize. 7. Select the XML buttn at the tp t view the prfile XML. 8. Find the sectin f text starting with <dict>... </dict> that yu cnfigured previusly, fr example, Restrictins r Passcde. The sectin cntains a cnfiguratin type identifying its purpse, fr example, restrictins. 9. Cpy this sectin f text and clse the XML View. Open yur prfile. 10. Select the Custm s paylad and select Cnfigure. Paste the XML yu cpied in the text bx. The XML cde yu paste needs t cntain the cmplete blck f cde, frm <dict> t </dict>. 11. Remve the riginal paylad yu cnfigured by selecting the base paylad sectin and selecting the minus [-] buttn. 25

26 Yu can nw enhance the prfile by adding custm XML cde fr the new functinality. Imprtant: Any device nt upgraded t the latest versin ignres the enhancements yu create. Test the prfile devices with lder versins t verify expected behavir. 12. Select Save & Publish. Bkmarks (Knx) Bkmarks are particularly useful fr easy navigatin t extended URLs with a large amunt f characters. Bkmark icns can be placed n an end user's springbard directly next t the app. These icns can be used t cnnect t internal cntent repsitries r lgin screens withut having t pen a brwser and type ut a lng URL. Deply Bkmarks Bkmarks functin much like an app n a device, prviding end users a simple way t access a URL directly frm an icn n their device's menu. The end-user sees the bkmark icn and title, selects the bkmark and cnnects directly t a specified URL. 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid 2. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 3. Select the Bkmarks paylad. 4. Cnfigure the Bkmarks settings, including: Label URL Icn Prvide the name that appears n the device menu. Specify the link destinatin that the user is brught t upn selecting the Bkmark. Add an image fr the bkmark as it appears n the device menu. 5. Select Save & Publish. Set Date/Time (Knx) Set the date and time and the display frmat t prvide yur fleet with the apprpriate reginal frmat. 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Cntainer. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 26

27 4. Select the Date/Time paylad. 5. Cnfigure the Date/Time settings, including: Date Frmat Determine the rder that the Mnth, Day, and Year displays. Time Frmat Chse 12 r 24 Hurs. 6. Select Save & Publish. 27

28 Chapter 3: Samsung Knx Cntainer Management Knx Management Overview 29 Knx Cntainer Passcde Management 29 Audit Lgs 29 28

29 Chapter 3: Samsung Knx Cntainer Management Knx Management Overview After yur devices are enrlled and cnfigured, manage the devices using the AirWatch Cnsle. The management tls and functins enable yu t keep an eye n yur devices and remtely perfrm administrative functins. Yu can manage all yur devices frm the VMware AirWatch Dashbard. The Dashbard is a searchable, custmizable view that yu can use t filter and find specific devices. This feature makes it easier t perfrm administrative functins n a particular set f devices. The Device List View displays all the devices currently enrlled in yur AirWatch envirnment and their status. The Device Details page prvides device-specific infrmatin such as prfiles, apps, AirWatch Agent versin and which versin f any applicable OEM service currently installed n the device. Yu can als perfrm remte actins n the device frm the Device Details page that are platfrm-specific. Knx Cntainer Passcde Management Once a passcde is set fr the cntainer, yu have the ability t clear r change the passcde frm the Details View page f the AirWatch Cnsle. Once the minimum passcde requirement is set in the passcde prfile, users have t create the passcde nce while enrlling their devices. Select the desired device in the list view and select Mre t access the management ptins. Cntainer Change Cntainer Passcde Clear Passcde Allws yu t clear the passcde frm the Knx cntainer. If yu clear r change the Knx cntainer passcde, the device passcde settings are nt affected. Management Gives the user the ability t reset their Knx cntainer passcde. This cmmand is available fr devices running Knx v2.1 and belw. Audit Lgs The AirWatch Cnsle has the ability t mnitr errrs that might prevent successful creatin f the Knx cntainer. The lg prvides the cause f the errr and what needs t be reslved fr successful Knx deplyment. 29

30 Chapter 3: Samsung Knx Cntainer Management The audit lgs are sent t the AirWatch Cnsle frm the Knx enabled devices and stred in the Device Details page. The Transmits Lgs Autmatically setting determines the threshld at which the lg file is reprted t the device details. Cnfigure Audit Lgs Befre yu can btain audit lgs fr Samsung Knx, yu must first cnfigure the feature in the AirWatch Cnsle. 1. Navigate t Grups & s > All s > Devices &Users > Andrid > Agent s t cnfigure the audit lgs. 2. Select Enable Audit Lgging under Samsung Knx. 3. Set parameters fr retrieving the audit lgs: Lgging Level Determines hw severe an errr has t be in rder fr it t be sent t the lg file. The lgging levels are listed in rder r severity where Ntice is the least severe and Alert is the mst severe. The lg levels are: Alert Critical Errr Warning Ntice 4. Set the minimum level (in percentage) f the lg files that are sent t the AirWatch Cnsle. The fllwing text bxes determine hw frequent the lg files are sent: Critical Lg Size Enter a percentage (up t 70 percent) t define the critical lg size. When the lg file passes this percentage, a critical lg size alert is sent t the admin. Maximum Lg Size Enter a percentage (up t 90 percent) t define the maximum lg size. When the lg file passes this percentage, a maximum lg size alert is sent t the admin. Full Lg size Set t 97 percent by default. When the lg file reaches this percentage, a full lg size alert is sent t the admin and immediate actin is required. Imprtant: Critical Lg Size and Maximum Lg Size are cnfigurable. Full Lg Size is required t be set at 97%. 5. Set when the lg files are autmatically transmitted t the AirWatch Cnsle: Transmits Lgs Autmatically Determines when the audit lgs are t be transmitted t the AirWatch Cnsle t ntify the admins f errrs: Never The lg file is never transmitted t the cnsle. Critical The lg file needs be at critical size t be transmitted t the cnsle. Maximum The lg file needs be at maximum size t be transmitted t the cnsle. Full The lg file needs be at full size t be transmitted t the cnsle. 30

31 Chapter 3: Samsung Knx Cntainer Management 6. Select Save. 7. Navigate t Devices > List View > Select desired device > Mre > Attachments > Dcuments t view the lg files. 31

32 Chapter 4: Samsung Knx fr the End User Knx fr the End User Overview 33 Create Knx Cntainer n a Device 33 User Interface 33 32

33 Chapter 4: Samsung Knx fr the End User Knx fr the End User Overview This sectin shws yu hw end users create the Knx cntainer n their devices as well as hw the user's interface will lk between the persnal cntainer and the Knx cntainer. If during enrllment f the device the device wnership has been set t Crprate-dedicated, there will be n dual persna n the device meaning n persnal and business cntainer. The device will be lcked int Cntainer Mde fr Knx functinality nly. If the default wnership is designated t be Crprate Dedicated then the cntainer will be created in Cntainer Only Mde. Create Knx Cntainer n a Device End users have t simply walk thrugh device enrllment t create the Knx Cntainer n their device. 1. Enrll the device using the AirWatch Agent. 2. Tap Activate n the AirWatch Samsung Service installatin screen. A pp-up displays shwing that the Knx License Key has been accepted. 3. Accept the Terms and Cnditins f the Knx applicatin 4. Tap Cnfirm n the Knx Privacy Plicy. 5. Tap the Dwnlad Samsung Knx buttn. The Knx applicatin dwnlads. 6. Start Knx by tapping the push ntificatin in the ntificatin tray r by tapping n the Knx widget n yur hme screen. 7. Fllw the prmpts t finish the device enrllment prcess. User Interface The Knx cntainer is aut-cnfigured upn selectin. This ne-time cnfiguratin can be expanded with mre cntainer prfiles. When cmplete, yu can access crprate cnfiguratins frm Knx Hme. All Applicatins and data inside the Knx cntainer are islated frm applicatins lcated in the persnal cntainer. If users unenrll their device frm the AirWatch Agent, that remves Knx frm their device. While Knx is installing, users are prmpted t set the Knx passwrd and passwrd timeut. The Knx cntainer nly requires the passcde setup fr activatin. Other settings cme dwn with the passcde prfile. The passwrd and timeut settings can be changed r reset frm the AirWatch Cnsle. Uers cannt create the Knx cntainer withut cmpleting this step. The passwrd timeut determines hw lng Knx can be inactive befre the user is required t enter the passwrd t pen Knx. Users are als prmpted t set a backup pin if they are using the fingerprint passcde setting. The backup pin setting is a Samsung requirement and cannt be changed by AirWatch.e Knx cntainer prvides a separate Andrid envirnment within the mbile device, cmplete with its wn hme screen, launcher applicatins, and widgets. Here are sme tips n features and actins end users may perfrm frm their device: Users can add shrtcuts t their Knx applicatins n their persnal cntainer. Tapping the Knx applicatin shrtcut pens the applicatin in the Knx cntainer. The Knx cntainer passcde and timeut rules still applies. 33

34 Chapter 4: Samsung Knx fr the End User Users are ntified f Knx messages r frm the ntificatin tray while they are using their device as a persnal device. Tapping a ntificatin frm the tray starts the Knx cntainer. End-users return t the persnal cntainer by tapping the Persnal hme icn within the Knx cntainer. 34

35 Accessing Other Dcuments Accessing Other Dcuments While reading this dcumentatin yu may encunter references t dcuments that are nt included here. The quickest and easiest way t find a particular dcument is t navigate t and search fr the dcument yu need. Each release-specific dcument has a link t its PDF cpy n AirWatch Resurces. Alternatively, yu can navigate t AirWatch Resurces n myairwatch (resurces.air-watch.cm) and search. When searching fr dcumentatin n Resurces, be sure t select yur AirWatch versin. Yu can use the filters t srt by PDF file type and AirWatch v