Default Policy Settings

Size: px

Start display at page:

Download "Default Policy Settings"

Edgar Morton
6 years ago
Views:

1 Default Policy Settings This chart documents the default settings of the entire NotifyMDM policy suite for each security level available in the Create New Policy Suite Wizard. It can also be used as a template for planning any customizations to your policy suites. Print two charts - one for planning a policy suite for corporate liable devices and one for planning a policy suite for individual liable devices. Select a security level to start with and then mark the rules you want to customize. Policy Low Level Moderate Level Strict Level High Level Audit Tracking: General Archive device file list Send file list frequency (in days) Record phone log Record text message log Record installed applications Record managed applications Audit Tracking: Location Tracking Record location of device GPS Location accuracy X 1 X 1 X 3 X 5 Device Control: Device Features NotifyMDM Default Policy Settings 1

2 Allow Bluetooth Allow browser Allow camera Allow GPS Allow Infrared Allow internet sharing from the device Allow NFC Allow remote desktop Allow SD card Allow synchronization from a desktop Allow text messaging Allow USB Allow Wi-Fi Policy Low Level Moderate Level Strict Level High Level Allow user to remove enrollment (Individual) Allow user to remove enrollment (Corporate) Initiate Selective Wipe when user removes MDM app account Allow Screen Capture Disable Fingerprint Device Control: Allow HTML formatted Maximum HTML body truncation size (in KB) Allowed Allowed Handsfree only Disabled No Max No Max No Max No Max Allow consumer Allow POP/IMAP Maximum plain text body truncation size No Max No Max No Max No Max (in KB) NotifyMDM Default Policy Settings 2

3 Device Control: ActiveSync Synchronization Maximum calendar age for synchronization (All Days) (3 months) (3 months) (3 months) Specific Calendar Age for Synchronization (Not Set) (Not Set) (Not Set) (Not Set) Maximum age for synchronization (Sync All) (1 month) (2 weeks) (1 week) Specific Age for Synchronization (Not Set) (Not Set) (Not Set) (Not Set) Require manual sync when roaming Device Control: Applications Allow Copy and Paste Allow Unsigned Applications Allow Unsigned Package Installation File Share Permissions ios Devices: Device Features Allow explicit content Allow FaceTime (prerequisite: Allow Camera) Allow Fingerprint for Unlock Allow Game Center Allow adding Game Center friends Allow multiplayer gaming Allow Global Background Fetch while roaming Allow Lock Screen Control Center Allow Lock Screen Notification View Allow Lock Screen Today View Allow Over-the-Air PKI Updates Allow Passbook while device locked NotifyMDM Default Policy Settings 3

4 Allow screenshot Allow Siri Allow Siri while device locked Enable Siri profanity filter (prerequisite: Allow Siri) Allow voice dialing (prerequisite: Require Password) Force encrypted backup Force itunes Store Password Entry Force Limited Ad Tracking Force Unmanaged Air Drop Force Watch Wrist Detection ios Devices: Applications Allow App Management Allow Activity Continuation Allow App Store Allow managed applications installation Allow Bookstore Allow Bookstore erotica (prerequisite: Allow Bookstore) Allow Enterprise Books Backup Allow Enterprise Books Metadata Backup Allow in app purchases Allow itunes Allow Managed App Documents to Open Unmanaged Apps Allow Unmanaged App Documents to Open NotifyMDM Default Policy Settings 4

5 Managed Apps Policy Low Level Moderate Level Strict Level High Level Record Installed Applications Force pairing password for outgoing AirPlay requests ios Devices: Safari Browser Allow Safari (prerequisite: Allow Browser) Accept cookies Always Always From visited sites Never Allow Auto-fill Allow JavaScript Block Pop-ups Force fraud warning ios Devices: Ratings Rating region US US US US Application ratings Allow All Apps Movie ratings Allow All Movies PG-13 Don t Allow Movies TV show ratings ios Devices: Security Allow All TV Shows TV-14 Don t Allow TV Shows Allow Untrusted TLS Prompt Allow Diagnostic Submission Text Managed Domains Don t Allow Movies Don t Allow TV Shows Managed Domains Blank Blank Blank Blank Managed Safari Domains Blank Blank Blank Blank ios Devices: icloud Allow icloud backup Allow ICloud Keychain Sync NotifyMDM Default Policy Settings 5

6 Allow icloud Photo Library Y Y Y Y Allow document sync Allow managed apps cloud sync Allow Photo Stream Allow Shared Photo Streams ios Devices: Management Allow Management of Settings Allow Voice Roaming Allow Data Roaming Enable Personal Hotspot (Corporate) Enable Personal Hotspot (Individual) ios Devices: Supervised Mode Allow Account Modification Allow Activation Lock Allow AirDrop Allow App Cellular Data Modification Allow App Removal Allow Assistant User Generated Content X X X x Allow Auto Correction Allow Automatic App Downloads Allow Configuration Profile Installation Allow Definition Lookup Allow Device Name Modification Allow Enterprise App Trust Allow Find My Friends Modification NotifyMDM Default Policy Settings 6

7 Allow Full Wipe via Device Allow Host Pairing Allow imessage Allow Keyboard Shortcuts Allow Paired Watch Allow Passcode Modification Allow Predictive Keyboard Allow Spell Check Allow Spotlight Results Allow user to change restrictions Allow Wallpaper Modification Global HTTP Proxy X Blank X Blank X Blank X Blank Content Filter Filter Type Grayed out Grayed out Grayed out Grayed out Auto Filter Inappropriate Web Sites Permitted URLs Blank Blank Blank Blank Blacklisted URLs Blank Blank Blank Blank Whitelisted Bookmarks Blank Blank Blank Blank Single App Mode X Blank X Blank X Blank X Blank Single App Mode: Disable Touch Screen Single App Mode: Disable Device Rotation Single App Mode: Disable Volume Buttons Single App Mode: Disable Ringer Switch Single App Mode: Disable Sleep/Wake Button Single App Mode: Disable AutoLock Single App Mode: Enable VoiceOver NotifyMDM Default Policy Settings 7

8 Single App Mode: Allow VoiceOver Adjustments Single App Mode: Enable Zoom Single App Mode: Allow Zoom Adjustments Single App Mode: Enable Invert Colors Single App Mode: Allow Invert Colors Adjustments Single App Mode: Enable AssistiveTouch Single App Mode: Allow AssistiveTouch Adjustments Single App Mode: Enable Speak Selection Single App Mode: Enable Mono Audio Resource Control Allow ActiveSync Allow File Share Allow Managed Apps Provision Managed Profile Samsung KNOX Device Policies: Alternative Home Screen Enable Alternative Home Screen Allow Hardware Keys Allow Back Button Allow Home Button Allow Menu Button Allow Power Button Allow Volume Button NotifyMDM Default Policy Settings 8

9 Allow Multi Window Mode Allow Navigation Bar Allow Status Bar Allow System Bar Allow Task Manager Samsung KNOX Device Policies: Applications Allow Google Play Allow Settings Allow YouTube Samsung KNOX Device Policies: Browser Policy HTTP Proxy Samsung KNOX Device Policies: Device Features Allow Access to Clipboard Allow Sharing Clipboard Between Applications Allow Audio Recording Allow Cellular Data Allow Developers Mode Allow background process limit Allow killing activities one leave Allow USB debugging Allow using mock locations Allow Factory Reset Allow installation of applications from sources other than Google Play NotifyMDM Default Policy Settings 9

10 Allow installation of non-trusted apps Allow Microphone Allow MTP Allow NFC Allow OTA Upgrade Allow Safe Mode Allow Screen Capture Allow SD Card Allow Tethering Allow USB-Host-Storage Allow Video Recording Samsung KNOX Device Policies: Policy Allow Account Addition Samsung KNOX Device Policies: Kiosk Mode Kiosk Mode Blank Blank Blank Blank Samsung KNOX Device Policies: Password Maximum character sequence length Maximum occurrences of a character in a password Minimum character change length Minimum password length Maximum numeric sequence length Minimum number of complex characters Set forbidden string permissions Minimum password length NotifyMDM Default Policy Settings 10

11 Allow occurrence of username in password Allow occurrence of in password Forbidden password strings Blank Blank Blank Blank Enable password visibility Enable password pattern visibility Define password pattern (Corporate) Blank Blank Blank Blank Define password pattern (Individual) Blank Blank Blank Blank Require password change timeout Maximum password change timeout-in minutes Disable device on filed password attempts Maximum number of attempts Samsung KNOX Device Policies: Roaming Allow Data while roaming Allow Push while roaming Allow Sync while roaming Allow Voice calls while roaming Samsung KNOX Workspace Policies Create KNOX Workspace Container Samsung KNOX Workspace Policies: Policy Allow Account Addition Samsung KNOX Workspace Policies: Password Minimum password length Maximum character sequence length NotifyMDM Default Policy Settings 11

12 Maximum occurrences of a character in a password Minimum character change length Minimum password length Maximum numeric sequence length Minimum number of complex characters Set forbidden string permissions Allow occurrence of username in password Allow occurrence of in password Minimum password length Forbidden password strings Blank Blank Blank Blank Enable password visibility Enable password pattern visibility Define password pattern (Corporate) Blank Blank Blank Blank Define password pattern (Individual) Blank Blank Blank Blank Require password change timeout Maximum password change timeout-in minutes Disable device on failed password attempts Maximum number of attempts Require device password expiration Password expiration in days Require device password history Number of passwords stored Samsung KNOX Workspace Policies: Restrictions Allow camera NotifyMDM Default Policy Settings 12

13 Allow share list Use secure keypad Security Settings: Password Require Device Password Require TouchDown PIN Enable password recovery Allow simple password Require minimum password length Minimum password length Require complex password Require alphanumeric password Minimum number of complex characters 1 if enabled Require alphabetic password Require numeric password Require biometric password Require device password expiration Password expiration in days 30 if enabled Require device password history Number of passwords stored 1 if enabled Enable password echo Begin password echo after attempts 5 if enabled 5 if enabled 5 if enabled 5 if enabled Require Numeric Complex Password Security Settings: Encryption Require encryption on the device NotifyMDM Default Policy Settings 13

14 Require encryption on the SD card Security Settings: Device Inactivity and Locking Require max inactivity time device lock Max inactivity timeout (in minutes) 60 if enabled Require device challenge timeout Max device challenge timeout 120 if enabled Enable customizable lock message Customizable lock message Blank Blank Blank Blank Lock message phone number Blank Blank Blank Blank Audible alert on lock Maximum grace period (in minutes) 5 minutes 1 minute 0 (immediately) 0 (immediately) Wipe device on failed number of unlock attempts Maximum number of unlock attempts 4 if enabled Security Settings: Emergency Calls Enable emergency calls when locked Allow dialing of any number Ambulance phone number Fire phone number Police phone number Other phone number SMIME Settings Require signed SMIME messages Require encrypted SMIME messages NotifyMDM Default Policy Settings 14

15 Require signed SMIME algorithm SHA1 SHA1 SHA1 SHA1 Require encryption SMIME algorithm TDES TDES TDES TDES Allow SMIME Encryption algorithm negotiation Do not negotiate Do not negotiate Do not negotiate Do not negotiate Allow SMIME soft certs TouchDown: Installation Allow any server certificate Initiate enrollment Require TouchDown encryption TouchDown: General Allow copy/paste in s Allow easy PIN recovery Allow speak notification option Require TouchDown PIN Show calendar info on notification bar Show info on notification bar Show task info on notification bar Disable Printing Forced SMIME Pin Timeout TouchDown: Signature Allow change signature on device Set signature (Corporate / Individual) TouchDown: Widgets Allow export to third party widgets Links to Security Settings Links to Security Settings Links to Security Settings Links to Security Settings via TouchDown via TouchDown via TouchDown via TouchDown NotifyMDM Default Policy Settings 15

16 Allow TouchDown calendar widget Allow TouchDown widget Allow TouchDown task widget Allow TouchDown universal widget Show widget data when TouchDown is locked TouchDown: Phone Book Phone book fields to copy Assistant Phone Car Phone Computer Phone Department Home Address Home Fax Home Phone Home Phone 2 Location Mobile Phone Note Organization/Company Other Address Other Fax Pager Photo All All All All NotifyMDM Default Policy Settings 16

17 Radio Phone Title Work Address Policy Low Level Moderate Level Strict Level High Level Work Phone Work Phone 2 TouchDown: User Configurable Settings -Calendar Show All-day events in the Calendar Widget Show upcoming events only Enable meeting resource field Show calendar tasks in the Agenda Show overdue tasks in the Agenda Customize the start and end days for the week First day of a week to show in Calendar Monday Monday Monday Monday Last day of a week to show in Calendar Friday Friday Friday Friday Start time of the work day 8:00 8:00 8:00 8:00 End time of the work day 17:00 17:00 17:00 17:00 Default reminder for each new event 3 days 3 days 3 days 3 days Default privacy status for each new event Normal Normal Normal Normal Default availability status for each new event Busy Busy Busy Busy Calendar zoom size TouchDown: User Configurable Settings - Device Control Show a compact PIN screen (NEW 7.1) Default theme (NEW 7.1) Basic Basic Basic Basic TouchDown: NotifyMDM Default Policy Settings 17

18 User Configurable Settings - Enable selectors Show summary Highlight senders Enable search as you type Automatically download embedded images Enable move to any folder option Highlight unread messages Enable preview attachments option Always expand folders Enable confirm deletes prompt Enable confirm move prompt Toolbar mode Always show Always show Always show Always show After delete go to Next Next Next Next Enable alerts at non-peak times Confirm move to Junk prompt TouchDown: User Configurable Settings - Synchronization Enable push mode Off-peak polling interval TouchDown: Suppressions Suppression Configuration Custom Custom Custom Custom TouchDown: Suppressions - Calendar, Contacts, Tasks Allow appointment alert configuration NotifyMDM Default Policy Settings 18

19 Allow appointment reminders at non-peak times option Enable appointment reminders at non-peak times Allow appointment synchronization options Allow category configuration Allow copy to phone format options Name format for contacts copied to phone Allow enable appointment reminders option Enable appointment reminders Allow include phone contacts in picklist option Include phone contacts in picklist Allow normalize phone numbers option Normalize phone numbers Allow reminders configuration Set reminders (in min) Allow update contact changes to phone option Update contact changes to phone TouchDown: Suppressions - Device Control Allow ActiveSync device type string field ActiveSync device type string field Allow backup database (menu option) Allow backup settings Allow disable tablet mode (tablet devices only) option Disable tablet mode (tablet devices only) Allow exclude attachments from gallery option First MI Last First MI Last First MI Last First MI Last TouchDown TouchDown TouchDown TouchDown NotifyMDM Default Policy Settings 19

20 Exclude attachments from gallery Allow export settings Allow filtered tasks on home screen and widgets option Display tasks on home screen and widgets Allow login ID, address, domain fields Allow quick configuration Allow restore database (menu option) Allow restore settings Allow server name fields Allow show s on startup option Show list on startup Allow use system background data setting option Use system background data setting TouchDown: Suppressions - Allow always BCC myself option Enable always BCC myself option Allow choose folders Allow disable SmartReplies and SmartForwards option Disable SmartReplies and SmartForwards Allow don t delete s on server option Do not delete on server Allow don t mark read on server Do not mark read on server Allow alerts configuration NotifyMDM Default Policy Settings 20

21 Allow body style options body style (Corporate/Individual) Allow checking frequency options checking frequency (in minutes) Allow download size options Allow view text size options text size Allow synchronization options Allow enable HTML options Allow folder language options Allow manage rules option Allow notify on new mail option Send new mail notifications Allow out of office configuration Allow signature line field TouchDown: Suppressions - Security Allow clean SD card on remote wipe option Clean SD card on remote wipe Allow client certs configuration Allow remote kill configuration Remote kill code Allow security policy display font: Calibri, Arial, Helvetica, sans-serif; size: 11pt; color: black font: Calibri, Arial, Helvetica, sans-serif; size: 11pt; color: black font: Calibri, Arial, Helvetica, sans-serif; size: 11pt; color: black font: Calibri, Arial, Helvetica, sans-serif; size: 11pt; color: black Normal Normal Normal Normal REDRUM REDRUM REDRUM REDRUM NotifyMDM Default Policy Settings 21

22 Allow S/MIME settings configuration Allow wipe data (menu option) TouchDown: Suppressions - Synchronization Policy Low Level Moderate Level Strict Level High Level Allow defer server updates option Enable defer server updates Allow enable SMS syncing (Exchange 2010 Only) option Allow manual sync when roaming option Allow notify on password failure option Send password failure notifications Allow notify on polling failure option Send failed polling notifications Allow notify on successful polling option Send successful polling notifications Allow peak time configuration Allow poll during off-peak times option Enable polling at off-peak times Windows Devices: Applications Allow Setup Allow IE Browser Allow Windows App Store Allow Windows Store Auto Update Y Y Y Y Restrict App Installation to System Volume N N N N Windows Devices: Device Features NotifyMDM Default Policy Settings 22

23 Allow Action Center Notifications Y Y Y Y Allow Bluetooth Discovery Y Y Y Y Allow Cortana Y Y Y Y Allow Developer Unlock N N N N Allow Microsoft Account Connection Y Y Y Y Allow Sync My Settings Y Y Y Y Allow Task Switcher Y Y Y Y Allow Toasts Y Y Y Y Allow Voice Recording Y Y N N Windows Devices: Management Allow Data Roaming Allow Phone Reset Allow VPN Over Cellular Y Y Y Y Allow VPN Over Cellular Roaming Y Y Y Y Windows Devices: Passport for Work Use Passport for Work Y Y Y Y Require Security Device N N Y Y Minimum PIN Length Require Uppercase Letters N N Y Y Require Lowercase Letters N Y Y Y Require Special Characters N N Y Y Require Numbers N N Y Y Allow Biometrics Y Y Y Y User Self-Administration Portal (USAP): ios Security Actions NotifyMDM Default Policy Settings 23

24 Display Selective Wipe Display Locate Device Display Lock Device Display Full Wipe Display Clear Passcode User Self-Administration Portal (USAP): Android Security Actions Display Selective Wipe Display Locate Device Display Lock Device Display Wipe Storage Card Display Full Wipe Display Reboot Device Display Power Off Display Unblock Password Entry User Self-Administration Portal (USAP): Device Statistics Display Connections Display Basic Statistics Display Advanced Statistics User Self-Administration Portal (USAP): ios Applications Display Managed Apps Display Blacklists Display Whitelists User Self-Administration Portal (USAP): Android Applications NotifyMDM Default Policy Settings 24

25 Display Managed Apps Display Blacklists Display Whitelists User Self-Administration Portal (USAP): Certificates Display Add Certificates Whitelists/Blacklists Permissions Blacklists Whitelists NotifyMDM Default Policy Settings 25

Functionality by Device Platform

Functionality by Device Platform Functionality by Device Platform for the Notify Mobile Device Management System Last revision: 02/24/16 Current Release: Version 3.9.x Policy Rules: All Devices 1 TABLE