VMware AirWatch Mobile Management Guide Enabling mobile access to your organization's

Transcription

1 VMware AirWatch Mbile Management Guide Enabling mbile access t yur rganizatin's AirWatch v9.2 Have dcumentatin feedback? Submit a Dcumentatin Feedback supprt ticket using the Supprt Wizard n supprt.air-watch.cm. This prduct is prtected by cpyright and intellectual prperty laws in the United States and ther cuntries as well as by internatinal treaties. VMware prducts are cvered by ne r mre patents listed at VMware is a registered trademark r trademark f VMware, Inc. in the United States and ther jurisdictins. All ther marks and names mentined herein may be trademarks f their respective cmpanies. 1

2 Table f Cntents Chapter 1: Overview 4 Intrductin t Mbile Management 5 MEM Requirements 5 Chapter 2: Infrastructure Management 7 Deplyment Types 8 Secure Gateway Prxy Mdel 8 Direct PwerShell Mdel 9 Direct Gmail Mdel 10 MEM Deplyment Mdel Matrix 12 AirWatch Recmmendatins 15 Chapter 3: Migratin t AirWatch 17 Migratin 18 Migrate t Secure Gateway 18 Migrate t PwerShell 18 Migrate t Gmail 20 Migrate Devices 20 Chapter 4: Mbile Management Cnfiguratin 21 Cnfigure Mbile Management Deplyment 22 Chapter 5: Device Assignment t Mbile Management Envirnment 24 Device Assignment 25 Device Sync up 26 Chapter 6: Mbile Prfiles 27 Deply EAS Mail using Native Mail Client (Andrid) 28 Cnfigure an EAS Mail Prfile using Native Mail Client (ios) 30 Cnfigure an EAS Mail Prfile using AirWatch Inbx (ios) 31 Exchange ActiveSync Prfile (Windws Desktp) 33 Cnfigure an EAS Prfile fr AirWatch Inbx (Windws Desktp) 34 2

3 Cnfigure an Exchange ActiveSync Prfile (Windws Desktp) 37 Enable Certificate-Based 39 Chapter 7: Access Cntrl Enfrcement 40 Cmpliance Plicies 41 Activate an Cmpliance Plicy 42 Cntent, Attachments & Hyperlinks Prtectin 45 Enable Security Classificatin 45 Enable Attachment Prtectin 45 Enable Hyperlink Prtectin 47 Chapter 8: Management 48 Dashbard 49 List View 49 Accessing Other Dcuments 53 3

4 Chapter 1: Overview Intrductin t Mbile Management 5 MEM Requirements 5 4

5 Chapter 1: Overview Intrductin t Mbile Management The ability t view crprate data n yur device prvides a level f cnvenience and imprves prductivity, but als presents security and deplyment challenges. T vercme such challenges, VMware AirWatch Mbile Management (MEM) slutin delivers cmprehensive security fr yur crprate infrastructure. Challenges Mbile prvides benefits and at the same time presents bigger challenges. Prvisining acrss different device types, perating systems, and clients. Securing access ver unsecured netwrks. Prtecting sensitive infrmatin frm third-party apps. Restricting access frm unauthrized, lst, r stlen devices. Preventing attachments frm being lst and disseminated thrugh the third-party reader apps when they are viewed. Advantages f Mbile Management (MEM) VMware AirWatch MEM prvides all the key factrs f a successful and secure mbile deplyment: Enfrce SSL security. Cnfigure ver-the-air. Discver existing unmanaged devices. Prtect frm data lss. Blck unmanaged devices frm accessing . Restrict access t nly cmpany-apprved devices. Use certificate integratin and revcatin. MEM Requirements Knw the supprted web brwsers fr the AirWatch Cnsle befre yu prceed with the VMware AirWatch Mbile Management (MEM) slutin. Disclaimer Integratin with the third-party prduct is nt guaranteed and dependent upn the prper functining f thse thirdparty slutins. Supprted Brwsers The AirWatch Cnsle supprts the latest stable builds f the fllwing web brwsers: 5

6 Chapter 1: Overview Chrme Firefx Safari Internet Explrer 11 Micrsft Edge Nte: If using IE t access the Cnsle, navigate t Cntrl Panel > Settings > Internet Optins > Security and ensure yu have a security level r custm security level that includes the Fnt Dwnlad ptin being set t Enabled. If yu are using a brwser lder than thse listed abve, AirWatch recmmends upgrading yur brwser t guarantee the perfrmance f the AirWatch Cnsle. Cmprehensive platfrm testing has been perfrmed t ensure functinality using these web brwsers. The AirWatch Cnsle may experience minr issues if yu chse t run it in a nn-certified brwser. 6

7 Chapter 2: Infrastructure Management Deplyment Types 8 Secure Gateway Prxy Mdel 8 Direct PwerShell Mdel 9 Direct Gmail Mdel 10 MEM Deplyment Mdel Matrix 12 AirWatch Recmmendatins 15 7

8 Chapter 2: Infrastructure Management Deplyment Types AirWatch ffers tw types f deplyment mdels using which yu can prtect and manage yur infrastructure. Using these deplyment mdels alng with the plicies yu define in the AirWatch Cnsle, yu can effectively manage yur mbile devices by allwing r blcking the access. In the prxy mdel, a separate server called the SEG prxy server is placed between the AirWatch server and the crprate server. This prxy server filters all the requests frm the devices t the server and relays the traffic nly frm the apprved devices. This way the crprate server is prtected as it des nt directly cmmunicate with the mbile devices. The SEG Prxy deplyment mdel can be cnfigured n tw platfrms: Classic and V2. Thugh the functinality f bth the platfrms are the same, V2 platfrm assures imprved perfrmance ver Classic platfrm. In the direct mdel apprach, there is n prxy server invlved and AirWatch cmmunicates directly with the servers. The absence f prxy server makes the installatin and cnfiguratin steps simpler in this mdel. The table prvides the list f servers that are best cmpatible with the tw deplyment mdels. Deplyment Mdel Cnfiguratin Mde Mail Infrastructure Prxy Mdel Secure Gateway - Classic Platfrm Micrsft Exchange 2003/2007/2010/2013/2016 Exchange Office 365 IBM Dmin w/ Ltus Ntes Nvell GrupWise (with EAS) Gmail Secure Gateway - V2 Platfrm Micrsft Exchange 2010/2013/2016 Exchange Office 365 Direct Mdel PwerShell Mdel Micrsft Exchange 2010/2013/2016 Gmail Mdel Micrsft Office 365 Gmail Nte: AirWatch nly supprts the versins f third-party servers currently supprted by the server prvider. When the prvider deprecates a server versin, AirWatch n lnger supprts integratin with that versin. Secure Gateway Prxy Mdel The Secure Gateway (SEG) prxy server is a separate server installed in-line with yur existing server t prxy all traffic ging t mbile devices. Based n the settings yu define in the AirWatch Cnsle, the SEG Prxy server makes allw r blck decisins fr every mbile device it manages. The SEG Prxy server filters all cmmunicatin requests t the crprate server and relays traffic nly frm apprved devices. This relay prtects the crprate server by nt allwing any devices t cmmunicate with it. Install the SEG server in yur netwrk s that it is in-line with the traffic f the crpratin. Yu can als install it in a Demilitarized Zne (DMZ) r behind a reverse prxy. Yu must hst the SEG server in yur data center, regardless f whether yur AirWatch MDM server is in the clud r n premises. 8

9 Chapter 2: Infrastructure Management Direct PwerShell Mdel In the PwerShell mdel, AirWatch adpts a PwerShell administratr rle and issues cmmands t the Exchange ActiveSync (EAS) infrastructure t permit r deny access based n the plicies defined in the AirWatch Cnsle. PwerShell deplyments d nt require a separate prxy server and the installatin prcess is simpler. PwerShell deplyments are fr rganizatins using Micrsft Exchange 2010,2013,2016, r Office 365. In the setup, where Office 365 the clud server is used, the AirWatch server sets up the PwerShell sessin directly with the server. In the setup, where AirWatch server is n the clud and the Exchange server is n premise, PwerShell cmmands are issued by the AirWatch server but the PwerShell sessin with the server is setup by the VMware Enterprise Systems Cnnectr. 9

10 Chapter 2: Infrastructure Management When bth the AirWatch server and the server is n premise, the AirWatch server sets up the PwerShell sessin directly with the server. Here, there is n VMware Enterprise Systems Cnnectr server required unless the AirWatch server cannt cmmunicate with the server directly. Fr assistance in chsing between the Secure Gateway and PwerShell deplyment mdels, see AirWatch Recmmendatins n page 15. Direct Gmail Mdel Organizatins using the Gmail infrastructure may be familiar with the challenge f securing endpints fr Gmail and preventing mail frm circumventing the secure endpint. AirWatch addresses these challenges by prviding a flexible and safe methd t integrate yur infrastructure. In the direct Gmail deplyment mdel, AirWatch server cmmunicates directly with Ggle. Depending n the security needs, yu can chse t stre the Ggle passwrd in the AirWatch database r remve it frm the database. In the passwrd retentin r string cnfiguratin, AirWatch stres the Ggle passwrd in its database. When the device is nn-cmpliant, AirWatch resets the passwrd n Ggle preventing the user frm lgging int ther device. When the device is back t cmpliant status, AirWatch resets the ld passwrd n the Ggle server and the user can lgin using the ld passwrd. In the passwrd remval cnfiguratin, AirWatch des nt stre the Ggle passwrd in its database. When the device is nn-cmpliant, the prfile is remved frm the user's device preventing the user frm receiving s. When the device is back t cmpliant status, AirWatch triggers a new passwrd, sends it t Ggle and the device thrugh the prfile. 10

11 Chapter 2: Infrastructure Management 11

12 Chapter 2: Infrastructure Management MEM Deplyment Mdel Matrix Office 365 requires mre cnfiguratin fr the SEG Prxy mdel. AirWatch recmmends the Direct mdel f integratin fr Clud-based servers. Refer the AirWatch Recmmendatins n page 15 sectin fr mre details. Supprted Nt supprted by AirWatch X Feature nt available N/A Nt Applicable Enfrced Security Settings Use digital signatures thrugh S/MIME capability Prtect sensitive data thrugh frced encryptin SEG Prxy Mdel Exchange 2010/2013/2016 Ltus Traveler Nvell GrupWise Security Tls Direct Mdel Office 365 (PwerShell) Exchange 2010/2013/2016 (PwerShell) Gmail N/A Enfrce SSL Security Attachment & Hyperlinks Security Enfrce attachments and hyperlinks t pen in VMware Cntent Lcker r VMware Brwser nly * x x x Autmatic Cnfiguratin Cnfigure ver-the-air n device Access Cntrl Blck unmanaged devices frm accessing Discver existing unmanaged devices access with custmizable cmpliance plicies Require device encryptin fr access Prevent cmprmised devices frm access N/A Allw / blck - Mail client x 12

13 Chapter 2: Infrastructure Management SEG Prxy Mdel Direct Mdel Exchange 2010/2013/2016 Ltus Traveler Nvell GrupWise Office 365 (PwerShell) Exchange 2010/2013/2016 (PwerShell) Gmail Access Cntrl Allw / blck - User x Allw / blck - Device mdel Allw / blck - Device OS Allw / blck - EAS Device type x Management Visibility traffic statistics x x x clients statistics x x x Certificate Management CA Integratin / revcatin N/A Architecture Inline gateway (Prxy) N/A N/A Exchange PwerShell N/A N/A N/A N/A Passwrd management fr Gmail Directry API Integratin fr Gmail VMware Bxer fr ios and Andrid [^] N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A Supprted AirWatch Inbx fr ios AirWatch Inbx fr Andrid 13

14 Chapter 2: Infrastructure Management SEG Prxy Mdel Exchange 2010/2013/2016 Ltus Traveler Nvell GrupWise Direct Mdel Office 365 (PwerShell) Exchange 2010/2013/2016 (PwerShell) Gmail AirWatch Inbx fr Windws Desktp + + N/A ios Native Client Andrid Native Client** Windws Mbile Native Client x Windws Phne Blackberry 10*** N/A ios Tuchdwn* Andrid Tuchdwn Andrid Ltus Ntes Client* N/A N/A N/A N/A N/A * Attachments & Hyperlinks security is nt supprted n the Andrid Ltus Ntes client and ios Tuchdwn client **Andrid native client supprts SAFE, HTC Pr2, LG Optimus Pr, and Intuitin devices nly ***EAS prfile is nt supprted + Exchange 2003 is nt supprted ^ Exchange 2003, Require ActiveSync Prfile, and Multi MEM are nt supprted fr VMware Bxer. 14

15 Chapter 2: Infrastructure Management AirWatch Recmmendatins The features that AirWatch supprts and the recmmended deplyment sizes are listed in this sectin. Use the decisin matrix t chse the deplyment that best suits yur need. Attachment Encryptin With enfrced attachment encryptin n yur mbile devices, AirWatch can help keep yur attachments secure withut hindering the end users' experience. Native AirWatch Inbx Tuchdwn Traveler VMware Bxer ios Andrid Windws Phne* *If yur deplyment includes Windws Phne 8/8.1/RT devices, AirWatch recmmends using attachment encryptin. SEG supprts attachment encryptin and hyperlink transfrmatin n Bxer, nly if these features are enabled fr the Bxer app cnfiguratin n the AirWatch Cnsle. SEG supprts attachment encryptin with Exchange 2010/2013/2016 and Office Management The listed recmmendatins give yu the greatest level f security with the easiest deplyment and management. G mail PwerShell Secure Gateway (SEG) Clud Mail Infrastructure Office 365 ** ^ Gmail On-premises Infrastructure Exchange 2010 ^ Exchange 2013 ^ Exchange 2016 ^ Ltus Ntes Nvel GrupWise ^AirWatch recmmends using the Secure Gateway (SEG) fr all n-premises infrastructures with deplyments f mre than 100,000 devices. Fr deplyments f less than 100,000 devices, using PwerShell is anther ptin fr yur management. Please refer t the Secure Gateway vs. PwerShell Decisin Matrix. **The recmmended threshld fr PwerShell implementatins is based n the mst recent set f cmpleted perfrmance tests, and may change n a release by release basis. Deplyments up t 50,000 devices can expect reasnably quick sync and run cmpliance time frames (less than three hurs). As the deplyment size expands clser t 100,000 devices, then administratrs can expect the sync and run cmpliance prcesses t cntinue t increase in the 3 7 hur time frame. 15

16 Chapter 2: Infrastructure Management Secure Gateway vs PwerShell Decisin Matrix The matrix infrms yu abut the deplyment features f SEG and PwerShell t help yu chse which deplyment suits yur need. Prs SEG Real Time Cmpliance Attachment encryptin Hyperlink transfrmatin PwerShell N additinal n-premises servers required fr management Mail traffic is nt ruted t an npremises server befre being ruted t Office 365, s ADFS is nt required Cns Additinal server (s) required ADFS must be cnfigured t prevent end users frm cnnecting directly t Office 365 (arund SEG) + N real time cmpliance sync Nt recmmended fr large deplyments (mre than ) AirWatch Inbx must be used t cntainerize attachments and hyperlinks in VMware Cntent Lcker and VMware Brwser respectively + Micrsft recmmends using Active Directry Federated Services (ADFS) fr preventing direct access t Office 365 accunts. Cnnecting IBM Ntes Traveler Server thrugh AirWatch Inbx If yu are using an AirWatch Exchange ActiveSync prfile t cnnect t an IBM Ntes Traveler server thrugh the Andrid AirWatch Inbx, yu may receive 'HTTP 449' respnse when an Andrid device attempts t cnnect t the Traveler server. This 'HTTP 449' errr ccurs if the ActiveSync plicy headers sent frm the client (and enfrced thrugh AirWatch) d nt match the plicy headers supprted by the Traveler server. AirWatch recmmends the fllwing steps t reslve such issues: 1. Add the fllwing flag t the ntes.ini file n the Traveler server. NTS_AS_PROVISION_EXEMPT_USER_AGENT_REGEX=(AirWatch*) (Apple*; AWInbx*) 2. Next, restart the Traveler server. Adding this flag disables Traveler frm enfrcing any plicies t the AirWatch Inbx. Yu shuld then use AirWatch fr applying the required plicies t the app. Devices that use plicies prvisined directly by Traveler (that is, nt cnfigured thrugh AirWatch), are nt affected. Nte: If yu are using IBM Ntes Traveler with SEG 7.3+, then the IBM Ntes Traveler requires the Micrsft-Server- Activesync website supprt. 16

17 Chapter 3: Migratin t AirWatch Migratin 18 Migrate t Secure Gateway 18 Migrate t PwerShell 18 Migrate t Gmail 20 Migrate Devices 20 17

18 Chapter 3: Migratin t AirWatch Migratin With AirWatch, it is easy t migrate devices frm yur existing infrastructure t ne f the Mbile Management (MEM) deplyment mdels: Secure Gateway(SEG), PwerShell, r Gmail. By migrating t these mdels, yu can enfrce access cntrl plicies ensuring access is prvided nly t the apprved users and devices. Migrate t Secure Gateway migratin t Secure Gateway (SEG) enables users' access t s nly thrugh the SEG prxy. It enfrces access cntrl plicies, giving access nly t apprved users and devices and attachment encryptin plicies ensures data security. T migrate t the SEG envirnment: 1. Cnfigure SEG at yur required rganizatin grup under Glbal in the AirWatch Cnsle. 2. Dwnlad and install SEG. 3. Test the SEG functinality using the cmpliance plicy. 4. Disable all cmpliance plicies temprarily. 5. Ask all users t enrll their devices int AirWatch. 6. Prvisin a new prfile (with the SEG server URL as the hstname) t all the enrlled devices. 7. Peridically, remind users with unmanaged devices t enrll int AirWatch. 8. Mdify firewall (r Threat Management Gateway) rules t blck EAS access t the mail server, n a specific date. This ensures mbile devices are blcked frm accessing the mail server directly. Existing Webmail, Outlk Web Access (OWA), and ther clients cntinue t access the mail server. 9. Enable plicies n the SEG server t begin enfrcing access cntrl and data security n devices attempting t access crprate . Migrate t PwerShell By migrating t PwerShell, yu are securing yur devices and syncing the devices with Exchange r Office 365 fr s. PwerShell envirnment discvers managed and unmanaged devices and with the help f access cntrl plicies gives access t nly apprved users and devices. T migrate t PwerShell: 1. Cnfigure PwerShell integratin at yur required rganizatin grup under Glbal in the AirWatch Cnsle. 2. Cnfigure the integratin with user grups (either custm r pre-defined). 3. Test the PwerShell functinality with a subset f users (fr example, test users) t ensure the fllwing features wrk: 18

19 Chapter 3: Migratin t AirWatch Syncing with the server t discver devices. Access cntrl in real time. 4. Disable all cmpliance plicies temprarily. 5. Prvisin a new prfile t all devices that have enrlled int AirWatch with the server hstname. Cmplete this step t remve the prfile frm the device using Device Cmpliance plicies. 6. Sync with the server t discver all devices (managed and unmanaged) that are syncing fr Peridically remind users with unmanaged devices t enrll int AirWatch. 8. Activate and enfrce cmpliance rules t blck access frm all nn-cmpliant devices n a specific date, including the unmanaged devices. 9. Set up the server t blck all devices by default. 10. Sync with the server t retrieve a list f allwed and blcked devices (as a result f the abve plicy change) and Run Cmpliance against these devices. When this is dne, the Dashbard displays: Unmanaged devices as blcked. Managed devices are allwed fr . Wrkarund fr Bxer Flexible Deplyment The Flexible Deplyment feature f Bxer enables yu t create different assignments fr smart grups in yur Organizatin Grup. Fr mre infrmatin abut cnfiguring VMware Bxer as a public applicatin, see Cnfigure and Deply VMware Bxer n page 1 and VMware Bxer Settings n page 1. When migrating between Exchange envirnments r t Office 365, access may be blcked fr Bxer if PwerShell is being leveraged fr Management. T avid blcking access, create a Device Access Rule in Exchange t allw AirWatch managed Bxer cnfiguratins. Yu can fllw these steps t cnfigure a device access rule fr Office 365 t allw access t devices installed with Bxer: 1. Lg in t the Exchange Cntrl Panel. 2. Select Mbile. 3. T add a new rule, select the '+' icn under Device Access Rules. 4. Frm Device family, select brwse, and then select BxerManagediPhne, BxerManaged ipad, r BxerManagedAndrid. Select OK. Repeat this step fr ther BxerManaged devices. 5. Frm Only this mdel, select All mdels. 6. Select Allw access fr the rule. Fllw the abve mentined instructins n ther Exchange versins t prevent cmpliance restrictin during MEM migratin. 19

20 Chapter 3: Migratin t AirWatch Migrate t Gmail By migrating t Gmail, yu are synching yur devices with the Gmail server. Yu can integrate yur Gmail with r withut a Secure Gateway (SEG) r directly with the Directry APIs. T migrate t Gmail: 1. Prepare Gmail fr AirWatch integratin. 2. Enable the Single Sign On (SSO) ptin n Gmail r create the Service Accunt certificate. 3. Cnfigure the Gmail integratin frm the AirWatch cnsle using the MEM cnfiguratin wizard. 4. Prvisin EAS prfiles t users with the new randmized passwrd. Devices that d nt receive this prfile are autmatically blcked frm accessing Gmail. Migrate Devices AirWatch can migrate devices acrss rganizatin grups and MEM deplyments. Fr example, yu want t migrate all yur devices managed by 'MEM deplyment A' t 'MEM deplyment B'. T migrate the devices: 1. Navigate t Dashbard. 2. Filter the managed devices that are under yur present 'MEM deplyment'. 3. In the List View page, select all the devices and select the Migrate Devices ptin frm the Administratin drpdwn menu. 4. In the Migrate Devices Cnfirmatin page, enter the given key cde t cnfirm the migratin and select the cnfiguratin t which yu want t deply the devices. Select Cntinue. After yu perfrm these steps, AirWatch autmatically remves the earlier Exchange ActiveSync (EAS) prfile and pushes the new EAS prfile with the target deplyment grup. The device then cnnects t its new deplyment grup. AirWatch then displays the updated memcnfigid fr the device n the Dashbard. 20

21 Chapter 4: Mbile Management Cnfiguratin Cnfigure Mbile Management Deplyment 22 21

22 Chapter 4: Mbile Management Cnfiguratin Cnfigure Mbile Management Deplyment Yu can integrate yur infrastructure in a few simple steps using the Mbile Management (MEM) cnfiguratin wizard. MEM can nly be cnfigured at a parent rganizatin grup and cannt be verridden at a child rganizatin grup. One MEM cnfiguratin can be assciated with a single r multiple Exchange ActiveSync (EAS) prfiles. T cnfigure the MEM deplyment: 1. Navigate t > Settings, and then select Cnfigure. 2. Select the deplyment mdel and then select the type. Select Next. If Prxy is the deplyment mdel, select the Gateway Platfrm: Fr Classic platfrm, the types that can be selected are : Exchange Ggle Apps using Passwrd Prvisining Nvell Grupwise IBM Ntes. Fr V2 platfrm, the type available is Exchange. If Direct is the deplyment mdel, then the types that can be selected are: Exchange Ggle App with Direct API Ggle App using Passwrd Prvisining - Select With Passwrd Retentin r Withut Passwrd Retentin as the Gmail Deplyment Type. Fr mre infrmatin n the deplyment methds, see Deplyment Types n page Enter the details fr the chsen deplyment type: Fr SEG deplyments: Enter a friendly name fr this deplyment. Enter the SEG prxy server details. Fr PwerShell deplyments: Enter a friendly name fr this deplyment. Enter the details f the PwerShell server, authenticatin, and sync settings. Fr Gmail : Enter a friendly name fr this deplyment. Enter the details f the Gmail settings, authenticatin, Gmail Directry APIs Integratin, and SEG prxy settings. 22

23 Chapter 4: Mbile Management Cnfiguratin 4. Assciate a template EAS prfile with the MEM deplyment and select Next. Create a template EAS prfile fr this deplyment. New template prfiles are nt published t devices autmatically. Yu can publish prfiles t yur devices frm the Prfiles page. Assciate an existing prfile t this deplyment. This is mandatry if mre than ne MEM deplyment is t be cnfigured at a single rganizatin grup. 5. The MEM Cnfig Summary page displays the cnfiguratin details. Save the settings. 6. Once saved, yu can add the advanced settings t this deplyment. Select the Advanced icn crrespnding t yur deplyment. Cnfigure the available settings fr the user mailbxes as per requirement in the Mbile Management Advanced Cnfiguratin page. Select Save. 7. T cnfigure multiple MEM deplyments, select Add (available n the Mbile Management Cnfiguratin main page) and perfrm steps 2 7. In a SEG deplyment, yu may assign a particular cnfiguratin as the default using the ptin Set as default available under. Nte:a. Yu shuld create mutually exclusive user grups when cnnecting multiple PwerShell envirnments t the same Exchange server. b. Use different dmains in the cnfiguratin when cnnecting multiple Gmail envirnments. c. Cnsider cnnecting SEG and PwerShell integratin t the same envirnment nly during migratin f MEM deplyments with apprpriate settings. Yur AirWatch representative can help yu with this implementatin. 23

24 Chapter 5: Device Assignment t Mbile Management Envirnment Device Assignment 25 Device Sync up 26 24

25 Chapter 5: Device Assignment t Mbile Management Envirnment Device Assignment Device enrllments, assignment f prfiles t devices, and change in the device cmpliance status impacts Mbile Management (MEM). MEM cnfiguratins are assigned t devices based n the EAS prfiles present n the devices. The Managed and Require ActiveSync Prfile cmpliance plicies ensures that unmanaged and manual cnfiguratins remain unpermitted. Devices with Exchange Active Sync (EAS) prfile When a device with an EAS prfile assciates t a particular MEM cnfiguratin, AirWatch sends plicy updates t that MEM cnfiguratin. This feature facilitates migratins and multiple MEM cnfiguratins where ne r mre envirnments are managed. Regardless f the client, all Ggle MEM mdels require an EAS prfile. Fr new installs, assciating an EAS prfile t a MEM cnfiguratin is mandatry. Fr upgrades, an admin has t assciate an EAS prfile t the MEM cnfiguratin upn cmpletin f the upgrade prcess. SEG Prxy Integrated AirWatch sends a bradcast message t all the MEM cnfiguratins f the rganizatin grup t which the device has enrlled. This message states the cmpliance status f the device. When cmpliance changes, an updated message is sent. When the device cnnects t a particular SEG server, the SEG recgnizes the device frm the bradcast message sent earlier. The SEG Prxy then reprts the device as discvered t AirWatch. AirWatch then assciates the device with the MEM Cnfiguratin fr SEG and displays it n the Dashbard. If multiple SEG servers are lad balanced, single plicy bradcast messages apply t nly ne SEG. This includes the messages sent frm the AirWatch Cnsle t SEG upn enrllment, cmpliance vilatin, r crrectin. Use Delta Sync with a refresh interval f ten minutes t facilitate newly enrlled r cmpliant devices. These devices experience a waiting perid f maximum ten minutes befre begins t sync. Benefits: Updated plicies frm the same API surce fr all SEG servers. Smaller perfrmance impact n API server. Reduced implementatin r maintenance cmplexity cmpared t the SEG clustering mdel. Fewer failure pints as each SEG is respnsible fr its wn plicy sets. Imprved user experience. PwerShell Integrated PwerShell MEM cnfiguratins behave the same as SEG in terms f plicy updates. Fr migratins t PwerShell, it is imprtant that new prfiles are assciated t the PwerShell MEM cnfiguratin. Assciating a new prfile reduces unnecessary cmmunicatin with the previus MEM cnfiguratin. Gmail Integrated Prfiles are required fr this type f deplyment except when integrating with Ggle Directry APIs. Unless the devices are prvisined with the prfiles, the cnfigured Gmail deplyment des nt identify r manage the device. 25

26 Chapter 5: Device Assignment t Mbile Management Envirnment Device Sync up Once yu cnfigure a Mbile Management (MEM) deplyment, the devices f the assciated rganizatin grup syncs up with MEM. Yu can view the devices detail and status n the Dashbard page f the AirWatch Cnsle. When the devices appear n the dashbard depends n the deplyment mdels the devices are assigned t. Devices managed with the SEG Prxy appear n the Dashbard when the SEG Prxy reprts the device as cnnected and managed. Thse managed with PwerShell appear n the Dashbard when AirWatch sends a PwerShell cmdlet, allwing the device t cnnect t . Devices managed with Gmail appear n the Dashbard when the SEG Prxy AirWatch EAS prfile is queued up fr the device. The Dashbard shws ne f the fllwing statuses: Managed Assigned - Enrlled devices with identified memcnfigid. Managed Unassigned - Enrlled devices fr which the memcnfigid has nt yet been identified thrugh prfile assignment r aut discvery. Unmanaged Discvered - Devices nt yet enrlled in AirWatch and a specific MEM cnfiguratin at the rganizatin grup that has discvered them. 26

27 Chapter 6: Mbile Prfiles Deply EAS Mail using Native Mail Client (Andrid) 28 Cnfigure an EAS Mail Prfile using Native Mail Client (ios) 30 Cnfigure an EAS Mail Prfile using AirWatch Inbx (ios) 31 Exchange ActiveSync Prfile (Windws Desktp) 33 Cnfigure an EAS Prfile fr AirWatch Inbx (Windws Desktp) 34 Cnfigure an Exchange ActiveSync Prfile (Windws Desktp) 37 Enable Certificate-Based

28 Chapter 6: Mbile Prfiles Deply EAS Mail using Native Mail Client (Andrid) 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add > Add Prfile > Andrid. 2. Select Device t deply yur prfile t a device. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the Exchange ActiveSync paylad. 5. Cnfigure Exchange ActiveSync settings: Setting Mail Client Accunt Name Exchange ActiveSync Hst Ignre SSL Errrs Dmain User Address Passwrd Identity Certificate Past Days f Mail t Sync Descriptin Select Native Mail Client as the accunt type. Enter a descriptin fr the mail accunt. Enter the external URL f yur cmpany's ActiveSync server. The ActiveSync server can be any mail server that implements the ActiveSync prtcl, such as IBM Ntes Traveler, Nvell Data Synchrnizer, and Micrsft Exchange. In the case f Secure Gateway (SEG) deplyments, use the SEG URL and nt the server URL. Enable t allw devices t ignre SSL errrs fr Agent prcesses. Enter the end-user's dmain. Lgin Infrmatin Yu can use the Lkup Values instead f creating individual prfiles fr each end user. Enter the end-user's username. Yu can use the Lkup Values instead f creating individual prfiles fr each end user. Enter the end-user's address. Yu can use the Lkup Values instead f creating individual prfiles fr each end user. Enter the passwrd fr the end user. Yu can use the Lkup Values instead f creating individual prfiles fr each end user. Select (if desired) an Identity Certificate frm the drp-dwn if yu require the end user t pass a certificate in rder t cnnect t the Exchange ActiveSync, therwise select Nne (default). Settings Select the number f days wrth f past mail t sync with device. 28

29 Chapter 6: Mbile Prfiles Setting Past Days f Calendar t Sync Sync Calendar Sync Cntacts Allw Sync Tasks Maximum Truncatin Size Signature Allw Attachments Maximum Attachment Size Allw Frwarding Allw HTML Frmat Disable screenshts Sync Interval Descriptin Select the number f past days t sync n the device calendar. Enable t allw calendars t sync with device. Enable t allw cntacts t sync with device. Enable t allw tasks t sync with device. Specify the size beynd which messages are truncated when they are synced t the devices. Enter the signature t be displayed n utging s. Restrictins Enable t allw attachments with . Specify the maximum attachment size in MB. Enable t allw frwarding. Specify whether synchrnized t the device can be in HTML frmat. If this setting is set t false, all is cnverted t plain text. Enable t disallw screensht t be taken n the device. Enter the number f minutes between syncs. 29

30 Chapter 6: Mbile Prfiles Setting Descriptin Peak Days fr Sync Schedule Schedule the peak week days fr syncing and the Start Time and End Time fr sync n selected days. Set the frequency f Sync Schedule Peak and Sync Schedule Off Peak. Chsing Autmatic syncs whenever updates ccur. Chsing Manual nly syncs when selected. Chsing a time value syncs the n a set schedule. Enable Use SSL, Use TLS and Default Accunt, if desired. S/MIME Settings Select Use S/MIME Frm here yu can select an S/MIME certificate yu assciate as a User Certificate n the Credentials paylad. S/MIME Certificate Select the certificate t be used. Require Encrypted S/MIME Messages Enable t require encryptin. Require Signed S/MIME Messages Enable t require S/MIME signed messages. Prvide a Migratin Hst if yu are using S/MIME certificates fr encryptin. Select Save t save the settings r Save & Publish t save and push the prfile settings t the required device. 6. Select Save t save the settings r Save & Publish t save and push the prfile settings t the required device. Cnfigure an EAS Mail Prfile using Native Mail Client (ios) Use the fllwing steps t create an cnfiguratin prfile fr the native mail client n ios devices. 1. Navigate t Devices > Prfiles & Resurces > Prfiles > Add. Select Apple ios. 2. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 3. Select the Exchange ActiveSync paylad. 4. Select Native Mail Client fr the Mail Client. Fill in the Accunt Name text bx with a descriptin f this mail accunt. Fill in the Exchange ActiveSync Hst with the external URL f yur cmpany's ActiveSync server. The ActiveSync server can be any mail server that implements the ActiveSync prtcl, such as Ltus Ntes Traveler, Nvell Data Synchrnizer, and Micrsft Exchange. In the case f Secure Gateway (SEG) deplyments, use the SEG URL and nt the server URL. 5. Select the Use SSL check bx t enable Secure Scket Layer use fr incming traffic. 30

31 Chapter 6: Mbile Prfiles 6. Select the S/MIME check bx t use mre encryptin certificates. Prir t enabling this ptin, ensure yu have upladed necessary certificates under Credentials prfile settings. Select the S/MIME Certificate t sign messages. Select the S/MIME Encryptin Certificate t bth sign and encrypt messages. Select the Per Message Switch check bx t allw end users t chse which individual messages t sign and encrypt using the native ios mail client (ios 8+ supervised nly). 7. Fill in the Lgin Infrmatin including Dmain Name, Username and Address using lk-up values. Lk-up values pull directly frm the user accunt recrd. T use the { Dmain}, { UserName} { Address} lkup values, ensure yur AirWatch user accunts have an address and user name defined. 8. Leave the Passwrd field empty t prmpt the user t enter a passwrd. 9. Select the Paylad Certificate t define a certificate fr cert-based authenticatin after the certificate is added t the Credentials paylad. 10. Cnfigure the fllwing Settings and Security ptinal settings, as necessary: Past Days f Mail t Sync Dwnlads the defined amunt f mail. Nte that lnger time perids will result in larger data cnsumptin while the device dwnlads mail. Prevent Mving Messages Disallws mving mail frm an Exchange mailbx t anther mailbx n the device. Prevent Use in 3rd Party Apps Disallws ther apps frm using the Exchange mailbx t send message. Prevent Recent Address Syncing Disables suggestins fr cntacts when sending mail in Exchange. Prevent Mail Drp Disables use f Apple's Mail Drp feature. 11. Assign a Default Audi Call App that yur Native EAS accunt will use t make calls when yu select a phne number in an message. 12. Select Save and Publish t push the prfile t available devices. Cnfigure an EAS Mail Prfile using AirWatch Inbx (ios) Use the fllwing steps t create a cnfiguratin prfile fr the AirWatch Inbx. Fr mre infrmatin abut AirWatch Inbx, see the VMware AirWatch Inbx Guide. 1. Navigate t Devices > Prfiles & Resurces > Prfiles. 2. Select Add and select ios as the platfrm. 3. Cnfigure the prfile's General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 4. Select the Exchange ActiveSync paylad and then select the AirWatch Inbx frm the Mail Client drp-dwn. 5. Enter the Exchange ActiveSync Hst, which is the infrmatin f yur EAS server. Fr example: webmail.airwatchmdm.cm. 31

32 Chapter 6: Mbile Prfiles Enable Ignre SSL Errrs t allw the devices t ignre Secure Scket Layer errrs frm agent prcesses. Enable Use S/MIME t select the certificate/smart card fr signing and encrypting messages. Befre enabling this ptin, ensure that yu have upladed necessary certificates under the Credentials prfile settings. Yu d nt need t uplad any certificates if a smart card is selected as the credential surce in the Credentials prfile settings. Select the certificate/smart card t sign nly messages in the S/MIME Certificate text bx. Select the certificate/smart card t bth sign and encrypt messages in the S/MIME Encryptin Certificate text bx. If the smart card is selected, default infrmatin ppulates the Smart Card Reader Type and Smart Card Type. Chse the Smart Card Timeut interval. 6. Enter Lgin Infrmatin t authenticate user cnnectins t yur EAS Hst. The prfile supprts lkup values fr inserting enrllment user s infrmatin and lgin infrmatin. 7. Cnfigure Settings, such as: Enable Calendar Enable Cntacts Caller ID Sync Interval The frequency with which the AirWatch Inbx app syncs with the server. Ntificatins Cnfigure hw end users can be ntified f new s. Disabled means they d nt receive a ntificatin. Yu can als trigger the device t play an alert sund, r allw the device t display specific message details such as the sender, subject, and message preview. Past Days f Mail t Sync Past Days f Calendar t Sync Enable HTML Signature Enable Signature Editing 8. Cnfigure a Passcde fr AirWatch Inbx. Yu can require an end user t enter a passcde when the AirWatch Inbx is pened. This is nt the accunt passwrd, but the passcde the user enters t access the applicatin. The fllwing passcde settings are available: Authenticatin Type T allw ios users t lg in using their AirWatch credentials, select Username and Passwrd as the Authenticatin Type under the Passcde sectin. Passcde Cmplexity Determine whether the passwrd is simple r cmplex. Minimum Length Set the minimum number f characters allwed fr the passcde. 32

33 Chapter 6: Mbile Prfiles Minimum Number f Cmplex Characters, if the Cmplexity is set t Alphanumeric. Maximum Passcde Age (days) Limit the number f days allwed befre passcde has t be reset. Passcde Histry Determine the histry f passcdes used t prevent the user frm reusing passcdes. Aut-Lck Timeut (min) Set the number f minutes befre the device autmatically lcks. Maximum Number f Failed Attempts Determine the number f passcde entry attempts allwed befre the data in AirWatch Inbx are erased. 9. Cnfigure mre restrictins and security settings. The fllwing restrictins are available: Allw/Disable Cpy and Paste Disable user s ability t lng press text and cpy it t the clipbard. Disable user s ability t cpy text frm utside f the client and paste it int a mail message. Restrict all links t pen in the VMware Brwser app nly Cnsider using this setting instead f the SEG plicy t transfrm hyperlinks where the use case allws fr increased SEG perfrmance. Restrict attachments t pen nly in the VMware Cntent Lcker Cnsider using this setting instead f the SEG plicy t encrypt attachments where the use case allws fr increased SEG perfrmance. Set a Maximum Attachment Size (MB) Allw Printing 10. Select Save & Publish. Username and Passwrd Yu can define the user name that is assigned fr users t lg in t the AirWatch Inbx. The user name can be their actual address r an user name that is different frm their actual address. When cnfiguring the Exchange ActiveSync (EAS) paylad in the AirWatch Inbx prfile settings, there is a User text bx under Lgin Infrmatin that yu can set t a predefined lkup value. If yu have user names that are different than user addresses, yu can use the { UserName} text bx, which crrespnds t the user names imprted during directry service integratin. Even if yur user user names are the same as their addresses, use the { UserName} text bx, because it uses addresses imprted thrugh the directry service integratin. Exchange ActiveSync Prfile (Windws Desktp) The Exchange ActiveSync prfiles enable yu t cnfigure yur Windws Desktp devices t access yur Exchange ActiveSync server fr and calendar use. Strngly cnsider nly using certificates signed by a trusted third-party certificate authrity (CA). Mistakes in yur certificates expse yur therwise secure cnnectins t ptential man-in-the-middle attacks. Such attacks degrade the 33

34 Chapter 6: Mbile Prfiles cnfidentiality and integrity f data transmitted between prduct cmpnents, and might allw attackers t intercept r alter data in transit. The Exchange ActiveSync prfile supprts the native mail client and AirWatch Inbx fr Windws Desktp. The cnfiguratin changes based n which mail client yu use. Imprtant: Native Mail Client supprt is nly available fr Windws 10 devices. Remving Prfile r Enterprise Wiping If the prfile is remved using the remve prfile cmmand, cmpliance plicies, r thrugh an enterprise wipe, all data is deleted, including: User accunt/lgin infrmatin. message data. Cntacts and calendar infrmatin. Attachments that were saved t the internal applicatin strage. Username and Passwrd Yu can define the user name that is assigned fr users t lg in t the AirWatch Inbx. The user name can be their actual address r an user name that is different frm their actual address. When cnfiguring the Exchange ActiveSync (EAS) paylad in the AirWatch Inbx prfile settings, there is a User text bx under Lgin Infrmatin that yu can set t a predefined lkup value. If yu have user names that are different than user addresses, yu can use the { UserName} text bx, which crrespnds t the user names imprted during directry service integratin. Even if yur user user names are the same as their addresses, use the { UserName} text bx, because it uses addresses imprted thrugh the directry service integratin. Cnfigure an EAS Prfile fr AirWatch Inbx (Windws Desktp) Create an Exchange ActiveSync prfile t give Windws Phne devices access t yur Exchange ActiveSync server fr and calendar use. The settings change when yu use the AirWatch Inbx as yur Windws Phne client. Use the fllwing steps t create a cnfiguratin prfile fr the AirWatch Inbx: 1. Navigate t Devices > Prfiles > List View > Add and select Add Prfile. 2. Select Windws and chse Windws Desktp as the platfrm. 3. Select User Prfile. 4. Cnfigure the prfile General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 5. Select the Exchange ActiveSync paylad. By default, AirWatch Inbx is selected in the Mail Client drp-dwn menu. 34

35 Chapter 6: Mbile Prfiles 6. Enter the Exchange ActiveSync Hst, which is the infrmatin f yur EAS server. Fr example: webmail.airwatchmdm.cm. Settings Use SSL Use S/MIME Dmain User Address Passwrd Paylad Certificate Require Passcde Type Descriptins Enable t send all cmmunicatins thrugh the Secure Scket Layer. Enable t stre end-user S/MIME certificates. This ptin is necessary fr S/MIMEenabled prfiles. Enter the dmain. Enter the user name. Lgin Infrmatin Enter the address. This text bx is a required setting. Enter the passwrd. Select the certificate fr the EAS paylad. Settings Enable t require a passcde when the AirWatch Inbx app is pens. Select the type f lgin credentials required: Passcde Username and Passwrd Cmplexity Select the level f cmplexity fr the passcde: Simple Alphanumeric Minimum Length Allw Simple Value Minimum Number f Cmplex Characters Maximum Age Histry Aut Lck When Device Lcks Grace Perid Maximum Number f Failed Attempts Select the minimum number f characters the passcde must have. Enable t allw passcdes that d nt meet cmplexity requirements. Select the smallest number f nn-alphanumeric characters allwed. Displayed when Cmplexity is set t Alphanumeric. Select the maximum number f days a passcde may be used. Select the number f previus passcdes remembered. If a user changes a passcde and it matches a stred previus passcde, the passcde is nt accepted. Enable t lck AirWatch Inbx autmatically when the device lcks. Select the number f minutes the app remains pen and unlcked befre autmatically lcking. Select the number f incrrect passcde entry attempts allwed befre the data in AirWatch Inbx is erased. 35

36 Chapter 6: Mbile Prfiles Settings Require Passcde Type Descriptins Passcde Enable t require a passcde when the AirWatch Inbx app is pens. Select the type f lgin credentials required: Passcde Username and Passwrd Cmplexity Select the level f cmplexity fr the passcde: Simple Alphanumeric Minimum Length Allw Simple Value Minimum Number f Cmplex Characters Maximum Age Histry Aut Lck When Device Lcks Grace Perid Maximum Number f Failed Attempts Disable Cpy-Paste Select the minimum number f characters the passcde must have. Enable t allw passcdes that d nt meet cmplexity requirements. Select the smallest number f nn-alphanumeric characters allwed. Displayed when Cmplexity is set t Alphanumeric. Select the maximum number f days a passcde may be used. Select the number f previus passcdes remembered. If the end user reuses a passwrd within the number f recrded ccurrences, they cannt reuse that passwrd. Enable t lck AirWatch Inbx when the device lcks. Select the number f minutes the app remains pen and unlcked befre autmatically lcking Select the number f incrrect passcde entry attempts allwed befre the data in AirWatch Inbx is erased. Restrictins Enable t restrict the cpy/paste actins in AirWatch Inbx: Disable ability t lng press text and cpy it t the clipbard. Disable ability t cpy text frm utside f the client and paste it int a mail message. Disable Attachments Maximum Attachment Size (MB) Restrict Dmains Restrictin Type Dmain Name Enable t restrict end user frm pening attachments inside the AirWatch Inbx app. Enter the maximum size (in MB) that a received attachment may be. Enable t restrict the mail flw t specific dmains. Select the type f restrictin fr dmains. Select Add t add a dmain t the whitelist r blacklist. 36

37 Chapter 6: Mbile Prfiles 7. Select Save t keep the prfile in the cnsle r Save & Publish t push the prfile t the devices. Cnfigure an Exchange ActiveSync Prfile (Windws Desktp) Create an Exchange ActiveSync prfile t give Windws Phne devices access t yur Exchange ActiveSync server fr and calendar use. Use the fllwing steps t create a cnfiguratin prfile fr the native mail client: 1. Navigate t Devices > Prfiles > List View > Add and select Add Prfile. 2. Select Windws and chse Windws Desktp as the platfrm. 3. Select User Prfile. 4. Cnfigure the prfile General settings. These settings determine hw the prfile is deplyed and wh receives it. Fr mre infrmatin n General settings, refer t the VMware AirWatch Mbile Device Management Guide, available n AirWatch Resurces. 5. Select the Exchange ActiveSync paylad. 37

38 Chapter 6: Mbile Prfiles 6. Cnfigure the Exchange ActiveSync settings: Settings Mail Client Accunt Name Exchange ActiveSync Hst Use SSL Dmain Username Address Passwrd Identity Certificate Next Sync Interval (Min) Past Days f Mail t Sync Diagnstic Lgging Require Data Prtectin Under Lck Descriptins Select the Mail Client that the EAS prfile cnfigures. AirWatch supprts the Native Mail Client and AirWatch Inbx. Enter the name fr the Exchange ActiveSync accunt. Enter the URL r IP Address fr the server hsting the EAS. Enable t send all cmmunicatins thrugh the Secure Scket Layer. Enter the dmain. Lgin Infrmatin The prfile supprts lkup values fr inserting enrllment user lgin infrmatin. Fr mre infrmatin, see Exchange ActiveSync Prfile (Windws Desktp) n page 33. Enter the user name. Enter the address. This text bx is a required setting. Enter the passwrd. Select the certificate fr the EAS paylad. Settings Select the frequency, in minutes, that the device syncs with the EAS server. Select hw many days f past s sync t the device. Enable t lg infrmatin fr trubleshting purpses. Cntent Type Enable t require data t be prtected when the device is lcked. 38

39 Chapter 6: Mbile Prfiles Settings Allw Sync Allw Cntacts Sync Allw Calendar Sync Descriptins Enable t allw the syncing f messages. Enable t allw the syncing f cntacts. Enable t allw the syncing f calendar events. 7. Select Save t keep the prfile in the AirWatch Cnsle r Save & Publish t push the prfile t the devices. Enable Certificate-Based Using certificates ver the standard username and passwrd credentials have certain benefits as the certificates prvide strnger authenticatin against unauthrized access. It als eliminates the need fr end users t enter in a passwrd r renew ne every mnth. Sensitive s between recipients can be encrypted thrugh S/MIME r prve yur identity thrugh a message signature. T enable Certificate-based 1. Navigate t Devices > Prfiles & Resurces > Prfiles. 2. Select ADD > Add Prfile and then select the required platfrm. 3. Chse the Credentials prfile setting and cnfigure it. Credential Surce Select any frm the available list. Uplad Uplad a certificate and enter a name fr the certificate. Defined Certificate Authrity Select the CA and the certificate template frm the drp-dwn menu fr yur rganizatin grup. The certificate authrities and the templates are added fr an rganizatin grup at Devices > Certificates > Certificate Authrities. User Certificate Select the type f S/MIME certificate S/MIME Signing Certificate S/MIME Encryptin Certificate 4. Save & Publish the settings. 39

40 Chapter 7: Access Cntrl Enfrcement Cmpliance Plicies 41 Activate an Cmpliance Plicy 42 Cntent, Attachments & Hyperlinks Prtectin 45 Enable Security Classificatin 45 Enable Attachment Prtectin 45 Enable Hyperlink Prtectin 47 40

41 Chapter 7: Access Cntrl Enfrcement Cmpliance Plicies Once has been deplyed, yu can further prtect yur mbile by adding access cntrl. The access cntrl feature allws nly secure and cmpliant devices t access yur mail infrastructure. The access cntrl is enfrced with the help f cmpliance plicies. cmpliance plicies enhance security by restricting access t nn-cmpliant, unencrypted, inactive, r unmanaged devices. These plicies allw yu t prvide access t nly the required and apprved devices. plicies als restrict access based n the device mdel and the perating systems. These plicies are categrized as General Plicies, Managed Device Plicies, and Security Plicies. The different plicies that fall under each categry and the deplyments t which they are applicable are listed in the table. - Applicable - Nt Applicable SEG PwerShell Gmail General Plicies Sync Settings Managed Device Mail Client User EAS Device Type Managed Device Plicies Inactivity Device Cmprmised Encryptin Mdel Operating System Require ActiveSync Prfile Direct Integratin using passwrd management Withut SEG and withut Passwrd purge Withut SEG and with Passwrd Purge SEG prxy using passwrd management Direct Integratin using Directry API 41

42 Chapter 7: Access Cntrl Enfrcement SEG PwerShell Gmail Security Plicies Security Classificatin Attachments (managed devices) Attachments (unmanaged devices) Hyperlink Activate an Cmpliance Plicy The cmpliance plicies available n the AirWatch Cnsle are General Plicies, Managed Device Plicies, and Security Plicies. Yu can activate any f these cmpliance plicies r edit the rules fr these plicies t allw r blck the devices. T activate an plicy: 1. Navigate t > Cmpliance Plicies. By default, the plicies are disabled and are dented by a red clred circle under the Active clumn. 2. Use the edit plicy icn under the Actins clumn t edit any f the rules fr a plicy. General Plicies Enfrce plicies n all devices accessing . When yu chse a user grup, the plicy applies t all the users f that grup. Plicy Sync Settings Descriptin Prevent the device frm syncing with specific EAS flders. AirWatch prevents devices frm syncing with the selected flders irrespective f ther cmpliance plicies. Fr the plicy t take effect, it is necessary t republish the EAS prfile t the devices (this frces devices t resync with the server) Managed Device Mail Client Restrict access nly t managed devices. Restrict access t a set f mail clients. Yu can allw r blck mail clients based n the client type such as Custm and Discvered Yu can als set default actins fr the mail client and newly discvered mail clients that d nt display in the Mail Client drpdwn menu. Fr the custm client type, wildcard (*) characters and aut-cmplete are supprted. 42

43 Chapter 7: Access Cntrl Enfrcement User EAS Device Type Restrict access t a set f users. Yu can allw r blck user type that includes Custm, Discvered, AirWatch User Accunt, and AirWatch user grup. Yu can als set default actins fr usernames that d nt display in the Username r Grup drp-dwn menu. Fr the custm user type, wildcard (*) characters and aut-cmplete are supprted. Whitelist r blacklist devices based n the EAS Device Type attribute reprted by the end-user device. Yu can allw r blck devices based n the client type that includes Custm and Discvered mail client. Yu can als set default actins fr the EAS device types that d nt display in the Device Type drp-dwn field. Fr the custm client type, wildcard (*) characters and aut-cmplete are supprted. Managed Device Plicies Enfrce plicies n managed devices accessing . Plicy Inactivity Device Cmprmised Encryptin Mdel Operating System Require ActiveSync Prfile Descriptin Prevent inactive, managed devices frm accessing . Yu can specify the number f days a device shws up as inactive (that is, des nt check in t AirWatch), befre AirWatch prevents access. The minimum accepted value is 1 and maximum is Prevent cmprmised devices frm accessing . This plicy des nt blck access fr devices that have nt reprted cmprmised status t AirWatch. Prevent access fr unencrypted devices. This plicy is applicable nly t devices that have reprted data prtectin status t AirWatch Restrict access based n the platfrm and mdel f the device. Restrict access t a set f perating systems fr specific platfrms. Restricts access t devices which are nt managed with an Exchange ActiveSync prfile. Security Plicies Enfrce plicies n attachments and hyperlinks. This plicy is applicable fr SEG deplyments nly. Fr mre infrmatin, see Cntent, Attachments & Hyperlinks Prtectin n page 45. Plicy Security Classificatin Descriptin Define the plicy fr the SEG t take n s with tags and withut tags. Yu can use the predefined tags r create tags using the Custm ptin. Based n the classificatin, yu can either chse t allw r blck the in AirWatch Inbx and ther clients. 43

44 Chapter 7: Access Cntrl Enfrcement Attachments (managed devices) Attachments (unmanaged devices) Hyperlink Encrypt attachments f the selected file types. These attachments are secured n the device and are nly available fr viewing n the VMware Cntent Lcker. Currently, this feature is nly available in managed ios, Andrid devices, and Windws Phnes with the Cntent Lcker applicatin. Fr ther managed devices, yu can chse t either allw encrypted attachments, blck attachments, r allw unencrypted attachments. Encrypt and blck attachments r allw unencrypted attachments fr unmanaged devices. Encrypted attachments are nt viewable n unmanaged devices. This feature is intended t maintain integrity. If an with an encrypted attachment is frwarded frm an unmanaged device, the recipient can still view the attachment n a PC r anther mbile device. Fr the maximum use f SEG, AirWatch recmmends using SEG fr the attachment encryptin and hyperlink transfrmatin that can be accessed using AirWatch Inbx fr ios, Andrid, and the Native Mail Client fr ios and Andrid. Allw device users t pen hyperlinks cntained within an directly with VMware Brwser present n the device. The Secure Gateway dynamically mdifies the hyperlink t pen in VMware Brwser. Yu may chse ne f the Mdificatin Type: All - Chse t pen all the hyperlinks with VMware Brwser. Exclude - Chse if yu d nt want the device users t pen the mentined dmains thrugh the VMware Brwser. Mentin the excluded dmains in the Mdify all hyperlinks except fr these dmains field. Yu can bulk-uplad the dmain names frm a CSV file as well. Include - Chse if yu want the device users t pen the hyperlinks frm specified dmains thrugh the VMware Brwser. Mentin the included dmains in the Only mdify hyperlinks fr these dmains field. Yu can bulk uplad the dmain names frm a.csv file as well. 3. Create yur cmpliance rule and Save. 4. Select the gray circle under the Active clumn t activate the cmpliance plicy. A page appears with a key cde. 5. Enter the key cde in the crrespnding field and select Cntinue. The plicy is activated and shws a green clred circle under the Active clumn. 44

45 Chapter 7: Access Cntrl Enfrcement Cntent, Attachments & Hyperlinks Prtectin AirWatch helps yu prtect and cntrl the mbile attachments that are vulnerable t data lss fr bth managed and unmanaged devices. AirWatch allws device users t pen hyperlinks in an directly with VMware Brwser present n the device. The Secure Gateway dynamically mdifies the hyperlink t pen in VMware Brwser. Pre-Requisites In rder t start prtecting yur attachments, ensure yu have the listed items. Secure Gateway (SEG) VMware Cntent Lcker (ios, Andrid, and Windws Phne) Supprt fr Micrsft Exchange 2010/2013/2016, IBM Ntes, Nvell GrupWise, and Gmail Enable Security Classificatin Yu can select the security classificatins n the AirWatch Cnsle against which yu want the AirWatch Secure Gateway (SEG) t take actin. There is a list f pre-defined security classificatins t chse frm as well as the ptin t create yur wn custm classificatin. T enable security classificatin: 1. Navigate t > Cmpliance Plicies > Security Plicies. 2. Select the gray clred circle under the Active clumn fr the Security Classificatins cmpliance plicy. A page appears with a key cde. 3. Enter the key cde in the crrespnding field and select Cntinue. The plicy gets activated and is indicated by a green clred circle under the Active clumn. 4. Select the Edit ptin under the Actins clumn. 5. Select Add and then select the type f tag frm the Type drp-dwn menu. Optins available are Pre-defined and Custm. Select the tag type as Pre-defined t get a list f available tags frm the Security Classificatin drp-dwn menu. Select the tag type as Custm t enter yur wn custm tag in the Security Classificatin field. 6. Enter a Descriptin fr the tag and select Next. 7. Cnfigure the actins that SEG shuld take against s marked r nt marked with a tag. Yu may chse t allw r blck s n AirWatch Inbx r ther clients. Select Next. 8. View the Summary and Save. Enable Attachment Prtectin attachments are f varius file types. On the AirWatch Cnsle, yu can select the files types fr which the attachments must be encrypted by the AirWatch Secure Gateway (SEG). These encrypted attachments are secured n the mbile devices and can be viewed using the AirWatch Cntent lcker applicatin. 45

46 Chapter 7: Access Cntrl Enfrcement Granular settings are available fr managed ios, Andrid devices, and Windws Phne. Fr ther managed devices and all unmanaged devices, attachments can be prevented (in-bulk) frm being pened in third-party apps. T enable attachment prtectin: 1. Navigate t > Cmpliance Plicies > Security Plicies. 2. Select the gray clred circle under the Active clumn fr the Attachments (Managed devices) r Attachments (Unmanaged devices)cmpliance plicy. A page appears with a key cde. 3. Enter the key cde in the crrespnding field and select Cntinue. The plicy is activated and is dented by a green clred circle under the Active clumn. 4. Select the Edit ptin under the Actins clumn. 5. Select whether t encrypt & allw r blck r allw withut encryptin attachment fr each file categry (fr managed ios, Andrid and Windws devices nly). 6. Select the check bx Allw Attachments t be saved in Cntent Lcker t save the attachments in Cntent Lcker. The attachments remain encrypted and Cntent Lcker plicies applies. 7. Chse the plicy fr any Other Files nt mentined here. 8. Enter file extensins that are t be excluded frm the actins cnfigured in Other Files int the Exclusin List. 9. Enter a Custm Message fr Blcked Attachmentst infrm the recipient that an attachment has been blcked. 10. Save the settings. 46

47 Chapter 7: Access Cntrl Enfrcement Enable Hyperlink Prtectin Using the hyperlink security plicy, yu can cntrl the hyperlinks in the s t be mdified s that these can be pened directly with VMware Brwser. T enable hyperlinks prtectin: 1. Navigate t > Cmpliance Plicies > Security Plicies. 2. Select the gray clred circle under the Active clumn fr the Hyperlink cmpliance plicy. A page appears with a key cde. 3. Enter the key cde in the crrespnding field and select Cntinue. The plicy is activated and is dented by the green clred circle under the Active clumn. 4. Select the Edit ptin under the Actin clumn. 5. Select the platfrm fr which yu want t ignre the hyperlink transfrmatins fr AirWatch Inbx. 6. Select ne f the Mdificatin Type: All - Chse t pen all the hyperlinks with VMware Brwser. Include - Chse if yu want the device users t pen the hyperlinks frm specified dmains thrugh the VMware Brwser. Mentin the included dmains in the Only mdify hyperlinks fr these dmains field. Yu can bulk uplad the dmain names frm a CSV file as well. Exclude - Chse if yu d nt want the device users t pen the mentined dmains thrugh the VMware Brwser. Mentin the excluded dmains in the Mdify all hyperlinks except fr these dmains field. Yu can bulk uplad the dmain names frm a CSV file as well. 7. Save the settings. 47

48 Chapter 8: Management Dashbard 49 List View 49 48

49 Chapter 8: Management Dashbard Yu can mnitr yur user grup's traffic and devices thrugh the AirWatch Dashbard. This dashbard gives yu a real-time summary f the status f the devices cnnected t the server. Yu can access the dashbard frm > Dashbard. Frm the dashbard, yu can als use the available graphs t filter yur search. Fr example, if yu want t view all the managed devices f an rganizatin grup, select the Managed Devices graph. The graphs display the results in the List View page. List View The > List View page allws yu t view all the real-time updates f yur end-user devices that yu are managing with AirWatch Mbile Management (MEM). Yu can view the device r user-specific infrmatin either as a summarized list r as a custmized ne based n yur requirement. Switch between the Device and User tabs t view the user and device infrmatin. In rder t view the summary r the custmized list f the infrmatin, change the Layut. List View page enables yu t: Whitelist r blacklist a device t allw r deny access t respectively. View the devices which are managed, unmanaged, cmpliant, nn-cmpliant, blcked, r allwed. View the device details such as OS, Mdel, Platfrm, Phne Number, IMEI, and IP address. List View page prvides detailed infrmatin that includes: Settings Last Request Descriptin The last state change f the device either frm AirWatch r frm Exchange in the PwerShell integratin. In SEG-integratin this clumn shws the last time a device synced mail. 49