Telenor MDM. Quick Start Guide

Transcription

1 Telenor MDM Quick Start Guide February 2016

2 Table of content 1 Usage information About Home hyperlink Description of the warning flags Greyed (read-only) items Information omissions Additional documentation Login and UI navigation Login to the Telenor MDM Server Successful Login Language selection Pulldown Tenancy selection Pulldown Logout button Navigation layout UI Anatomy Device Status indicators Coloured shaped symbols Documentation navigation Command navigation Hyperlink navigation Adding a new user Add/Explore Hierarchies & Groups Add New User Complete new user details Add a device - General Add an Android device SMS enrollment QR code enrolment Expected user interaction: Displaying and capturing the activation QR code Adding Apple ios devices Add Apple profile via message Page 2 / 83

3 4.2.2 Add Apple profile via SMS message Apple ios User accepts profile installation request Profile installation acceptance Add a Symbian S60 device SMS enrollment Add a Windows Phone 8 device Add a Windows device Adding a Windows device to MDM server user Add an Apple OS X device Add Apple profile via message Add an Unknown device Add a device Self Service Prerequisites Enrollment delegation User independence Location and Time zone independence Incorrect login credentials Password request Password change Home screen UI GUI Navigation User & Devices tab SSP Adding a new device Actions Tab Applications Tab GPS Administrative restrictions Enable SSP Enable AD authentication Allow removal of device Allow registration of new device Allow editing of user data Location tab Allow GPS Page 3 / 83

4 6 Device information Custom Parameters Adding Custom Parameters Defining a type "password" custom parameter Defining a type "default" custom parameter Custom Parameters deletion Assigning a value to a custom parameter Adding Applications The application details window Adding an Apple Application (using Search (Apple)) Adding an Android Application (Google Play) Adding a WindowsPhone8 Application Windows Phone Store (Microsoft Store) Configurations Accessing the "Configurations" template Configuration naming convention Icon legend Configuration details general Platform filters General configuration details Viewing deleting editing configuration details Custom parameter enabled configuration templates Exchange EAS definition Create an EAS configuration template Create an EAS automated operation to deploy Exchange configurations Exchange (AS) defined account configuration example Exchange (AS) Custom Parameter account configuration example Telenor AppStore configuration Actions and Operations Global operations Definitions of the Operation elements Page 4 / 83

5 Simple operation example Complex operation example Simple scheduled operation example Complex scheduled operation example Adding a new Operation Enabling an Operation Disabling an Operation Deleting an operation Reports Report Scheduling Appendix A Functional group components Main Organisation Main Infrastructure Main Operations Main Reports Main Settings Appendix B Telenor MDM client apps Appendix C Hierarchies and Groups Appendix D Device information Device details Delete and Refresh Device details Actions manual action Available manually applied action commands Device details Actions Security Screen Lock Android device Screen Unlock Android device Screen Lock ios device Screen unlock ios device Device details MDM Client actions MDM Server action Remote support MDM Server actions Assign device To device pool MDM Server actions KNOX Device details, OS specific commands Page 5 / 83

6 15.4 History History MDM operations Connection log Installations Installations Apps Installations Apps KNOX Installations ios Certificates Installations ios Profile SIM card management List of figures Figure 1 Initial login page Figure 2 Successful login screen Figure 3 MDM server 5.09 Global navigation overview Figure 4 Navigating the MDM server Figure 5 Device status indicators Figure 5 Hyperlink navigation Figure 6 Initial Hierarchy and Group structure Figure 7 Simple Hierarchy and Group structure Figure 8 The Users and devices window Figure 9 Add new user information page Figure 10 Add new device details Figure 11 URL link opened to the profile process Figure 12 Initial profile phases Figure 13 Example Apple OS X enrollment Figure 14 Available MDM client apps Figure 15 Change SSP access password Figure 16 Add new device platform selection Figure 17 Unrestricted UI Figure 18 Remove device button Figure 19 Add new device button Figure 20 Edit user data (password) button Figure 21 GPS enabled display Figure 22 Illustrated custom parameter process Page 6 / 83

7 Figure 23 Select type "password" custom parameter from pull down list Figure 24 Select type "default" custom parameter from pull down list Figure 25 Customer parameter value saved Figure 26 Application Search (Apple) facility Figure 27 Automatic insertion of application details Figure 28 Adding Android applications Figure 29 Example Android application search Figure 30 Accessing configuration templates Figure 31 Example of configuration template icons Figure 32 Selecting an existing configuration for review Figure 33 Operations elements Figure 34 Scheduled operation Figure 35 Report scheduling pop up Figure 36 Available MDM client apps Figure 37 Hierarchy&Groups command summary Figure 38 Delete device and refresh Figure 39 Remote support Figure 40 Device Pool - Assign device to user Figure 41 Device Pool - Assign to user Figure 42 Device Pool - Add to pool Figure 43 KNOX compatible password control Figure 44 Device OS specific commands Figure 45 Device history Figure 46 ios device application list details Figure 47 Device installed application listing Figure 48 Administrative KNOX application control Figure 49 Device certificates Figure 50 ios device profiles Figure 51 Editing the SIM card management device entry List of tables Table 1 Minimum device OS version... 9 Table 2 User navigation options Table 3 New user details Page 7 / 83

8 Table 4 WP 8.x username elements Table 5 SSP administrative restrictions Table 6 Custom parameter enabled configuration templates Table 7 Operations elements Table 8 Operations elements continued Table 9 Operations - simple example Table 10 Operations - complex example Table 11 Operations - scheduled example Table 12 Scheduled operation detail Table 13 Actions manually applied to the selected device Table 14 Device security commands Table 15 Device MDM client actions Table 16 Remote support matrix Table 17 Device OS specific commands Table 18 Device History table description Table 19 Device History display options Table 20 History MDM operations headers Table 21 Installation information matrix Table 22 Device application list details Table 23 Knox application details Table 24 SIM card data details Page 8 / 83

9 1 Usage information This Quick Start Guide is written with the understanding that the user will have a configured Telenor MDM instance available for the sole purpose of managing mobile devices. At present, the Telenor MDM server supports the following mobile devices: 1.1 Platform Android >= 2.1 Apple ios >= 5.0 Apple OS X >= 10.x Windows Phone >= 8 Windows Device >= 8.1 Minimum OS device version Symbian S60 >= S60 3 rd Edition Feature Pack 2 About Table 1 Minimum device OS version The Quick Start Guide has been designed to assist a novice user in the enrollment of their mobile device to the Telenor MDM server. Each section of the document will list the topics that will be covered, in a logical order. At the end of each section will be a small note indicating advanced topics that can be performed and where the information may be found. Appendixes have been added for supplemental information. 1.2 Home hyperlink A hyperlink (^ Home) is inserted into the bottom right-hand side of the footer which when pressed will return the reader to the beginning of the document and is only active in PDF format. 1.3 Description of the warning flags This document may contain warnings and safety recommendations of the following meaning: Attention: May have undesired consequences Advanced information General information Page 9 / 83

10 1.4 Greyed (read-only) items Two discrete colours are used to designate write enabled (editable) and read-only (non-editable) commands and information throughout the entire MDM server Read only configuration elements are usually configured (and protected) by the Global Administrators security credentials. Read only information can also include information retrieved from a mobile device and is readonly by default. Read only information can also include absolute values, information and totals; the information retrieved and displayed in a report for example. 1.5 Any Configuration template, Application, or parameter that has the [Global] suffix is only editable by a Global administrator. Information omissions The MDM server can only display information that is provided by the mobile devices. In the following example, taken from a Symbian S60 device, Device > Applications there appears to be an omission of the program name within the returned information. There are two types of programs in Symbian S60 devices - applications and processes. Only the application has a "Program name" which is displayed, whereas the application is not named, hence the apparent omission in the display Please be aware that the MDM server will only display information retrieved from the mobile device(s). Page 10 / 83

11 1.6 Additional documentation The following additional documentation is available from your Telenor representative, service provider, and the following website Revision details have been omitted from the documentation list as the most current version will be available from your Telenor representative or service provider Page 11 / 83

12 2 Login and UI navigation In this section: 2.1 Login to Telenor MDM server Navigation layout UI layout and navigation Menu items and hyperlink navigation Login to the Telenor MDM Server All users login to the common MDM server web page using their predefined user name and associated password. Figure 1 Initial login page. When using the cloud solution, the service provider will supply the credentials of the Global system administrator. Your username and password will be presented to you by the system administrator. The password is case sensitive. Repeated insertion of an incorrect password will result in the account (username) being blocked by the MDM server. An initial grace period of 15 minutes must pass before attempting to login to the MDM server. If further repeated insertion of an incorrect password is detected, then the username will be banned for a prolonged period of time. The system administrator's assistance is required at this point. Additional administrators may be added to the MDM server. Navigate to Settings > Base > Admins and refer to the Admin Guide for further guidance. Page 12 / 83

13 2.1 Successful Login Figure 2 Successful login screen Language selection Pulldown The administrator may choose to display the UI from the illustrated available languages. The preferred language of a user, once selected (or altered) will be retained by the MDM server, during consecutive login/logout sessions. The displayed language may be changed at any time, the UI screen will refresh, displaying in the chosen language Tenancy selection Pulldown For a Global administrator the tenancy pulldown selector will allow the Global Administrator to navigate to another tenancy with the MDM server. For Tenant administrators the tenancy pulldown will only indicate the tenancy that has been allocated to the Tenant administrator. In the example above the tenancy is referred to as the "Dokumentation" tenancy Logout button A user may logout of the MDM server by selecting the logout button at any time during their session. The logout button and tenancy and language pulldown selectors are always available. Page 13 / 83

14 2.2 Navigation layout The MDM server navigation is achieved by selecting a main "header" menu subject (pictured with white background) of the Dashboard, Organization, Infrastructure, Operations, Reports and System settings. Figure 3 MDM server 5.09 Global navigation overview Each header menu item, when selected, will open a new web page, containing the vertical section menu items (pictured with grey background), such as Users & devices, Device pool and Unregistered devices.each section sub menu element will have a detailed configuration panel associated with it. Page 14 / 83

15 2.3 UI Anatomy The information and features in the Telenor MDM server are presented in a number of browser pages. This section describes the design structure used. Figure 4 Navigating the MDM server 1. Main Menu tabs (horizontal) All Telenor menu options are divided into tabs along the top edge of the window. The currently selected tab is shown in a contrasting colour. The example above shows the "Organization" tab is selected. 2. Page menu items (vertical) When a main tab is selected, a new page is displayed. In the left-hand side of the page are menu items that can be selected which will open further menu options. The currently selected page menu item is shown, slightly wider and in a contrasting colour. 3. Page menu The page menu is displayed in the middle of the screen. The page menu can typically be made up of several panels, all with increasing functional layers available when selected. 4. Dynamic filter bar The dynamic filter bars are usually cylindrical in shape and accept text as input. As each letter is typed, a dynamic search of the relevant MDM server table is completed, with the results being dynamically displayed. As more text is inserted, the displayed results will decrease until either the required information is located, for example, "Name" or "No data available in table" will be shown. Page 15 / 83

16 2.4 Device Status indicators Coloured shaped symbols Navigate to Organisation > Users & devices and expand upon any user select. Listed below each user is a list of all the devices that are currently registered to that specific user, along with an indicating coloured symbol. Indicating Symbol Description No symbol Device is enrolled and in frequent communication with the MDM Server Grey square Device is not active Red circle Device has not connected Yellow triangle Device activation is pending Figure 5 Device status indicators The table above describes the meaning of each coloured symbol. 2.5 Documentation navigation Within the documentation, the greater than sign ( > ) separates items in a menu navigation string. For example, Operations > Operations > Is roaming > Pull down selection ( Yes / No ) indicates that you first choose "Operations" from the main menu tabs, then "Operations" from the left-hand vertical sub menu options, followed by the selection of an operation name, then the condition to be applied Command navigation Command navigation consists of a command tagged onto the navigational direction: Select the Organization > Hierarchies & groups > Add a new hierarchy will instruct the administrator on how to locate the "Add a new hierarchy" command within the MDM server. Page 16 / 83

17 2.6 Hyperlink navigation Hyperlinks are used to allow detailed examination of information. For example, if an Operation (named All LockCode Policy) has been deployed to a device, a status message would be included in the device history. Figure 6 Hyperlink navigation Selecting the " All LockCode Policy " hyperlink will open the Operation > All LockCode Policy allowing closer examination. Selecting the browsers "back" button will return the administrator to the device history log. When hyperlinks are available, selecting the hyperlink will either: Navigate the administrator to the origin of the link, for example, a configuration statement To further functionality, for example, with the displaying of GPS records It is always advisable, due to the dynamic nature of the updating data, for the administrator to restart their query with the vertical menu buttons. Page 17 / 83

18 3 Adding a new user In this section: 3.1 Add groups and hierarchies Add a user details Add/Explore Hierarchies & Groups Hierarchies and groups allow the Telenor MDM system administrator to define an organisation structure using logical levels to either reflect their own organisational structure, or to create a new organisational structure to assist with their mobile device management. A default MDM server tenancy does not have an established hierarchy or groups. It is the responsibility of the new tenant administrator to define the hierarchy and group structure. Navigate to Organization > Hierarchies & Groups > Add a new hierarchy Figure 7 Initial Hierarchy and Group structure Figure 8 Simple Hierarchy and Group structure This initial framework when established will greatly assist in the formation of the initial hierarchy and groups. Commands used: Add a new Hierarchy insert "Sales" Select the "Sales" Hierarchy then Add a new subgroup insert "North" Select the "Sales" Hierarchy then Add a new subgroup insert "South" Simple Hierarchy and Group structure complete The hierarchies and group functionality offers the user an administrator the flexibility of adding hierarchies, groups and subgroups, along with allocating specific y users and devices to specific groups and hierarchies. Hierarchies and groups may be created using the CSV Import facility, see the CSV Import facility document for more details For an expansion of commands see Appendix C Hierarchies and Groups Page 18 / 83

19 3.2 Add New User Navigate to Organization > Users and devices > Add user When selecting the "Users & devices" tab, the administrator is presented with the following: Figure 9 The Users and devices window The system administrator has the following navigation options: Detail Collapse all Expand all Add user CSV import Description Selecting the "Collapse all" link will collapse the expanded view if the current hierarchy Selecting the "Expand all" link will expand the users view, allowing detailed inspection of the registered user. Selecting the "Add user" button will allow the registration of a new user to the MDM server. CSV import allows "bulk importing" user information into the MDM server Table 2 User navigation options Once "Add user" is selected, the "New user data" window is revealed. Figure 10 Add new user information page All input fields highlighted with a red star are mandatory Page 19 / 83

20 3.2.1 Complete new user details Prior to adding a new user to the Telenor MDM server, the administrator will ensure that the following details are available:-. First name, last name and either address OR UserId are mandatory fields that are required when adding new user information. User information fields Detail First name* Last name* address* UserID* WP8 username password Group allocation Custom Parameters Description The first name of the new user The surname of the new user An address of the new user (Either is mandatory OR UserID) A unique numeric code of the manually assigned to the user (Either is mandatory OR UserID) If a WP8 user, then a WP8 username is required If a WP8 user, then a password is required The groups that the new user will be a member of User assigned custom parameters, the users device(s) inherit these values Table 3 New user details For details regarding the use of "Custom Parameters" (see Custom Parameters) The username and password for enrollment must be defined using an explicit format in the MDM Server Users & devices page as WP 8.x user name and WP 8.x password for every user to enroll their Windows Phone. The username for enrollment defines where the WP 8.x device will find the "Auto- discovery service" and must consist of following parts: Username.mdm_instance@Name_of_Autodiscovery_Server e.g. tonyd.tndktraining@dmass.de This Windows Phone 8 username and password must be communicated to the user of the registered device to allow them access to the Company Hub. The "Add device" button only becomes available when a user is selected.- It allows the administrator to complete the information of the new device If multiple users need to be added to the system, then please refer to the CSV Import documentation. Other methods of importing large numbers of users are also available and are usually determined by the Global administrator Page 20 / 83

21 4 Add a device - General Before enrolling any device to the MDM server please make the following checks: Verify the time and date is set correctly on the device Verify a valid Wi-Fi access point for Wi-Fi only device Verify battery is good and fully charged Verify the user is in a safe position to use the mobile device Highlight the user that you wish to add a mobile device to: Navigate to Organization > Users and devices > Add device the "New Device data" configuration page will be displayed. Insert the new device details Figure 11 Add new device details Once the device information has been inserted then: Select - Enroll via requires a valid address Select -Enroll via SMS will only be displayed when a valid mobile telephone number is inserted using International format ( e.g ) If you are adding an ios device, then the "Apple ios" tab must be selected, and the details of the Apple IOS device inserted. The MDM server will not be able to effectively communicate with a device that has been entered into the wrong platform. The "Ownership" pull down selection allows the system administrator to define whether a device is owned by the user "private" or owned by the enterprise "Corporate" Page 21 / 83

22 4.1 Add an Android device The Telenor MDM server currently supports the following Android devices (OS must be >=2.1), and an appropriate MDM client will be automatically downloaded to the Android device during enrollment: Samsung HTC Other manufacturer Two methods exist for enrolling an Android device to the MDM server SMS enrollment By sending an SMS text message (Enrol via SMS) to the device, which contains a MDM client download link and embedded activation data which is the quickest method for Android enrollment. Expected user interaction: Open the SMS text message Select the URL hyperlink The MDM client will be downloaded Select the downloaded MDM client "Accept" and install the MDM client Read ( if required) the advisory At the end of the advisory select "Install" Once installed select "Activate" Automatic activation with SMS enrollment Insert Activation Security code ( default 1234) Acknowledge Backup security code warning The Device is enrolled and connects to MDM server A valid IMSI telephone number, in international format (+45 etc.) must be inserted into the device details before the "Enroll via SMS" button becomes visible. The user must accept additional steps that are required for Samsung devices before the device is enrolled to the MDM server. The additional registration steps have been made mandatory by Samsung Page 22 / 83

23 4.1.2 QR code enrolment By sending an message (Enrol via ) to the registered user of the devices address. This message contains a MDM client download link and attached QR code. The QR code contains the MDM client activation data, and must be scanned from within the MDM client UI by the user's device during MDM client activation. Typical message with attached QR code Expected user interaction: Open the on device and QR code display device Select the URL hyperlink The MDM client will be downloaded Select the downloaded MDM client "Accept" and install the MDM client Read ( if required) the advisory At the end of the advisory select "Install" Once installed select "Activate via QR code" Point the device's camera to the QR code Insert Activation Security code ( default 1234) Acknowledge Backup security code warning The Device is enrolled and connects to MDM server Displaying and capturing the activation QR code During Activation select "Activate via QR code" Point the device's camera to the QR code The QR code will be displayed on the activating device. The QR Code will be processed by the activating MDM client. Once the QR code is approved, the activation will proceed and the user will be asked to: Insert Activation Security code ( default 1234) The user must accept additional steps that are required for Samsung devices before the device is enrolled to the MDM server. The additional registration steps have been made mandatory by Samsung Page 23 / 83

24 4.2 Adding Apple ios devices Apple devices are either Wi-Fi only and capable of receiving messages, or IMSI and capable of receiving SMS text messages. For any administration of Apple device it is important that a secure form of communication is enabled between the MDM server and the Apple device. This is achieved by enrolling the Apple device to the MDM server using Apple's MDM profile. The Apple MDM profile is a trusted exchange of security certificates that creates an absolute connectivity of the Apple device to a MDM server, utilising Apple's APNS (Apple Push Notification System) Once this secure connectivity has been created, the MDM server is allowed to silently manage the Apple device Add Apple profile via message Once the "Add new device" ios form has been completed, the administrator would select the "Enroll via " An message will arrive at the users registered address. The user would then open the message and select the Apple profile hyperlink. Once selected, Apple MDM profile enrollment will begin on the user's device. (See User accepts the profile installation request ) Add Apple profile via SMS message Once the "Add new device" ios form has been completed, the administrator would select the "Enroll via SMS" An SMS message will arrive at the users registered mobile phone number. The user would open the SMS text message and select the Apple profile hyperlink. Once selected, Apple MDM profile enrollment will begin on the user's device. (See User accepts the profile installation request ) Page 24 / 83

25 4.3 Apple ios User accepts profile installation request Once opened on the user's device, the following sequence of questions will be displayed on the user's ios device: Figure 12 URL link opened to the profile process. The user has to agree to the installation of the Apple MDM profile by inserting their device passcode, then selecting the Install Profile button. The device passcode will only be required to install the Apple MDM profile if previously enabled on the device Profile installation acceptance Once the user has agreed to install the profile, the profile installation process automatically proceeds. Figure 13 Initial profile phases. The Apple Profile initially progresses through and pauses with a "Warning" that the end user must accept by selecting Install, which will then reveal a final question regarding "Remote Management" of the device. By selecting " Trust" the user has agreed that their device (whether business or privately owned) can be remotely managed by the organisation issuing the ios profile. " Trust" is only seen with ios 8.x and ios 9.x devices having being introduced in ios 8 Page 25 / 83

26 4.4 Add a Symbian S60 device The Symbian S60 device may only be enrolled via an SMS message SMS enrollment By sending an SMS text message (Enrol via SMS) to the device, which contains a MDM client download link and embedded activation data which is the quickest method for Symbian enrollment. Expected user interaction: Open the SMS text message Select the URL hyperlink The MDM client will be downloaded Select the downloaded MDM client "Accept" and install the MDM client Read ( if required) the advisory At the end of the advisory select "Install" Once installed select "Activate" Automatic activation with SMS enrollment Insert Activation Security code ( default 1234) Acknowledge Backup security code warning The Device is enrolled and connects to MDM server A valid IMSI telephone number, in international format (+45 etc.) must be inserted into the device details before the "Enroll via SMS" button becomes visible. Symbian S60 MDM client, Navigate to Options -> Connection -> Select access point Access Point 1 configure for Home Wi-Fi Access Point 2 configure for Work Wi Fi Access Point 3 configure for SIM Data services The Symbian MDM client access the "cheapest" internet connection when available Symbian S60 devices must have a valid Access Point designated within the MDM client before it will connect with the MDM server. On the device, Navigate to Options -> Connection -> Select access point. Page 26 / 83

27 4.5 Add a Windows Phone 8 device The username and password for enrollment must be defined using an explicit format in the MDM Server Users & devices page as WP 8.x user name and password for every user to enroll their Windows Phone. The username for enrollment defines where the WP 8.x device will find the "Auto- discovery service" and must consist of following parts: Username.mdm_instance@Name_of_Autodiscovery_Server e.g. tonyd.tndktraining@dmass.de Windows Phone 8.x Username Dot MDM5 WP8 auto-discovery server URL Value A unique name (for example, tonyd) A dot (.) delimiter The MDM Server instance (for example tndktraining) delimiter Server address (dmass.de) Table 4 WP 8.x username elements This Windows Phone 8 username and password must be communicated to the user of the registered device to allow them access to the Company Hub. The WP 8.x username is case sensitive and must be unique within the "Auto-discovery service", MDM tenancy and MDM server schema. Duplicate WP 8.x usernames are detected when initially entered into a user's profile (Organization > Users and devices > users). The MDM server will display the following message if a WP 8.x username already exists. the same WP 8.x username already exists" "User with If a device is added to the MDM server without a defined IMEI, then the MDM server will create a new device entry, which will need to be deleted (no data). If the user is in possession of their correctly formed WP 8.x username, and WP 8.x password, they can enroll their WP 8.x device into their MDM server by selecting the following on their device: On their WP 8.0 device navigate to: Settings System Company Apps On their WP 8.1 device navigate to: Settings System Workplace Select enroll; insert their WP 8.x username and password. The enrollment process is initiated by the device user. Page 27 / 83

28 4.6 Add a Windows device Navigate to Organization > Users & Devices. The "New user data" window will open. Insert the details of the new user, and press "Save". The new user will be created in the MDM server database. 4.7 Adding a Windows device to MDM server user The Windows device only requires the Windows device username and password to be defined in order to enroll into the MDM server. The enrollment process is initiated by the device user. Every enrollment of a Windows Device creates a new device instance on the MDM server even if the device already exists! The Windows device management protocol does not (at this point in time) uniquely identify the device to the MDM server 4.8 Add an Apple OS X device Apple OS X devices are Wi-Fi only and capable of receiving messages. For any administration of Apple device it is important that a secure form of communication is enabled between the MDM server and the Apple device. This is achieved by enrolling the Apple device to the MDM server using Apple's MDM profile. The Apple MDM profile is a trusted exchange of security certificates that creates an absolute connectivity of the Apple device to a MDM server, utilising Apple's APNS (Apple Push Notification System) Once this secure connectivity has been created, the MDM server is allowed to silently manage the Apple device. 4.9 Add Apple profile via message Once the "Add new device" OS X form has been completed, the administrator would select the "Enroll via " Figure 14 Example Apple OS X enrollment An message will arrive at the users registered address. The user would then open the message and select the Apple profile hyperlink. Once selected, Apple MDM profile enrollment will begin on the user's device. (See Apple ios User accepts profile installation request) Page 28 / 83

29 4.10 Add an Unknown device At times, the automated device recognition and MDM client download facility fails due in part to the proliferation of Android devices manufacturers. In such situations, the user must, using the devices web browser, be instructed to do the following: 1. Navigate to (The following web page will appear) Figure 15 Available MDM client apps 2. Manually selected by tapping the "Andre" MDM Klient When the MDM client has been downloaded, follow the instructions for enrolling an Android using QR code (see QR code enrollment). The MDM administrator will forward the QR activation code to your registered address Page 29 / 83

30 5 Add a device Self Service The self-service portal allows end-users to manage their own devices. The Telenor SSP can be accessed through the following URL The Telenor SSP will allow: End-user to locate device (GPS) End-user to register their device End-user to lock / clear passcode End-user to install optional policies on their devices The SSP (Self Service Portal) is designed to allow any registered user to enroll their mobile device into the Telenor MDM server allowing their device to benefit from the automation allowed by mobile device management. The Self Service Portal utilises the users address and defined password as authentication. The user may change their password at any given time using the "Forgot password?" facility which for security reasons only allows a password update conversation with the registered users address. 5.1 Prerequisites The user must be registered within the MDM server database, have a current address, and a mobile device capable of being managed in a MDM environment. Page 30 / 83

31 5.2 Enrollment delegation The SSP allows administrators to delegate the enrollment of their devices into the Telenor MDM environment by simply sending an with the URL of their Telenor Self Service Portal to a registered user. 5.3 User independence The user, on receipt of the , would then log in to the SSP using their MDM server configured address and password. Enroll a new device Delete an existing device Lock a device screen Unlock a device screen Add an application Change SSP / MDM server password All user enabled features are enabled by the server administrator. If a feature is not available then a request should be made to the MDM server tenant administrator. 5.4 Location and Time zone independence The user, can at any time, and from any internet browser, log into the SSP and update their mobile situation. 5.5 Incorrect login credentials Any user wishing to utilise the SSP facility must know their MDM server registered address, and password. An "Invalid and/or password" notification will be displayed if the user has inserted an incorrect (or unregistered) address and/or password. Page 31 / 83

32 Typically the "Password" entered is incorrect, which may be reset by selecting the "Request password" hyperlink. 5.6 Password request Once the user selected the "Request password" hyperlink, an will be sent to the specified address. And the user will be informed by how to proceed resetting their password. The customer must select the hyperlink contained within the "Self Service Portal Reset password" . Once selected a "Set password" screen will become available. The user would then insert a new password, repeat the new password and press the "Set password" button. Page 32 / 83

33 If the password and repeated password are not identical, then the user will receive the "Repeated password must be the same" pop up notification. If the password and repeated password are identical, then the user will receive the "New password is set" pop up. The user would then select the "Back to login page" and enter their registered address and newly set password Finally the user would select the "Login" button to enter the self-service portal Password change Once successfully logged into the SSP UI the user may select the blue "edit" button, located adjacent to the users address. The edit button will allow the user to change their password to a more memorable password if required. Figure 16 Change SSP access password The user enters their new password and then selects the blue "Save" button. The user's newly created password is now saved and must be used at next logon. Page 33 / 83

34 5.7 Home screen UI On completion of a successful login the user will be allowed to perform selective tasks with the mobile device depending upon the restrictions configured by the administrator. 5.8 GUI Navigation The SSP GUI interface is written using AJAX and is therefore self- contained. Navigation is accomplished by clicking on the specific horizontal menu tab that you wish to utilise. Selecting the browser "back" button will terminate the users SSP session. 5.9 User & Devices tab The User &devices tab will display all information that has been provided by the system administrator for them to view. The main elements are listed in the table below. Title Name Password Device Platform Model Phone number Description Displays the user name associated with the device Displays the registered address of the user. This is used to log into the SSP and will be used in all correspondence between the user and MDM server (e.g. with password reset) The password of the users account which may be changed by the user Displays the "given" name of the device Displays the platform (architecture) the device is associated with Displays the absolute model number of device, not the marketing name Displays the telephone number of the device if registered with the MDM server The information displayed within the SSP's menu system is dependent on the Administrative restrictions. (See Administrative restrictions) Page 34 / 83

35 5.10 SSP Adding a new device Figure 17 Add new device platform selection The user would then select the device platform they would like to add to the MDM server and press the appropriate platform button. Once a platform has been selected, the enrollment of the selected platform device will commence. For examples, see Adding Apple ios devices Add an Apple OS X device Add an Android device Add a Windows device Add a Symbian S60 device The device will be shown on the users SSP UI when the device has successfully enrolled into the MDM server. The information displayed within the SSP's menu system is dependent on the Administrative restrictions. (See Administrative restrictions) Page 35 / 83

36 Actions Tab The "Actions" tab will allow the user to perform the following limited activities on their selected device. Allow lock and unlock When enabled allows the user to deploy a lock code to ios, OS X, Android, and Symbian devices. If a lock code exists, and "Unlock" is used, then any lock code will be removed, allowing the user access to their device. Allow device wipe When enabled and the "Wipe" device button is selected, a wipe device command will be sent. A forced connection to the device will be made and the device will initiate a security erase when received. Allow push notification messages When enabled, the user will be able to examine the "push notification" messages sent to the device. The user will be able to follow the operational notification messages as they are generated. The information displayed within the SSP's menu system is dependent on the Administrative restrictions. (See Administrative restrictions) Page 36 / 83

37 5.11 Applications Tab The applications tab will display all recommended applications that have been made available to the user through the Telenor AppStore The information displayed within the SSP's menu system is dependent on the Administrative restrictions. (See Administrative restrictions) GPS The GPS tab will display collected GPS data from the device if the user's security policy allows collection of GPS data and if the device is actually using GPS data. The information displayed within the SSP's menu system is dependent on the Administrative restrictions. (See Administrative restrictions) Page 37 / 83

38 5.13 Administrative restrictions A typical SSP user interface may be similar to the UI shown below. Figure 18 Unrestricted UI The SSP display language can be changed by clicking on the displayed language indicator which reveals the other language options. The SSP is available to display in the following languages: English, German, Spanish, Danish and Finish. Some of the above features may not be visible. The administrator may limit the functionality available to the end user by either enabling or disabling the available features through the MDM Server Settings > SSP > SSP Field Enable SSP Enable AD authentication Allow registration of new device Allow removal of device Allow editing of user data Allow GPS Allow lock and unlock Allow wipe Allow push notification messages Allow install application Description The SSP infrastructure is available to users when enabled Allow SSP users to authenticate with Microsoft's AD Allow a user to register a new device Allow a user to remove Allow a user to edit their password Allow GPS data to be displayed in the SSP Allow the user to issue the lock or unlock command to a registered mobile device Allow the user to issue a security wipe to a registered mobile device Allow device push notification messages to be displayed in the SSP Allow the user to install an available application Table 5 SSP administrative restrictions The SSP is common to all users. Different SSP profile cannot be created for different user or user groups, allowing a convenient facility to users. Page 38 / 83

39 Enable SSP The SSP can either be enabled and available at a typical address of or disabled. When enabled, specific functionality is either enabled or disabled by the administrator Enable AD authentication When AD authentication is enabled, the user will gain access to the MDM SSP using their Microsoft Active Directory user credentials as opposed to their registered MDM server credentials Allow removal of device When enabled will allow the user to select (by mouse clicking) a registered device that they wish to remove from the MDM server by clicking the red "X" remove button. If this feature is not enabled, then the red remove button will not be visible to the user. Figure 19 Remove device button Allow registration of new device When enabled, the "Add new device" button will be displayed on the User and Device tab. If a user selects the "Add new device button" then a new window will appear (see device platform error!) which displays the available device platforms that can be enrolled into the MDM server. Figure 20 Add new device button If the user selects the "add new device" button the following screen will be revealed: Page 39 / 83

40 Allow editing of user data When enabled will allow the user to edit their MDM server password by selecting the blue "Edit" button. Figure 21 Edit user data (password) button If this feature is not enabled, then the blue "edit" button will not be visible to the user Location tab Allow GPS When enabled and the "location" tab is selected will display the GPS coordinates and map of the last reported location communicated by the device to the MDM server. The results displayed are dependent upon the registered device allowing "location services", or GPS data from their MDM client to be transmitted from the device to the MDM server. Figure 22 GPS enabled display If the user has many devices registered with the MDM server, then the location displayed of the last recorded location will be different as each device is selected, unless all the devices are in the same location, for example, an office desk. Page 40 / 83

41 6 Device information Navigate to Organisation > Users & devices > User > device > Details A tremendous amount of detail are displayed. For a full explanation of all the contents listed within the fields see Appendix D Device information This section refers to the information available from the "Device details" window Page 41 / 83

42 7 Custom Parameters Custom parameters allow the efficient utilization of the MDM Server to distribute multiple configuration parameters to multiple users, by defining the end user information once, and using one configuration template. If, for example, the administrator wishes to deploy "Exchange settings" to 1,000 users through a configuration template, most of the detail found in the configuration template is common to all recipients, except for the values of "Exchange username" and "Exchange password". The administrator would then define an Exchange Configuration template, using custom parameters for the user name and password. When this configuration template is sent to users, either through an Action (See Action), or Operation (See Operation), then the custom parameters will be substituted by the user's unique username and password. Figure 23 Illustrated custom parameter process Custom parameters: Allow the MDM server to substitute selected data, such as a user's "Exchange address", or device characteristics, such as the device "MAC address" when deployed to an enrolled device. Are identical in creation, format and configuration. The primary function of a custom parameter is to substitute user configuration values (e.g. Exchange username) within MDM server configuration templates. Can be defined as type "default", where the values assigned to the custom parameter are visible, or type "password" where the values are encrypted and displayed as "******", hiding the true values. Page 42 / 83

43 7.1 Adding Custom Parameters Custom parameters can be defined as either type "password", in which case, the information presented to the Telenor MDM server remains hidden, and encrypted, or as type "default", in this case the contents of the custom parameter is visible Defining a type "password" custom parameter Navigate to Settings > Base > Custom Parameters > Add new Complete the pop up item with a memorable name for the Custom parameter name. If the Custom parameter value is to be hidden, ensure the Customer parameter type password box is checked. Selecting OK will create and display the new Custom parameter Defining a type "default" custom parameter Navigate to Settings > Options > Custom Parameters > Add new Complete the pop up item with a memorable name for the Custom parameter name. If the Custom parameter value is to be hidden, ensure the Customer parameter type password box is checked. If the Custom parameter has a general "default" value, and the administrator would like the value of the parameter to be visible, ensure that the Customer parameter type password box is not checked. Selecting OK will create and display the new Custom parameter Custom Parameters deletion Navigate to Settings > Options > Custom Parameters The custom parameters main window displays all previously registered custom parameters. Only existing custom parameters may be deleted by selecting the adjacent "Delete" button Assigning a value to a custom parameter Navigate to Organization > Users & Devices> Details > Custom Parameters. In the Custom parameters section, select "Add new". All previously defined Custom Parameters will be displayed, if none are available, then select "Add new". Figure 24 Select type "password" custom parameter from pull down list From the pull down menu, select the custom parameter that you wish to assign a value, and insert value for selected custom parameter, the press OK. Page 43 / 83

44 The Custom Parameter "ExchangePassword" was created as type "secret" therefore the value of the password field will be hidden. Figure 25 Select type "default" custom parameter from pull down list. The Custom Parameter "ExchangeUsername" was created as type "default"; therefore, the value of the username password field will be seen. On completion the Organization > Users & Devices > Details > Custom Parameters will display both the "ExchangePassword" and "ExchangeUsername" Custom Parameter. Figure 26 Customer parameter value saved The values of type "password" are not displayed due to the encrypted nature of the "password" type customer parameter; any suspected problem can be corrected by deleting the assigned value, then recreating the custom parameters value. Page 44 / 83

45 8 Adding Applications The addition of Apps for ios, Android, Windows Phone8, Symbian and Mac OS X devices to the MDM server is accomplished by the following steps: 1. Add a (new) application name via Infrastructure > Application > Add 2. Insert the application detail, access rights and logo 3. Define the URL or file location of the application package For ios devices, the "Search (ios)" facility will automatically populate all application fields (except "categories" and "Available in AppStorage") allowing speedy additions of ios application packages to the MDM server (see Adding an ios Application (using the Search (ios) facility) ) For Android devices, the "Search (Android)" facility will automatically populate all application fields (except "categories" and "Available in AppStorage") allowing speedy additions of Android application packages to the MDM server) (see Adding an Android Application (Google Play). For Window Phone 8 devices (see Adding a WindowsPhone8 Application ) The URL magnifier symbol, when selected for ios applications, will retrieve the BundelD from the downloaded.plist and automatically populate the version and ID fields. The URL magnifier symbol, when selected for Android applications, will retrieve the package name and version and automatically populate the version and ID fields. Application version update: 1. If a newer version of an application is available through the appropriate App stores, administrator must do the following: 2. Edit the Application configuration 3. Delete either the ios or Android application Version an ID fields (whichever is appropriate). 4. Click on the adjacent URL magnifier symbol - the Version and ID fields will be populated with the updated Version and ID information from the current App. If no application information is available the "!" sign will be populated in the Version and ID fields. Page 45 / 83

46 8.1.1 The application details window The application details window is made up of the following elements: Details Name Description Description The inherited name of the application. Change the application name as require A free text area describing the application. When using the "Search (ios)" facility, this field will be populated with the description as it appears in itunes Categories Categories may be added or deleted using the "Edit" button Adding a category Deleting a category Logo Search (ios) Allows the administrator to select a logo from their file system. When using the "Search (ios)" OR "Search (Android)" facility, the logo will be populated with the logo as it appears in itunes/google Play. If, however, the itunes/google Play logo is not required, the administrator can still apply their choice of logo by selecting the "Upload logo file" button, or clear by selecting the "clear" button The Search ios field enables the administrator to search the itunes database directly. If an application is selected from itunes, then the detailed information is completed automatically. Search Term For example Lync Device selection Select either iphone or ipad The default device is iphone Search Country Select either us,de,at,es,dk,fi The default country is "dk" Search (Android) Search For example Lync The Search Android field enables the administrator to search the Google Play database directly. If an application is selected from Google Play, then the detailed information is completed automatically. Once the application details have been entered, select "save" button to commit the information to the MDM server. Once the application is added to the MDM Server, it is can be made available either manually or automatically to the end user through: Manually: Administrator selects Device Actions > Install application User selects the application through the device's Telenor AppStorage functionality (ios and Android devices only) Automatically: The administrator selects Operations > Operation and creates an operation, which when satisfied, allows the specified application to be installed on the user's device. Application availability is determined by the "Availability in AppStorage" selection button located in the General details pane of Configurations > Application List. Page 46 / 83

47 8.2 Adding an Apple Application (using Search (Apple)) The "Search (Apple)" utility is located at the bottom left hand side of the application details pane. The administrator would select the country code, from the Region drop down menu and the Apple device group, either iphone, ipad or OSX, from the device pull down menu. Figure 27 Application Search (Apple) facility The administrator can, for example, insert any of the following search phrases: 1. The Bundle ID (com.rovio.angrybirds) OR 2. Free search text partial or complete (e.g. Angry Birds), the device and specific country code. The itunes store is dynamically searched, presenting the search results below the "Search (Apple)" input field. Having inserted the term "Angry" into the Search (Apple) field, the available results are dynamically returned. If "Angrybirds" is selected, the following completed application form will be revealed: Figure 28 Automatic insertion of application details. Page 47 / 83

48 The only administrator task remaining would be to add a "Category". 8.3 Adding an Android Application (Google Play) Navigate to Infrastructure > Applications and select the "Add button". Figure 29 Adding Android applications In the dynamic Search (Android) box, insert the name of the (Google Play) application that you require e.g. Angry Figure 30 Example Android application search Select the application that is required. Once selected the Search (Android) facility will automatically complete the following: 1. Populate description field 2. Populate the logo field 3. Add the source URL to the Android application definition window 4. Add the Application ID to the Android application definition window The automatic population of the application fields is dependent upon Google Play store. Once the application has been selected from the results returned by the dynamic Search (Android) form, the application information is updated in the appropriate fields automatically When satisfied with the details, the administrator will select the "Save" button, committing the application description to the MDM server database. Page 48 / 83

49 8.4 Adding a WindowsPhone8 Application The "Install Application" for a WP8 device is NOT for installing applications into the MDM server making them available for deployment to WP8 devices. The "Install Application" function is to update existing applications that have been installed using Company Hub and are signed with the companies unique token for WP8 application signing. The MDM server supports: The updating of company signed applications distributed to the end user(s) device(s) through the "Company Hub" application. Linking to apps. Within the Microsoft Store. Company Hub is an application that acts as a portal to a company specific experience on the Windows Phone 8 device. It is created and signed by the company who wish to distribute "in house" developed applications to their employees without using the Windows Phone Store. It is normally distributed to devices during the enrollment process (of the MDM server) to the company apps location on the WP8 device(s). The applications that reside in Company Hub must be signed with the same certificate as the Company Hub application. Please refer to the associated documentation "MDM Microsoft Company Hub configuration 5.0" for further details in the installation and deployment of the Company Hub Windows Phone Store (Microsoft Store) All applications that are installed by the user from the Windows Phone Store (Microsoft Store) will be updated via the Store application on their WP8 device. Applications that are added to the MDM server via Infrastructure > Applications which then become available to the user(s) via the Company Hub, i.e. those applications created in the MDM server that are linked to the Windows Phone Store (Microsoft Store) will receive updates via the Store application on their WP8 device. To allow any of the installed applications to be available to the users Telenor AppStore, then an Application list must be created, specifying which users are allowed to use what applications. (See Telenor AppStore configuration) Page 49 / 83

50 9 Configurations The Configurations settings of the Telenor MDM server allow the system administrator to utilise prebuilt configuration templates that when completed with the customer's information can be deployed to user's mobile device(s). The following sections provide a summary of parameters, detailed parameter information and examples of typical parameters for the following generic configurations. A unique feature of the MDM server is that once a configuration profile has been defined, and saved, it can be repeatedly delivered too many devices, over an indefinite time period. New features within the configurations templates are expected to be added. These additions will reflect enhancements of both the MDM server operating software and specific mobile device architecture Previously defined configurations may not be updated automatically to include, or take advantage of the new feature(s). The administrator must ascertain which additional features they would like to deploy to which device(s). 9.1 Accessing the "Configurations" template Navigate to Infrastructure > Configurations Figure 31 Accessing configuration templates A list of all defined configuration templates will be shown, along with the "Add" button, which will allow the completion of additional configuration template. The MDM server software package contains predefined configurations when shipped. These are identified with a "Global" suffix and can only be edited by the systems Global administrator. Page 50 / 83

51 9.2 Configuration naming convention The configuration template naming convention is as follows: "Configuration type: User assigned name" The "Configuration type" is assigned automatically by the MDM server. The "User assigned name" is assigned by the administrator when the configuration template is created. This value can be edited. 9.3 Icon legend All configuration template fields inform the administrator which template command (or information) field is compatible with which specific device platform using the platform icon as an indicator. Figure 32 Example of configuration template icons The command can only be deployed to the devices associated with the displayed icons. 9.4 Configuration details general Each configuration template contains the following header structure Filter properties by platform for all configurations General configuration details The opportunity to Edit, Cancel or Save the configuration details Page 51 / 83

52 9.4.1 Platform filters The configuration details will display all applicable platform icons to each configuration setting. If, however, the administrator wishes to view only configuration settings applicable to ios devices for example, then selecting the Apple ios properties filter check box, will display only configuration settings pertinent to Apple ios devices General configuration details Each configuration template contains a "General" heading that indicates the type of configuration template (Exchange in the above example), a friendly "Name" associated with the configuration template and a free text "Comment" field for convenience Viewing deleting editing configuration details To view any existing configuration detail, the administrator would select the configuration by clicking the configuration name with their mouse. The action of selecting a configuration produces the following: The selected configuration is highlighted The configuration details are displayed in a separate window The configuration details can be edited, by selecting the green "Edit" button The configuration can be deleted, by selecting the red "Delete" button. If a configuration is to be deleted, ensure that the configuration is removed from all devices. To check how many devices have a configuration installed, navigate and use the Reports > Configurations The example below shows that the "Exchange: Exchange" has been selected for viewing. Using the window scroll bar, to the right hand side of the visible screen allows the administrator to view the entire configuration details. Figure 33 Selecting an existing configuration for review If the configuration setting "Exchange: Exchange" is no longer required, then it can be removed from the MDM server by selecting the red "Delete" button. A pop up will appear asking to confirm the deletion. Page 52 / 83

53 Once selected, the configuration template can be edited by selecting the green "Edit button". Whilst in edit mode, all configurable fields pull down menus and check boxes will appear with a pale grey highlighted border. 9.5 Custom parameter enabled configuration templates The following configuration templates contain the facility to utilise custom parameters, allowing the same configuration template to be deployed to multiple devices without the need of entering discrete user parameters, such as username and password. A specific custom parameter pull down selection will be revealed when the following names entry fields are selected within the specific configuration templates. Configuration Template Username Password User display name Access Point Sender name Signature https Username https Password Autolock Exchange Global proxy OpenScape Mobile Secure PIM VPN Table 6 Custom parameter enabled configuration templates The following example is taken from the Exchange configuration template. In edit mode, the administrator can either insert an appropriate parameter, for example, username, or they can utilise the pull down selector which will allow the administrator to select from any of the installed custom parameters. Page 53 / 83

54 Once editing is complete, the changes must be saved by scrolling to the bottom of the configuration template and selecting the "Save" button. When the configuration template is installed onto the user's device, the custom parameter will be replaced by the actual value contained within the user's description, for example Joe Smith. 9.6 Exchange EAS definition Navigate to Infrastructure > Configurations > Add > Exchange Select the required configuration template with your mouse pointer. The selection "Exchange" will be highlighted. Enter a memorable name for the new configuration; press the "OK," button. Once all values are entered, select the configuration using the "Save" button. The configuration may now be deployed to any registered device either through the use of a configured "Operation" or directly through the selected devices "Action" pull down Create an EAS configuration template In order to make a configuration profile (for example Infrastructure > Configuration > Exchange) applicable for all selected users, an efficient, automatic method has been established to negate the unnecessary transmission of repeated configuration data. Instead of completing the "ExchangeServer configuration" details with every Exchange username and Exchange password, the following raw Custom Parameters are used. Detail Username field: Password field Description {{DeviceCustomParamId="exchange_username"}} {{DeviceCustomParamId="exchange_password"}} As the configuration profile is assigned and delivered to a specific user, then the value of: Page 54 / 83

55 And the value of: {{DeviceCustomParamId="exchange_username"}} is substituted with the users assigned Exchange Username {{DeviceCustomParamId="exchange_password"}} is substituted with the assigned (hidden) Exchange Password The Custom Parameter achieves this by allowing only the parts that change, in this example, the Exchange username and Exchange Password to be substituted with the values assigned to each user Create an EAS automated operation to deploy Navigate to Operations > and ADD a new configuration, selecting all devices, applying the created configuration Exchange configurations Main Settings Server name Sync while roaming Username Password Domain Number of days to sync Available settings The name of the server Drop down selection of either manual or automatic Either the name of the user OR the Custom Parameter specification Either the password of the user OR the Custom Parameter specification The domain name of the s server Drop selection from typically 1 day to unlimited Available settings Free text field Advanced Prevent move Prevent 3rd Party Exclude recent address syncing Use SSL Available settings Check box true prevents the user from moving messages between accounts Check box true prevents a third party application from sending Check box true - recently used addresses are not sync'd across the device Check box true use a secure SSL connection whilst synchronising Authentication Authentication type Available settings Chose from None, Identity file, Identity file from SCEP account (server side) Identity file from SCEP account (device side) ios5 S/MIME Enabled Signing certificate Encryption certificate Enabled Available settings Check box true enables S/MIME A pull down menu listing all available signing certificates A pull down menu listing all available encrypting certificates Check box true enables per message encryption switch ( new encryption per message) Page 55 / 83

56 9.6.4 Exchange (AS) defined account configuration example Main Settings Server name mail.7p-group.com Username Password ********** Domain Intranet.local Schedule Peak sync schedule Manual selection Off peak sync schedule Manual selection Calendar Sync Calendar Tasks Sync tasks Contacts Sync contacts Advanced Use SSL The MDM server configuration templates displays up to date icons for all eligible platforms. Please ensure that the documentation is current with your installed software release of the MDM Server Exchange (AS) Custom Parameter account configuration example General Type Name Defines the type of configuration settings Configuration settings friendly name Main Settings Server name Username mail.7p-group.com {{DeviceCustomParamId="exch_username"}} Password ********** Domain Intranet.local Schedule Peak sync schedule Off peak sync schedule Manual selection Manual selection Page 56 / 83

57 Calendar Sync Calendar Tasks Sync tasks Contacts Sync contacts Advanced Use SSL {{DeviceCustomParamId="exch_ "}} If the configuration of the user's Exchange account fails, please ensure that the correct custom parameter is used for the individual user. Examine the following device details for each incorrectly configured user. Page 57 / 83

58 9.7 Telenor AppStore configuration Use the following procedure to ensure that an application that has been loaded into the MDM server will be available to defined users through the Telenor AppStore Navigate to Infrastructure > Configurations > Add > Application List Select the required configuration template with your mouse pointer. The selection "Application List" will be highlighted. Enter a memorable name for the new configuration; press the "OK," button. The following Application List template screen will be presented. List type Availability in AppStorage Application - Ensure that recommended is selected. - Ensure that "Everyone" is selected - Add from application list The application may be selectively restricted to user by utilising the "For selected groups" option. If different combinations of stored applications need to be distributed to different group responsibilities, then create addition "Application list" configuration templates. Page 58 / 83

59 10 Actions and Operations Actions can be used by the Telenor MDM administrator to apply a preconfigured "Action" to a specific device, whereas Operations allow the MDM administrator to define a set of conditions, that when met, will apply a desired set of actions to be applied to a defined number of registered devices, as a one off, as scheduled (timed) or when the Operation condition is met. Operations are designed: To assist in the automatic configuration of registered mobile devices. When used in the configuration of mobile devices, the Operations, when defined, will typically be applied once to the mobile device(s). To restrict and report the activities of attached mobile devices. When used in the restriction and reporting of mobile devices, the Operations, when defined, are typically applied to the mobile device(s) every time the device connects (or as defined by the schedule) to the MDM server until the operation condition statement (and action) is fulfilled. Operations are defined as: A simple operation is a test on a predefined condition statement, which if true, allows a predefined action to be performed. A complex operation is a test on multiple predefined conditions statement, which when all conditions statements are true, will allow either a single or multiple predefined actions to be performed A scheduled operation is either a simple or complex operation that utilises predefined schedules Operation Statement: An Operation statement refers to the combination of either a simple/complex condition combined with their associated simple/complex actions - whether schedules or not. The MDM server maintains an "operations statement execution" history ensuring that the selected execution schedule is automated. Operations are "checked" with the operational statement values each time the selected (by operation statement) device(s) connect with the MDM server. The MDM server searches its database to reveal the number of devices that match the Operation condition statement. If new devices have been added to the MDM server that the Operation condition statement refers to, ensure that the devices have connected to the MDM server before proceeding with the deployment of the Operation. If the "Operation execution schedule" is altered, the new "Operation execution schedule" will only be implemented when the user's device has connected to the MDM server, or is forced to connect via a "Force Connection" action or operation. Page 59 / 83

60 10.1 Global operations New MDM server installations may contain preconfigured "Global" operations which cannot be edited Definitions of the Operation elements Navigate to Operations > Add An Operation is created by selecting the predefined values from the State/Schedule, Conditions and Actions pull down boxes, thus creating an Operations "statement" then pressing the "Save" button. Figure 34 Operations elements The MDM server operation section contains the following elements: Operation element Name Description A friendly name used to identify the operation "All Android Devices" State/Schedule OFF Operation disabled (use SEND if required) On every connection #1 On the first connection only Only once Once a day Once a week Once a month Scheduled see Scheduled operations Operation deployed every device connection Operation deployed on first connection only Operation deployed once Operation deployed once a day Operation deployed once a week Operation deployed once a month Table 7 Operations elements The operation must be enabled before it is executed on each device connection. If it is not enabled, it will not be executed, and a "Send" must be used to execute the operation. #1 - When the "on every connection" schedule is used a timeout of 3 minutes has been implemented to ensure that a sufficient period of time has elapsed between the execution of scheduled commands Page 60 / 83

61 Operation element Conditions Edit or Delete Actions Edit or Delete Save Send Delete "No matched devices" OR Description The predefined conditions ( multiple conditions may exist by selecting ADD) Each saved Conditions condition may be individually edited or deleted The predefined conditions ( multiple actions may exist by selecting ADD) Each saved Action condition may be individually edited or deleted The "Save" button is revealed when a change, such as an ADD or Delete ( updates the db) The "Send" will send the operation to matching devices(s) Deletes the Conditions or Actions statement ( Save to retain changes) The MDM server will indicate the number of devices that meet the condition statement. Table 8 Operations elements continued Simple operation example Test condition/query Test value Test result (hidden) Resulting Action to perform Belongs to group Ratingen TRUE Then Install Application Table 9 Operations - simple example All devices that belong to the group "Ratingen" will have the defined application installed onto their device Complex operation example Test condition/query Test value Test result (hidden) Action to perform Belongs to group Ratingen TRUE Then Install Application Table 10 Operations - complex example AND AND Apply configuration Reboot (device) Operations allow the administrator to compile either a single condition, or a group of conditions that when met will allow either a single or multiple actions to be executed on the device, a group of devices or the whole installation. The operational conditions can be edited at any time. Once edited, they must be re applied to the selected device(s) Simple scheduled operation example Select "Once a day" Test condition/query Test value Test result (hidden) Action to perform Belongs to group Austria TRUE Then Install Application AND AND Table 11 Operations - scheduled example Apply configuration Reboot (device) Once a day, all devices that belong to the group "Austria" will have the defined application installed onto their device. Page 61 / 83

62 Complex scheduled operation example From the State/Schedule pull down, select scheduled. Schedule element Logging Period start Run until Repeat Period end Description Check box true enabled. Date and Time of scheduled start Once Forever reveals the "Repeat" dialogue box Until reveals the "period end" dialogue box Every Insert an integer value, qualified with either Minute, Hour or Day(s) On selected weekday(s) check box true Mon,Tues,Wed,Thurs,Fri,Sat,Sun On first day of the month On last day of the month Date and Time of scheduled end Table 12 Scheduled operation detail Figure 35 Scheduled operation Adding a new Operation To add a new operation, select the "Add" button. Insert a suitable name for the Operation into the pop up, and press save Navigate to Operations > Operations Complete the Operation by selecting the conditions you would like to be observed with a suitable resulting action Enabling an Operation Navigate to Operations > Operations Enabling an Operation is achieved by selecting the Operation, then moving the slider button with the mouse pointer to change the state from "Off" to "On". Page 62 / 83

63 Disabling an Operation Navigate to Operations > Operations. Disabling an operation is achieved by selecting the operation, then moving the slider button with the mouse pointer to change the state from "On" to "Off" Deleting an operation Navigate to Operations > Operations. Deleting an operation is achieved by selecting the operation, and selecting the "Delete" button. Page 63 / 83

64 11 Reports The Reports section of the MDM server will return different information dependent upon the administrator status of the user. A Tenant administrator will be able to retrieve selective information from all installed devices excluding the associated tenancy information within the report. A Global administrator, running reports from the Global tenancy view will have an additional column "tenant" added to their report. Specific reports can be ordered using the "Reports" intuitive pull-down filters. All report information can be exported as a CSV file. Reports can be scheduled via the "Schedule this" button Reports containing tenancy information can only be generated by a Global administrator when running the report from the Global tenancy view Report Scheduling Reports now contain a "Schedule this" button located in all Reports templates allowing the Tenant administrator to define the start time, end time, whether the report is run Once, Forever or Until a defined future date for a specific report, and that the report be delivered ( via ) to a specified address Figure 36 Report scheduling pop up Once the Schedule this button is selected within a report, the pop up window will appear. Ensure that a friendly name for the report is entered in the "Schedule name" field; complete the requirements for the report schedule, finally selecting the green OK button to save and schedule the report. Page 64 / 83

65 12 Appendix A Functional group components Below is listed a brief outline of menu component. Some components which are found in the Menu Settings area are not listed and are reserved for the Global Administrator Main Organisation Contains the tools necessary to define the organisational structure, add users and their devices. Users & devices Hierarchies & groups User assignment Device Pool Unregistered devices Add/Delete users and devices Add/Delete/Inspect/Update/Search users and groups Allows the administrator to assign users to groups Displays the "free device" pool that can be allocated to a user Displays devices that are detailed, but not enrolled into the MDM server 12.2 Main Infrastructure Contains the tools necessary to load applications into the MDM server and define configuration settings that can be deployed to devices manually through device actions, or automatically through policies Applications Application wrapping Certificates Configurations Contracts Service History CostGuard Apple VPP Certificate Manager Add/Delete Applications Add/Remove additional application security Add/Delete both Trust and Identity certificates Add/Delete/define configuration details Add device contract (warranty) timestamps Add device service (repair) history Add/Delete/define restrictive usage of both voice and data bandwidth Convenient management of Apple's Volume Purchase Plan Convenient management of proxy security certificates 12.3 Main Operations The "Operations" function group contains the tools necessary to configure and define operation actions and settings that can be deployed to devices manually through device actions, or automatically through policies. Operations Scheduler Create condition logic, when met, operations apply Creates a timed schedule assisting in procedural organisation 12.4 Main Reports Allow the system administrator to produce selective reports from current information held in the MDM server. All reports can have filters applied, allowing either the maximum or minimum amount of information to be viewed on screen, or exported to a CSV file. Inventory Infrastructure Monitoring Including Devices/Models/Platforms/Manufacturers/Firmware Operations/Configurations/Certificates (infra)/applications (infra)/contracts Device metrics, e.g. connection, overdue, wipe failed etc. Page 65 / 83

66 12.5 Main Settings The Settings function group contains the tools necessary to configure and control the MDM Server. Base System Connections Messages ios Android WP8 SSP Define MDM server internet settings and password Define system settings and parameters Define connection settings and parameters Define messaging parameters Define ios specific parameters Define Android specific parameters Define WF8 specific parameters Define Self Service Portal UI configuration Page 66 / 83

67 13 Appendix B Telenor MDM client apps All client specific software may be downloaded from Telenor's client application download site, located at Figure 37 Available MDM client apps The site was last updated February 4, Page 67 / 83

68 14 Appendix C Hierarchies and Groups Use the diagram below to assist in the formation of new hierarchies and groups. Figure 38 Hierarchy&Groups command summary Element Command Action Hierarchy Add new hierarchy Allows the administrator to create a new top level group of a hierarchy Collapse Collapses the hierarchy view, only the top level group of each hierarchy will be visible Expand Expands the hierarchy view, allowing inspection of the subgroups Subgroup Add a new subgroup Add a new subgroup becomes active when any named group is selected. A pop up is revealed allowing the administrator to insert the name of the new subgroup, the action is retained when the "Save" button is selected. Rename Any subgroup can be renamed. A pop up is revealed allowing the administrator to insert the name of the new subgroup, the action is retained when the "Save" button is selected. Terminal (end) group Add a new subgroup Add a new subgroup (to terminal group) becomes active when any terminal group is selected. A pop up is revealed allowing the administrator to insert the name of the new subgroup, the action is retained when the "Save" button is selected. Rename Delete Move member to Any terminal subgroup can be renamed. A pop up is revealed allowing the administrator to insert the name of the new subgroup, the action is retained when the "Save" button is selected. The delete command is only active in any terminal subgroup. All devices must be deleted OR relocated (move member to" another group prior to the subgroup being permanently deleted from the MDM server database. Move member to allows the administrator to move (relocate) all members (and their devices) present in a selected terminal group top any other selected terminal group The "target" subgroup must exist prior to issuing the move command. Page 68 / 83

69 15 Appendix D Device information 15.1 Device details Delete and Refresh At the top right hand side of the device details panel is a group of two buttons which directly affect the deployment and registration of the registered device, one of which is the "Delete" button" Figure 39 Delete device and refresh If the delete button is selected, a pop up asking for confirmation of the deletion (from the MDM server) is presented to the system administrator Device details Actions manual action Navigate to Organisation > Users & devices > User > device > Actions > Action. The device details action is designed for a single action (or multiple single actions) to be performed on the selected device. If multiple actions are required, on multiple devices then this can be achieved through Operations. All "Operations" and configuration details to be applied to a mobile device from the device details actions menu must first be created and stored in the MDM server. Page 69 / 83

70 Available manually applied action commands Footnotes: Description Apply configuration Remove configuration Install application Uninstall application Reactivate application Disable application Launch application Install certificate 3, Uninstall certificate 3, Send SMS message Send Backup Restore Send Push Notification 6 7 Remove Application list File command Install Antivirus license Reactivate SAFE/KNOX Deactivate KNOX 3= Samsung specific SAFE functionality required. 4 = HTC specific HTCpro functionality required. 5 = Trusted (root) certificates only. 6 = If "Meteor" service is configured. 7 = If Telenor MDM client and activated on device. Table 13 Actions manually applied to the selected device Page 70 / 83

71 15.3 Device details Actions Security The Security commands presented to the administrator vary depending on the model of the registered device. Some security functions are made available by the manufacturer, some are not. The MDM Server will present the security commands available to the selected device. The full set of security commands are listed below. Screen Screen Lock Description On receipt of this command, the MDM Client will initialise the Lock protocol of the device, using the MDM client Privacy code as default lock code. Screen Unlock On receipt of this command, the MDM Client will reset the passcode to the supplied passcode. Device Wipe EAS Accounts Wipe Detonate On receipt of this command, the device will attempt to erase all Exchange Active Sync information. On receipt of this command, the device will implement a "Security Erase", clearing the device and all available storage of user data. On receipt of this command, the MDM Client will perform a "Security Erase", rendering the device inoperative. A workshop initialisation may have to be performed on the device prior to further use. Table 14 Device security commands Screen Lock Android device The Android MDM client has a default security code of When the "Screen lock" is sent to the Android device, the screen will lock. The user must insert either the default (if still valid) MDM client privacy code OR the MDM client privacy code that the user has set Screen Unlock Android device When a "Screen unlock" command is sent to an Android devices MDM client, the MDM client will remove any pre-set security mechanism (Swipe code, pin number etc.). The user can then create a new security mechanism, with a new pin code for example Screen Lock ios device When a "Screen lock" command is sent to an ios device with the Telenor MDM server profile, the ios device screen will lock. The user may only access the device by inserting their PIN code Screen unlock ios device When a "Screen unlock" command is sent to an ios device with the Telenor MDM server profile, the ios device screen will unlock, allowing the user to access the device and create a new security PIN code. Page 71 / 83

72 Device details MDM Client actions The MDM Client actions menu is dependent on the MDM Client being successfully installed and activated to the MDM Server. The full set of MDM Clients actions commands are listed below. MDM Client Force connection Activate MDM Client Deactivate Activate with QR code Description The MDM Client on receipt of this command will attempt to immediately communicate with the MDM Server. The MDM Client on receipt of this command will attempt to communicate with the specified MDM server. The MDM Client on receipt of this command will delete the connection settings of the MDM server. Note. Once this action is performed the MDM Client will not be able to communicate with the original MDM Server. The MDM client on receipt of this command will attempt to activate using a supplied QR code. Remove MDM Client Reboot device The MDM client will be removed on receipt of this command The MDM Client on receipt of this command will force the device to reboot. Reset security code Reset encryption Reset data The MDM Client, on receipt of this command, will instruct the user of the device in changing the MDM Client security code. The MDM Client on receipt of this command will reset and re establish the encryption data used for the communication between the MDM Client and MDM Server. The MDM Client on receipt of this command will reset the MDM Client operation thread. All commands and responses to the MDM Servers commands held on the MDM Client will be deleted. All current commands will have to be resubmitted. Table 15 Device MDM client actions Only the available commands will be shown when the User's and Devices > Device > Actions tab is selected. All functionality is dependent on an MDM client being successfully installed and activated to the MDM server on the selected device. Force connect on WP8.1 devices will also update inventory Page 72 / 83

73 MDM Server action Remote support The MDM server utilises the BOMGAR remote support service, and when enabled (see Connection Remote support ) will allow the MDM administrator to commence an interactive session with a user's installed BOMGAR client. Figure 40 Remote support With the Remote support "action box" the administrator can choose the best interaction method to start either a Full or Chat session with the user. Current supported technologies are: Support mode Description Remote Control System Info Available on Android devices only - View or control remote computers, servers and mobile devices Kill processes; start, stop, pause, resume, and restart services; and uninstall programs on remote PCs or devices Support chat Allow the administrator to enter into a "text" session based chat with the user File Transfer Transfer files between remote computers, tablets or smartphones during remote support sessions using Bomgar's built-in File Transfer Screen Capture See your customer's screen and fully interact with the remote computer as if it were on your desk App Deployment For Apple devices use Apple Enterprise App Store Bomgar SDK Allows mobile application developers to include Bomgar remote support in their iphone, ipad and Android apps Table 16 Remote support matrix Due to design limitations, ios remote support can only be accessed through the Bomgar ios application. For a fuller description of Bomgar's current capabilities, please refer to the Bomgar website - Page 73 / 83

74 MDM Server actions Assign device The MDM server action "Assign device" allows the administrator to assign the currently selected device to either another (registered) user, or to the device pool. Figure 41 Device Pool - Assign device to user The "To user" button, when selected, will produce a pop up that allows the administrator to search for and select a username that they wish to assign the current device to. Figure 42 Device Pool - Assign to user From the search results, selecting the name of the user, and selecting the "Ok," button will change the assignment of the device from the present user to the newly selected user. When transferring the device from an existing user to the device pool it is advisable to remove all remotely installed configurations, certificates, applications, and policies from the device To device pool At the top right hand side of the device details panel is a group of three buttons which directly affect the deployment and registration of the registered device, one of which is the "Add to pool" button" Figure 43 Device Pool - Add to pool On the selection of this button, the device will be assigned to the free device pool. Page 74 / 83

75 MDM Server actions KNOX The following KNOX actions pane will only be visible with devices that are compliant with the Samsung Knox specifications. Figure 44 KNOX compatible password control. "Lock" button, when issued to the device will place an administrative lock on the KNOX container. Access to the KNOX container is no prohibited. The MDM server administrator must issue the "Unlock" MDM server action to the device. "Unlock" button, when selected, will issue an administrative unlock to an MDM server locked KNOX container. When this command is received by the device, the KNOX container will be unlocked allowing the user to insert their password in order to access their KNOX container. "Enforce change" button, when selected, will send a KNOX formatted message to the user's device which will force the user to change their KNOX container password credentials. "Reset" button, when selected will send a KNOX formatted message to the user's device which will automatically reset the password. "Container Remove" button will remove the KNOX application software from the device. The container remove action will not reset the devices operating system to pre-knox. Page 75 / 83

76 Device details, OS specific commands The OS specific commands presented to the administrator vary depending on the model of the device. Some OS specific commands are made available by the manufacturer, some are not. The MDM Server will present the OS specific commands available to the selected device. The full set of OS specific commands are listed below. Figure 45 Device OS specific commands Only OS specific commands that are available to the selected device will be displayed in the OS specific actions window. A description of the available commands follows Hotspot Enable Disable Roaming Description On receipt of this command, the device will switch on its wireless "Hotspot" facility. On receipt of this command, the device will switch off its wireless "Hotspot" facility. Enable data Disable data On receipt of this command, the device will be enabled for "data roaming". On receipt of this command, the device will be disabled for "data roaming". Activate mobile data Connection On receipt of this command, the device will enable mobile data, allowing internet browsing through the devices SIM card if no Wi-Fi is enabled Update device inventory On receipt of this command, the device will update its current inventory using APNS. Table 17 Device OS specific commands Page 76 / 83

77 Device OS specific commands continued. MDM Remove MDM profile Install MDM client On receipt of this command, the device will remove the MDM server ios profile. On receipt of this command, the device will install the MDM client. Remove MDM client Organization Set organization info. Remove organisation info. On receipt of this command, the device will uninstall the MDM client. On receipt of this command, the device will set the organisational information. On receipt of this command, the device will remove the organisational information. Only the available commands will be shown when the User's and Devices > Device > Actions tab (OS specific commands) is selected. All functionality is dependent on a trust relationship being successfully established with the MDM server of the selected device History Navigate to Organisation > Users & devices > User > device > History. The History tab, when selected, will reveal all the activity that has occurred and has been logged on the chosen device. Figure 46 Device history There is a maximum of two distinct activities that are logged and available to view by the MDM server. The views are dependent on the operating system of the device. Device Action log entries. MDM Operations log entries. Page 77 / 83

78 Column Header Description Operation Action type Status Last Update Send again A hyperlink to the Operation that has been or is being executed on this device. Selecting the hyperlink will reveal open the Operation statement Displays the Action title, allowing the administrator to interpret the command. Status of action, either sent, done, waiting, cancel, or cancelled A Timestamp indication when an action or was sent to device The administrator is allowed to resend the command operation that is reported in the device history Table 18 Device History table description Any information displayed in the History section that is bold and turquoise in colour, are hyperlinks to the originating section of the command that the device attempted to execute. Available options: Status Period Start date End date All Custom Wait Today On selection, On selection, Sent Yesterday Select from Select from Processing Current week Displayed calendar Displayed calendar Done Error Cancelled Last week Current month Table 19 Device History display options The "MDM Operations" history data type will only be displayed if the device has an active MDM client installed History MDM operations The MDM operation log will only be reported for those devices that have a MDM client installed. The report typically contains the following information. Column Header Command Data Status Status comment Assigned Modified Description Device information, profile list, certificate list Name of applied configuration/application/communication Status of action, either sent, done or waiting System comment, for example "Update rejected" Timestamp when action was sent from device Timestamp when action was completed Table 20 History MDM operations headers If the hyperlink is selected in from the "Data" column, then an information pop-up box regarding the execution details of the command will be revealed. The information pop-up box indicates to the administrator where, in this instance, the executing command is retrieving the required information of the application that will be sent to the selected device. Page 78 / 83

79 Connection log The connection log displays the connection time and IP address of connecting devices Installations Navigate to Organisation > Users & devices > User > device > Installations The device installations tab will display information regarding the currently installed components resident on the selected device. Figure 47 ios device application list details The information displayed in the installation view is dependent upon the device manufacturer. Installations Apps Apps KNOX Certificates Profiles Include System applications Include deleted applications App Storage View Android 1 Advanced data for managed apps. Android KNOX Apple WindowsPhone 8 1 Nokia S60 Table 21 Installation information matrix. Note 1:With release MDM v Android devices - the inventory of certificates is OS and platform dependent. Windows Phone 8.1certificate inventory allowed. Page 79 / 83

80 The application information is displayed using the following headers. Parameter Program Name Identifier Version Size Attr. Description Unique program name of the application on device. There may only be one application with the same name on a single device. In the case of Java applications, this name may be different on different devices. The program name does not depend on the device language Unique Identifier of the application Version reported by application. Version format may vary for different platforms Size of the applications own folder in kilobytes. Note: An application may install files to other folders as well; these files are not included. To be used with MDM Scheduler Config To be used with MDM Scheduler Feedback Application Feedback (method to deliver inventory data from the client to server) Uninstall When selected allows the application to be uninstalled from the device Table 22 Device application list details Deleted applications can be included into the report if the "include deleted applications" check box is selected. The refresh icon should be used when the administrator has updated the application list through the introduction of the device action, operation or creation (inclusion) of a new operation. The refresh operation will update the current application list when read from the user's device Installations Apps The Installations > Apps view allows the administrator to scroll through the applications that are installed on the selected device. Figure 48 Device installed application listing Page 80 / 83

81 Installations Apps KNOX The MDM server will display the "KNOX application" window only with KNOX capable devices. Figure 49 Administrative KNOX application control The administrator may control the state of running (or stopped) applications by utilising the following application options. Field Enabled Uninstall Allow to Install Start Stop Description Denotes the state of the application/process can be either Enabled (Yes)/Disabled (No) When selected will uninstall the application from the device If "Yes" denotes that the application is allowed to be installed on the device Allows the application to run in the foreground (Start) Allows the application to be stopped must be completely restarted from the "Stopped" state Table 23 Knox application details Once an application option has been changed, the administrator would either send the update to the device by forcing the device connection, allowing the MDM client to collect/deliver the application parameters to the device(s). With Wi - Fi devices, the changed option will be reflected on the device when a scheduled server connection is scheduled or if the user manually connects to the MDM server through the MDM client "connect to server" function Installations ios Certificates The MDM server will display all root and identity certificates that have been loaded from the MDM server to the device. Figure 50 Device certificates Page 81 / 83

82 Certificates are initially loaded into the MDM server through Infrastructure>Certificates, then dispatched to valid devices through a device "Action" or "Operation" statement Installations ios Profile The configuration profiles are generated, loaded into the MDM server through the configuration of ios profiles located through Infrastructure>Configuration>iOS Profile and dispatched to the device by an "Action", or "Operation" statement. Figure 51 ios device profiles A closer inspection of the profile is revealed by selecting the magnify icon SIM card management Navigate to Organisation > Users & devices > User > device > SIM card An editable SIM card information tab will be displayed. The server administrator can insert and update information in the following fields by selecting the "Edit" button. Figure 52 Editing the SIM card management device entry. Page 82 / 83