Pulse Workspace Appliance. Administration Guide

Transcription

1 Pulse Workspace Appliance Administration Guide Product Release 2.0, Document Revisions 1.0 Published Date January 2018

2 Pulse Secure, LLC 2700 Zanker Road, Suite 200 San Jose, CA The Pulse Secure Logo, the Pulse logo, and PulseE are trademarks of Pulse Secure, LLC. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Pulse Secure assumes no responsibility for any inaccuracies in this document. Pulse Secure reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Products made or sold by Pulse Secure or components thereof might be covered by one or more of the following patents that are owned by or licensed to Pulse Secure: U.S. Patent Nos. 5,473,599, 5,905,725, 5,909,440, 6,192,051, 6,333,650, 6,359,479, 6,406,312, 6,429,706, 6,459,579, 6,493,347, 6,538,518, 6,538,899, 6,552,918, 6,567,902, 6,578,186, and 6,590,785. Pulse Workspace Appliance Administration Guide The information in this document is current as of the date on the title page. END USER LICENSE AGREEMENT The Pulse Secure product that is the subject of this technical documentation consists of (or is intended for use with) Pulse Secure software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at By downloading, installing or using such software, you agree to the terms and conditions of that EULA by Pulse Secure, LLC. All rights reserved 2

3 Table of Contents Introduction...9 Getting Started...10 Dashboards...14 Provisioning Devices...17 Features Supported on ios and Android Devices...18 ios Workspace Onboarding...19 Android Workspace Onboarding...26 End User Auto provisioning...32 Android For Work...34 Overview...35 Add App to Catalog...35 Uploading Your In-house or Enterprise Apps using Google Play Console...41 Policy Settings...45 Workspace Administration...53 User Management...54 App Catalog...61 Policy Management...73 Workspace Properties...82 System Management...85 LDAP Groups...86 Adding an ios MDM Certificate...90 CA Certificate for ios...96 VPN Certificate...97 Changing the Enterprise Usage Agreement...98 Analytics...99 Login Attempts Report...99 Appliance Health Report...99 Appliance Activities Report Log Aggregation and Analysis Pulse One Administration User Administration Role Management Adding Admin Defined Role Modifying Role Removing Role Appliance Activities Pulse One Properties Appendix A: Provisioning Devices by Pulse Secure, LLC. All rights reserved 3

4 Auto-provisioning of Workspace (LDAP Group Policy) References by Pulse Secure, LLC. All rights reserved 4

5 List of Figures Figure 1: Pulse One Unified Management... 9 Figure 2: Pulse One Login Page Figure 3: End User License Agreement Figure 4: Welcome Wizard Figure 5: Pulse One Home Page Figure 6: Change Password Figure 7: Overall Dashboard Figure 8: Appliance Health Figure 9: Workspaces Information Figure 10: Welcome Page with Download Link SAML Authentication Figure 11: Welcome with Registration Link Activation key Figure 12: Domain Discovery Service Figure 13: SAML Single Sign-on Figure 14: Registration Key Figure 15: Enterprise BYOD Policies Figure 16: Workspace Installation Figure 17: Workspace Server Certificate Figure 18: App Management Figure 19: Installed and Available Apps Figure 20: Welcome Page with Download Link SAML Authentication Figure 21: Welcome with Registration Link Activation key Figure 22: Domain Discovery Service Figure 23: SAML Single Sign-on Figure 24: Registration Key Figure 25: Enterprise User Agreement Figure 26: Work Profile Figure 27: Google Account Figure 28: Workspace Apps Figure 29: Workspace Apps Library Figure 30: Launch Registration Portal Figure 31: Notification Figure 32: Welcome Figure 33: App Catalog Figure 34: Select a Platform Figure 35: Add App from Google Play Figure 36: Select App from Search Result Figure 37: Configure App Details Figure 38: Configure App Figure 39: Configure App Permissions Figure 40: Approve App by Pulse Secure, LLC. All rights reserved 5

6 Figure 41: Add App to Catalog Figure 42: Note Figure 43: Add Android App Manually Figure 44: Upload an App Figure 45: Google Play Admin Console Figure 46: Additional Google Services Figure 47: Publish the Private App on Google Play Store Figure 48: Accept Developer Agreement Figure 49: Add New Application Figure 50: Prepare Store Listing Figure 51: Upload APK to Production Figure 52: Restrict Distribution Figure 53: Pulse One Admin Console Figure 54: Add Policy Figure 55: Add Policy Details Figure 56: Add App to Policy Figure 57: Add App from App Catalog Figure 58: Edit App Rule Figure 59: Configure App Details Figure 60: Configure App Figure 61: Publish App Figure 62: Publish Global Figure 63: Enable VPN Figure 64: Edit Property Figure 65: Configure Host Figure 66: Screenlock Password Quality Figure 67: Add User Figure 68: Enter User Information Figure 69: Delete User Figure 70: Select the User Figure 71: Tags Icon Figure 72: Select the Tags Figure 73: Select the User's Workspace Figure 74: Workspace pane Figure 75: Workspace compliance Figure 76: Edit Figure 77: Activities Figure 78: Policy History Figure 79: Actions Figure 80: App Catalog Figure 81: Select a Platform Figure 82: Add App from Google Play Figure 83: Select App from Search Result Figure 84: Configure App Details Figure 85: Configure App Configuration by Pulse Secure, LLC. All rights reserved 6

7 Figure 86: Configure App Permissions Figure 87: Approve App Figure 88: Add App to Catalog Figure 89: Note Figure 90: Add Android App Manually Figure 91: Upload an App Figure 92: App Catalog Figure 93: Select a Platform Figure 94: Add App from Apple App Store Figure 95: Add App from Apple App Store Figure 96: Configure App Details Figure 97: Select a Platform Figure 98: Add Apple App Manually Figure 99: Add ios APP Figure 100: Add APP from App Catalog Figure 101: Edit App Rule Figure 102: Configure App Details Figure 103: Publish App Figure 104: Publish Global Figure 105: Open the Add Policy dialog box Figure 106: Set Policy attributes Figure 107: Add Apps and Properties Figure 108: Publish the policy Figure 109: Policy Properties Figure 110: Workspace Properties Figure 111: Edit Property Figure 112: Workspace settings Figure 113: ActiveSync property Figure 114: Adding an LDAP Group Figure 115: Provide LDAP Group details - using Group Name Figure 116: Provide LDAP Group details - using Distinguished Name Figure 117: Removing an LDAP Group Figure 118: Configuring the LDAP Provider Figure 119: Map Policy Figure 120: LDAP Group in User Details Figure 121: Open Apple MDM Cert page Figure 122: Download CSR and Upload CSR to the Apple Push Certificates Portal Figure 123: Log in to the Apple Push Certificates Portal Figure 124: Create a New Certificate Figure 125: Accept Terms of Use Figure 126: Upload Certificate Signing Request Figure 127: Download Signed Certificate Figure 128: Upload Signed Certificate Figure 129: Review Certificate Figure 130: Renew Certificate by Pulse Secure, LLC. All rights reserved 7

8 Figure 131: Renew Push Certificate Figure 132: CA Certificate Option Figure 133: CA Certificate Trust Settings Figure 134: Download VPN Root Certificate Figure 135: Navigate to Enterprise Usage Agreement Figure 136: Login Attempts Figure 137: Appliance Health Figure 138: Appliance Activities Figure 139: Appliance Logs Figure 140: Save Query Figure 141: Admin Users Figure 142: Add Admin User Figure 143: Edit User Details Figure 144: Remove Admin User Figure 145: Reset Login Figure 146: Suspend User Figure 147: Role Management Figure 148: Create New Role Figure 149: Modify Role Figure 150: Confirm Delete Role Figure 151: Appliance Activities Figure 152: Workspace Activities Figure 153: Search Activity Figure 154: Filter Activities Figure 155: Activity Details Figure 156: Pulse One Properties Figure 157: Edit Properties Figure 161: Launch the Provisioning Portal Figure 162: Registration link and PIN code Figure 163: Register to Pulse Workspace by Pulse Secure, LLC. All rights reserved 8

9 Introduction Pulse One provides unified management of Pulse Connect Secure, Pulse Policy Secure and Pulse Workspace in a single easy-to-use console. Figure 1: Pulse One Unified Management It controls enterprise access to datacenter and cloud from a single console. Role-based access - Grants console access and privileges based on IT role and credentials Group-based management - Publish software updates, policy changes and configuration provisioning by custom- defined groups Centralized administration - Collectively administers multiple appliances without logging into them on a boxby-box basis Built-in Mobility Management - Provides basic EMM functionality for ios and Android devices and management of BYOD Workspaces System Dashboard - Assesses the collective health of all appliances and provides security alerts and appliance alarms Appliance Dashboard - Provides appliance status with analytics for connectivity, capacity, utilization, and uptime Administrator Audit Logging - Tracks administrator changes to appliance configuration Monitor and Reporting - Monitors system activity and provides historical reporting SaaS Deployment - Introduces new features and scales without datacenter logistics and planning Back Office Integration - Uses APIs and connectors for easy integration with Microsoft Active Directory and other systems 2018 by Pulse Secure, LLC. All rights reserved 9

10 Getting Started This section details the steps to log in to Pulse One administration. Use the Pulse One admin URL to launch the Pulse Secure's Pulse One Admin Console. T If you are an existing user, enter the user name and password. Click Sign In to log in to Pulse One. If Enterprise SSO is configured for your user ID, then click Sign In with Enterprise SSO. Figure 2: Pulse One Login Page If you are a new user, you would have received a Welcome Mail from Pulse One to your registered mail id. Click the Set your password link in the Welcome Mail. In the Pulse One login page that appears, provide a strong password and confirm the password. On successful login, the End User License Agreement (EULA) page appears. If you have forgotten your Pulse One password, click the Forgot password link. In the page that appears, enter your user id and click Request reset. An that contains Reset your password link will be sent to your registered mail id. Use this link to launch Pulse One and provide your new password and confirm the new password. Note: The Reset your password link that you received in the has an expiration time of 1 hour. Beyond this time, you will have to make a new request for reset by Pulse Secure, LLC. All rights reserved 10

11 Figure 3: End User License Agreement If you are a new user logging into Pulse One for the first time, then in the EULA page use the scroll bar to read through the terms of the agreement and then click Agree. The Welcome wizard page appears. The Welcome wizard provides you a brief overview of Pulse One, Appliance management and Bring Your Own Device. In the Welcome wizard, click the right-arrow button till the Get Started option. Select the Don't show this to me again check box and then click Start Now. Figure 4: Welcome Wizard Note: You can view the Welcome wizard any time by clicking the settings icon on top right corner of the page and selecting Show Welcome Wizard by Pulse Secure, LLC. All rights reserved 11

12 Figure 5: Pulse One Home Page Select the appropriate menu, settings icon or user icon, and get started with the administration. Change Password To change user password: 1. Click the User icon on top-right corner of the page. 2. From the menu displayed, click Change Password to change your login password. Figure 6: Change Password An that contains Set new password link will be sent to your registered mail id. Use this link to launch Pulse One and provide your new password. Note: The Set new password link that you received in the has an expiration time of 1 hour. Beyond this time, you will have to make a new request for setting new password by Pulse Secure, LLC. All rights reserved 12

13 To log out of the admin console, click Logout by Pulse Secure, LLC. All rights reserved 13

14 Dashboards Dashboard gives the administrator a view of overall system health, appliance health information, and mobile Workspace details. Select the Dashboard tab, and then select Overall. Figure 7: Overall Dashboard Administrator can view the following information: Overall appliance statistics Logins in past 24 hours Pulse Connect Secure versions Pulse Policy Secure versions Critical appliance events with timestamp Select the Dashboard tab, and then select Appliances. When users report any issues, for example unable to connect or VPN connection is slow, the administrator can see if any particular appliance has any issue like high CPU utilization or disk utilization by Pulse Secure, LLC. All rights reserved 14

15 Figure 8: Appliance Health Administrator can view the following information: Number of Pulse Connect Secure and Pulse Policy Secure appliances Maximum concurrent user licenses for PCS and PPS appliances Number of deployed clusters Licenses consumed for PCS and PPS appliances SSL/VPN appliance OS versions NAC appliance OS versions 2018 by Pulse Secure, LLC. All rights reserved 15

16 Select the Dashboard tab, and then select Workspaces. Figure 9: Workspaces Information Administrator can view the following information: Workspace statistics Workspace allocation Devices and carriers Workspace connectivity Coverage by policy Workspace registration 2018 by Pulse Secure, LLC. All rights reserved 16

17 Provisioning Devices Features Supported on ios and Android Devices ios Workspace Onboarding Android Workspace Onboarding End User Auto provisioning 2018 by Pulse Secure, LLC. All rights reserved 17

18 Features Supported on ios and Android Devices This section provides information about the features supported by Pulse Secure Client on ios 8.0.x and Android devices. Note: The legacy Sandbox support is discontinued from this release. Features supported on ios 8.0.x devices Refreshed UI and flows: Pulse Secure client has a completely refreshed UI and provides a unified end- user experience. The client now supports any of the following modes: VPN only - connecting to Pulse Connect Secure (PCS) Workspace only - connecting to Pulse Workspace (PWS) VPN+Workspace - connecting to PCS for VPN and PWS for Mobile management Seamless onboarding to PCS and PWS: Pulse Secure client has an improved, user-friendly onboarding experience. The client allows the end user to enter connection URL on the Welcome screen and has the ability to automatically detect the type of server (PCS or PWS) by validating the user-entered connection URL and provides a seamless onboarding to the corresponding server. PWS onboarding using SAML based authentication: Pulse Secure client supports SAML based authentication for onboarding a user to PWS. For this feature, PWS acts as the SAML Service Provider (SP) and PCS acts as SAML Identity Provider (IdP). For this release, IdP support is restricted only to PCS. The third party IdPs are not supported. Improved compliance reporting: Pulse Secure client has the ability to detect whether an ios device is jailbroken and can report the status to Pulse Workspace server. Additionally, the compliance status is also displayed on the client indicating whether the device is compliant or non-compliant. If non- compliant, additional reasoning is provided to the end-user by Pulse Secure, LLC. All rights reserved 18

19 Features supported on Android devices Refreshed UI and flows: Pulse Secure client has a completely refreshed UI and provides a unified end- user experience. The client will now support any of the following modes: VPN only - connecting to Pulse Connect Secure (PCS) Workspace only - connecting to Pulse Workspace (PWS) VPN+Workspace - connecting to PCS for VPN and PWS for Mobile management Seamless onboarding to PCS and PWS: Pulse Secure client has an improved, user-friendly onboarding experience. The client allows the end user to enter connection URL on the Welcome screen and has the ability to automatically detect the type of server (PCS or PWS) by validating the user-entered connection URL and provides a seamless onboarding to the corresponding server. PWS onboarding using SAML based authentication: Pulse Secure client supports SAML based authentication for onboarding a user to PWS. For this feature, PWS acts as the SAML Service Provider (SP) and PCS acts as SAML Identity Provider (IdP). For this release, IdP support is restricted only to PCS. The third party IdPs are not supported. Improved compliance reporting: Pulse Secure client has the ability to detect whether an Android device is rooted and can report the status to Pulse Workspace server. Additionally, the compliance status is also displayed on the client indicating whether the device is compliant or non-compliant. If non-compliant, additional reasoning is provided to the end-user along with remediation steps. ios Workspace Onboarding This section describes the steps to provision an ios Workspace. When the Workspace administrator invites you to provision your mobile device, you will receive a welcome which contains instructions for provisioning your device. Based on the domain property setting, the registration workflow can be one of the following: Unified Client SAML Authentication Unified Client PIN Authentication 2018 by Pulse Secure, LLC. All rights reserved 19

20 Unified Client SAML Authentication Launch the workspace registration URL. The welcome page contains the link to download and install Pulse Secure from Apple App Store for iphone or ipad devices, and SAML authentication note. Figure 10: Welcome Page with Download Link SAML Authentication 2018 by Pulse Secure, LLC. All rights reserved 20

21 Unified Client PIN Authentication The welcome contains registration link to download and install Pulse Secure from Apple App Store for iphone or ipad devices, Enterprise URL, provisioning address and provisioning Activation key. Figure 11: Welcome with Registration Link Activation key 1. Start the provisioning process by opening Pulse Secure Client on your mobile device and entering the Corporate address or Corporate URL provided by your company by Pulse Secure, LLC. All rights reserved 21

22 Domain Discovery Service In the -based authentication, once user enters , client would parse domain and send it to a discovery server to fetch the server URL. It would then proceed with AD authentication with the server. Note: To set up the Auto-Discovery experience, you will need to contact Pulse Secure Technical support through DevOps ticket. Once the needed information is provided (and validated), Technical Support will enable the Auto-Discovery experience for your Domain. Figure 12: Domain Discovery Service 2. In case of SAML single sign-on, type the username and password, and press the Sign In button. Figure 13: SAML Single Sign-on 2018 by Pulse Secure, LLC. All rights reserved 22

23 3. In case of PIN authentication, enter your address and registration key from the Welcome and then press the ACTIVATE button. Figure 14: Registration Key 4. Press the ACCEPT button to accept the Enterprise BYOD policies. Figure 15: Enterprise BYOD Policies 2018 by Pulse Secure, LLC. All rights reserved 23

24 5. Press the INSTALL button to begin Workspace registration. Figure 16: Workspace Installation 6. You will be prompted to install the Workspace Server certificate. Press Install, then Install, then Trust, and then Done. Figure 17: Workspace Server Certificate 2018 by Pulse Secure, LLC. All rights reserved 24

25 7. Once the Workspace registration is complete, press the CLOSE button. You may be prompted to perform a variety of actions including installing applications one at a time, managing the existing applications, setting a device passcode or entering your password. These actions will depend on your enterprise security policy. Figure 18: App Management 8. Navigate to Workspace Apps. To view installed apps, tap the Installed tab. To install optional apps, tap the Available tab and from the list select the app you want to install. Once installed, the app will be listed in the Installed list. Figure 19: Installed and Available Apps 2018 by Pulse Secure, LLC. All rights reserved 25

26 Android Workspace Onboarding This section describes the steps to provision an Android Workspace. When the Workspace administrator invites you to provision your mobile device, you will receive a welcome which contains instructions for provisioning your device. Based on the domain property setting, the registration workflow can be one of the following: Unified Client SAML Authentication Unified Client PIN Authentication Unified Client SAML Authentication Launch the workspace registration URL. The welcome page contains the link to download and install Pulse Secure from Google Play for Android devices, and SAML authentication note. Figure 20: Welcome Page with Download Link SAML Authentication 2018 by Pulse Secure, LLC. All rights reserved 26

27 Unified Client PIN Authentication The welcome contains registration link to download and install Pulse Secure from Google Play for Android devices, enterprise URL, provisioning address and provisioning Activation key. Figure 21: Welcome with Registration Link Activation key 1. Start the provisioning process by opening Pulse Secure Client on your mobile device and entering the Corporate address or Corporate URL provided by your company. Wait while the device connects to the server. Domain Discovery Service In the -based authentication, once user enters , client would parse domain and send it to a discovery server to fetch the server URL. It would then proceed with AD authentication with the server by Pulse Secure, LLC. All rights reserved 27

28 Note: To set up the Auto-Discovery experience, you will need to contact Pulse Secure Technical support through DevOps ticket. Once the needed information is provided (and validated), Technical Support will enable the Auto-Discovery experience for your Domain. Figure 22: Domain Discovery Service 2. In case of SAML single sign-on, type the username and password, and press the Sign In button. Figure 23: SAML Single Sign-on 2018 by Pulse Secure, LLC. All rights reserved 28

29 3. In case of PIN authentication, enter your address and registration key from the Welcome and then press the ACTIVATE button. Wait while the server validates the address and registration key. Figure 24: Registration Key 4. Read the Enterprise User Agreement and press the Accept button. Figure 25: Enterprise User Agreement 2018 by Pulse Secure, LLC. All rights reserved 29

30 5. Press Next to set up Pulse Secure work profile on the device. Note: If the device is not encrypted, Google will prompt to encrypt the device with encrypt option and then will reboot the device. Figure 26: Work Profile 6. In case of Google Apps user, after the user has been authenticated, server checks for user's Google account. If user's Google account does not exist, then user is prompted with the create account page. 7. If the Google account already exists, user is taken to the Signing in to Google Enterprise Account page. Press NEXT to sign into Google with your Google Enterprise Account. Figure 27: Google Account 2018 by Pulse Secure, LLC. All rights reserved 30

31 8. Once the Workspace registration is complete, the Workspace Apps will be installed automatically in the background. Figure 28: Workspace Apps 9. To install optional apps, select Google Play Store > My Work Apps > Library (Note that this navigation option may vary from device to device). Figure 29: Workspace Apps Library 2018 by Pulse Secure, LLC. All rights reserved 31

32 End User Auto provisioning This section details the steps to auto provision an end user. 1. Launch the registration portal ( 2. Enter your address and click Submit. Figure 30: Launch Registration Portal A welcome message containing signing up process and tips is displayed. Figure 31: Notification On successful address validation, you will get a Welcome Go to your Inbox and open the Welcome . This contains the steps for registration process by Pulse Secure, LLC. All rights reserved 32

33 Figure 32: Welcome by Pulse Secure, LLC. All rights reserved 33

34 Android For Work Overview Add App to Catalog Uploading Your In-house or Enterprise Apps using Google Play Console Policy Settings 2018 by Pulse Secure, LLC. All rights reserved 34

35 Overview Android for Work is a program for supporting enterprise use of Android, which consists of product features in Android, Google Play for Work, Android for Work Accounts and other productivity tools. The solutions built on Android for Work include data security, apps security, device security etc. An IT administrator needs to set up Android for Work before anyone can start using it. The setup differs depending on what type of GSuite or managed Google Account you have, or if you use Android for Work Accounts. The type of account you have determines if you can use Google Mobile Management or a third-party EMM provider. Pulse Workspace provides the following solutions: Android for Work Accounts: This helps customers who do not have GSuite or Managed Google Account to use Android for Work. Google Play for Work: This helps GSuite or Managed Google Account customers to use Android for Work. For more details about Android for Work, refer to Google website. For details about setting up Android for Work Accounts and Google Play for Work, refer to Pulse Workspace Appliance Getting Started Guide. Add App to Catalog Many apps typically require some configuration on the device such as user information ( address), server information (url, port), enable specific features (VPN), etc. By defining these configurations in the admin console, the app can auto-configure with minimal user input and will simplify the setup process for end users. The App Catalog screen displays the apps that have been added to the management console. On this screen, you can see the App details or add a new app. 1. Select the Workspaces tab, and select App Catalog. The page displays a list of apps. Search box - Allows the apps list to be filtered Android, ios or All - Allows the app list to be filtered to apps of a single platform Add App - Allows adding apps from Google Play, Apple App Store or Manually App list - Displays information about each app in the system Edit icon - Allows to edit the app setting Delete icon - Allows to delete an app from the app catalog. If the app is assigned to one or more policies, then the deletion of app from app catalog is possible only after removing the app from all the policies by Pulse Secure, LLC. All rights reserved 35

36 Figure 33: App Catalog Add Android App from Google Play To add an Android app from Google Play: 1. In the App Catalog, click Add App and select Android. Figure 34: Select a Platform 2. In the Add App From Google Play window, select the country from the drop-down list. Figure 35: Add App from Google Play 3. Type the name of the App in the Search box and press Enter. A list of apps is displayed based on the search 2018 by Pulse Secure, LLC. All rights reserved 36

37 criteria. 4. Select the app from the Apps list and click Next. Figure 36: Select App from Search Result 5. In the Configure App Details dialog: Make changes to the description if required. Select the Required check box if the app should be pushed automatically on enrolment. If you access the app through VPN, then select the Network access as Require VPN. Then click Next. Figure 37: Configure App Details 2018 by Pulse Secure, LLC. All rights reserved 37

38 6. In the Configure App > App Configuration dialog: Provide app service host details. Choose if certificate authentication is required to access the app. Provide managed app certificate alias and click Next. To view available app macros and their descriptions, click Available App Macros. Figure 38: Configure App 7. Some apps need permissions to access. In the Configure App > App Permissions dialog, select appropriate permissions for the app and click Next. For information about configuring default runtime permission, see Android Restrictions in Policy Properties. Figure 39: Configure App Permissions 2018 by Pulse Secure, LLC. All rights reserved 38

39 8. In the approval dialog, click Approve. Figure 40: Approve App 9. Click Add to add the app to catalog. Figure 41: Add App to Catalog 2018 by Pulse Secure, LLC. All rights reserved 39

40 This completes adding the Android app from Google Play to the catalog. Next step is to add the app to a specific policy. For details, see Adding App to a Policy. Figure 42: Note Add Android App Manually Before proceeding with manual adding of Android app, ensure you have the following details: Google enterprise login credentials App package name - example: com.microsoft.office.word App title - example: Microsoft Word App creator - provider of the app, example: Microsoft download URL - location of plist file, also called manifest file, built by the app distributor To add an Android app manually: 1. Click Add App and select Android. In the Add App From Google Play window, click Add App Manually. Figure 43: Add Android App Manually 2. Log in with Google enterprise credentials and follow the Google instructions to upload apk, publish the app, publish the content rating and pricing, and publish the custom app by Pulse Secure, LLC. All rights reserved 40

41 Figure 44: Upload an App 3. Once published, it takes about four hours to reflect in the Pulse Workspace console. The app will be listed in the App Catalog list. To modify the app, click the Edit icon corresponding to the app and follow the steps described in Add App from Google Play above. Uploading Your In-house or Enterprise Apps using Google Play Console To distribute an internal (in-house) Android app to the users under the corporate domain, the app needs to be published on Google Play Store and then restricted to users under the corporate Domain. This section details the following steps: Log in to Google Play Admin Console Publish the Private App on Google Play Store Approve the Private App for AFW Provisioning Log in to Google Play Admin Console 1. Sign in to Google Play Admin Console ( 2. Select More Controls > APPS > Additional Google Services by Pulse Secure, LLC. All rights reserved 41

42 Figure 45: Google Play Admin Console 3. Click the Wifi Icon to open the filter pane. 4. Under Featured Services filter, clear the Show top featured services check box. 5. Enable the Google Play Developer Console service by clicking the On for everyone status. Figure 46: Additional Google Services Publish the Private App on Google Play Store 1. Launch the link to upload the private app. Figure 47: Publish the Private App on Google Play Store 2018 by Pulse Secure, LLC. All rights reserved 42

43 2. If required, pay the registration fee. The registration may take up to 48 hours to complete. Figure 48: Accept Developer Agreement 3. Click the Add new application button and proceed to upload the apk. Also, add the required graphics and other mandatory information. Figure 49: Add New Application 4. In the Add New Application page, select the language and enter a title for the application. Click the Prepare Store Listing button. Figure 50: Prepare Store Listing 2018 by Pulse Secure, LLC. All rights reserved 43

44 5. Upload the new apk by clicking on the Upload your first APK to Production button. Figure 51: Upload APK to Production Pulse Workspace Appliance Administration Guide 6. Under Restrict Distribution, select the Only make this app available to users of my Google apps domain name check box. Figure 52: Restrict Distribution Approve the Private App for AFW Provisioning 1. After uploading your app on the Play Store, sign in to your Pulse One console. 2. Add and approve this app for AFW provisioning. Then verify if the app is installed on the client. Reference: Please refer the following Google support page for the procedure to distribute apps in your organization by Pulse Secure, LLC. All rights reserved 44

45 Policy Settings This section details the steps to add policy and set the policy properties. Adding App to a Policy 1. Log in to Pulse One as admin. Figure 53: Pulse One Admin Console 2. Select the Workspaces tab and select Policies to add a new policy. Figure 54: Add Policy 2018 by Pulse Secure, LLC. All rights reserved 45

46 3. Enter a name for the policy, select a user tag, and click Save. 4. Next step is to add the apps from the Google Play Store to this policy. Figure 55: Add Policy Details 5. Enable the Show Global apps option. A list of apps that are configured with Global policy will be displayed. 6. Select Android Apps, and click Add App. Figure 56: Add App to Policy 2018 by Pulse Secure, LLC. All rights reserved 46

47 7. In the Add App from App Catalog dialog, enter the app name in the Search box and press Enter. A list of apps is displayed based on the search criteria. 8. From the apps list, select the app to configure and click Add. Figure 57: Add App from App Catalog 9. In the Android Apps list, select the app and click Edit app rule. Figure 58: Edit App Rule 2018 by Pulse Secure, LLC. All rights reserved 47

48 10. In the Configure App Details dialog, make appropriate changes. If you access the app through VPN, then select the Network access as Require VPN. Note that you cannot change the description. Click Next. Figure 59: Configure App Details 11. In the Configure App > App Configuration dialog, make appropriate changes and click Save. Figure 60: Configure App 2018 by Pulse Secure, LLC. All rights reserved 48

49 12. Select the app from the Android Apps list and click Publish. Figure 61: Publish App 13. For the prompt to publish Global, click Yes. Figure 62: Publish Global This completes adding an Android app to a policy 2018 by Pulse Secure, LLC. All rights reserved 49

50 Setting Policy Properties To set the properties: 1. Select the Properties tab, and click the Edit icon corresponding to VPN Enabled to change the property. This requires configuration in the Pulse Connect Secure server, and for the details refer to the section Deploying ios Per App VPN using Pulse Workspace Provisioning in the Pulse Workspace Configuration Guide. Figure 63: Enable VPN 2. Select Yes and click Save. Figure 64: Edit Property 3. On the Properties tab, click the Edit icon corresponding to VPN Host. 4. In the Edit Property window, enter the VPN host address and click Save. Figure 65: Configure Host 2018 by Pulse Secure, LLC. All rights reserved 50

51 Password Setting Android password settings are categorized into: quality, expiration and complex settings. For details of the password policy properties, see Policy Properties. Password policies are configured in the admin console and deployed on Android devices. 1. On the Properties tab, click the Edit icon corresponding to Screenlock Password Quality. 2. In the Edit Property window, select one of the following screen unlocking mechanism and click Save: complex, alphanumeric, alpha, pin_complex, pin, pattern, password The "complex" type of password requires a combination of alpha, numeric, and symbol characters and additionally supports specification of minimum numbers of such characters. If a user has not defined screen lock in his device, then the password policy defined by the admin will be forced to the user's device. Figure 66: Screenlock Password Quality Lock Work Profile Android 7.0 Nougat or later allows to lock work profile on devices. To open a work app, device prompts for the passcode. Administrator can define the length of the passcode, number of invalid passcode attempts. To set up or change the work profile lock: 1. On your device, go to Settings > Security > Work profile security. 2. Tap the lock type you d like to use and follow the instructions. (For details, see Passcode.) 3. (Optional) If you re changing your work profile lock, enter the pattern, PIN, or password when prompted. 4. If necessary, choose how you want your work notifications to show on your device when it s locked. Note: You can change your work notification settings at any time. 5. Tap Done. Policy Properties that Do Not Affect AFW Clients The following are the policy properties that do not affect AFW clients: Passcode Auto Enter Lock Timeout Max Tries.* Numeric Only Require.* 2018 by Pulse Secure, LLC. All rights reserved 51

52 Space Allow Art Crash.* Error Reporting Level Heartbeat Time Sec Device Device Encryption Enable Bug Report Touchdown VPN VPN Numeric Password Save Password VPN Type 2018 by Pulse Secure, LLC. All rights reserved 52

53 Workspace Administration User Management App Catalog Policy Management Workspace Properties 2018 by Pulse Secure, LLC. All rights reserved 53

54 User Management Pulse One users with a Workspace license entitlement will be able to manage Workspace from the Workspaces tab. Add User This section will walk you through the steps to add a new user to your domain. 1. Select the Workspaces tab. 2. Select the Devices tab. From the Actions drop-down list, click Add User. Figure 67: Add User 3. Enter the user information into the Create New User dialog box and then click Create. Figure 68: Enter User Information 4. If you want to create another user, select the Create another check box and then click Create by Pulse Secure, LLC. All rights reserved 54

55 Required fields: Pulse Workspace Appliance Administration Guide Username - User's name (This must be unique and can be used to configure the client inside the workspace during the provisioning process) Full Name - User's full name Workspace - account to which workspace notifications are sent (This account can also be used to configure the client inside the workspace during the provisioning process) Provision - account to which the welcome is sent Optional fields: Phone Number - Phone number to which the welcome SMS is sent Tags - Tags assigned to this user (used for policy assignment) Device Match - String used to limit the device a user can provision (for example, entering "Apple" would limit the user to provisioning Apple devices). Carrier, IMEI, IMSI, manufacturer, model_number, os_version, phone_number or serial_number can be used in the Device Match field. Options Create Space for this user Send the welcome to this user Send the welcome SMS to this user Delete User This section details the steps to delete a user from your domain. 1. Select the Workspaces tab. Select the user you want to delete. The user details are displayed on the right pane. Note: You can optionally search for the user using the search box. Figure 69: Delete User 2. Once you have selected the user account, from the Actions list, click Delete User. In the Confirm dialog box, click Yes to confirm the user deletion by Pulse Secure, LLC. All rights reserved 55

56 Add a Policy Tag to a Workspace User Account Tags are used to apply policies to users accounts. Once a policy is tagged, just add the same tag to the user to apply the policy to that user's device. This section details the steps to apply a policy tag to a Workspace User Space. 1. Select the Workspaces tab. Select the user you would like to manage. You can optionally search for the user using the search box. Figure 70: Select the User 2. Click the Tags icon located at the corner of the user details pane. Figure 71: Tags Icon 2018 by Pulse Secure, LLC. All rights reserved 56

57 3. Update or add policy tags to the user and click Save. Figure 72: Select the Tags Workspace Actions This section details the steps to perform administrative actions on a workspace. 1. Select the Workspaces tab. Select the user and then the Workspace you want to manage. Figure 73: Select the User's Workspace Note: You can optionally search for the user using the search box. 2. Select Actions from the Workspace pane. Then select the action you want to perform. Push Space - sends the latest policy to the users device and forces a check-in Resend Invitation - resends the Workspace Welcome or SMS with a new registration token Note: This action is only available before the Workspace has been provisioned by Pulse Secure, LLC. All rights reserved 57

58 Reset Passcode - resets the Workspace passcode (supported in ios devices only) Clear Errors - clears secure shortcut errors from Android devices Lock Workspace - locks this device Note: Locking an Android Workspace will prevent the user from using the Workspace until an administrator resets the user's passcode. Passcode reset is not supported in Android devices. Wipe Workspace - wipes all data in this Workspace Delete Workspace - deletes the Workspace record from the Management server Note: When a Workspace is deleted, no further administrative actions can be performed on the Workspace, including wiping the Workspace. Revoke VPN Certificate - prompts to revoke VPN certificate Show VPN Certificate Info - shows if the VPN certificate is valid Understanding the Workspace Details Window The Workspace pane allows you to view the overall status of the Workspace. Device Manufacturer/Model - used to identify the Workspace Workspace State - the current status of the Workspace Workspace Apps - the apps installed in the Workspace Space Details - the Workspace client details Device Details - information gathered from the device Figure 74: Workspace pane The Compliance window displays the current status of device properties and if they are compliant with the Workspace security policy. Policy Expired - Policy is expired Device allows USB debugging - USB debugging is enabled Device allows root access - root access is enabled 2018 by Pulse Secure, LLC. All rights reserved 58

59 Device allows unknown market install - Side loading apps is enabled Note: This must be enabled for devices that do not support silent installation. Pulse Workspace Appliance Administration Guide Device allows process debugging - Process debugging is enabled Device is using encryption - Device is encrypted Figure 75: Workspace compliance The Edit window allows you to view and edit the Workspace Device Match and Phone Number fields. Device Match - string used to limit the device a user can provision (for example, entering "Apple" would limit the user to provisioning Apple devices). Carrier, IMEI, IMSI, manufacturer, model_number, os_version, phone_number or serial_number can be used in the Device Match field. Phone Number - phone number to which the welcome SMS is sent Figure 76: Edit 2018 by Pulse Secure, LLC. All rights reserved 59

60 The Activities window displays the log of Workspace activity. Double click an activity to see the detailed view. Figure 77: Activities The Policy History window displays the current and previous policies applied to a Workspace. Figure 78: Policy History 2018 by Pulse Secure, LLC. All rights reserved 60

61 The Actions menu displays the list of actions available for the Workspace. Figure 79: Actions Pulse Workspace Appliance Administration Guide App Catalog The App Catalog screen displays the apps that have been added to the management console. On this screen, you can see the App details or add a new app. To view apps in the App Catalog: 1. Select the Workspaces tab, and select App Catalog. The page displays a list of apps. Search box - Allows the apps list to be filtered Android, ios or All - Allows the app list to be filtered to apps of a single platform Add App - Allows adding apps from Google Play, Apple App Store or Manually App list - Displays information about each app in the system Edit icon - Allows to edit the app setting Delete icon - Allows to delete an app from the app catalog. If the app is assigned to one or more policies, then the deletion of app from app catalog is possible only after removing the app from all the policies. Figure 80: App Catalog 2018 by Pulse Secure, LLC. All rights reserved 61

62 Add Android Apps From Google Play To add an Android app from Google Play: 1. In the App Catalog, click Add App and select Android. Figure 81: Select a Platform 2. In the Add App From Google Play window, select the country from the drop-down list. Figure 82: Add App from Google Play 3. Type the name of the App in the Search box and press Enter. A list of apps is displayed based on the search criteria. 4. Select the app from the Apps list and click Next. Figure 83: Select App from Search Result 2018 by Pulse Secure, LLC. All rights reserved 62

63 5. In Configure App Details dialog: Make changes to the description if required. Select the Required check box if the app should be pushed automatically on enrolment. If you access the app through VPN, then select the Network access as Require VPN. Then click Next. Figure 84: Configure App Details 6. In the Configure App > App Configuration dialog: Provide app service host details. Choose if certificate authentication is required to access the app. Provide managed app certificate alias and click Next. To view available app macros and their descriptions, click Available App Macros. Figure 85: Configure App Configuration 2018 by Pulse Secure, LLC. All rights reserved 63

64 7. Some apps need permissions to access. In the Configure App > App Permissions dialog, select appropriate permissions for the app and click Next. For information about configuring default runtime permission, see Android Restrictions in Policy Properties. Figure 86: Configure App Permissions 8. In the approval dialog, click Approve. Figure 87: Approve App 2018 by Pulse Secure, LLC. All rights reserved 64

65 9. Click Add to add the app to catalog. Figure 88: Add App to Catalog This completes adding the Android app from Google Play to the catalog. Next step is to add the app to a specific policy. Figure 89: Note Add Android App Manually Before proceeding with manual adding of Android app, ensure you have the following details: Google enterprise login credentials App package name - example: com.microsoft.office.word App title - example: Microsoft Word App creator - provider of the app, example: Microsoft download URL - location of plist file, also called manifest file, built by the app distributor 2018 by Pulse Secure, LLC. All rights reserved 65

66 To add an Android app manually: 1. Click Add App and select Android. In the Add App From Google Play window, click Add App Manually. Figure 90: Add Android App Manually 2. Log in with Google enterprise credentials and follow the Google instructions to upload apk, publish the app, publish the content rating and pricing, and publish the custom app. Figure 91: Upload an App 3. Once published, it takes about four hours to reflect in the Pulse Workspace console. The app will be listed in the App Catalog list. Click the Edit icon corresponding to the app, and follow the steps described in Add App from Google Play above. Add ios Apps From Apple App Store To add an ios app to app catalog: Note: If the app that you wanted to add requires app config schema, then request the app vendor for the same. 1. Select the Workspaces tab and click App Catalog by Pulse Secure, LLC. All rights reserved 66

67 Figure 92: App Catalog 2. Click Add App and select ios. Figure 93: Select a Platform 3. In the Add App From Apple App Store window, select the country from the drop-down list. 4. Type the name of the app in the Search box and press Enter. A list of apps is displayed based on the search criteria. 5. Select the app from the list and click Next. Figure 94: Add App from Apple App Store 2018 by Pulse Secure, LLC. All rights reserved 67

68 6. Search and select an app from the Apple App Store and click Next. Figure 95: Add App from Apple App Store Pulse Workspace Appliance Administration Guide 7. In the Configure App Details dialog: Make appropriate changes. Click Upload, browse and select the app config file that you got from the app vendor. Click Add to add the app to catalog. Figure 96: Configure App Details 2018 by Pulse Secure, LLC. All rights reserved 68

69 Add Apple App Manually Before proceeding with manual adding of ios app, ensure you have the following details: App package name - example: com.microsoft.office.word App title - example: Microsoft Word App creator - provider of the app, example: Microsoft download URL - location of plist file, also called manifest file, built by the app distributor. To add an ios app manually to App Catalog: 1. Select the Workspaces menu and click App Catalog. 2. Click Add App and select ios. Figure 97: Select a Platform 3. In the Add App From Apple App Store window, click Add App Manually. 4. In the Add Apple App Manually window, enter the app package name, app title, app provider name and download URL. Then click Add. The download URL must point to a plist file / manifest file that is accessible by the end users' devices. The device fetches the plist from the download URL and then from there it will download the actual IPA and do the installation. Figure 98: Add Apple App Manually 5. The app will be listed in the App Catalog list. Click the Edit icon corresponding to the app, and follow the steps described in Add App from Apple App Store above by Pulse Secure, LLC. All rights reserved 69

70 Add App to Policy To add the app to a policy: 1. Select the Workspaces tab, and select Policies. A list of policies is displayed. Select a policy from the list, select ios Apps, and click Add App. Figure 99: Add ios APP 2. Select the app from the app catalog list and click Add. Figure 100: Add APP from App Catalog 2018 by Pulse Secure, LLC. All rights reserved 70

71 3. In the Apps list, select the app and click Edit app rule. Figure 101: Edit App Rule 4. In the Configure App Details dialog, make appropriate changes and click Save. Figure 102: Configure App Details 2018 by Pulse Secure, LLC. All rights reserved 71

72 5. Select the app and click Publish Figure 103: Publish App 6. For the prompt to publish Global, click Yes. Figure 104: Publish Global This completes adding an ios app from the Apple App store using App Catalog by Pulse Secure, LLC. All rights reserved 72

73 Policy Management This section details the steps to create a new policy. 1. Select the Workspaces tab, then select the Policies tab and click Add to add a new policy. Figure 105: Open the Add Policy dialog box 2. Set Policy Name. This is a label for you to identify the policy. 3. Set the policies target criteria and LDAP Group. Figure 106: Set Policy attributes 4. Click Save. Note: Policy name is not unique, means two or more policies can have same name. Policies are unique based on their search criteria, and not based on the policy names by Pulse Secure, LLC. All rights reserved 73

74 5. When a policy is created, it starts in the edited state. You can now add applications and properties to the policy before applying the policy to your mobile devices. Figure 107: Add Apps and Properties 6. Once you have completed editing the policy, click Publish. You will see the policy's state change to publishing and then published. This will apply the policy to the mobile devices. Figure 108: Publish the policy 2018 by Pulse Secure, LLC. All rights reserved 74

75 Policy Properties This section describes the Policy Properties provided in the Workspace Properties. Figure 109: Policy Properties ActiveSync ActiveSync Accept All Certs - If this is set to true, the Workspace client will accept an untrusted server certificate. Activesync Domain - The domain set for the Workspace ActiveSync connection. The ActiveSync domain must be the enterprise domain which should be the same as the exchange server domain. ActiveSync Server - This should be set to ActiveSync Server Proxy address of the Pulse Connect Secure (PCS) if proxy uses PCS. ActiveSync Server Proxy - This must be set to Security Appliance if PCS is used. Otherwise, it should be set to None. ActiveSync SSL - Determines if the Workspace client will connect to the ActiveSync server using an SSL connection. ActiveSync UserID Field - This must be set to Username if ActiveSync Server Proxy uses PCS. Otherwise, it should be set to . UPN Domain Name - The domain set for constructed UPN method of login authentication. Use Constructed UPN for Workspace - If this is set to true, constructed UPN is used for ActiveSync and the Office365 users will be able to use UPN as the login username instead of using their addresses. Use Pulse One for authentication - If this is set to true, Pulse One will be used as authentication server for ActiveSync connections and it will override the configured ActiveSync server settings. If this is set to false, then existing ActiveSync server settings will be used for ActiveSync connections by Pulse Secure, LLC. All rights reserved 75

76 Compliance Jail Break Detection - When compliance is set to Allow, "iscompliant" value sent from client is True. When compliance is set to Restrict VPN, "iscompliant" value sent from client is False. When compliance is set to Wipe, "iscompliant" value sent from client is False. Minimum OS Version - Sets minimum OS version. Non-Compliant OS Version Action - If user provisions the device that has OS version lower than that is set in Minimum OS Version policy, the device becomes non-compliant device. Actions for a noncompliant device can be one of the following: Allow: User is allowed VPN access, and the device remains in the non-compliant state Restrict VPN: User is restricted from VPN access Wipe: Profile is wiped off from the user's device Minimum Pulse Client Version - Sets minimum Pulse Client version. Non-Compliant Pulse Client Version Action - If user provisions the device that has Pulse Client version lower than that is set in Minimum Pulse Client Version policy, the device becomes non-compliant device. Actions for a non-compliant device can be one of the following: Allow: User is allowed VPN access, and the device remains in the non-compliant state Restrict VPN: User is restricted from VPN access Wipe: Profile is wiped off from the user's device Rooted Detection - Determines the action the client should take when it determines a device is Rooted. The options are allow, notify, lock or wipe. USB Debugging - Determines the action the client should take when it determines a USB debugging has been enabled. The options are allow, notify, block, lock or wipe. Device Enable Bug Report - If this is set to true, the user will be able to send bug reports. Android Restrictions Block Unknown Sources - Blocks users from installing apps from unknown sources such as third-party app stores, file-sharing utilities, web browsers, and attachments, thus prevents users from installing malware on the device. Default Runtime Permission - Sets the chosen value as default for all permissions for all apps on a policy. Note: If admin modifies the runtime permission from grant to deny and enforce the policy on an existing provisioned device, user has to clear the cache on the managed apps. Disallow Cross Profile Copy Paste Blocks users from copying the contents of this work profile and pasting to other profiles. It does not restrict copying the contents of other profiles and pasting to this work profile. ios ActiveSync ios ActiveSync Enabled - If enabled, the Workspace ActiveSync account will be configured on ios devices. ios ActiveSync Name - A user-visible name of the account, shown in the Mail and Settings applications. ios ActiveSync Prevent Move - If enabled, messages may not be moved out of this account into 2018 by Pulse Secure, LLC. All rights reserved 76

77 another account. Pulse Workspace Appliance Administration Guide ios ActiveSync Prevent Send By 3rd Party apps - If enabled, the Workspace account is not available for sending mail in third-party applications. ios Managed Domains ios Managed Domains - The domain set for the Workspace ActiveSync connection. The ActiveSync domain must be the enterprise domain which should be same as the exchange server domain. ios Managed Web Domains - The domains that are viewed as internal to the organization. ios POP/IMAP ios Description - A user-visible description of the account, shown in the Mail and Settings applications. ios Disable Mail Recents Syncing - If enabled, the Workspace account is excluded from address Recents syncing. ios Enabled - If enabled, an IMAP or POP account will be configured on ios devices. ios Incoming Auth - Designates the authentication scheme for incoming mail. ios Incoming Host - Designates the incoming mail server host name (or IP address). ios Incoming Port - Designates the incoming mail server port number. If no port number is specified, the default port for a given protocol is used. ios Incoming Use SSL - Designates whether the incoming mail server uses SSL for authentication. ios Outgoing Auth - Designates the authentication scheme for outgoing mail. ios Outgoing Host - Designates the outgoing mail server host name (or IP address). ios Outgoing Port - Designates the outgoing mail server port number. ios Outgoing Use SSL - Designates whether the outgoing mail server uses SSL for authentication. ios Prevent Move - If enabled, messages may not be moved out of this account into another account. ios Prevent Send By 3rd Party Apps - If enabled, the Workspace account is not available for sending mail in third-party applications. ios Type - Determines the type of account to set up. It can be IMAP or POP. ios Username - The Username set in the configuration. It is set to either the users username or their corporate address. ios Restrictions Blacklist Package Names: Restricts user to use those apps in device that are added in this policy. Note: This Property is applicable only to Supervised ios devices with OS > 9.3. ios Allow Camera - Disables the camera when unchecked. ios Allow Cloud Backup - Disables icloud backup when unchecked. ios Allow Cloud Keychain Sync - Disables icloud keychain sync when unchecked. ios Allow Enterprise Book Backup - Disables enterprise books back up when unchecked by Pulse Secure, LLC. All rights reserved 77

78 ios Allow Handoff - Disables the continuity feature when unchecked. Pulse Workspace Appliance Administration Guide ios Allow Managed App Cloud Sync - Prevents management app from using cloud sync when unchecked. ios Allow Open From Managed To Unmanaged - If disabled, documents in managed apps and accounts only open in other managed apps and accounts. ios Allow Open From Unmanaged To Managed - If disabled, documents in unmanaged apps and accounts will only open in other unmanaged apps and accounts. ios Allow Screen Shot - Disables device Screen Shots when unchecked. ios Allow Siri - Disables Siri when unchecked. ios Allow Siri While Locked - Disables Siri while the device is locked when unchecked. CA Certificate ios Trusted CA Certificate Enabled - If enabled, turns on the SSL trust for the root CA certificate. For details about uploading CA Certificate from Pulse Workspace console, see the section CA Certificate for ios. Mail+ Mailplus Allow Open In - BOOL if the user should be allowed to open documents in other apps. Mailplus Allow Print - Users to be allowed or blocked for printing the content. Mailplus Auto Config Enabled - Activates/deactivates the Mail+ app functionality. Mailplus Disable Copy Paste - Prevents users from inadvertently sending sensitive information to third party apps. Mailplus License Key - Key provided by ikonic Apps. Mailplus Passcode Allow Simple - Sets passcode complexity to simple. Mailplus Passcode Alpha Numeric Required - Requires alphanumeric passcodes. Mailplus Passcode Enabled - Sets Mail+ app passcode. This value takes precedence over ActiveSync policies. Note that this does not affect device passcode. Mailplus Passcode Length - Sets the number of characters for the passcode. Mailplus Passcode Require Special - Requires special character in the passcode. Mailplus Passcode Time Out - Defines the idle time in seconds after which the Mail+ app will be locked or will run in the background. Nine Nine Work app, provided by Google apps, synchronizes with Exchange Server using ActiveSync, and it is based on Android for Work. License Number - License to use Nine Work app. Passcode Android for Work supports two levels of passcode challenge. Passcode on the Workspace Managed Device and Work Profile helps in protecting the data in the device and Workspace. When passcode is set, user must provide the passcode to unlock the device or Workspace. The Work Profile passcode is supported on Android 7.0 and above by Pulse Secure, LLC. All rights reserved 78

79 The Workspace Managed Device Passcode applies passcode policies only to Workspace managed devices enrolled with a Work Profile. This passcode will need to be entered each time the device is unlocked and can be applied in addition to the Work Profile Passcode. The Work Profile Passcode applies passcode policies only to Workspace apps, so users do not have to enter complex passwords each time they unlock their device when enrolled with a Work Profile. The Work Profile passcode ensures that the end users can access their private apps while keeping corporate app data protected without the use of wrapping technologies. Passcode on the device helps in protecting the data in the device. When passcode is set, user must provide the passcode to unlock the device. (Work Profile) Expiration Days - Specifies the number of days for which the passcode can remain unchanged. (Work Profile) Lock Timeout - Defines the time in seconds where the Workspace will be locked if no Workspace app was in foreground. (Work Profile) Max Tries (ios Factory Reset) - Specifies the number of allowed failed attempts to enter the passcode at the device's lock screen. (Work Profile) Numeric Only - Determines whether the user is forced to set a PIN. (Work Profile) Passcode History - When the user changes the passcode, it has to be unique within the last specified entries in the history. (Work Profile) Passcode Length - Specifies the minimum overall length of the passcode. (Work Profile) Require Letters - Requires the user to have only alphabets in their passcode. (Work Profile) Require Lowercase - Requires the user to have at least one lowercase letter in their passcode. (Work Profile) Require Non-Letters - Requires the user to have numbers and symbols in their passcode. (Work Profile) Require Number - Requires the user to have at least one number in their passcode. (Work Profile) Require Special - Requires the user to have at least one special character in their passcode. (Work Profile) Require Uppercase - Requires the user to have at least one uppercase letter in their passcode. (Work Profile) Screenlock Password Quality - Specifies the screen unlock mechanism: complex, alphanumeric, alpha, pin_complex, pin, pattern, or password. If the device is set with a different screen unlock type than that is pushed by the console, then it shows the device as non-compliant. If the screen unlock type is "password", then Passcode Length and Passcode History attributes will be applicable. If the screen unlock type is "pin" or "pin_complex", then Passcode History attribute will be applicable. Expiration Days - Specifies the number of days for which the passcode can remain unchanged. ios Allow Simple - Determines whether a simple passcode is allowed. A simple passcode is defined as containing repeated characters, or increasing/decreasing characters (such as 123 or CBA). ios Force Pin - Determines whether the user is forced to set a PIN. Simply setting this value (and not others) forces the user to enter a passcode. ios Max Grace Period - The maximum grace period, in minutes, to unlock the phone without entering a passcode. ios Max Inactivity - Specifies the number of minutes for which the device can be idle (without being unlocked by the user) before it gets locked by the system. Lock Timeout - Defines the time in seconds where the Workspace will be locked if no Workspace app was in foreground. Max Tries (ios Factory Reset) - Specifies the number of allowed failed attempts to enter the passcode at the device's lock screen. Numeric Only - Determines whether the user is forced to set a PIN. Passcode History - When the user changes the passcode, it has to be unique within the last specified entries in the history by Pulse Secure, LLC. All rights reserved 79

80 Passcode Length - Specifies the minimum overall length of the passcode. Require Letters - Requires the user to have only alphabets in their passcode. Pulse Workspace Appliance Administration Guide Require Lowercase - Requires the user to have at least one lowercase letter in their passcode. Require Non-Letters - Requires the user to have numbers and symbols in their passcode. Require Number - Requires the user to have at least one number in their passcode. Require Special - Requires the user to have at least one special character in their passcode. Require Uppercase - Requires the user to have at least one uppercase letter in their passcode. Screenlock Password Quality - Specifies the screen unlock mechanism: complex, alphanumeric, alpha, pin_complex, pin, pattern, or password. If the device is set with a different screen unlock type than that is pushed by the console, then it shows the device as non-compliant. If the screen unlock type is "password", then Passcode Length and Passcode History attributes will be applicable. If the screen unlock type is "pin" or "pin_complex", then Passcode History attribute will be applicable. Space Allow Art - If enabled, Android devices that run ART can be provisioned. Android Auto Config Enabled - If enabled, the Workspace ActiveSync account will be configured on Android devices. Android Manual Config Allowed - If enabled, the user can change the ActiveSync account settings in the Workspace. Crash Count - The number of times an app in the Workspace can crash in the Crash Period before the application is disabled. Crash Grace Time Sec - The number of seconds the Workspace will wait before allowing the app to start after killing it. Crash Period Sec - The timeframe for watching repeated app crash. Debug - Policy update explicitly uses the Debug property in the console to "refresh_sec=10". The normal policy property for policy refresh has a resolution of 1 hour. Using the Debug property, this can be set to smaller periods of time. Error Reporting Level - The detail of the logging information sent to the server when the user sends a debug log. Heartbeat Time Sec - The number of seconds between connection heartbeats. Policy Expiration days - The number of days after which a Workspace is considered to be out of compliance and is blocked for not contacting the server. The blocked user can contact the Workspace administrator to extend the policy expiration days. VPN Enable Location Awareness - If selected, when the user with ios device is connected to corporate WiFi, the VPN on-demand functionality will disconnect VPN. Stealth Mode - UI-less VPN profile uses certificate in Keystore for authentication and Pulse client does not come into foreground during VPN setup. The sign-in URL configured on Pulse Connect Secure server must be configured for certificate authentication. Use L3 VPN - If selected, enables L3 VPN UDP support on ios platform. VPN Certificate Auth - If selected, the VPN connection will be set to certificate authentication using the Workspace client certificate by Pulse Secure, LLC. All rights reserved 80

81 On-Demand VPN Timeout (minutes) - The amount of time in minutes during which no traffic is sent over the active tunnel by the application. Once the time is elapsed, the tunnel is brought down and the device starts monitoring for any further traffic. VPN Connection Name - A user-visible description of the VPN account. VPN Enabled - If selected, a VPN configuration will be sent down to the Workspace. VPN Group - Extends IPsec architecture to support PCS that are shared by a group of security appliances. VPN Host - Designates the VPN server host name (or IP address). VPN Numeric Password - If selected, the Workspace will present the user with a pim pad rather than a keyboard to enter their password. VPN Realm - Designates the Realm the Workspace users will use. VPN Role - Designates the Role the Workspace users will use. VPN Safari Domains - Specifies only those domains that trigger the VPN connection. VPN Save Password - If selected, the Workspace will cache the password used to connect to the VPN server. VPN Connection Type - Type of VPN being used. Connection types supported are: Manual, VPN On Demand and Always On. VPN UserID Field - The Username set in the VPN configuration. It is set to either the users username or their corporate address. VPN Verify Certificate - If enabled, the VPN client will accept an untrusted certificate. WiFi Enterprise Wifi Inner Authentication - Select the protocol used to authenticate the username and password (None, PAP, CHAP, MSCHAP or MSCHAPv2). The None option is valid only for Android devices. Enterprise Wifi Outer Identity - Specify an alternate username to be used outside the encrypted tunnel, such as anonymous, to conceal the user s identity in unencrypted packets. WiFi Enabled - If enabled, sets the device to automatically join the network. WiFi Password - Password for WiFi network filled by admin or prompted during connection. WiFi Protocol - Protocol used to connect to the WiFi Network. The options are WEP, WPA2, EAP-TLS, EAP- TTLS, and EAP-PEAP. WiFi SSID - SSID of the Wi-Fi network to be used. Wifi Username - Username for WiFi network filled by admin or prompted during connection. Related topics: In the Pulse Workspace Configuration Guide: Configure Office365 as an ActiveSync Policy Configure Security Appliance as an ActiveSync Proxy Deploying ios Per App VPN using Pulse Workspace Provisioning Enterprise Wifi Configuration Pulse Workspace Provisioning using SAML Configuration LDAP Auto Provisioning ios Compliance and Jail Break Detection 2018 by Pulse Secure, LLC. All rights reserved 81

82 Workspace Properties 1. Click the Settings icon on top-right-corner of the page and select Workspace Properties. Figure 110: Workspace Properties 2. Click the Edit button corresponding to the field you want to edit. Change the value and then click Save. Figure 111: Edit Property Properties Enterprise Connections Activesync Host - address of the Pulse Workspace that ActiveSync Proxy will forward ActiveSync connections to; this address must be accessible to the Pulse Workspace ActiveSync Proxy. Activesync Provider - Pulse Connect Secure appliance to which Pulse One / Pulse Workspace will forward the ActiveSync notifications. Enable Workspace Registration with SAML - If set to true, enables single sign-on. LDAP Provider - Pulse Connect Secure appliance configured for User's group membership based autoprovisioning. Misc ios Vpp Stoken - Apple VPP Service Token Support - Pulse Workspace support center s address. This address will be shown in the Support information displayed on the device. Support Phone - Pulse Workspace support center s phone number. This phone number will be shown in the 2018 by Pulse Secure, LLC. All rights reserved 82

83 Support information displayed on the device. Workspaces Display Advanced AFW Properties - If set to true, shows advanced AFW properties (App Permissions). Enable International App Stores - If set to true, enables to choose app from international app stores. Related topics: ActiveSync Configuration LDAP Auto Provisioning Pulse Workspace Provisioning using SAML Configuration 2018 by Pulse Secure, LLC. All rights reserved 83

84 Appliance ActiveSync Configuration This feature introduces the ability on Pulse Connect Secure gateway to function as activesync proxy for Mobile devices that are Onboarded through Pulse Workspace Server. Pulse Connect Secure gateway will be able to filter out and reject activesync connection requests coming from unauthorized mobile devices and allow only those devices that have been successfully provisioned on Pulse Workspace Server. 1. Click the Settings icon on top-right-corner of the page and select Workspace Properties. Figure 112: Workspace settings 2. The Activesync Provider field must be set to the Connect Secure device. This requires ActiveSync configuration in the Pulse Connect Secure server, and for the details refer to the section ActiveSync Configuration in the Pulse Workspace Configuration Guide. 3. Click the Edit icon to modify the ActiveSync property of the policy. Figure 113: ActiveSync property 2018 by Pulse Secure, LLC. All rights reserved 84

85 System Management LDAP Groups Adding an ios MDM Certificate CA Certificate for ios VPN Certificate Changing the Enterprise Usage Agreement 2018 by Pulse Secure, LLC. All rights reserved 85

86 LDAP Groups Enterprises would like to assign policies based on the LDAP group. For example, staff in Sales needs access to specific set of Enterprise apps as against staff in Finance which needs a different set of Enterprise apps. You can configure LDAP groups and assign these groups to policies. These policies are then sent to Workspaces when users configure Workspaces on their mobile devices. If users are in multiple LDAP groups, then they get multiple policies. The order of policies applied to Workspaces depends on the order of polices configured on Workspace Server. To add an LDAP group: 1. Click the Settings icon on top-right-corner of the page and select LDAP Groups. The Manage LDAP Groups page displays a list of existing LDAP groups. Figure 114: Adding an LDAP Group 2. Click Add Group to add a new LDAP group. You can add LDAP group based on Group Name (Domain) or Distinguished Name. Figure 115: Provide LDAP Group details - using Group Name 3. In the Add LDAP Group dialog, enter a label to the group, enter the domain name to which the group belongs, and provide a name to the group. 4. Click Save to add the group. 5. In the Add LDAP Group dialog, enter a label to the group, select Distinguished Name, and enter the distinguished name. 6. Click Save to add the group by Pulse Secure, LLC. All rights reserved 86

87 7. When an LDAP Group is added, it is unverified. Pulse One (Pulse Workspace) checks validity of the group by sending message to designated (registered) Pulse Connect Secure appliance. Once LDAP group is verified, it is ready to use. Note: Admin can assign only the verified LDAP Groups to policies. For details about the configuration in the Pulse Connect Secure server, refer to the section LDAP Auto Provisioning in the Pulse Workspace Configuration Guide. Figure 116: Provide LDAP Group details - using Distinguished Name 8. In case the verification of LDAP Group fails, the group state will be shown as Invalid. You can edit the details and resubmit for verification. 9. Click the More icon next to the Invalid state group, and select Edit Group from the options. In the Edit LDAP Group dialog, make the necessary changes and click Save. 10. Click the More icon next to the Invalid state group, and select Verify Group to resubmit the group for verification. Note: You cannot edit an already verified group. To remove an LDAP group: 1. To remove an LDAP Group, click the More icon next to the state of the group that you want to remove, and select Delete Group from the options. 2. In the dialog displayed, click Yes to remove the group. Note: When the LDAP Group is deleted, it is removed from all the policies it is attached to. Figure 117: Removing an LDAP Group 2018 by Pulse Secure, LLC. All rights reserved 87

88 To configure an LDAP group: 1. Click the Settings icon on top-right-corner of the page and select Workspace Properties to go to the Workspace Properties page. 2. Click the Edit Properties icon corresponding to LDAP Provider. 3. In the Edit Properties dialog that is displayed, select the LDAP Provider from the drop-down list and click Save. Figure 118: Configuring the LDAP Provider 4. Select the Policies tab. In the Workspace Polices frame, click Add. Provide a policy name, user tag and choose the Verified LDAP groups from the drop down-menu to map with policy. Click Save. Figure 119: Map Policy 2018 by Pulse Secure, LLC. All rights reserved 88

89 5. Select the Workspaces tab and click on Devices. A list of Workspace users is displayed. 6. Select a user. The User Details pane shows the LDAP Group to which the user is attached. Figure 120: LDAP Group in User Details 2018 by Pulse Secure, LLC. All rights reserved 89

90 Adding an ios MDM Certificate This section details the steps to add an Apple MDM push certificate to your Workspace management console. An Apple MDM push certificate allows your Workspace management console to push policies, updates and actions to your managed ios devices. Note: An Apple MDM certificate is required to provision and manage ios devices. This certificate, downloaded from Apple, is valid for one year and requires renewal. If the certificate expires, the enrolled ios devices will appear offline and must be re-provisioned. To add an ios MDM certificate: 1. Click the Settings icon on top-right-corner of the page and select Apple MDM Cert to go to the Apple MDM Cert management page. Figure 121: Open Apple MDM Cert page 2. Click the Download the signing request cert (CSR file) link to download the MDM push certificate's CSR (Certificate Signing Request) file. Then save the file to your computer. 3. Click the link to go to the Apple Push Certificates Portal web site by Pulse Secure, LLC. All rights reserved 90

91 Figure 122: Download CSR and Upload CSR to the Apple Push Certificates Portal 4. Sign in to the Apple Push Certificates Portal using your organizations Apple ID. Figure 123: Log in to the Apple Push Certificates Portal 2018 by Pulse Secure, LLC. All rights reserved 91

92 5. Click Create a Certificate to create a new MDM push certificate. Figure 124: Create a New Certificate 6. Review and accept the terms of use. Figure 125: Accept Terms of Use 2018 by Pulse Secure, LLC. All rights reserved 92

93 7. Click Browse and then select the CSR file downloaded from your Pulse One console. Click Upload. Figure 126: Upload Certificate Signing Request 8. Click Download to download the MDM push certificate's PEM file. Save the file to your computer. Figure 127: Download Signed Certificate 2018 by Pulse Secure, LLC. All rights reserved 93

94 9. Return to the Apple MDM Cert page in your Pulse One console. Click Browse and select the PEM file you downloaded from the Apple Push Certificates Portal. Click Upload. Figure 128: Upload Signed Certificate 10. You can now review the MDM push certificate information in your Pulse One console. Figure 129: Review Certificate 2018 by Pulse Secure, LLC. All rights reserved 94

95 To renew certificate, click Renew in Apple Push Certificates Portal. Figure 130: Renew Certificate 11. Add notes, click Choose File to select the CSR file, and then click Upload to renew push certificate. Figure 131: Renew Push Certificate 2018 by Pulse Secure, LLC. All rights reserved 95

96 CA Certificate for ios For IOS 10.x devices and later, the custom certificates are not trusted by IOS device by default. When the ios device tries to connect to the Pulse Connect Secure appliance whose device certificate was signed by the root CA certificate that is not in ios device Trust Store, the device refuses the SSL handshake with the Pulse Connect Secure appliance. The solution is to push the CA certificate with the MDM payload. To upload CA certificate from Pulse Workspace Console, do the following. 1. Click the Settings icon on top-right-corner of the page and select CA Certificate to go to the CA Certificate page. Figure 132: CA Certificate Option 2. Click Browse, select the certificate file and click Upload to upload the CA Certificate. Note: CA Certificate needs to be in the.pem format only. 3. To enable trust, select Workspaces > Policies > Global > Properties > CA Certificate. Set ios Trusted CA Certificate Enabled to Yes and then publish. 4. Provision an ios device. In the device, navigate to Settings > General > Profile and Device Management > Pulse Secure Profile > More Details and verify that the CA Certificate is pushed as part of MDM payload. Also, navigate to Settings > General > About > Certificate Trust Settings and verify that the CA Certificate is trusted. Figure 133: CA Certificate Trust Settings 2018 by Pulse Secure, LLC. All rights reserved 96

97 VPN Certificate The Workspace Management Server includes an integrated Certificate Authority (CA) and Online Certificate Status Protocol (OCSP) server. These can be used to issue certificates to workspaces for client certificate based VPN authentication. You can use the VPN Cert window to download your Workspace Root CA certificate. This will be used when configuring your VPN. 1. Click the Settings icon on top-right-corner of the page and select VPN Cert to go to the VPN Certificate download page. 2. Click the VPN certificate link to download the CA Certificate for this Management console. Figure 134: Download VPN Root Certificate 3. To renew the certificate, click Regenerate. 4. In the confirmation dialog that is displayed, click Yes. Click on the VPN Certificate link to download the regenerated cert. Log in to PCS appliance and navigate to System > Configuration > Certificates > Trusted Client CAs. Delete the old CA certificate. Click on the Import CA Certificate link to upload this certificate by Pulse Secure, LLC. All rights reserved 97

98 Changing the Enterprise Usage Agreement The Enterprise Usage Agreement must be agreed when you provision the Workspace. This should be modified with your Enterprise Usage Agreement. This section details the steps to edit the Enterprise Usage Agreement. 1. Click the Settings icon on top-right-corner of the page and select Enterprise Usage Agreement to go to the Enterprise Usage Agreement management page. Figure 135: Navigate to Enterprise Usage Agreement 2. Edit the text in the Enterprise Usage Agreement and then click Save by Pulse Secure, LLC. All rights reserved 98

99 Analytics This section provides detailed steps to view various reports for appliances. Login Attempts Report Appliance Health Report Appliance Activities Report Log Aggregation and Analysis Login Attempts Report To view Login Attempts report: 1. Select Analytics > Login Attempts. The report shows the login attempts, authentication mechanism and result, and device OS in the last 24 hours. You can choose bar chart, line graph, pie chart or table data to display. Figure 136: Login Attempts Appliance Health Report To view Appliance Health report: 1. Select Analytics > Appliance Health. 2. From the Appliance Health drop-down, select the appliance for which you want to view the report. The following reports for the selected appliance over the last 24 hours are displayed: CPU Utilization Memory Utilization Disk Utilization Network Throughput 2018 by Pulse Secure, LLC. All rights reserved 99

100 Figure 137: Appliance Health Appliance Activities Report To view Appliance Activities report: 1. Select Analytics > Appliance Activities. 2. From the Appliance Activities drop-down, select the filter such as critical, alert, warning, error etc. that you want to view in the report. Figure 138: Appliance Activities 2018 by Pulse Secure, LLC. All rights reserved 100

101 Log Aggregation and Analysis The syslog forwarded from the configured PCS/PPS appliances can be viewed in Appliance Logs. Here, users have a consolidated view of logs generated by every PPS/PCS appliances configured to forward its syslogs to the Pulse One server. Figure 139: Appliance Logs The system provides a set of Default Queries below the Appliance Logs menu in the navigation pane. Administrator can also customize the queries and save them for future use. These customized queries are listed below Saved Queries. The Appliance Logs page allows searching by a string token by typing in the token in the search bar or doubleclicking a string in the logs details. The view is then filtered to display all messages with the token that is being searched for. Users can enter multiple tokens separated by space. This customized query can then be saved using the Save Query feature. Figure 140: Save Query 2018 by Pulse Secure, LLC. All rights reserved 101

102 To view logs from any of the system default queries, expand Default Queries and click on the query. To view logs from the customized queries, expand Saved Queries and click on the query. It is also possible to filter the logs by timestamp. This can be done by choosing a From date and To date in the date fields on the top right. Users can also choose to filter search results by Match All (will display search results that have all tokens searched for), or Match Any (will display search results that include any of the tokens searched for). The number of search results to be displayed on the screen can be 50, 100, 250, 500 by making a choice on the bottom left corner of the screen. Finally, the search results can span over multiple pages and navigated using the buttons on the bottom right corner of the screen. Note: Only the saved queries can be deleted using the Delete Query feature by Pulse Secure, LLC. All rights reserved 102

103 Pulse One Administration User Administration Pulse One Properties Appliance Activities 2018 by Pulse Secure, LLC. All rights reserved 103

104 User Administration Pulse One offers comprehensive Admin account management. This section details the steps to create an Admin user. 1. Select the Administration tab and then select User Administration. A list of existing admin users is displayed. 2. Click Add User to add an admin user. 3. Click the Edit icon in the user details pane to modify the user details. 4. Click Delete User to remove an admin user. Figure 141: Admin Users Adding Admin User To add an admin user: 1. In the Add Admin User window, enter the user details. 2. Select Role from the drop-down list - Super Admin, Read Only Admin 3. Select the Workspace check box to provide the link to user's workspace. 4. Select the Send Workspace welcome check box to send an confirmation to the user about the creation of Workspace. 5. Click Create. The new user will be displayed in the User's list. Figure 142: Add Admin User 2018 by Pulse Secure, LLC. All rights reserved 104

105 Note: If Role is set to Read Only Admin, then the user will not be given the permissions to create/update/ delete functions. Modify User Details To modify a user's details, select the user from the list and in the user details pane click the Edit icon. Make the required changes and click Update. Figure 143: Edit User Details Removing Admin User To remove an admin user: 1. Select the user from the list, and click Delete User. 2. In the Remove Admin User confirmation message box, click OK to remove the selected user as an administrator. The user is removed as an administrator, but will still be a Pulse Workspace user. 3. In order to remove the user even from Pulse Workspace, select the Remove entire user record check box and click OK. Figure 144: Remove Admin User 2018 by Pulse Secure, LLC. All rights reserved 105

106 Reset User Password To reset a user's password: 1. Select the user from the list, and click the Reset login link in the user details pane. An that contains the Set new password link will be sent to your registered mail id. 2. Click the Set new password link in the mail. 3. In the Pulse One page that appears, provide the new password and confirm the new password. The new password will be saved in the database. 4. Then log in to Pulse One with the new password. Note: The Set new password link that you received in the has an expiration time of 1 hour. Beyond this time, you will have to make a new request for setting new password. Figure 145: Reset Login Suspend User To suspend a user, select the user from the list and click Suspend User. The user will be locked and will not be able to log into admin console. The Forgot Password option in the Login page will not send mail to reset password. To unlock the suspended user, select the user and click Reset Login. This will send a mail to the user with a set new password link. Figure 146: Suspend User 2018 by Pulse Secure, LLC. All rights reserved 106

107 Role Management Pulse One offers comprehensive Role management. This section details the procedures to manage admin defined roles. 1. Select the Administration tab, and then select Role Management. A list of system defined roles is displayed. 2. Click Add Role to add a new admin defined role. To create a role from an already existing role, click Duplicate corresponding to the existing role. 3. Click the Edit icon in the role details pane to modify the admin defined role assignment. The system defined roles cannot be edited. 4. Click Delete Role to remove an admin defined role. The system defined roles cannot be removed. Figure 147: Role Management Adding Admin Defined Role To add a new role: 1. In the Create New Role window, enter the role name. 2. In the Role Assignment section, select the permissions for Dashboard, Appliances, Settings, Users, and Roles from the drop-down list. None - This permission will disable the assigned feature. For example, if Appliances permission is set to None, then Appliances page will not be visible in Pulse One console for this role. Read Only - This permission will disable create/edit/delete options for the assigned feature. Edit - This permission allows create/view/edit operations. Delete - This permission allows all operations. Figure 148: Create New Role 2018 by Pulse Secure, LLC. All rights reserved 107

108 3. Click Create. Modifying Role You can modify only the admin defined roles. To modify a role's permissions, select the role from the list and in the role details pane click the Edit link. Make the required changes and click Save. Figure 149: Modify Role Removing Role You can remove only the admin defined roles. To remove an admin defined role: 1. Select the role from the list, and click Delete Role. 2. In the Confirmation message box, click Yes to remove the selected role. Figure 150: Confirm Delete Role Appliance Activities The Activity Log displays information about the events registered in the Management Server. These include Appliance and Workspace activities. You can view filtered Activities for Users, Workspaces or Policies. To view Appliance activities: 1. Select the Administration tab and click Appliance Activities by Pulse Secure, LLC. All rights reserved 108

109 Figure 151: Appliance Activities To view Workspace activities: 1. Select the Administration tab and click Workspace Activities to go to the Activities page. Figure 152: Workspace Activities Search for an Activity To search for individual events: 1. Type a search term into the Search box and press Enter. Examples of search terms for Workspace activities are usernames, event types and workspaceids. Figure 153: Search Activity 2018 by Pulse Secure, LLC. All rights reserved 109

110 Filter Activities 1. Click an Event type button to filter for a specific event type. Figure 154: Filter Activities Open Activity Details 1. Click the Details button associated with the activity you want view the details. The Activity Details dialog displays the additional details. Figure 155: Activity Details 2018 by Pulse Secure, LLC. All rights reserved 110

111 Pulse One Properties To open Pulse One Properties page, click the Settings icon on top-right-corner of the page and select Pulse One Properties. Figure 156: Pulse One Properties Edit Property 1. Click the Edit button corresponding to the field you want to edit. 2. Change the value and then click Save. Figure 157: Edit Properties Properties Enterprise Connections Auto Configure SAML Settings - If enabled, automates the SAML Metadata configuration flow for both Appliance and Pulse One SAML settings. SAML Identity Provider - Pulse Connect Secure appliance configured for Pulse One server SAML autoprovisioning by Pulse Secure, LLC. All rights reserved 111

112 Password Console Minimum Password Length - minimum length of a console password Pulse Workspace Appliance Administration Guide Console Password Expiration Days - how many days until an Administrator must change their console password Console Password Require Lowercase - console password must contain at least one lowercase letter Console Password Require Number - console password must contain at least one number Console Password Require Special - console password must contain at least one special character Console Password Require Uppercase - console password must contain at least one uppercase letter Console Password Reset Timeout Hours - number of hours a console password reset link is valid Domain Allowed Password Attempts - number of login attempts until a console account is locked Welcome Timeout Hours - number of hours a registration token in a welcome is valid Misc Created On - date the management console was created Locale - Console language code Page Footer - footer information that will be displayed at the bottom of the admin console Server Version - current Management Server version that will be displayed at the bottom of the admin console Note: The Created On and Server Version fields are not editable by Pulse Secure, LLC. All rights reserved 112

113 Appendix A: Provisioning Devices Auto-provisioning of Workspace (LDAP Group Policy) 2018 by Pulse Secure, LLC. All rights reserved 113

114 Auto-provisioning of Workspace (LDAP Group Policy) This section describes the auto-provisioning of Workspace using LDAP Group Policy. Pulse Workspace Appliance Administration Guide Before proceeding with the below steps, ensure the enterprise domain and domain are created for your enterprise. Enterprise administrator must create Workspace policies, add group names and then assign group names to policies. The VPN appliance validates these group names to make sure that they are real groups. Note: Obtain Provisioning portal URL from your enterprise administrator. 1. Launch the Provisioning portal. Enter your address and click Submit. Figure 158: Launch the Provisioning Portal Pulse One validates the group for the user by querying Pulse Connect Secure VPN gateway and assigns appropriate policy to user workspace. On successful verification, you will receive an from the Pulse Workspace system containing the instructions for the registration process by Pulse Secure, LLC. All rights reserved 114

115 Figure 159: Registration link and PIN code 2. For Android phone, enable Settings > Security > Unknown Sources. 3. Enter the URL mentioned in the mail in a web browser on your mobile device by Pulse Secure, LLC. All rights reserved 115

116 Figure 160: Register to Pulse Workspace 4. In the Pulse Workspace registration screen, enter your address and registration key, and then press Register. This will install Pulse Workspace on your device. By default, your Workspace is provisioned with default policy by Pulse Secure, LLC. All rights reserved 116