MDM Android Client User Guide 7P Mobile Device Management. Doc.Rel: 1.0/

Transcription

1 MDM Android Client User Guide 7P Mobile Device Management Doc.Rel: 1.0/

2 Table of Contents 1 Objectives and Target Groups Important information Third-Party Materials Text conventions Integrity of device OS Hyperlink navigation Home hyperlink Menu Items Description of the warning flags Additional documentation Automatic MDM client selection MDM client distribution Device administrators permission Android 4.x devices unknown sources path Android 2.x devices unknown sources path MDM Client Installation SMS initiated delivery with automatic activation Wi-Fi installation with QR code activation MDM Client download and installation Downloaded application installation Activate device administration? Client Activation Methods SMS activation (preferred) Activation using QR code Activation confirmation Backup security code Client Activated Additional activation steps (Samsung Knox Workspace) MDM Client Android Console Access to the MDM Client About the MDM client MDM client navigation bar shortcuts Force a connection icon shortcut ii

3 Open the MDM client AppStore icon shortcut Open the MDM client navigation bar icon Open the MDM SSP icon shortcut MDM Client's menu structure MDM client preferences About About Application name and version Application management AppStore MDM Client preferences - Connection Connection connect Connection - Activity details Connection Activate MDM Client preferences -Advanced Advanced - Policies MDM Client preferences - Privacy Settings Privacy Change security code Privacy settings Send GPS data Privacy Settings Security code Privacy settings Device encryption MDM Client - Android Kiosk Mode Android Kiosk Mode applications Creating the Android Kiosk mode configuration Disable Kiosk mode internet connected device Disable Kiosk mode internet disconnected device Enabling Kiosk Mode Deploying a basic Kiosk mode configuration Disabling Kiosk Mode Enabling Kiosk Mode (Advanced) Application list (defined) Adding an application to an individual cell location Other Application list (manual) Kiosk Settings application Kiosk Settings application Clear data Samsung Knox Workspace MDM Server actions KNOX Samsung Knox Workspace Knox NOT activated (neither personal nor enterprise version) iii

4 Knox personal edition activated before MDM activates Knox KNOX PERSONAL EDITION NOT PREACTIVATED Remove (uninstall) the MDM Client Manual uninstall of the MDM Client Samsung KNOX Mobile Enrollment (KME) Samsung KME Features Utilising Samsung KME Samsung KME Supported devices and models Simple KME workflow Initial steps, performed with Samsung KME dashboard Device registration steps performed on 7P MDM server: Final steps performed with Samsung KME dashboard Apply for KNOX Mobile Enrollment Prepare the Samsung KME environment Add an MDM Profile Prepare the 7P MDM KME environment Enable KME devices in Dashboard View KME devices in Dashboard View KME devices via Reports Manually select device as KME enabled Set multiple devices as KME enabled Export KME devices to CSV file Export to KME CSV file Submit KME devices Samsung KNOX participating reseller Samsung KNOX non-participating reseller Final steps Ready to enroll iv

5 Table of Figures Figure 1 Android 4.x unknown sources... 5 Figure 2 Android 2.x unknown sources permission Figure 3 SMS download link Figure 4 containing download link Figure 5 Auto detection of the device Figure 6 Accessing the downloaded MDM client... 8 Figure 7 Do you want to install the application?... 8 Figure 8 Application installed... 9 Figure 9 Automatic activation message Figure 10 QR code activation Figure 11 Activate with QR code Figure 12 Inputting the activation PIN code Figure 13 Backup security code warning Figure 14 Samsung Knox Workspace acknowledgement Figure 15 Knox Standard management privileges Figure 16 MDM Client icon Figure 17 Accessing the MDM Client menu structure Figure 18 Force connection icon shortcut Figure 19 Navigation bar shortcut to the AppStorage contents Figure 20 Access to MDM client structure icon Figure 21 Accessing the MDM SSP user interface Figure 22 About the MDM Client Figure 23 Tools location Figure 24 Force connection to MDM Server Figure 25 Tools Activity details Figure 26 MDM client activation methods Figure 27 Policies Figure 28 Change security code Figure 29 Send GPS data Figure 30 Send security code Figure 31 Device encryption Figure 32 Enabling (Basic) Kiosk mode Figure 33 Define inbuilt Kiosk mode applications Figure 34 Disable Kiosk mode configuration v

6 Figure 35 Application list creation Figure 36 Kiosk settings Figure 37 Kiosk settings application buttons Figure 38 Samsung KNOX device screenshots Figure 39 Lock command issued from MDM server Figure 40 Unlock command issued from MDM server Figure 41 Deactivate MDM Client Figure 42 Active uninstall button Figure 43 Removal of MDM Client Figure 44 Samsung KME dashboard Figure 45 Resellers reference and KNOX ID Figure 46 7P MDM server dashboard Figure 47 7P MDM server reporting facility Figure 48 7P MDM server device information Figure 49 Example 7P MDM KME export Figure 50 Device list pending review Figure 51 Device list Ready to enroll List of Tables Table 1 Text convention... 1 Table 2 MDM Client's menu structure Table 3 Kiosk Mode main settings Table 4 Kiosk mode supported applications Table 5 Kiosk mode kiosk settings vi

7 1 Objectives and Target Groups Objectives: The aim of this document is to describe to customers of SEVEN PRINCIPLES AG the key features and deployment of the 7P MDM Android Client. It describes the installation process of the MDM Client, using both GSM (i.e. devices with an active SIM card and data plan) and Wi-Fi only compatible devices. The installation is followed by a description of the activation process which allows the MDM Client to successfully communicate with a designated MDM Server. The section entitled "MDM Client Android console," details the settings and functionality available to the MDM Client. This includes a full disclosure of the MDM Clients "Privacy Settings." The document also describes the installation process for the Android 2.x and Android 4.x operating system. Both installation and activation procedure only differ slightly. This document reflects the current functions of the 7P MDM Android Client. Any updates or feature enhancements made to the product will be promptly reflected in future releases of this document. Target group: This document was created specifically for the customers of SEVEN PRINCIPLES AG. 1.1 Important information The installation of both Identity and Root certificates is supported on the MDM Android platform providing the root certificate is of type ".cert, " and the identity certificate is of type ".p12" or ".pfx" and that an MDM client security code is present, otherwise the certificates installation will be silently rejected by the device Third-Party Materials All third-party trademarks are the property of their respective owners. Text conventions The following conventions are typically adhered to in the construction of this document. Convention Key names The word enter Bold Italics Description Integrity of device OS Keys that are pressed simultaneously are linked by a plus sign (+): e.g. Press Ctrl + Alt + Del Enter indicates you type something and then press the Return or Enter key. Used to distinguish certain words from others within the text Used to distinguish certain words from others within the text Table 1 Text convention The MDM server relies on the integrity of the device's OS to forward information to the MDM server by the device proprietary messaging OS, or via the MDM client acting with the device messaging OS. In the unfortunate event that a device OS is compromised or has been corrupted in any way, the information passed to the MDM server may be corrupt, impeded or non-existent. The handling of such a situation is beyond the scope of the 7P MDM server. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 1 / 60 ^Home

8 1.5 Hyperlink navigation Hyperlinks are used to allow detailed examination of information. For example, if an Operation (named SIM change test) has been deployed to the device, a status message would be included in the device history. Selecting the "SIM change test" hyperlink will open the Operation > SIM change test allowing closer examination. Selecting the browsers "back" button will return the administrator to the device history log. When hyperlinks are available, selecting the hyperlink will either: Navigate the administrator to the origin of the link, for example, a configuration statement To further functionality, for example, as with the displaying of GPS records Utilising the back facility of the browser may return the administrator to the original page. It is always advisable, due to the dynamic nature of the updating data, for the administrator to restart their query with the vertical menu buttons Home hyperlink A hyperlink (^Home) is inserted into the bottom right-hand side of the footer which when pressed will return the reader to the beginning of the document and is only active in PDF format. Menu Items The greater than sign ( > ) with spaces before and after the sign, separates items in the menu. For example, Operations > Operations > Is roaming > Pull down selection ( Yes / No ) indicates that you first choose "Operations" from the main tabs, then "Operations" from the left-hand menu options, followed by the selection of an operation name, then the condition to be applied. Description of the warning flags This document may contain warnings and safety recommendations of the following meaning: Attention: May have undesired consequences Caution: Operational functionality may be impeded Further attention may be required when implemented General information 7PMDM_Client_Android_v _02_EN_1.0.docx Page 2 / 36 ^Home

9 1.9 Additional documentation The following additional documentation is available from your 7P representative or service provider: Documentation title Documentation title 7PMDM_Manual_AdminGuide_EN 7PMDM_Note_AppleDEP_EN 7PMDM_Client_Android_EN 7PMDM_Manual_InstallGuide_EN 7PMDM_Client_iOS_EN 7PMDM_Delivery_RelNote_DE 7PMDM_Note_AppleVPP_EN 7PMDM_Delivery_RelNote_EN 7PMDM_Spec_SSP_EN 7PMDM_Delivery_ReleaseBulletin_EN 7PMDM_Spec_CSVImport_EN 7PMDM_Delivey_FeatureList_EN The following titles are considered static and will only be updated if there is a significant change or update to the details. 7PMDM_Client_SymbianS60_EN 7PMDM_Spec_LDAP_EN 7PMDM_Client_WindowsPhone_EN 7PMDM_Client_WindowsDevice_EN 7PMDM_MSCompanyHub_EN 7PMDM_Spec_AppWrapping_EN 7PMDM_Client_Files2Go_EN 7PMDM_Spec_Files2Go_EN 7PMDM_Spec_MSCompanyHub_EN 7PMDM_Spec_Vodafone_UltraCard_EN Revision details have been omitted from all the documentation lists as the most current version will be available from your 7P representative or service provider 7PMDM_Client_Android_v _02_EN_1.0.docx Page 3 / 36 ^Home

10 1.10 Automatic MDM client selection The MDM Server currently supports a diverse range of Android devices. Some devices have extended facilities that require the use of licensed API's to integrate with client software modules. Newer devices with additional functionalities may require additional application coding, and therefore a different MDM client. The proliferation of device dependent MDM clients can become challenging to IT administrators. To assist in this challenge, 7P have created an intelligent download repository of MDM client applications for use by 7P MDM server customers. During the enrollment process, the enrolling device will be guided to a specific website which automatically identifies the make and manufacturer of the browsing device, automatically presenting the appropriate MDM client application to the requesting device. When used with a 7P MDM server, the enrollment process requires that the device downloads and installs a 7P MDM client application which will then be activated to an MDM server. 1. Samsung SAFE3 compatible Android devices will use the 7P MDM SAFE3 Client 2. Knox Standard compatible Android devices will use the 7P MDM Knox Standard Client 3. HTC PRO /PRO2 series Android devices will use the 7P MDM HTC Client 4. Generic Android devices will use the 7P MDM SAFE4 Client 5. Tomorrows device with extended functionality to be confirmed The 7P MDM Generic client is 7P MDM SAFE4 client and will accommodate the majority of Android devices manufactured by smaller organisations Once the appropriate MDM client has been downloaded and installed on the user's device, the MDM client activation process can begin. The MDM client can be activated by either of the following methods: 1. SMS activation the MDM server sends an SMS package allowing automated activation 2. QR code activation the user receives an containing a QR code. The user scans the QR code with their device for activation. Once activated, the user will benefit from the silent OTA management of their mobile device MDM client distribution The MDM client is distributed to the end user in one of two ways: MDM server initiated MDM client installation User initiated MDM client installation using the SPP (Self Provisioning Portal) Both methods are applicable to either device that contain SIM modules, or devices that do not contain SIM modules, typically Wi - Fi only devices, such as e.g. many tablets. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 4 / 36 ^Home

11 1.12 Device administrators permission Prior to the installation of the MDM Client for Android devices, it is essential to ensure that the device is capable of installing non-market applications Android 4.x devices unknown sources path Navigate to Settings >Security >Device administrators and ensure the "Unknown sources" box is selected. Figure 1 Android 4.x unknown sources Once the "Unknown sources" tick box is selected, the device is ready to proceed with the MDM Client installation process Android 2.x devices unknown sources path Prior to the installation of the MDM Client for Android 2.x devices, it is essential to ensure that the device is capable of installing non-market applications. Navigate to Settings >Applications >Unknown sources and ensure the Unknown sources box is selected. Figure 2 Android 2.x unknown sources permission. Once the "Unknown sources" tick box is selected, the device is ready to proceed with the MDM Client installation process. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 5 / 36 ^Home

12 2 MDM Client Installation This chapter describes the Over-the-Air (OTA) installation of the 7P MDM Android Client in Global System for Mobile Communications (GSM) enabled devices, i.e. devices that have an active Subscriber Identity Module (SIM) card through a data provider. The benefit of this preferred method is that the MDM Client is automatically activated to its corresponding MDM server without user intervention. This chapter consists of the following sub-chapters: 2.1 SMS initiated delivery with automatic activation 2.2 Wi-Fi installation with QR code activation 2.3 MDM client download and installation 2.4 Activate device administration? 2.5 Client Activation Methods 2.6 Activation confirmation 2.7 Additional activation steps (Samsung SAFE) 2.1 SMS initiated delivery with automatic activation The MDM server operator will add your details to the MDM Server resulting in a short SMS message being sent to your mobile device. This message is important. The message contains the download hyperlink for the MDM Client that will be installed on the user's device. Embedded in the SMS text message is an encrypted activation code, used by the MDM client application. Figure 3 SMS download link. The user must open the message link, completing the operation by selecting the browser of their choice. The URL selected will be opened in a new screen. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 6 / 60 ^Home

13 2.2 Wi-Fi installation with QR code activation The Wi-Fi installation method of the MDM client is used with devices that do not have an enabled SIM card and generally only have access to messages. The MDM administrator would choose to "Enroll device via ." An will then be sent to the MDM server registered address for the specific user(s) that contains instructions and a hyperlink URL to an internet site where the required MDM client is hosted. Figure 4 containing download link. The user would open the on their Android device, select the link and download the MDM client application to their device. The procedure is then as described in "MDM Client Installation" except that the MDM server will not automatically activate with the MDM server, the steps described in the QR activation must be followed. 2.3 MDM Client download and installation The mobile device will be automatically recognised by the designated MDM client download site, and a specific MDM Client will be presented to the device for download. Figure 5 Auto detection of the device. Once the download warning has been accepted a "Downloading" message will be displayed, and the animated "downloading arrow" indicator will appear at the top of the device display screen in the user's notification tab, remaining animated until the file download is complete. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 7 / 36 ^Home

14 2.3.1 Downloaded application installation The user must now select the downloaded application file. This can be achieved by swiping the device screen, from the top of the device screen, allowing the device notification bar, and the notifications to be revealed, or the user can open the "downloaded" icon on their device which will open the downloaded file folder. Figure 6 Accessing the downloaded MDM client The user would then select their chosen package for installation. Once the user selects the downloaded MDM Client package has been selected, the user will be advised of the applications ability to read personal information from their Android device. Figure 7 Do you want to install the application? The user, at this stage, has the option to either cancel the installation or to commence the installation of the MDM client by tapping the "Install" button. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 8 / 36 ^Home

15 The user is informed that the selected application is installing. An animated progress indicator is used to show that the installation process is running. Figure 8 Application installed. Within a short period of time, the advisement will change from "Installing" to "App installed." The user would then proceed with the installation of the application by tapping "OPEN" to continue 2.4 Activate device administration? A notification screen detailing the "Device administration" privileges of the 7P MDM Client is displayed. The user must tap "ACTIVATE" to proceed with the MDM client installation. Figure 9 Automatic activation message. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 9 / 36 ^Home

16 2.5 Client Activation Methods The three valid methods of MDM client activation are: Automatically using embedded information within the initial enrollment SMS text message ( preferred) Quick Response code (QR), allowing the corresponding MDM server's credentials to be inserted into the MDM client application by scanning a specially prepared QR code image SMS activation (preferred) If the associated MDM Server is configured to deliver the MDM Client with automatic activation selected, and the MDM client installation commenced on receipt of an enrollment SMS message, then the MDM Client will automatically activate when "ACTIVATE" is selected, with no further action required from the user Activation using QR code The user must open the MDM client download and activation QR code on a laptop or similar device. This n method of MDM client activation requires the user to point their device's camera at the QR code so that it can be read and consumed by the MDM client. Figure 10 QR code activation . To activate the MDM Client using the QR code, the user must first select the "Activation with QR code" button. This will initialize the devices' on board camera. The user must then point their device's camera at the QR code. Figure 11 Activate with QR code. The QR code image will then be evaluated; the details embedded within the QR code will then be consumed by the MDM Client for activation processing. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 10 / 36 ^Home

17 2.6 Activation confirmation The user will be supplied with a PIN code that must be entered into the "Confirm activation" input field. Figure 12 Inputting the activation PIN code The activation confirmation PIN code is different for all MDM server installations and must be communicated to the user prior to installing the MDM client of their device. The default PIN code is 1234, then tap "Continue." Backup security code A "Backup security code" warning pop up will be displayed. The MDM client uses a "security code," which can be updated by the user, through the MDM client menu system. This security code is used as part of the encryption key when information is backed up to, or restored from the MDM server. Figure 13 Backup security code warning If a Backup security code is altered, then any information previously backed up to the MDM server will not be restored to the user's expectations. A user must complete a new backup every time their "Backup security code" is changed. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 11 / 36 ^Home

18 2.6.2 Client Activated The MDM client will display the expected (Next) connection time and the previous (Last) connection time and dates to the MDM server. There are no further steps to perform with the installation of the MDM client to: 1. Samsung SAFE3 compatible Android devices 2. HTC PRO /PRO2 series Android devices 3. Generic Android devices Additional steps will be required for the activation of Samsung Workplace (KNOX/SAFE4) compatible devices 7PMDM_Client_Android_v _02_EN_1.0.docx Page 12 / 36 ^Home

19 2.7 Additional activation steps (Samsung Knox Workspace) With Samsung Knox Workspace (SAFE4) compatible devices, a further acknowledgement is required prior to the MDM client activation. This will allow the user to utilise the KNOX facilities on their device which is licensed to Samsung Figure 14 Samsung Knox Workspace acknowledgement The user must tap in the acknowledgement box, which changes from any empty box, to a green "tick," then tap "Confirm." Figure 15 Knox Standard management privileges The user would then accept the extended mobile device management privileges by tapping "Continue." The acknowledgement and KNOX registration will be processed, resulting with the "Knox Standard License was accepted" on the MDM client front UI 7PMDM_Client_Android_v _02_EN_1.0.docx Page 13 / 36 ^Home

20 3 MDM Client Android Console This section describes the content, usage, and functions that are available through the MDM Client menu system. MDM Client functionality itself may differ, depending on the configuration settings of the corresponding MDM Server. 3.1 Access to the MDM Client Access to the MDM Client is gained by selecting the 7P MDM Client icon on the main screen of your Android Mobile device. Figure 16 MDM Client icon. Once open, the MDM client screen is presented. Typically the MDM client screen will inform of: Whether the MDM client service is activated or non- activated. The expected date and time of the "Next connection" to the MDM server The exact date and time of the "Last connection" to the MDM server The date and time that the "Last backup" command was executed, if no back up has been performed, then "n/a"( not applicable) will be shown. Enter to the MDM client menu structure by selecting down arrow, located at the top right hand side of the MDM client navigation bar. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 14 / 60 ^Home

21 3.1.1 About the MDM client Only three Android clients are utilised with the MDM server. To identify which MDM client is installed in the device navigate to Settings > About The Android client structure shares a common theme and layout allowing ease of support over the entire Android product range. Figure 17 Accessing the MDM Client menu structure For display purposes, each of the three supported MDM client "About " screens have been displayed. 1. Knox Standard compatible Android devices 2. Samsung SAFE3 compatible Android devices 3. HTC PRO /PRO2 series Android devices The "Generic Android devices" MDM client uses and displays Knox Standard compatible Android devices) 7PMDM_Client_Android_v _02_EN_1.0.docx Page 15 / 36 ^Home

22 3.2 MDM client navigation bar shortcuts Three active icons appear in the MDM client navigation bar: Force a connection icon shortcut Force a connection from the MDM client to MDM server Figure 18 Force connection icon shortcut Generally used if the user requires immediate delivery of a newly created application or operation policy Open the MDM client AppStore icon shortcut Open the App Store access to the MDM Clients AppStorage container Figure 19 Navigation bar shortcut to the AppStorage contents. All applications contained in the AppStorage container are managed by group membership. Application availability is determined by the MDM server administrator. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 16 / 36 ^Home

23 3.2.3 Open the MDM client navigation bar icon Open the MDM client menu structure Figure 20 Access to MDM client structure icon Tapping the open MDM client navigation bar icon will open the MDM client application allowing the user to navigate through, and select their specific functionality of the MDM client Open the MDM SSP icon shortcut Open the MDM server SSP access shortcut Figure 21 Accessing the MDM SSP user interface Tapping the open MDM server SSP icon will open the devices web browser in a new screen. The SSP server address will automatically populate the address bar, revealing the SSP log in screen to the device user. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 17 / 36 ^Home

24 3.3 MDM Client's menu structure The table below is presented to assist administrators or help desk operatives to navigate the MDM client menu structure if they do not have a device readily on hand. Main menu Submenu Description About Application name/version Shows the application name Application management AppStorage Displays applications available in the AppStore Connection Connect Forces connection with MDM Server Online Activity details Activate Tap or click the check box provided to allow/disallow the MDM client to connect to the internet. Shows the connection attempts and any errors that have occurred Change the activation settings Advanced Policies Allows the user to inspect any messages sent by the MDM server. Reset Data Allows the user to reset the MDM client activation data ( removes trusted connection to MDM server) Privacy Settings Change security code Allows the user to change MDM security code Send GPS data Security code Device encryption If enabled, allows GPS data to be transmitted to the MDM Server. Send the MDM client security code to the MDM server is administrator requests it. Utilises the built in device encryption of the mobile device. Table 2 MDM Client's menu structure Details and location of the elements of the menu structure are shown in the following pages. The "Reset data" functionality must be enabled by the MDM server administrator. Navigate to Settings> System > MDM Client > Allow Data Reset The MDM server will collect the location data of the device even if the corresponding settings have been disabled in the MDM client privacy settings. To disable the MDM servers forced GPS data collection and return the control of GPS location data collection to the device user (through MDM client Privacy settings) then the "Force enable GPS collection on client" checkbox must be disabled (unchecked) in the MDM server - Settings>System>GPS 7PMDM_Client_Android_v _02_EN_1.0.docx Page 18 / 36 ^Home

25 3.4 MDM client preferences About The "about section" displays information regarding the installed version of the MDM client About Application name and version The Settings >About displays the installed MDM Client application name, version number, and specific "build" information. Figure 22 About the MDM Client. 3.5 Application management AppStore Access to the MDM Clients AppStorage container can also be made from within the MDM client by selecting the "AppStorage" in the Application management field. Figure 23 Tools location. All applications contained in the AppStorage container are managed by group membership. Which applications are available to what user is determined by the MDM server administrator. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 19 / 36 ^Home

26 3.6 MDM Client preferences - Connection The Connection section of the MDM client allows the user to inspect and specify connection activity and details Connection connect The Connect button allows the user to force the MDM Client to connect to the MDM Server. Figure 24 Force connection to MDM Server. "Forced connection" is used when a user wishes to make a connection to the MDM Server, outside of the normal connection interval Connection - Activity details Displays a time stamped log of the MDM Clients connection activity with the MDM Server. The "activity details" also displays any error information that may have occurred during an activity (for example, file copy) with the MDM Server. Figure 25 Tools Activity details. The above shows a successful completion of "The user forced connection" with the MDM server." 7PMDM_Client_Android_v _02_EN_1.0.docx Page 20 / 36 ^Home

27 3.6.3 Connection Activate The general method for MDM client activation is with an encoded SMS message deployed to the user's device on initial configuration. Figure 26 MDM client activation methods. However, some devices do not support SMS capabilities, so the MDM client must be activated by either entering the MDM server details into the MDM client manually or by capturing the MDM client activation QR code through the devices on-board camera (see Client Activation Methods). 3.7 MDM Client preferences -Advanced The Advanced section of the MDM client allows the user to inspect and specify shortcuts and activity Advanced - Policies The Policies option will allow the user to view all current policies applied to this device by the MDM server. Figure 27 Policies. If the user does not agree or understand any enforced policy that is active on their device they should contact the system administrator for guidance. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 21 / 36 ^Home

28 3.8 MDM Client preferences - Privacy Settings Privacy settings contain elements of sensitive information that can either be sent or not, to the MDM Server Privacy Change security code This menu item allows the user to change their MDM security code. The user has to enter their current 5 digit numeric code. The user then has to insert and confirm their new 5 digit numeric code. Figure 28 Change security code. Please note that the reserved security code of cannot be used. If the user changes their security code, then all previous backups will not be available for restore as the 5 digit numeric code is used as part of the encryption keys used to safe guard all backup and restore information Privacy settings Send GPS data If selected, sends location information, using the built-in GPS hardware of the device. If no GPS device is present, no information will be sent. Figure 29 Send GPS data. The data is sent only if the MDM server has requested it to be sent and if the user has selected a valid interval. The GPS data is accessible to view by the system administrator. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 22 / 36 ^Home

29 3.8.3 Privacy Settings Security code If selected, the MDM client will transfer MDM client security code to the MDM server on every connection. Figure 30 Send security code The MDM security code is used as an encryption/decryption key for all backup/restore operations of the MDM client. If the security code is changed, ensure the user does a fresh backup as the previous backup will be unintelligible due to an incorrect (previous) decryption key Privacy settings Device encryption If selected, the MDM Client will invoke the on-board encryption mechanism and encrypt all data defined by the user. The encryption process is device dependant. Figure 31 Device encryption. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 23 / 36 ^Home

30 The user is advised to fully understand the impact on performance and power consumption prior to encrypting their device. Ensure that the device is fully charged, and then enter the device screensaver PIN code. Once entered, tap "continue" and the device encryption process will begin 7PMDM_Client_Android_v _02_EN_1.0.docx Page 24 / 36 ^Home

31 4 MDM Client - Android Kiosk Mode This section describes the additional restrictions that an administrator can apply to a Samsung Android device running the 7P MDM client and the 7P Android Kiosk application. Kiosk mode is a common way to lock down (restrict) an Android device, ensuring that it can only use apps specified explicitly by the MDM administrator. The apps, up to a maximum of 24 per page, and currently a maximum of 2 pages giving a total of 48 apps may include pre-installed applications and built-in function like Calendar, Phone, and Contacts. Kiosk mode may only be enabled on MDM server registered Samsung devices running version of the 7P MDM Android client, and Build and above of the 7P Android Kiosk application. Both applications are available from the mdmclinet.net website. 4.1 Android Kiosk Mode applications At present, there are two Android Kiosk mode applications: Kiosk app (standard version) - Version ID: Build Allows two pages of 24 applications to be displayed Each page can display a total of 24 apps ( displays 4*6 apps in portrait mode, and 6*4 apps in landscape mode) Kiosk app (standard version + CLR ) - Version ID: Build Allows two pages of 24 applications to be displayed Each page can display a total of 24 apps ( displays 4*6 apps in portrait mode, and 6*4 apps in landscape mode) The standard version + CLR is the same as identical to the 7P Kiosk (standard) app. However, there is a special CLR (clear data) option integrated into this Kiosk app version. The purpose of the clear data facility is to clear all browser, cache and app data within the Standard Samsung Native browser and the Chrome Browser. The clear option in this Kiosk app works in these 5 situations: When device is turned off and on again When device is being rebooted When autolock gets activated due to timeout on device When autolock gets activated because the user has quickly clicked on the power button to turn off the screen or and there has been a period greater than +10 secs of no activity When MDM server sends remote lock command 7PMDM_Client_Android_v _02_EN_1.0.docx Page 25 / 60 ^Home

32 4.2 Creating the Android Kiosk mode configuration 1. Navigate to Infrastructure > Configurations and create an Enable Kiosk mode configuration. 2. Add the following 7P Kiosk mode settings application detail in the Other(s) application list of the Kiosk mode configuration: com.sevenprinciples.android.mdm.settings Ensure that the URL in the Kiosk mode configuration contains a pointer to a valid location of version and above of the 7P Android Kiosk Mode application. 3. Navigate to Users & Devices > Device > Actions and from the device Actions menu, apply the Enable Kiosk mode configuration to the device. The target device UI screen will change in appearance from Native mode to Kiosk mode. When the device is in Kiosk mode only specified applications and buttons, determined by the administrator, will maintain their functionality Disable Kiosk mode internet connected device Create a Disable Kiosk mode configuration Deploy the Disable Kiosk mode configuration to the device through Actions> Install configurations Disable Kiosk mode internet disconnected device The only way to disable Kiosk mode with a device that has no connection to the 7P MDM server would be to hard reset the device. (See device manufacturer s guide.) 7PMDM_Client_Android_v _02_EN_1.0.docx Page 26 / 36 ^Home

33 4.3 Enabling Kiosk Mode Navigate to Infrastructure > Configurations > Add > Kiosk > Memorable Name of Configuration settings. Figure 32 Enabling (Basic) Kiosk mode From the Main settings ensure the Kiosk mode drop down is displaying Enabled, then use the information in the following table to complete the form. Parameter Kiosk mode URL Background image Allow multi-window mode Allow task manager Hide system bar Hide status bar Hide navigation bar Wipe recent tasks Disallow hardware keys Description Enabled OR Disabled This URL points to the location where the 7P Android Client Kiosk application may be accessed. The JPEG image that will be used as the Kiosk mode background wallpaper. This JPEG file may be uploaded directly to the MDM server or via a hosted internet location URL Allows the use of Android 7 (Nougat) devices multi-window mode (Must be 7 or above) Allows the use of the Task Manager when selected in Kiosk mode Hides the system bar when selected Hides the status bar when selected Hides the navigation bar when selected Wipes recent tasks when selected The following comma separated values are available: HOME, MENU, BACK, VOLUME_UP,VOLUME_DOWN Table 3 Kiosk Mode main settings 7PMDM_Client_Android_v _02_EN_1.0.docx Page 27 / 36 ^Home

34 Once the Main settings have been completed, then the administrator would select the applications that may be performed on the device in Kiosk mode from the Supported applications selection. Figure 33 Define inbuilt Kiosk mode applications For Application list, please refer to Enabling Kiosk mode (Advanced) further down in this section Deploying a basic Kiosk mode configuration Select a device, then Action > Install configuration > Named Kiosk mode configuration> Send Normal mode Kiosk mode being applied Kiosk mode The device will initially appear as normal; the screen will be blocked when the Kiosk mode application is received, resulting in a fully restricted Android device. The user will be restricted to the functionality and application that have been made available by the MDM administrator. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 28 / 36 ^Home

35 4.4 Disabling Kiosk Mode Navigate to Infrastructure > Configurations > Add > Kiosk > Memorable Name of Configuration settings. Figure 34 Disable Kiosk mode configuration From the Main settings ensure the Kiosk mode drop down is displaying Disabled, and Save the configuration. Select a device, then Action > Install configuration > Named Kiosk mode configuration> Send Kiosk mode Normal mode The device screen will return to normal once the Kiosk mode application ( and all restriction) has stopped. For devices that are already in Kiosk mode, and do not have any internet connectivity, then the only way to restore the device to normal operations will be to use the manufacturers recommended a hard reset. The manufacturer's hard reset is device dependant and must be implemented as instructed by the manufacturer. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 29 / 36 ^Home

36 4.5 Enabling Kiosk Mode (Advanced) Navigate to Infrastructure > Configurations > Add > Kiosk > Memorable Name of Configuration settings. From the Main settings ensure the Kiosk mode drop down is displaying Enabled, then use the information in the following table to complete the form. Supported applications Calendar Talks ( Phone call) Browser Camera MMS Contacts Application list Definition of Kiosk application list Description Allows the Calendar app when selected Allow the user to make calls when selected Allows the user internet access when selected Allows the user to take pictures when selected Allows the user to use the Multimedia Messaging Service (SMS etc.) Allows the user to access contacts when selected Allows the user access to native when selected Allows the administrator to select from pre-configured application lists from the drop down selection (See application list) It is possible to define where an application icon will be placed on the users device screen. At present, Kiosk mode is designed to display 2 pages of 24 application icons, whether in Portrait or Landscape mode. To take advantage of the automated placement, then the administrator must use the Application list name created. In manual mode, an application must be defined in the MDM server before it will appear in the application list pull down. Table 4 Kiosk mode supported applications 7PMDM_Client_Android_v _02_EN_1.0.docx Page 30 / 36 ^Home

37 4.5.1 Application list (defined) Navigate to Infrastructure > Configurations > Add > Application List > Memorable Name of Application list settings. Figure 35 Application list creation Ensure that Kiosk list(knox Standard) is selected. Once selected, two grids (page 1 and page ) each containing 24 cells each will be displayed. The grid cells represent the location that an application icon can be placed on a user s device. A maximum number of 24 applications per screen page, with a maximum of two screen pages may be configured in Kiosk Mode. This total of 48 applications is made up of the number of selected inbuilt apps plus the number of additional apps ( defined through the other(s) input box). The application icons will always be displayed on the target device as either a 4x6 matrix, in portrait mode, or a 6x4 matrix in landscape mode. The order in which the apps appear on the device is determined by the order the applications were added to the application list. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 31 / 36 ^Home

38 4.6 Adding an application to an individual cell location With the Application List configuration template displayed, and with the Kiosk List (Knox standard) radio button selected, and then when selecting any of the displayed grid cells, the following pop up window will be displayed. You are given the option to either name an application and supply the application identifier, for example Ikarus (Antivirus software) com.ikarus.mobi, or you may select an application from the MDM server application list tby selecting an application through the application list drop down selection. Once the application format is complete, press Save. The Kiosk list will be saved to the MDM server. The Application List configuration must now be selected in the Kiosk configuration. Navigate to Infrastructure > Configuration > Kiosk and add the newly created Kiosk application list from the Predefined application list pull down selection. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 32 / 36 ^Home

39 4.6.1 Other Application list (manual) If the administrator chooses to add applications manually to the Kiosk configuration, then they must ensure that the application is installed on the target devices and that the correct application ID s are used in the comma separated list. A typical application ID is : com.samsung.android. .provider, Once the other(s) list has been completed, select Save and deploy the configuration. 4.7 Kiosk Settings application The Kiosk settings icon will be displayed on the target device once the Kiosk settings application has been deployed ( and enabled in Kiosk mode). Figure 36 Kiosk settings If the Kiosk setting application icon is selected, then the following screen will appear 7PMDM_Client_Android_v _02_EN_1.0.docx Page 33 / 36 ^Home

40 Figure 37 Kiosk settings application buttons Parameter WiFi Bluetooth Torch Rotate Brightness (slider) Description Allows the user to turn on/off the devices WiFi. Allows the user to turn on/off, pair and scan for Bluetooth devices Allows the user to turn on/off the devices torch (light) Allows the user to turn on/off active screen rotation Allows the user to adjust the brightness of the devices display Table 5 Kiosk mode kiosk settings 4.8 Kiosk Settings application Clear data If internet browsing is enabled, or if applications are enabled that allow for autofill data to be stored on the device, then a potential security data breach could exist when the device is returned to a central location, at the end of a work cycle, to be picked up by a fellow work colleague for example. The Clear data button when selected, will manually erase any stored data ensuring that the device contains no internet browsing data for example, when locked and passed to another user.. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 34 / 36 ^Home

41 5 Samsung Knox Workspace For current information regarding the Samsung Knox initiative, please refer to the following Samsung website MDM Server actions KNOX If the KNOX configuration is updated and resubmitted to a device, KNOX is completely removed from the device including all KNOX stored created content! The following KNOX actions pane will only be visible with devices that are compliant with the Samsung Knox specifications. Figure 38 Samsung KNOX device screenshots If the MDM administrator issues the "Enforce change" KNOX function this will result in a KNOX formatted message being sent to the user's device which will force the user to change their Knox Workspace password credentials. If the MDM administrator issues the "Reset" KNOX function this will result in a KNOX formatted message to the user's device which will automatically reset the password. If the MDM administrator issues the "Lock" button, when issued to a device will place an administrative lock on the Knox Workspace. Access to the Knox Workspace is no prohibited. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 35 / 60 ^Home

42 The MDM server administrator must issue the "Unlock" MDM server action to the device. Figure 39 Lock command issued from MDM server. The "Unlock" button, when selected, will issue an administrative unlock to an MDM server locked Knox Workspace. Figure 40 Unlock command issued from MDM server. When this command is received by the device, the Knox Workspace will be unlocked allowing the user to insert their password in order to access their Knox Workspace. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 36 / 36 ^Home

43 5.2 Samsung Knox Workspace Samsung KNOX 2.0, a secure Android platform introduced by Samsung in 2013 as Samsung KNOX, targeted primarily at mid and high-tier devices, it leverages hardware security capabilities to offer multiple levels of protection for the operating system and applications. Key features include Trusted Boot, ARM TrustZone -based Integrity and Security services, SE for Android enhancements, and the KNOX 2.0 container. In addition, KNOX 2.0 features a new enterprise enrollment process that vastly improves both the employee and IT administrator experience for enrolling devices into the company s MDM system. In 2016, Samsung SAFE has been rebranded as Know Standard, and Knox container has been rebranded as Knox Workspace Knox NOT activated (neither personal nor enterprise version) The very first time before the user does something around Knox on a Knox 2.0 compatible device, it looks like this: Knox personal edition activated before MDM activates Knox When you choose to activate the KNOX application on a Knox 2.0 compatible device PRIOR to MDM KNOX 2.0 activation, then you result in having 2 Knox Containers at the same time on the device when the KNOX 2.0 enrolled and configured via MDM. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 37 / 36 ^Home

44 5.2.3 KNOX PERSONAL EDITION NOT PREACTIVATED IF you enroll the Knox Container (Knox Workspace) to the device BEFORE the user activated this Knox option, then the user will not be able to activate the Knox private option. Then you have ONLY 1 Knox Workspace on the device which is the recommended scenario. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 38 / 36 ^Home

45 6 Remove (uninstall) the MDM Client This section describes the removal (uninstall) process of the MDM Client from the user's device. The removal process is dependent on the configuration of the MDM Server and may be prohibited. 6.1 Manual uninstall of the MDM Client Prior to removing the MDM Client from the Android device, the user has to change the status of the MDM Client from "Activated device administrators" to "Deactivate device administrators." This is accomplished by navigating to Settings >Security >Device administrators, selecting the 7P MDM client, then "Deactivate." Figure 41 Deactivate MDM Client. The uninstall button is now active in Settings >Applications >7P MDM Client. Figure 42 Active uninstall button. If you wish to remove the 7P MDM Client from your Android device, navigate to Settings >Applications, and select 7P MDM Client. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 39 / 60 ^Home

46 Figure 43 Removal of MDM Client. Begin the "Uninstall" of the 7P MDM Client process by selecting the "Uninstall button." Confirm the action by pressing the OK button. Once completed, you will be advised that the "uninstall finished." 7PMDM_Client_Android_v _02_EN_1.0.docx Page 40 / 36 ^Home

47 7 Samsung KNOX Mobile Enrollment (KME) Samsung KNOX Mobile Enrollment (KME) is an efficient way to enroll large numbers of corporate-owned Samsung KNOX compatible (KNOX version 2.4 and above) devices into the 7P Mobile Device Management (MDM) environment without manually configuring each device. Only devices capable of running Samsung KNOX 2.4. Upgrades may be available for your existing devices, if so, upgrade them to KNOX 2.4, then indicate, on the MDM server, that the devices are KME compatible Samsung KME Features The following is a list of some of the main Samsung KME features. Auto re-enroll - Once a device is enrolled in your MDM, the MDM software will be reinstalled even if the device is erased and reset. Multiple MDM configurations - If you manage a complex MDM environment, Mobile Enrollment lets you set up devices with the right profile. Automatic installation and activation - Turn on the device, connect to Wi-Fi and Knox Mobile Enrollment installs and activates MDM application. Easy and efficient integration - No specific Knox license required. Cost saving for IT Admins Utilising Samsung KME The following is a bulleted list of the minimum Samsung KME requirements. Samsung Knox 2.4 (or above) devices. A 7P MDM server. A Knox Portal account with the Knox Mobile Enrollment feature enabled (See Prepare the 7P MDM KME environment) Samsung KME Supported devices and models The following devices support Knox Mobile Enrollment out of the box: Galaxy A3 (SM-A300, SM-A310), Galaxy A5 (SM-A500, SM A510), Galaxy J5 (SM-J500), Galaxy Note 5, Galaxy S5 Neo, Galaxy S6, Galaxy S6 Edge, Galaxy S6 Edge+, Galaxy Xcover 3 (SM-G388), Galaxy Tab A, Galaxy Tab E, Galaxy Tab S2, Galaxy Tab 4. For other Samsung devices, contact your sales representative for more information and details on using older devices with Knox Mobile Enrollment. See At the time of writing, Samsung confirms the Galaxy S6 and S6 Edge as compatible with Knox 2.4, and it says "any device that ships with Lollipop or gets a Lollipop update is highly likely to get a Knox 2.4 update, but the specifics are dependent on carriers and regions as well as on timing of other updates that are already in the pipeline." In other words, you'll need to carefully research which devices are compatible and when they become compatible. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 41 / 36 ^Home

48 8 Simple KME workflow This section is a review section of the typical steps a customer must take to be able to utilise Samsung s KME (Knox Mobile Enrollment facility) Initial steps, performed with Samsung KME dashboard 1. Customer registers with Samsung KME through 2. On successful registration, logs into Customer portal 3. Launches KME 4. Register/Define and add the participating reseller that the devices were purchased from 5. Finally, create an MDM profile 6. Add 7P MDM client file to created profile. Device registration steps performed on 7P MDM server: Ensure the validity of the IMEI of KME designated devices and that they are KNOX 2.4 compatible For a single device: Manually create and enable the device for KME through the 7P MDM UI For multiple devices: Use the CVS import facility to create and enable multiple devices for KME Export the KME tenant device list, using the KME export facility on the 7P server to KME desktop. Final steps performed with Samsung KME dashboard 1. Import the KME device list CSV into the Samsung KME dashboard. 2. Associate the uploaded KME CSV devices to the MDM profile created in step 5 3. Display/check the device list. All imported devices will have the Pending verification status. 4. Wait for the status to change to Ready to enroll. At this stage, all newly purchased, or recently wiped devices are ready for deployment. It is essential that initial stages of device deployment/enrollment must be performed using Wi-Fi connectivity. Ensure that the recipient has access to and the details of their associated wireless access point. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 42 / 36 ^Home

49 9 Apply for KNOX Mobile Enrollment In this section we will: Apply for KNOX Mobile Enrollment Login to the Samsung KNOX dashboard Launch and Inspect the KME dashboard From the web page, select the Get Started button. A new web page requesting you to register your company details will be displayed. Equally, select this URL Complete the form and select continue. Once registered, return to the Get Started page and select the Log in button in the Are you an existing KNOX customer field. Then login with you registered Samsung Account details. Your Samsung account dashboard will be displayed. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 43 / 36 ^Home

50 Locate the KNOX Mobile Enrollment section and select the Launch button. Your Samsung Knox Mobile Enrollment desktop will be revealed. Figure 44 Samsung KME dashboard The Samsung KME desktop allows quick and easy navigation. The main horizontal tabs allow ready access to the following functionalities. Tab Devices MDM Profile Reseller Device Users Description Displays the current KME registered devices Displays the available / configured MDM profiles Displays and allows the definition of Registered reseller and Displays the User ID of associated device users (past and 9.1 Prepare the Samsung KME environment From the dashboard, select the Resellers, and register a reseller Figure 45 Resellers reference and KNOX ID Once all the Resellers information has been entered, select Save. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 44 / 36 ^Home

51 9.1.1 Add an MDM Profile The MDM profile allows the KME administrator to: Define the MDM client to be downloaded into the device Define auxiliary configuration information through a JSON data file Decide whether to add KNOX related EULA s Decide on an additional User agreement Associate a KNOX license with this profile From the MDM profiles screen select the Add button An MDM Profile Details page will be presented. Ensure to insert a friendly name into the Profile name, then select the Add MDM applications button. Select the Add MDM applications button. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 45 / 36 ^Home

52 The Add MEM applications pop up will be revealed. Navigate to hover over the MDM Client with your mouse pointer, right click and select Save target address as or simply copy the link address, for example, Return and paste the MDM client android package link address into the field provided in the Add MDM applications pop up box. Once the link has been provided for the 7P MDM client, press Save 7PMDM_Client_Android_v _02_EN_1.0.docx Page 46 / 36 ^Home

53 The MDM Agent APK field will be populated with the supplied URL of the 7P MDM Client APK package. If a different MDM Agent APK is required, simply use the Remove function, and repeat the process. Additional MDM applications may be loaded at this stage, but this is beyond the scope of this document. Additional Custom JSON Data may also be provided, along with a selection of standard and customer created EULA s that may be included in this particular profile On completion, select the Save button. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 47 / 36 ^Home

54 The MDM Profiles dashboard will display the recently created profile. Selecting the MDM Profile hyperlink will reveal a summary of the profiles attributes. Check the summary information, edit any required information. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 48 / 36 ^Home

55 10 Prepare the 7P MDM KME environment In this section, we describe where the MDM administrator can confirm KME enabled devices, and describe the effect of the Export KME button Enable KME devices in Dashboard Navigate to Settings > System > Dashboard > Devices and ensure that the KME checkbox is selected. View KME devices in Dashboard Navigate to Dashboard > Devices The number of KME enabled devices within the current tenancy will be clearly displayed. Figure 46 7P MDM server dashboard 10.3 View KME devices via Reports Navigate to Reports> KME Devices Figure 47 7P MDM server reporting facility Use the 7P MDM server Report facility to identify specific or general KME device information through the use of filters and groups. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 49 / 36 ^Home

56 10.4 Manually select device as KME enabled Navigate to Organization > Users & Devices > Select a User > Select a user s device> Contact and enrollment information > Knox Mobile Enrollment Yes No Figure 48 7P MDM server device information Set multiple devices as KME enabled It would be better to use the CSV Import facility, allowing multiple devices to be KME enabled by specifying their KME state through the import of a CSV file into the 7P MDM server Export KME devices to CSV file Navigate to Organization > Users & Devices and select the Export to KME button. The MDM server will export the IMEI and MDM client activation code of all devices that are designated as KME enabled to a CSV file, downloading it to the administrators desktop. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 50 / 36 ^Home

57 10.7 Export to KME CSV file The exported KME CSV file contains the IMEI of the exported KME enabled devices; in this example quantity 2 devices are ready to be uploaded into the Samsung KME dashboard. Figure 49 Example 7P MDM KME export The 7P KME Export utility allows the administrator to inspect (and alter) the contents of the CSV file before it is imported into Samsung s KME environment Submit KME devices In the Samsung KME dashboard, select the Submit new devices button. A new pop up will be displayed, inviting the administrator to Upload a new device list. Use the select button to navigate to the desktops KME exported CSV file, and select Upload. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 51 / 36 ^Home

58 Once the files are uploaded, you will be asked to supply further details of the uploaded device list through and additional pop-up screen Samsung KNOX participating reseller If this option is selected, and using the previously added reseller information as default, then the information will be checked electronically, resulting in the device status changing from Pending verification to Ready to enroll. Samsung KNOX non-participating reseller If this option is selected, then further screens will be displayed allowing the insertion of proof of purchase documentation, whether direct invoices or purchase orders with the reseller. An unfortunate delay must be expected of this manual verification, which will allow the introduction of purchased devices, from non-participating resellers to be added to the Knox Mobile Enrollment scheme. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 52 / 36 ^Home

59 10.9 Final steps Ready to enroll Once the proof of purchase has been obtained, whether electronically, or through purchase documentation, then the approved devices on the device list will have their status changed from pending verification to Ready to enroll. Figure 50 Device list pending review When approved, the status will change to Ready to enroll. Figure 51 Device list Ready to enroll At this stage, contact the user and ensure that they have the password details for their wireless access point. Once this is confirmed, ask the user to power on the device. Once a Wi-Fi link is established, the device will communicate with Samsung s KME servers, and if the devices IMEI is registered then enrollment will commence, automatically. 7PMDM_Client_Android_v _02_EN_1.0.docx Page 53 / 36 ^Home