Mobile Device Management Guide

Transcription

1 Telstra Mobile Device Management Guide Windows Phone 6.5

2 Contents Purpose... 3 Overview of Mobile Device Management... 3 Getting Help... 3 Pre requisites... 3 Customer Admin Login... 4 Web Portal Address... 4 Getting Login Access... 4 First Time Login... 5 Forgotten Password... 5 Password Security... 7 Multiple Customer Logins... 8 Searching For Mobile Users... 8 Device Enrolment Device Diagnostics Configuration Settings Send Configuration Settings Create Configuration Settings Deploy Enterprise Software Upload Enterprise Software Install Enterprise Software Query Software Uninstall Software Security Wipe Security Policies Reporting FAQs Definitions Telstra Mobile Device Management Guide Windows Phone 6.5 Page 2

3 Purpose This user guide is for IT administrators who want to remotely manage their fleet of mobile devices via the Telstra Mobile Device Management ( MDM )portal. This userguide is not intended to be used by the mobile users. Overview of Mobile Device Management Telstra s MDM web portal allows nominated IT administrators to manage a diverse fleet of mobile devices and perform the following activities remotely over the air. The Telstra MDM portal is available to mobile users who have subscribed to Mobile Connect plans on their service. Description Send SMS Messages SMS messages can be sent to individuals or entire groups Configuration Settings Send settings eg ActiveSync, WiFi, APN etc Diagnostics Get information back about the device eg firmware Device Security Full wipe Device Restrictions Restrict certain applications eg Camera, Bluetooth Reporting Run and export standard reports eg list of devices etc Deploy Enterprise Software Install and uninstall enterprise software (*.cab) Note: Windows Phone 6.5 devices do NOT need client software or any software from the Microsoft Marketplace. Telstra MDM is supported natively in Windows Phone 6.5. A mobile user decides whether they will accept company settings on their device and can remove these settings by hard reset. It s up to each customer to ensure they do not allow access to company resources when these settings are manually removed by a mobile user. Getting Help Telstra provides assistance during business hours 8am 6pm, for customers wishing to use Telstra MDM. All correspondence should be initiated via to wireless@team.telstra.com and a customer support representative will get back to you. The customer support representative can only assist you if we have you listed as an authorised representative on the account who has the authority to remotely manage the company s devices. Pre requisites To use Telstra MDM, the following items need to be in place: You must have at least one Telstra Windows Phone 6.5 mobile devices as listed on Telstra s support page Telstra Mobile Device Management Guide Windows Phone 6.5 Page 3

4 You must have at least one active Telstra SIM and the mobile service MUST be connected with a Telstra Mobile Connect data plan. For more information on Mobile Connect data plans see here The device MUST always have internet access to in order to operate correctly with Telstra MDM. The mobile devices must be turned on and in mobile network coverage area All mobile devices you want to manage must be grouped under a single Telstra mobile billing account. If unclear about this requirement please contact your Telstra sales person or Telstra service delivery/billing contact and they can discuss implications of grouping mobile services under a single billing account. You will require a first time login password to access the Telstra MDM portal. o A first time login password can be requested from the Telstra MDM helpdesk via wireless@team.telstra.com o You will need to provide proof that you are an authorised representative of your company and have the authority to remotely manage employee/contractor devices. Customer Admin Login Web Portal Address Nominated IT administrators can login to the Telstra MDM portal at Getting Login Access The following credentials will be required to gain access Username Password This is your 10 digit Telstra mobile account number under which your mobile users are grouped. If uncertain about your Telstra mobile account number please contact the Telstra MDM helpdesk at wireless@team.telstra.com This is your unique Telstra MDM password which you will manage. The very first time you use the Telstra MDM portal, you will be required to request a password from the Telstra MDM helpdesk at wireless@team.telstra.com Note: You will need to provide proof that you are an authorised representative of your company and have the authority to remotely manage employee/contractor devices before Telstra will issue a password. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 4

5 First Time Login The very first time you login, you will be required to change your password. o Password has to be at least 6 characters o Password maximum length is 14 characters o Password cannot have 3 consecutive characters or numbers o Password must be alphanumeric (no special Characters) You should also enter your address (or a distribution address) and answer to a secret question as described below so that if you forget your password in future, this can be reset for you online without needing to contact Telstra. Forgotten Password If you have forgotten your password, this can be automatically reset and a new password issued online without you needing to contact Telstra. Alternatively if you get stuck, Telstra s MDM helpdesk can reset the password. Send an to wireless@team.telstra.com and you will then be asked to verify your details before the password is changed Pre requisites: When you login successfully for the first time you should setup your address and the answer to a secret question from the administration>user screen. Alternatively click on My Account in the top right hand corner to go directly to this page. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 5

6 You should also setup an answer to a secret question from the administration>user>modify security screen When you forget your password: When you enter your username(telstra 10 digit billing account number) and an incorrect password, you will be asked if you have forgotten your password and given the opportunity to have this reset. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 6

7 You will then be asked to enter your username and address You will then be asked for your answer to a secret question Your password will then be reset and you will be asked to enter a new one. You will also receive a confirmation that the password was reset Password Security The Telstra MDM portal will require that you change your password every 60 days Your login will timeout after 60 minutes of inactivity and you will be required to login again Passwords will be locked out after three incorrect attempts Accounts will be locked after 60 days if you have not logged in during that time. It is your responsibility to keep your password secret and secure. You should NOT pass these details to any person outside your organisation and should change password details if employees leave the organisation. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 7

8 Multiple Customer Logins Only one person at a time can login using the same username/password. If a second person tries to login using the same username/password the other person s login will timeout. Should you require additional logins for your company, please contact the Telstra helpdesk on wireless@team.telstra.com and they can assist. o Read only privileges can also be assigned to different logins depending on what roles you want to give different administration groups within your organisation. Searching For Mobile Users After login you will be presented with the default search screen to make it easy for you to find mobile users. However at any time you can also search for a mobile number by entering this in the top right hand corner. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 8

9 The Telstra MDM portal will then search for the mobile number and display a picture of the handset model associated with that mobile number. Search Problem Resolution The device cannot be found Check that the mobile number has a Mobile Connect plan activated Check that the mobile number belongs to the Telstra billing account number you are using to login. That is, if you logged into Telstra MDM using the mobile billing account number , check that the mobile number you are searching for is being billed under that Telstra account number. Telstra automatically refreshes mobile number information each night, and if a Mobile Connect plan is activated, this mobile number will be displayed the following day. Device model is shown as unknown The device model being used is not supported by the Telstra MDM portal. For a list of supported device models see Telstra cannot identify the device of the user correctly because the user has swapped devices recently Telstra automatically refreshes handset information each night and, if the model is supported for Telstra MDM, it will be displayed the following day should the user swap devices. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 9

10 If you believe the mobile number or handset model is not being displayed correctly please contact the Telstra MDM helpdesk at Device Enrolment Enrolment is a process of establishing authentication between the device and the Telstra MDM portal. A device MUST be successfully enrolled before the Telstra MDM portal can then send settings and policies to the device. To enrol a device: Step 1: Update the device security by installing a security file From the configuration tab, click on the send button next to the Security setting and the server will send an SMS to the mobile user requesting they download a security file. The mobile user will receive an SMS with a link and will need to download the security file and install this on their device. Under the Recent Actions panel on the Telstra MDM Portal the status of SMS will be shown. If the SMS is delivered successfully you will see status will go from pending>sent>success. Step 2: Send the enrolment credentials From the configuration tab, click on the send button next to the TelstraDM setting and the server will update authentication credentials on the device. Under the Recent Actions panel the status of enrolment will be shown. If the enrolment credentials are accepted by the device you will see status will go from pending>sent>success. The security file MUST be installed on the device before the enrolment credentials are sent otherwise the device will reject the enrolment credentials. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 10

11 Recent Actions Status Meaning The Telstra MDM server is in the process of sending the message to the device. If the status remains frozen in pending it means that the Telstra MDM server is having trouble sending the message The Telstra MDM server has sent the message to the device and is waiting for a response If the status remains frozen in sent it means the message has not been delivered OR the handset is not responding to the message. The transaction was successful and the device has reported that the setting has been successful The transaction was unsuccessful either because the handset rejected the message OR the server timed out after 3 minutes Note: This process only needs to be done once for each mobile device (unless the user chooses to hard reset the device in the future, in that case the process will need to be repeated for that device). The enrolment will not succeed unless the user successfully installs a security file. The Telstra MDM server will timeout after 3 minutes if it does not receive a successful notification from the device when sending settings. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 11

12 Device Diagnostics After a device has been successfully enrolled, the IT administrator can then view information about that particular device eg firmware version etc. From the Diagnostic screen click CheckDM The Telstra MDM portal will then query the device for diagnostics Once successful, information about the device will be available from the Diagnostics>Details tab. To refresh the diagnostic information click the CheckDM button and the server will request an updated set of values. Configuration Settings Send Configuration Settings Once a device has been successfully enrolled, the IT administrator can send and update company settings on the device silently while the user is in mobile network coverage. Telstra has pre loaded the following configuration settings that you might find useful and are available from the Diagnostics>Settings tabs Configuration Setting Description IT Admin Prompts Mobile User Prompts WM6 ActiveSync Configures the mobile device with Server The user will be Telstra Mobile Device Management Guide Windows Phone 6.5 Page 12

13 WM6 Gmail IMAP WM6 Windows Live POP WM6 BigPond POP WM6 ActiveSync APN WM6 Tethering APN WM6 Internet APN WM6 WLAN WPA your company ActiveSync settings Username Domain(optional) Configures the mobile device with Gmail settings Configures the mobile device with Windows Live (hotmail) settings Configures the mobile device with BigPond settings Configures the APN that the mobile device uses when connecting to ActiveSync Configures the APN that the mobile device uses when tethering with a PC Configures the APN that the mobile device uses when connecting to the internet Configures a company WLAN profile on the device (WPA/WPA2) NB: while the username is mandatory, a dummy value can be used and then the device will prompt the user to correct. Address Password(optional) Address Password(optional) Address Password(optional) APN Address Username(optional) Password(optional) APN Address Username(optional) Password(optional) APN Address Username(optional) Password(optional) IT admin will need to create this setting and define these fields: SSID Authentication type eg WPA/WPA2 PSK Index Encryption Type eg TKIP/AES prompted for their mail account password the next time the ActiveSync application tries to connect If incorrect or missing, the user will be prompted for their mail account password the next time the application tries to connect If incorrect or missing, the user will be prompted for their mail account password the next time the application tries to connect If incorrect or missing, the user will be prompted for their mail account password the next time the application tries to connect NA NA NA User will need to activate WiFi, and if in range the device will automatically connect to the access point Telstra Mobile Device Management Guide Windows Phone 6.5 Page 13

14 WM6 VPN PPTP WM6 Browser Homepage WM6 HTC HD2 Unlock Home Icons WM6 Encrypt PIM SDCard Configures a company VPN setting on the mobile device using PPTP protocol IT admin will need to create this setting and define these fields: VPN Server Address Username Password(optional) Work URL exception Changes the browser homepage Homepage URL NA Unlocks the HTC Sense homescreen icons. Specific to the HTC Touch HD2 model Encrypts , attachments, PIM, on the device as well as new items stored on the SD card NA NA The VPN will connect automatically based on the work URL exception defined by the IT admin User will need to power cycle the device and the icons will be unlocked. User will be prompted to setup a device password(if they don t already have one) and then restart the device. The device will update it s encryption status every time the device powers up All settings sent to the device are encrypted via SSL. No passwords or company settings are sent over the internet in clear text and the device stores personal passwords in encrypted format. To send a setting to device, select the Send button next to the setting you wish to send. You will then be prompted to enter a set of field values associated with that setting eg when sending ActiveSync settings you will need to enter the server address. Mandatory fields are highlighted and must be completed before clicking Send. Optional fields that are not completed will be ignored by the Telstra MDM server and will not be sent to the device. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 14

15 The Telstra MDM portal will then send the settings to the device silently over the air and the status will be shown in the Recent Actions panel Recent Actions Status Meaning The Telstra MDM server is in the process of sending the message to the device. If the status remains frozen in pending it means that the Telstra MDM server is having trouble sending the message The Telstra MDM server has sent the message to the device and is waiting for a response If the status remains frozen in sent it means the message has not been delivered OR the handset is not responding to the message. The transaction was successful and the device has reported that the setting has been successful The transaction was unsuccessful either because the handset rejected the message OR the server timed out after 3 minutes Telstra Mobile Device Management Guide Windows Phone 6.5 Page 15

16 Create Configuration Settings You can create your own settings using the pre defined configuration profiles available the Telstra MDM portal. This will allow you to customise the various fields associated with a configuration profile for your company. For example, you can create a custom VPN which automatically connects when a user browses to your intranet. On a Windows Phone professional device, you can also lock this VPN down so the user cannot change it. Step 1: Select a pre defined configuration profile to customise From the Administration>Configuration>Add Settings screen select a windows mobile configuration profile you would like to customise. NB: Windows Mobile configuration profiles begin with WM6 Step 2: Complete the fields based on your company requirements All the mandatory field are highlighted and must be completed Click Add when finished and the new setting will be saved. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 16

17 Step 3: Test the new setting After a setting has been successfully added, it will appear with your device on the diagnostics screen. It is strongly recommended that you send the setting to a test device to check that it works as expected before sending it out to employees. Step 4: Modifying your setting If you have made a mistake and need to modify the setting you have created go to the From the Administration>Configuration tab Click on the setting you have created Change the field values Click Modify Telstra Mobile Device Management Guide Windows Phone 6.5 Page 17

18 NB: You will not be able to modify the pre defined settings Telstra has created IMPORTANT: Before deploying any settings to staff these should be tested to ensure they have the desired result. Sending incorrect APN or VPN settings can prevent further Telstra MDM transactions and have charging implications so these advanced settings should be tested carefully. The device MUST always have internet access to the following URL in order to operate correctly with Telstra MDM If routing via a private APN or VPN, this URL MUST be accessible. Deploy Enterprise Software The Telstra MDM portal allows you to upload enterprise software for Windows Phone 6.5 devices (.cab files) and then send these to devices for installation. An enterprise application can also be uninstalled and you can query the device for a list of software. Upload Enterprise Software From the Administration>Software>Add screen input the following items: Manufacturer/Model Software Name (this must NOT contain any spaces) *.cab file to upload (this filename must NOT contain any spaces) Software version number (optional) Click Add Telstra Mobile Device Management Guide Windows Phone 6.5 Page 18

19 Install Enterprise Software Once the enterprise software has been uploaded, it can then be installed onto the relevant device make/model. From the Diagnostic>Software>Install Software tab a list of uploaded software will be shown for that particular make/model. Select the Install option and click Send The Telstra MDM portal will then send the software to the device and install it. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 19

20 Depending on the software, the user may or may not be prompted. If the user is prompted, they will be required to accept the prompts before the Telstra MDM portal receives a successful response from the device. Important: Software installation will fail if the device rejects the file. The *.cab file needs to be compatible with the device you are trying to install it on eg check that the.cab file is supported on that particular device model When uploading the software, the name must NOT contain any spaces otherwise the installation of the software will fail on the device. Query Software After the Telstra MDM portal has successfully installed enterprise software on a device, you can query the device to view it s software inventory. From the Diagnostic>Software tab click Check DM Software. The Telstra MDM portal will then query the device and return a list of software that has been installed by the Telstra MDM portal. Important: The device will only return software applications that have been installed by the Telstra MDM server. It will not return side loaded applications the user may have installed themselves or applications installed on the SD card. Uninstall Software After the Telstra MDM portal has installed enterprise software, this software can be uninstalled from the device silently without user interaction. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 20

21 From the Diagnostic>Software>Uninstall Software tab click Uninstall The software will be uninstalled from the device Important: Some enterprise software can be designed to prevent un install. If this is the case un install will fail. Security Wipe Where a device is enrolled, the IT administrator can then remotely wipe this device at any time when the device is in coverage. THIS WIPES THE ENTIRE DEVICE INCLUDING THE SD CARD. Go to Diagnostics>Security tab Click Wipe Device button Telstra Mobile Device Management Guide Windows Phone 6.5 Page 21

22 Note: Wiping the device deletes all company and person information from the device and SD card. The user will need to restore their personal information via desktop sync The device will need to be re enrolled if the Telstra MDM portal wants to send further settings. The Telstra MDM server will timeout after 3 minutes if it does not receive a successful notification from the device Security Policies Windows Phone 6.5 devices support the following security policies: Enable/disable camera Enable/disable Bluetooth Enable/disable WLAN To set a security policy: Go to Diagnostics>Security tab Select the relevant policy you want to enable/disable Click Send Telstra Mobile Device Management Guide Windows Phone 6.5 Page 22

23 The device will then disable or enable that feature. Depending on the policy it may also ask the user to restart the device. To check the policies on a device: Go to Diagnostics>Security tab Click Check Policies A list of the policies will then be returned from the device Reporting From the Admin Reports screen, standard reports are available. Once a report has been run, data can be exported to a.csv file for further manipulation. All reports can be run on an ad hoc basis(ie as needed). The command history report can also be run on a recurring basis(ie daily, weekly, monthly). Telstra Mobile Device Management Guide Windows Phone 6.5 Page 23

24 To run an adhoc report: Go to Administration>Reports Click the add (+) link in the Ad hoc report row Select the report you want to run The following standard reports are available on the Telstra MDM portal: Report Name Description Type of Report User/Device Inventory A list of all your mobile numbers, device models and device serial numbers(imei) Can be run on an ad hoc basis only ie once off as needed Device Application Inventory Provides a list of software installed on the device by the Telstra MDM server Can be run on an ad hoc basis only ie once off as needed Device Firmware Summary A list of firmware version returned from the device when queried by the Telstra MDM server Can be run on an ad hoc basis only ie once off as needed Traffic and Downloads Report Command Details Report A view of how much data is being transferred between the Telstra MDM Server and each device List of all the settings that have been sent to the device Can be run on an ad hoc basis only ie once off as needed Can be run once, daily, weekly or monthly Recurring reports can be scheduled from a set date/time and will then be run automatically by the Telstra MDM Portal every day, week or month. The Telstra MDM Portal will save these recurring reports for a period of 90 days and then delete them. To schedule a recurring report click the add (+) link to create either a daily, weekly or monthly report. Select the report you wish to run from the drop down list Give the report a name Select the date and time you want the report to run from Telstra Mobile Device Management Guide Windows Phone 6.5 Page 24

25 The Telstra MDM Portal will then schedule your report to run and a list of scheduled reports and status are listed when you click the listed (L) link from the Admin Reports main screen. To delete a recurring report click the delete link. Once a report has been successfully run, the report can be viewed and exported by clicking on the view (V) link from the Admin Reports main screen. FAQs How do I access the Telstra MDM Portal? How do I get a login? How do I get support? What is enrolment? The first time you login you will need to contact the Telstra MDM helpdesk at wireless@team.telstra.com and get a password Send an to wireless@team.telstra.com A process of setting up authorised authentication between Telstra Mobile Device Management Guide Windows Phone 6.5 Page 25

26 What if an employee leaves the organisation? Will Exchange Server security settings clash with the Telstra MDM settings? Can I get Telstra MDM access on standard data plans? Will Telstra MDM work with other carrier s SIM cards Are my passwords and settings sent to devices protected Will Telstra MDM work while the user is roaming internationally Will Telstra MDM work with other carrier s devices Why doesn t the Telstra MDM portal display a picture of the users device? How do I know when a setting has been successfully sent to the device. Why do I need to group my mobile users under a single billing account? the device and the Telstra MDM portal. Only needs to be done once per device (unless the device is hard reset) The device can be wiped remotely and the user will need to restore personal items via the desktop No. The device will use the most secure setting No, each user must have a Telstra Mobile Connect data plan to be eligible No Yes the Telstra MDM server sends all settings to the device via SSL encryption Yes, however international roaming charges apply. It is also only available in countries where Telstra has International Roaming arrangements with carriers. Features and capabilities can differ from network to network & will depend on the devices you are using. Telstra cannot guarantee that services will be available at all times. No. The Telstra MDM portal is setup, tested and configured specifically for Telstra branded devices. The device has either been swapped recently or is not supported on the portal. Telstra refreshes device information every night. Under the recent actions panel the status of all settings you send are listed. Note that it can take up to 3 minutes for the Telstra MDM Portal to return a failure as this is how long it takes to timeout This allows you to manage all these users with a single login. You would need to manage multiple logins and passwords otherwise. Definitions Telstra MDM Enrolment Configuration Setting Configuration Profile IT administrator APN Telstra Mobile Device Management Process of setting up authentication between the device and the Telstra MDM portal. If successful, server authentication credentials are stored on the device and the server can send settings to the device silently Sends the device instructions to add or change it s settings. Configuration settings are created using pre defined configuration profiles where the various values to be used with the configuration setting are defined. Used to create configuration settings. Configuration profiles define the various values a configuration setting can change on the device. A person or persons nominated by the customer to manage their fleet of devices Access Point Name. A connection address used by your device to connect Telstra Mobile Device Management Guide Windows Phone 6.5 Page 26

27 VPN IMEI to the internet or private network. Virtual private network. Allows a device to connect to company resources in a private manner over the internet. Unique 15 digit serial number of a device Microsoft Office, Outlook, Xbox LIVE and Windows Phone are trademarks of the Microsoft group of companies. Telstra Mobile Device Management Guide Windows Phone 6.5 Page 27