7P MDM Server x - ios Client Guide 7P Mobile Device Management. Doc.Rel: 1.0/

Transcription

1 7P MDM Server x - ios Client Guide 7P Mobile Device Management Doc.Rel: 1.0/

2 Table of Contents 1 Objectives and Target Groups Copyright information Integrity of device OS Text conventions Hyperlink navigation Home hyperlink Menu Items Additional documentation Description of the warning flags Introduction Apple MDM enrolment Apple MDM profiles and payloads Apple MDM enrolment of ios device User receives an enrolment URL via User receives an enrolment QR code via User accepts the profile installation request Profile installation commences Profile privacy warning Apple MDM profile installed Inspecting the Apple MDM profile User accepts the profile installation request (ios8) Profile installation acceptance Inspecting the Apple MDM profile ios 8 compatible devices ios 9 compatible devices ios 10 compatible devices MDM Server "Push" installation of 7P MDM Client MDM Server "pushes" 7P MDM Client to device User accepts the installation MDM Server Pushes "activation" command The 7P MDM Client successfully installed Page 2 / 44

3 4 7P ios MDM Client console P ios MDM Client features Reporting device s inventory data to MDM Server Network and connectivity User agent Operator information GPS data List of running processes Access to the 7P ios MDM Client P MDM Client home page MDM Client User Quick Task screen MDM Client Quick Task screen Backup Manager MDM Client Quick Task screen Application Storage MDM Client Quick Task screen Connect to Server MDM Client Quick Task screen Application Activity MDM Client Quick Task screen - SSP Access MDM Client Quick Task screen Settings ios MDM Client settings menu structure Settings - About Name and Version Settings Application Management AppStorage Settings Connection - Connect to server Settings Advanced Activity Details Settings Connection - Activate Settings Advanced Reset data Settings Backup Backup status Privacy settings change security code Settings Privacy settings Application configuration - GPS Info Privacy settings User settings Debugging mode Settings Privacy settings Application configuration Encrypt backup Settings User settings Privacy settings GPS data Settings User settings Privacy settings Security Code Settings Debug Remove (uninstall) the MDM Client MDM Server uninstall of the MDM Client Manual removal of the MDM Client Manual removal of the Apple MDM Profile Page 3 / 44

4 6 Apple macos devices Apple MDM enrolment of ios device User receives an enrolment URL via Profile installation Table of Figures Figure 1 communicating initial Apple MDM profile Figure 2 containing QR of Apple MDM profile Figure 3 URL link opened to the profile process Figure 4 Initial profile phases Figure 5 User acceptance required Figure 6 Profile installation complete Figure 7 Inspecting the profile elements Figure 8 URL link opened to the profile process Figure 9 Initial profile phases Figure 10 Inspecting the profile elements Figure 11 Apple ios 8 compatible devices Figure 12 ios 9 compatible devices Figure 13 ios 10 compatible devices Figure 14 App installation pop up Figure 15 7P MDM Client installed Figure 16 Agree to the T's & C's Figure 17 Allow data and location collection Figure 18 The 7P MDM Client icon Figure 19 The MDM Client home page Figure 20 MDM client in debug modes Figure 21 Accessing the user "Quick Task screen" Figure 22 Backup status Figure 23 Quick Task access to the Application storage Figure 24 Quick Task - connect to server Figure 25 Display application activity details command Figure 26 Accessing the SSP Page 4 / 44

5 Figure 27 The SSP UI Figure 28 Quick Task screen to MDM client settings Figure 29 MDM Client version Figure 30 Settings AppStorage display Figure 31 Connect to server command Figure 32 Display activity details command Figure 33 QR code activation of the MDM client Figure 34 Reset MDM Client data command Figure 35 Backup status Figure 36 Access privacy settings command Figure 37 GPS accuracy settings Figure 38 MDM Client debug settings Figure 39 MDM Client encryption settings Figure 40 Turn GPS data collection OFF Figure 41 GPS data collection settings Figure 42 Debug File explorer Figure 43 MDM Server removal of MDM Client Figure 44 Manual uninstall of MDM Client Figure 45 Location of Apple MDM profile Figure 46 Removal of Apple MDM profile Figure 47 Apple MDM profile removed Figure 48 communicating initial Apple MDM profile Figure 49 Advisory and User permission Figure 50 Confirmation and installation Figure 51 Further confirmation and installation Figure 52 Profile details Figure 53 User authorisation Figure 54 Profile installed List of tables Table 1 Text convention... 7 Table 2 Software component versions Table 3 MDM Client's menu structure Page 5 / 44

6 1 Objectives and Target Groups Objectives: The aim of this document is to describe to customers of SEVEN PRINCIPLES AG the key features of the 7P MDM Client for ios. It describes the installation process of the Apple MDM profile, using both GSM (i.e. devices with an active SIM card and data plan) and Wi-Fi only compatible devices. The Apple MDM profile is then followed by a description of the installation and activation process of the 7P MDM Client with a designated MDM Server. The section entitled "MDM Client ios console", details the settings and functionality available to the MDM Client This includes a full disclosure of the MDM Client s "Privacy Settings". This manual reflects the current functions of the 7P MDM Server and therefore experiences regular updates and enhancements that are made promptly. Target group: This document was created specifically for the customers of SEVEN PRINCIPLES AG. MDM Server trust relationship. The primary task of all system administrators is to establish a trust relationship between their MDM Server and the user's ios device. Once this trust relationship is established, the full command, control and configuration of the Apple MDM protocol can be utilised. In addition to the Apple MDM protocol, the 7P MDM Client for ios, allows the customer to define a private Application Storage (AppStorage) whilst also extending the management information system ( MIS) services and information that can be deployed (and retrieved) onto the users ios device by the 7P MDM Server. 1.1 Copyright information Apple, Apple iphone, ipod touch, ipad and macos are trademarks or registered trademarks of Apple Inc., registered in the U.S. and other countries. All other trademarks are property of their respective owners. 1.2 Integrity of device OS The MDM server relies on the integrity of the devices OS to forward information to the MDM server by the device proprietary messaging OS, or via the MDM client acting with the device messaging OS. In the unfortunate event that a device OS is compromised or has been corrupted in any way, the information passed to the MDM server may be corrupt, impeded or non-existent. The handling of such a situation is beyond the scope of the 7P MDM server. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 6 / 44 ^Home

7 Text conventions The following conventions are typically adhered to in the construction of this document. Convention Key names The word enter Bold Italics Description Hyperlink navigation Keys that are pressed simultaneously are linked by a plus sign (+): e.g. Press Ctrl + Alt + Del Enter indicates you type something and then press the Return or Enter key. Used to distinguish certain words from others within the text Used to distinguish certain words from others within the text Table 1 Text convention Hyperlinks are used to allow detailed examination of information. For example, if an Operation (named SIM change test) has been deployed to the device, a status message would be included in the device history. Selecting the "SIM change test" hyperlink will open the Operation > SIM change test allowing closer examination. Selecting the browsers "back" button will return the administrator to the device history log. When hyperlinks are available, selecting the hyperlink will either: Navigate the administrator to the origin of the link, for example, a configuration statement To further functionality, for example, as with the displaying of GPS records Utilising the back facility of the browser may return the administrator to the original page. It is always advisable, due to the dynamic nature of the updating data, for the administrator to restart their query with the vertical menu buttons Home hyperlink A hyperlink (^Home) is inserted into the bottom right-hand side of the footer which when pressed will return the reader to the beginning of the document and is only active in PDF format. Menu Items The greater than sign ( > ) with spaces before and after the sign, separates items in the menu. For example, Operations > Operations > Is roaming > Pull down selection ( Yes / No ) indicates that you first choose "Operations" from the main tabs, then "Operations" from the left-hand menu options, followed by the selection of an operation name, then the condition to be applied. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 7 / 44 ^Home

8 1.7 Additional documentation The following additional documentation is available from your 7P representative or service provider: Documentation title Documentation title 7PMDM_Manual_AdminGuide_EN 7PMDM_Note_AppleDEP_EN 7PMDM_Client_Android_EN 7PMDM_Manual_InstallGuide_EN 7PMDM_Client_iOS_EN 7PMDM_Delivery_RelNote_DE 7PMDM_Note_AppleVPP_EN 7PMDM_Delivery_RelNote_EN 7PMDM_Spec_SSP_EN 7PMDM_Delivery_ReleaseBulletin_EN 7PMDM_Spec_CSVImport_EN 7PMDM_Delivey_FeatureList_EN The following titles are considered static and will only be updated if there is a significant change or update to the details. 7PMDM_Client_SymbianS60_EN 7PMDM_Spec_LDAP_EN 7PMDM_Client_WindowsPhone_EN 7PMDM_Client_WindowsDevice_EN 7PMDM_MSCompanyHub_EN 7PMDM_Spec_AppWrapping_EN 7PMDM_Client_Files2Go_EN 7PMDM_Spec_Files2Go_EN 7PMDM_Spec_MSCompanyHub_EN 7PMDM_Spec_Vodafone_UltraCard_EN Revision details have been omitted from all the documentation lists as the most current version will be available from your 7P representative or service provider 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 8 / 44 ^Home

9 1.8 Description of the warning flags This document may contain warnings and safety recommendations of the following meaning: Attention: May have undesired consequences Caution: Operational functionality may be impeded Further attention may be required when implemented General information 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 9 / 44 ^Home

10 2 Introduction This chapter describes the Over-the-Air (OTA) installation of the 7P MDM ios Client for both Global System for Mobile Communications (GSM) enabled devices, i.e. devices that have an active Subscriber Identity Module (SIM) card through a data provider, and Wi-Fi enabled devices. The initial configuration communication method of the MDM Server to the ios device is through . Once the Apple MDM profile has been configured on the ios device, then any additional applications, settings and security certificates can be "pushed" to the ios device. The benefit of this preferred method is that the MDM Client is automatically activated to its corresponding MDM Server without user intervention. This chapter consists of the following sub-chapters: 2.1 Details of the Apple MDM enrolment process. 2.2 A brief explanation of profiles and payloads. 2.3 Apple MDM enrolment of ios device. The 7P MDM Server utilizes the following components of Apple s Over the air (OTA) Profile Delivery and Configuration, which includes: Full authentication. Identification. Simple Certificate Enrolment Protocol (SCEP). Encryption. Secure Sockets Layer (SSL). Apple Push Notification Service (APNS Certificates). APNS is a notification service, provided by Apple Inc., which provides priority to notifications. When the 7P MDM Server issues a command to an enrolled ios device, it is routed through APNS, which notifies the 7P MDM Server that the message has been received by the device. Commands and query responses from the ios devices are not sent by APNS. APNS alerts the device that it should communicate with its associated 7P MDM Server, to either receive new commands or deliver query responses. 2.1 Apple MDM enrolment The enrolment process is completed Over-the-Air (OTA) requiring minimal user intervention (the user accepts the enrolment process), which establishes a trust relationship between the users ios device and the MDM Server After an ios device enrols its Apple MDM profile, it can be personalised, updated and restricted silently, OTA, with the user s personal settings (user name, passwords, addresses, etc.), offering the IT department complete control of the ios devices functionality. e.g. Enable passcode, disable YouTube. The 7P MDM Server facilitates mass enrolments of Apple s ios devices with just one operation. "It is therefore essential that each ios device is enrolled with a 7P MDM server" 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 10 / 44 ^Home

11 Apple MDM profiles and payloads A configuration profile is an XML file that can be used to configure certain (single or multiple) settings for ios devices, typically iphone, ipod touch, and ipad. A payload refers to an individual collection of a certain type of settings, such as VPN settings, within the configuration profile. Apple MDM enrolment of ios device When a system administrator adds an IOS device to the 7P MDM server, an is generated containing a hyperlink URL which when opened on the user's ios device, will instruct the ios device in the installation of the Apple MDM profile. The Apple MDM payload configures the device so that its configuration can be managed over the air by the 7P MDM server. Only one Mobile Device Management payload can be installed on a device, and once it's installed, the device can receive further configuration profiles OTA from the MDM Server. Once the MDM payload has been successfully installed, the 7P MDM Server can install further configuration profiles. The 7P MDM Server can only remove configuration profiles that were installed using Apple's MDM operations, as opposed to profiles installed manually through a device configuration utility, or through links received by SMS. This section illustrates the enrolment process. User receives an enrolment URL via Once added to the MDM server, the user will receive the following to commence device enrolment. Contained within the message is a hyperlink (URL) which when selected will commence the Apple MDM enrolment procedure Figure 1 communicating initial Apple MDM profile. The user will receive and open the primary on their device. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 11 / 44 ^Home

12 2.5 User receives an enrolment QR code via If they have chosen to open their profile on another device, then they can scan the QR code to obtain the profile URL. Figure 2 containing QR of Apple MDM profile. Or the user may open a Safari browser on their device and enter the URL manually. 2.6 User accepts the profile installation request Once opened on the user's device, the following sequence of questions will be displayed: Figure 3 URL link opened to the profile process. The user has to agree to the installation of the Apple MDM profile by selecting Install, then Install Now buttons. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 12 / 44 ^Home

13 2.6.1 Profile installation commences Once the user has agreed to install the profile, the profile installation process automatically proceeds. Figure 4 Initial profile phases. The Apple Profile initially progresses through the "Device environment challenge" phases, ensuring the integrity of the target device Profile privacy warning A warning is then displayed to the user, informing them that if Install is selected, their device can be silently updated and configured by a system administrator. Figure 5 User acceptance required. The warning also indicates that personal data may be collected by the MDM server. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 13 / 44 ^Home

14 2.6.3 Apple MDM profile installed The Apple profile installer has completed when the "Profile Installed" page is shown Figure 6 Profile installation complete. Please note, the process takes approx. 1 minute, depending on the rate of user acceptance, and is completed when the user exits the process via Done Inspecting the Apple MDM profile The profile can be inspected at any time by navigating to Settings > General > Profiles on their ios device. In this instance, the profile has been installed with the Remove option. Figure 7 Inspecting the profile elements. If the user wishes to force the removal of the Apple MDM profile, which in turn will disassociate their device with the trusted relationship of the MDM Server, then the user would have to restore their ios device from a previous archived itunes backup. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 14 / 44 ^Home

15 2.7 User accepts the profile installation request (ios8) Once opened on the user's device, the following sequence of questions will be displayed: Figure 8 URL link opened to the profile process. The user has to agree to the installation of the Apple MDM profile by inserting their device passcode, then selecting the Install Profile button Profile installation acceptance Once the user has agreed to install the profile, the profile installation process automatically proceeds. Figure 9 Initial profile phases. The Apple Profile initially progresses through and pauses with a "Warning" that the end user must accept by selecting Install, which will then reveal a final question regarding "Remote Management" of the device. By selecting "Trust" the user has agreed that their device (whether business or privately owned) can be remotely managed by the organisation issuing the ios profile. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 15 / 44 ^Home

16 2.8 Inspecting the Apple MDM profile The profile can be inspected at any time by navigating to Settings > General > Profiles on their ios device. In this instance, the profile has been installed with the Remove option. Figure 10 Inspecting the profile elements. If the user wishes to force the removal of the Apple MDM profile, which in turn will disassociate their device with the trusted relationship of the MDM Server, then the user would have to restore their ios device from a previous archived itunes backup. 2.9 ios 8 compatible devices Figure 11 Apple ios 8 compatible devices 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 16 / 44 ^Home

17 2.10 ios 9 compatible devices Figure 12 ios 9 compatible devices Screenshot courtesy of ios 10 compatible devices Figure 13 ios 10 compatible devices Screenshot courtesy of 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 17 / 44 ^Home

18 3 MDM Server "Push" installation of 7P MDM Client In this section we will follow, from the user's perspective, the "Push" installation of the 7P MDM Client to the user's device. The user will be notified, by an onscreen pop up that the system administrator would like to install the selected software application onto the users device. The user's action will be: Select "install" when requested by the application. Accept the general Terms and Conditions of the software application. Accept the specific details of the Terms and Conditions (Location, contacts and calendar data). Allow the use of the users "Current Location". 3.1 MDM Server "pushes" 7P MDM Client to device One of the features of the Apple MDM protocol is OTA installation of software applications. The system administrator will remotely deploy the installation of the 7P MDM Client Figure 14 App installation pop up. A pop up will appear on the screen of the users device. To allow the installation to continue, the user selects the Install button. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 18 / 44 ^Home

19 3.1.1 User accepts the installation Once the user has accepted the installation, the MDM Server pushes the 7P MDM Client to the user's ios device where it is installed. Figure 15 7P MDM Client installed. A successful installation of the application program is indicated by the full appearance of the application icon. At this stage, although the MDM Client is installed, it has yet to be "Activated" to the MDM Server MDM Server Pushes "activation" command The system administrator sends a separate "Activation" command to the user's device. On receipt of the command, an information bar appears on the screen asking the user to "Press to activate the MDM Client". Figure 16 Agree to the T's & C's. Once the information bar is selected, the activation of the MDM Client commences. The Terms and Conditions of use are displayed. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 19 / 44 ^Home

20 3.1.3 The 7P MDM Client successfully installed The activation process continues, finally asking if the MDM Client could use the information regarding the current location of the device. Figure 17 Allow data and location collection. A "Service is Active" message is displayed on the home screen of the MDM Client. The user selects the "home" button of their ios device to return them to their normal applications. At this stage, the user's ios device has: Successfully installed the Apple MDM profile, which allows for seamless OTA configuration. Successfully installed the 7P MDM Client which allows access to the companies AppStorage. Please refer to section 4.1 where the added functionality of the 7P MDM Client is described. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 20 / 44 ^Home

21 4 7P ios MDM Client console This section describes in detail the added functionality that the MDM ios Client brings to the MDM environment. It also illustrates the location and availability of features to the ios device user. The document was written against the following software modules: Software component Version 7P MDM server ios 7 MDM client app ios 5/6 MDM client app (build2329) The 7P ios MDM Client is available to download from: Table 2 Software component versions. A customer designated MDM App Store (preferable) A 7P MDM server 7P MDM Client website, The 7P ios MDM Client introduces extra functionality to the user's device that is typically not found in the standard Apple MDM protocol. This chapter consists of the following sub-chapters: 4.1 A list of the 7P MDM Client features. 4.2 How to access the MDM Client features. 4.3 Details of the MDM Client's home screen. 4.4 Details of the MDM Clients features P ios MDM Client features The 7P MDM Client for ios supports the following Management Information Systems (MIS) data retrieval and features: Reporting device s inventory data to MDM Server DEVICE INFO: Free RAM; Total RAM; Free disc space; Total disc space; Battery level; Current device time; Time zone offset in hours; Daylight saving value in the time zone; Version of MDM Client running on the device; Current language of the device (LCID); 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 21 / 44 ^Home

22 Network and connectivity User agent MAC address of the device; Platform name; Device Name; Platform Version; Device manufacturer; MDM Client version; Jailbreak status; Operator information GPS data (MCC) Mobile Country Code; (MNC) Mobile Network Code; Network selection; Mobile Operator s Name; GMT Time; Latitude; Longitude; Altitude; Speed; List of running processes Filename; Unique ID; Number of processes; Backup and restore of contacts initiated from MDM Server; Backup and restore of calendar events initiated from MDM Server; Manual backup of contacts or/and calendar initiated by user from the menu on the ios client. Support for AppStorage application distribution. Access is available from the menu on the ios client. Encrypted connection between Server and client; File sharing using itunes; Reset, stop and start commands; User security code; Multilanguage support (English, German, Spanish and Italian). 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 22 / 44 ^Home

23 4.2 Access to the 7P ios MDM Client User's access to the functionality, company "AppStorage" and privacy settings of the 7P MDM Client is through the application icon of the user's ios device. Figure 18 The 7P MDM Client icon. Once accessed, the MDM Client home page is displayed P MDM Client home page The MDM Client home screen informs the user of the following: Whether the service is active or in "debug mode" The Next connection (to the MDM Server) time The Last connection (to the MDM Server) time The last time that a backup of either contacts and/or calendar was performed Figure 19 The MDM Client home page. To exit the MDM Client menu pages at any time, the user would select the "Home" button on their device. To return to the user's main ios device screen, the user would also select the ios device "Home" button. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 23 / 44 ^Home

24 If the user's device displays the "Debug enabled" state, then they must inform their support personnel who will discuss the situation with the user. Figure 20 MDM client in debug modes MDM Client User Quick Task screen The MDM client for ios 7and above has been designed for ease of use for the end user. In normal operation, the user would generally use, access, or inspect the following elements of the MDM Client: Backup Manager Application Storage Connect to Server Application Activity As such, the MDM client user's home screen contains a "one button" access to these elements. To access the user's Quick Task screen, the user taps the button at the centre of the MDM client home screen. Repeated use of the centre button will toggle the user between the "Home screen" and the "Quick Task" screen. Figure 21 Accessing the user "Quick Task screen" The blue "gear" icon in the bottom right of the screen allows access to the MDM Client settings menu (see ios MDM Client settings menu structure). 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 24 / 44 ^Home

25 4.3.2 MDM Client Quick Task screen Backup Manager Selecting the "Backup Status" navigation bar will allow the user: To observe when either a device "Contacts", device "Calendar" or both "Calendar and Contacts" were last backed up to the MDM server. To select a manual backup of either a device "Contacts", device "Calendar" or both "Calendar and Contacts". If either the "Contacts or "Calendar" slider is enabled (Green "On", Greyed out "off"), then the user may initiate a manual backup by selecting the "Start" button in the top navigation bar. Figure 22 Backup status Once completed, return to the "Quick Task" screen by selecting the "Back" button in the top navigation bar MDM Client Quick Task screen Application Storage The Application Storage is designed to give users the ability to download approved in-built applications from a centrally managed secure Enterprise Web resource. Figure 23 Quick Task access to the Application storage When the "Application Storage" button is selected, the content of the "AppStorage" is presented to the user. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 25 / 44 ^Home

26 4.3.4 MDM Client Quick Task screen Connect to Server If the "Connect to Server" button is selected, the MDM Client will "force a connection" with its associated MDM server. Figure 24 Quick Task - connect to server. The "forced connection" to the server will allow the device to update applicable policies MDM Client Quick Task screen Application Activity The Activity details "screen displays the connection activity of the MDM Client with the MDM server. Figure 25 Display application activity details command. The "Application Activity" details screen displays time stamped information messages regarding the connection and communication of the MDM Client to the MDM server. The Activity screen also contains a "Connect" button in the top right hand of the navigation bar. Selecting the "Connect" button will force a connection between the MDM client and MDM server. Selecting the "Back" button in the navigation bar will return the user to the "Quick Task" screen. If further details are required, the user can select any of the "Activity" messages. By selecting a message navigation bar, a "Connection Status" page will be displayed. The information found in the "Connection Status" screen may be requested by support personnel who are in the process of assisting a customer with a potential problem. From the "Connect Status" screen, the user may return to the "Connection History" page by selecting the "Activity" button in the navigation bar. Selecting the "Home" button in the "Activity" navigation bar will return the user to the "Quick Tasks" screen. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 26 / 44 ^Home

27 4.3.6 MDM Client Quick Task screen - SSP Access Access to the MDM server s Self Service Portal is now available through the home page of the ios MDM Client. The user selects the icon located in the bottom left hand side of the ios client Home screen, and will be redirected to the SSP. Figure 26 Accessing the SSP Figure 27 The SSP UI The user must enter their MDM server SSP credentials to access the SSP s functionality MDM Client Quick Task screen Settings The MDM client contains an extensive menu structure that is generally used by support personnel either directly or through the MDM server to assist the user with potential problem resolution. Access to the MDM client settings can be obtained by selecting the blue "Gear" icon which is located at the bottom of the user's "Quick Task" screen. Figure 28 Quick Task screen to MDM client settings Once the gear icon is selected, the MDM client "Settings" screen will automatically appear, allowing the user to investigate the information contained within. Selecting the "Done" button in the "Settings" navigation bar will return the user to the "Quick Tasks" screen. To return to the user's main ios device screen, the user would also select the ios device "Home" button. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 27 / 44 ^Home

28 4.4 ios MDM Client settings menu structure Main menu Submenu Description About Application name Shows the name of the application Application management Application Version. AppStorage Shows the application version Displays the content of the company defined AppStore. Connection Connect to server. Forces a connection with the MDM Server Activity Details. Displays the current communication and backup activity if applicable. Activate. Used to activate the MDM Client with the MDM Server settings. Advanced Reset data. Resets the MDM Client settings to default Backup Backup status. Shows a time stamped status of the backup process. Privacy Settings Change security code Allows the user to change the MDM client security code Application configuration GPS info If enabled, allows GPS data to be transmitted to the MDM Server. Encrypt backup If enabled, ensures that all backup operations to the MDM Server are encrypted with the user's security code Send data to server GPS data. If enabled, allows GPS data to be sent to the MDM server MDM security code If enabled allows the users security code to be sent to the MDM server Table 3 MDM Client's menu structure Settings - About Name and Version The application name and version number of the MDM client is always displayed in the "About" information field. On occasion the user may be asked to relay this number to a remote support person Figure 29 MDM Client version. Selecting the "Done" button will return the user to the users "Quick Tasks" screen. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 28 / 44 ^Home

29 4.4.2 Settings Application Management AppStorage The Application Storage is designed to give users the ability to download approved in-built applications from a centrally managed secure Enterprise Web resource. Figure 30 Settings AppStorage display. When the "Application Storage" button is selected, the content of the "AppStorage" is presented to the user Settings Connection - Connect to server If selected, the MDM Client will immediately attempt to communicate with the MDM Server. The "Connect to server" command is typically used by support personnel to assist the user by updating a configuration setting, policy or application. Figure 31 Connect to server command The MDM client will attempt to connect with the MDM server. Once completed, the user can return to the settings page by selecting the "Done" button in the top navigation bar. Selecting the "Done" button again will return the user will be returned to the users "Quick Tasks" screen. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 29 / 44 ^Home

30 4.4.4 Settings Advanced Activity Details The Activity details "screen shows the connection activity of the MDM Client with the MDM server. Figure 32 Display activity details command. The Activity details screen displays time stamped information messages regarding the connection and communication of the MDM Client to the MDM server. It also contains a "Connect" button in the right hand side of the top navigation bar. Selecting the "Connect" button will force a connection between the MDM client and MDM server. Selecting the "Back" button in the navigation bar will return the user to the settings screen. If further details are required, the user can select any of the "Connections History" messages. By selecting a message navigation bar, a "Connection Status" page will be displayed. The information found in the "Connection Status" screen may be requested by support personnel who are in the process of assisting a customer with a potential problem. From the "Connect Status" screen, the user may return to the "Connection History" page by selecting the "Activity" button in the navigation bar. Selecting the "Back" button in the "Connections History" navigation bar will return the user to the "Settings Advanced" screen. Selecting the "Done" button again will return the user will be returned to the users "Quick Tasks" screen Settings Connection - Activate Activate is the process which allows the MDM Client to successfully connect to and communicate with a designated MDM server. All MDM servers have a unique URL and password. The URL informs the MDM Client where to connect to the MDM server, and the password, which when entered into the MDM Client is presented to the MDM Server for authentication. The process of MDM client for ios authentication is typically automated by the MDM server administrator. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 30 / 44 ^Home

31 The "Activation" details must be transmitted to the user either through an complete with a valid QR (Quick response) code which contains: The address of the MDM server The password of the MDM server Figure 33 QR code activation of the MDM client The user would complete the "Activation" form, by presenting the devices camera toward the QR code. The Activation process will proceed; an activity identifier will be displayed, informing the user of the task being performed, which in this case, is "Connecting" to the MDM server. Once successfully completed, the MDM client will display the top of the settings menu. Selecting the "Done" button again will return the user will be returned to the users "Quick Tasks" screen. If the MDM Server address is modified and the connection to the new server fails, then the MDM Client will default to the previously known MDM Server address. If an expired QR code is selected, the MDM client will indicate with the message "Error! Incorrect Activation data!" Settings Advanced Reset data The "Reset data" option clears any command or message data that has been transmitted by the MDM server which is stored internally on the MDM Client. The "Reset data" button is red in colour, signifying that a system function that will delete all current settings will be performed. The MDM Client s activation data and MDM security code will remain. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 31 / 44 ^Home

32 The user will "Reset data" of the MDM client by pressing the red "Reset data" button. Figure 34 Reset MDM Client data command. After resetting, the MDM Client immediately connects to the server to reset policies and settings. The "Reset data" process will proceed; an activity identifier will be displayed, informing the user of the task being performed, which in this case, is "Connecting" to the MDM server. Once successfully completed, the MDM client will display the settings menu. Selecting the "Done" button again will return the user will be returned to the users "Quick Tasks" screen. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 32 / 44 ^Home

33 4.4.7 Settings Backup Backup status Selecting the "Backup Status" navigation bar will allow the user to observer when either a device "Contacts", device "Calendar" or both "Calendar and Contacts" were last backed up to the MDM server. Figure 35 Backup status Once completed, the user can return to the settings page by selecting the "Settings" button in the top navigation bar, where they can select to review or alter other MDM client setting items. The "Done" button will automatically appear in the top left of the navigation bar, which if selected, will return the user to the user's home collection menu screen Privacy settings change security code Privacy settings allow the user to restrict the MDM Client from transmitting user sensitive data to the MDM Server and are protected by a "Security code", which is generally changed from the default value by the user when the MDM client is initially installed. The system administrator will always inform the user of the initial MDM client "Security code" ensuring that the user sensitive settings are not compromised. Figure 36 Access privacy settings command. Access to the privacy functions menu is password protected. The user has to enter a valid MDM security code (default MDM security code is 77441) and select "OK" into the "Security Code" pop up field to unlock this functionality. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 33 / 44 ^Home

34 When the correct security code has been entered, the Privacy settings view will appear. The user can change the security code by selecting Change security code option, located in the "User settings". Once completed, the user can return to the settings page by selecting the "Settings" button in the top navigation bar, where they can select to review or alter other MDM client setting items. The "Done" button will automatically appear in the top left of the navigation bar. Selecting the "Done" button again will return the user will be returned to the users "Quick Tasks" screen. The Default security code is determined by the MDM Server system administrator and can be located at the following MDM server location Organization > Users & devices >Device> Inventory > Security > MDM Client password Settings Privacy settings Application configuration - GPS Info GPS information defines the accuracy of the user's device location information which is collected by the MDM Server from the devices built-in GPS hardware. If no GPS device is present, no information will be sent. The GPS information can only be sent to the MDM Server if the following conditions are met: The device is capable of receiving GPS data information. The device user has allowed (enabled) the transmission of GPS data. MDM Server has requested GPS information from the MDM Client. Apple s design of GPS settings is different from other platforms. On other platforms, the GPS settings are controlled by a time period, whereas with ios devices Accuracy and Distance are used. Accuracy - The desired location accuracy. The location service tries to achieve the selected accuracy, which cannot be guaranteed. To optimize power and performance, an appropriate accuracy value for your usage scenario (e.g. use a large accuracy value when only a coarse location is needed) is advised. Distance - Specifies the minimum update distance in meters. The MDM Client is not notified of movements less than the stated value, unless the accuracy has improved. Figure 37 GPS accuracy settings. Small values of Accuracy and Distance will significantly affect battery consumption. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 34 / 44 ^Home

35 If the Location services are disabled for the ios MDM Client, the application would freeze after working in the background for approximately 10 minutes. The user can, at any time after successfully entering their "Security Code" into the privacy settings of the MDM ios client alter the accuracy of the "GPS data". For any adjustment to the accuracy of the GPS records to remain, the user must press the "Save" button located in the top navigation bar. Once completed, the user can return to the settings page by selecting the "Back" button in the top navigation bar Privacy settings User settings Debugging mode The MDM clients "Debugging mode" switch is usually selected by the instruction of a support person who wishes to assist in potential problem resolutions. Figure 38 MDM Client debug settings. The debugging mode will only occur when the "Debugging mode" switch is in the "ON" position Settings Privacy settings Application configuration Encrypt backup This setting determines whether the "Encrypted backup" is enabled. Figure 39 MDM Client encryption settings. Encrypted backup utilises the users "Security Code" as an encryption key. If the user changes their "Security Code" it is essential that they complete a backup of the device, as the previous backup will be encrypted with their previous "Security Code" prohibiting a useful restore of previous backup information. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 35 / 44 ^Home

36 The "Encrypted backup" option may be enforced by the system administrator through policy of the MDM server. If the feature is not controlled by a MDM server policy, the user can, at any time after successfully entering their "Security Code" into the privacy settings of the MDM ios client alter the state of the "Encrypt backup" switch. Once completed, the user can return to the settings page by selecting the "Settings" button in the top navigation bar Settings User settings Privacy settings GPS data The MDM clients "GPS data" switch determines whether GPS data can be collected by the MDM Server. Device GPS data collection will only occur when the "GPS data" switch is in the green "ON" position. Figure 40 Turn GPS data collection OFF The switch can be either in the green "ON" position, allowing the user's "GPS data" to be transmitted to the MDM server, or in the grey "OFF" position, where the user's "GPS data" will not be transmitted to the MDM server. The user can, at any time after successfully entering their "Security Code" into the privacy settings of the MDM ios client alter the state of the "GPS data" transmission switch. Once completed, the user can return to the settings page by selecting the "Settings" button in the top navigation bar. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 36 / 44 ^Home

37 Settings User settings Privacy settings Security Code The user's privacy settings "Security code" will only be transmitted to the MDM server when the switch "Security code" is in the green "ON" position. Figure 41 GPS data collection settings. The switch can be either in the "ON" position, allowing the user's "Security Code" to be transmitted to the MDM server, or in the grey "OFF" position, where the user's "Security Code" will not be transmitted to the MDM server. The user can, at any time after successfully entering their "Security Code" into the privacy settings of the MDM ios client alter the state of the "Security Code" transmission switch. If the user allows their "Security Code" to be transmitted to the MDM server, and if the user forgets or misplaces this code, the user can then ask the MDM server administrator to retrieve the "Security Code" from the MDM server. Once completed, the user can return to the settings page by selecting the "Settings" button in the top navigation bar Settings Debug When the debug option is enabled, through "Privacy settings", an additional menu item," File explorer" will appear under the Debug settings heading. Figure 42 Debug File explorer. The debug file explorer is designed to be used with the assistance of support personnel. Once the support activity has completed, the user would select "Settings" then "Done" to return to the Quick Task menu. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 37 / 44 ^Home

38 5 Remove (uninstall) the MDM Client This section, describes the removal (uninstall) process of the MDM Client from the user's device. The removal process is dependent on the configuration of the MDM Server, and may be prohibited MDM Server uninstall of the MDM Client When the MDM Client is removed via the MDM Server, the user will observe, if viewing their ios device that the MDM Client icon "disappears" from their ios device. This is activity is normal when the application is removed. Figure 43 MDM Server removal of MDM Client Manual removal of the MDM Client The manual removal of the MDM Client involves the user pressing and holding the MDM Client icon. Figure 44 Manual uninstall of MDM Client. An "x" will be added to the icon, when selected. The user is then asked to confirm the application deletion. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 38 / 44 ^Home

39 5.2 Manual removal of the Apple MDM Profile The user can inspect and remove the Apple MDM Profile from their ios device. Figure 45 Location of Apple MDM profile. The user navigates to Settings > General > Profiles > MDM Setup on their ios device. The user would then press the remove label, and removal confirmation. Figure 46 Removal of Apple MDM profile. The user's ios device will show the progress of the Apple MDM profile removal. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 39 / 44 ^Home

40 Once the Apple MDM profile has been removed, the Profile list remains empty. Figure 47 Apple MDM profile removed. Any configuration, application, password or restriction applied to the user's ios device will not be enforceable if the Apple MDM profile is removed. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 40 / 44 ^Home

41 6 Apple macos devices The installation of an Apple macos MDM mobileconfig package is dependent upon the minimum of macos v1.7 being installed on the device. macos v1.7 supports a limited set of Apple's MDM commands ( ProfileList, InstallProfile, RemoveProfile etc.) Apple MDM enrolment of ios device When a system administrator adds a macos device to the 7P MDM server, an is generated containing a hyperlink URL which when opened on the user's macos device, will instruct the user in the installation of the Apple MDM profile. The Apple MDM payload configures the device so that its configuration can be managed over the air by the 7P MDM server. Only one Mobile Device Management payload can be installed on a device, and once it's installed, the device can receive further configuration profiles OTA from the MDM Server. Once the MDM payload has been successfully installed, the 7P MDM Server can install further configuration profiles. The 7P MDM Server can only remove configuration profiles that were installed using Apple's MDM operations, as opposed to profiles installed manually through a device configuration utility. This section illustrates the enrolment process. User receives an enrolment URL via Once added to the MDM server, the user will receive the following to commence device enrolment. Contained within the message is a hyperlink (URL) which when selected will commence the Apple MDM enrolment procedure Figure 48 communicating initial Apple MDM profile. The user will receive and open the on their macos device. A configuration package named "enrollment.mobileconfig" will be received. Double clicking the enrollment.mobileconfig package will start the profile installation process. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 41 / 44 ^Home

42 6.3 Profile installation The following screenshots depict the customers experience during the installation of the "enrollment.mobileconfig "package. Figure 49 Advisory and User permission Figure 50 Confirmation and installation Figure 51 Further confirmation and installation 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 42 / 44 ^Home

43 Figure 52 Profile details Figure 53 User authorisation Figure 54 Profile installed If an macos device under MDM management receives a "lock" command, the device will reboot and the user is required to insert the correct "lock " code. If the user has misplaced the "lock" code, then the default of 7070 may be used, if this fails to unlock the device, contact the 7P MDM administrator who will be able to advise of the "lock" code used to "lock" the device. 7PMDM_Client_iOS_v5.22.0x_EN.docx Page 43 / 44 ^Home

44 List of changes Version Date Changes Reason Author Version release Version ios7 and above Version ios (882) Static Tony Dargis Author: Tony Dargis Version: English Date: DocNr: n/a Proprietary Notice: All rights reserved. No part of the document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the written permission of SEVEN PRINCIPLES, Erna-Scheffler-Straße 1a, Köln. The information in this document is subject to change without notice. COPYRIGHT SEVEN PRINCIPLES PMDM_Client_iOS_v5.22.0x_EN.docx Page 44 / 44 ^Home