The administrator can configure and manage system environment for Knox Manage for efficient operation.

Transcription

1 3 Environment setup The administrator can configure and manage system environment for Knox Manage for efficient operation. The following items can be configured in the Admin Portal: Configuration - Authentication Setting: Set the method of user authentication when logging in to Knox Manage from the device. - Profile Update Interval Setting: The Knox Manage server sends the policy in Device Management Profile to a device on a regular basis. To update the policy according to the schedule set for all devices to which a profile is assigned, set the profile update interval. - SEG Profile Setting: Set the SEG profile to support direct installation of Knox Manage on a device via Universal MDM Client (UMC) preloaded on SAMSUNG Galaxy devices. This process enables communication with the SAMSUNG Enterprise Gateway (SEG) server. Android & ios settings - Limited Enrollment: To enroll the devices activated by adding IMEIs or Serial Numbers only, enter information about the relevant devices in Limited Enrollment. For more information, see Managing Limited Enrollment. - APNs Setting: Set the Apple APNs certificate for managing ios devices in the Knox Manage. For more information, see Setting an APNs certificate. - DEP Server Settings: To auto-register Knox Manage on a large number of ios devices quickly and easily, configure the settings for the Device Enrollment Program (DEP) by Apple. For more information, see Setting up the DEP. - DEP Device Management: You can manage DEP devices enrolled in the DEP portal, sync the DEP server with the Knox Manage server, deploy the DEP profile, send DEP device commands, or view profiles assigned or applied to the DEP devices. For more information, see Managing DEP device. - VPP Server Settings: Set the Apple's Volume Purchase Program (VPP) to deploy a public application, which is used within a company or organization, to a large number of ios devices. For more information, see Volume Purchase Program. - VPP User Management: You can manage VPP users in order to assign or unassign VPP applications to them. Knox Manage syncs the information about the VPP users and applications to keep it up-to-date. For more information, see Managing VPP users. License: Set and management of a Knox Manage and E-FOTA licenses. For more information, see License. 32

2 Message Template: Message template for sending personal information and Knox Manage installation link via SMS or . For more information, see Managing message templates. Master Data: The standard information for Knox Manage, which is classified into categories. For more information, see Setting master data. Admin Console - Logo Setting: Set the logo and the Header field's background and font colors displayed in the upper-left side of the Admin Portal. For more information, see Setting Logo. - Administrators: You can add and manage administrators who manage the Admin Portal. For more information, see Registering an administrator account. - Dashboard Management: You can create a dashboard to check the operational status of Knox Manage or manage the list of reports, which can be used to create a dashboard. For more information, see Adding dashboard. - Reports: This provides queries that allow you to check the usage status of Knox Manage. You can create a dashboard based on them or simply refer to them as reports. For more information, see Adding a report. The Admin Portal provides the following advanced settings: Certificates: Knox Manage allows you to register and manage external certificates for the use of networks such as Wi-Fi, VPN, Exchange, and APNs. For more information, see Certificates. AD/LDAP Sync: Set up a sync service to add information about users, groups, and organizations to Knox Manage by linking the server with the AD/LDAP system within a company and to sync updated information in the integrated system at a specific interval. For more information, see AD/LDAP Sync services. System Integration: To access client's intra-company data by integrating their directory server through a Lightweight Directory Access Protocol (LDAP)-based Active Directory service, integrate the directory server. For more information, see Integrating a directory server and Setting a directory connector. EMM API: Knox Manage provides an Open API to allow developers to utilize a variety of services and develop applications more easily. For more information, see EMM API. 33

3 Configuring the environment You can manage the environment setting for Knox Manage. You cannot add an environment category, but only can modify the environment setting values. The following is the description of each item in the configuration: 1. Go to Settings > Configuration. 2. Click on the left of category to check the details. Details of each category are as follows: Admin: Configurations for login restrictions, OTP, country code and time zone. Category Two-Factor Authentication Default Country Code Time Zone Mobile Admin allowed in Secure Browser only Secure Browser settings key value Maximum Failed Login Attempts Inactivity Limit on Admin Accounts (days) Maximum Session Timeout (min) You can set the OTP authentication for two-step authentication when logging in to the Knox Manage Admin Portal. It is necessary to enter mobile number or address of the administrator for OTP authentication. OTP is not send if the information is unavailable. You can set the country code where Knox Manage Admin Portal being operated. Default country code is used as the default value when you register an administrator, user, or public application. You can set the standard time zone for the Knox Manage server. Based on this time zone, you can view the information on the Admin Portal, tasks and events scheduled by the administrator runs and statistics on users and devices is collected. Determine whether to allow access to mobile Admin Portal via Secure Browser only. Enter SECUREBROWSER in the Secure Browser settings key value field. You can set the maximum failed login attempts. User account locks upon exceeding the maximum attempts. Range: 3-5 times (Default value: 5 times) Except for super administrators and technical support administrators, if a sub-administrator or read-only administrator fails to log in for the period of time specified in the Inactivity Limit on Admin Accounts (days) field, the account deactivated and the user can not able to log in. To log in again, contact the super administrator. Range: days (Default value: 9999 days) You can set the system maximum session timeout for Knox Manage Admin Portal. Range: 1-60 minutes (Default value: 30 minutes) 34

4 Category Action When Admin Login Fails Allow Multi-point Logins You can set account lock options upon exceeding allowed failed login attempts. Deactivate account until an upper level admin unlocks Disable login for 10 mins No action You can set the option for concurrent logins. Device: Configurations for user device. Category Limited Enrollment Device Location View Period (days) Maximum Number of Active Devices per User You can enroll or unenroll devices whose IMEI or Serial Number has been registered. IMEI is a unique number assigned to each mobile device. You can set to enroll the devices with registered IMEI or serial numbers. TRUE: Enroll the devices registered with IMEI or serial numbers only in Settings > Android > Limited Enrollment are activated. FALSE A device's location data is saved to check the location history through its inventory information. You can view the device's location data saved during the set period of time. Range: 5-30 days (Default value: 30 days) You can set the maximum number of enrolled devices per user. Range: Unlimited or 1-5 Inventory Scheduler: Set the cycle to collect the device inventory per platform. Category Inventory Collection Interval for Android (hr) Inventory Collection Interval for ios (hr) Inventory Collection Interval for Windows (hr) You can set the interval to collect Android device information. (If the setting is 0, the device inventory is not be collected by scheduler.) Among the Android Inventory information, you can configure the location collection schedule setting in Profiles > Device Management Profile > Android Policy > Scheduler. For more information, see Adding device location report schedule. Range: 0, 4-24 hours You can set the interval to collect ios device information and location inventory. (If the setting is 0, the device inventory is not be collected by scheduler.) Range: 0, 4 24 hours You can set the interval to collect the user s device inventory for Windows by hour and set the synchronization interval with MDM Agent in hour. If the setting is 0, the device inventory is not collected by scheduler. Range: 0, 4-24 hours 35

5 MDM: Configurations for MDM. Category APNs Topic for ios Daily retries for device commands in queue Camera Option from Lock Screen for ios KeepAlive Interval (hr) KeepAlive Duration (days, set 0 to disable) KeepAlive Interval Period (hr, Android Only) The owner ID of the APNs certificate for MDM. It is automatically entered when uploading the APNs certificate in the APNs setting. If it is different from the UID value of the current Subject Name in the APNs setting, enter the current UID value. In the command prompt, run the following command and set the value appearing after UID= to APNs topic. C:/> keytool -v -list -storetype pkcs12 -keystore {APNS certificate filename}.p12 find UID Set the number of times a notification should be sent to Knox Manage so that device commands can be reapplied to devices if they have not been processed successfully. Available choices: You can set it to 0, 1, or 2. Upon receiving a notification, Knox Manage reapplies the relevant device commands. You can find the device commands in queue in Service Overview > Device Command in Queue. - 0: No notification is sent to Knox Manage. - 1: A notification is sent at 11:00 p.m. in local time per tenant. - 2: A notification is sent at 10:00 a.m. and again at 10:00 p.m. in local time per tenant. You can set the camera option when the device screen is locked. TRUE: The camera can be used even when the screen is locked. FALSE: The camera cannot be used when the screen is locked. You can set the KeepAlive interval to check the connection between the Knox Manage server and devices at the set interval. Knox Manage server checks the last time the server communicated with devices for KeepAlive interval to check the connection status. Range: 6, 8, 12, or 24 hours You can set the KeepAlive duration. If there is no communication between the Knox Manage server and devices for the set period, then it attempt to re-establish a connection directly with the device at the set KeepAlive Interval instead. At this time, If the device still fails to establish communication, then its status changes to Disconnected. If it later manages to re-establish communication with the server at the set KeepAlive Interval or through a device command, then its status changes to Enrolled. If you want to disable Keep Alive function, enter 0. Range: days You can set the KeepAlive interval to check the connection between the Knox Manage server and devices at the set interval. This interval is only applicable to Android device. If you set the KeepAlive Interval Period to 4 hours, Android devices try to establish communication with the Knox Manage server every 4 hours. Range: 4 24 hours 36

6 Category Reminder to Go Off Before KeepAlive Expiration (hr, Android Only) Delete App upon Unenrollment You can set the reminder to go off before KeepAlive expiration to notify Android devices that Use of Knox Manage is blocked due to KeepAlive period exceeded. Range: 1-3 hours You can select whether to delete app upon unenrollment. TRUE: When the administrator unenroll Android devices, Knox Manage deletes the Managed Apps installed on the device before deactivation. When deactivating ios device, the app list to be deleted on the screen. (For Android, Managed App refers to the enterprise internal apps. For ios, it refers to all apps installed through Knox Manage). FALSE: If False is selected, when the administrator change the device status to inactive, the device is unenrolled but the app is not be deleted. Service Desk: Set the service desk information. Category Service Desk Service Desk Phone Enter the service desk address. Enter the service desk phone number. 3. Click to apply any changes you have made. Configuring authentication The user authentication process is necessary for users to login to Knox Manage from the device. You can configure automatic or manual authentication process. Automatic authentication: The default user authentication method that Knox Manage provides. Manual authentication: You can select Sync User Authentication Settings or Local User Authentication Settings. If globalldapauthenticator is set in the User Authentication Settings and globalemmauthenticator is set in the Local User Authentication Settings, system provides Automatic. To set user authentication manually, follow the steps below: 1. Go to Settings > Configuration. 2. Click Authentication Setting on the top of the window. 37

7 User Authentication Settings: The authentication method for user to login to Knox Manage. - Sync User Authentication Settings: Directory service synced with AD/LDAP saves the user information in the Knox Manage server and authenticates the user. Item Authenticator LDAP Service ID globalemmauthenticator: Authenticate using user ID and password saved in the Knox Manage server. globalldapauthenticator: Authenticate using user ID and password stored through AD/LDAP sync. globalldapserviceauthenticator: Authenticate using user ID saved in the Knox Manage server and the password from AD/LDAP accessed by the directory service. globalldapserviceauthenticator: You can enter the directory service ID when you use the LDAP Service Authenticator. - Local User Authentication Settings: You can authenticate either with the authenticator you have selected or with the directory service. If you check Set identical to the Sync User Authentication Settings, system provides the same authentication method with Sync User Authentication Settings. Item Authenticator LDAP Service ID Select the method from globalemmauthenticator, globalldapauthenticator, globalldapserviceauthenticator, or newly configured authenticators. globalemmauthenticator: Authenticate using user ID and passwords saved in the Knox Manage server. globalldapauthenticator: Authenticate using user ID and password stored through AD/LDAP sync. globalldapserviceauthenticator: Authenticate using user ID saved in the Knox Manage server and the password from AD/ LDAP accessed by the directory service. globalldapserviceauthenticator: You can enter the directory service ID when you use the LDAP Service Authenticator. 3. Click Save. 38

8 Setting the profile update interval The Knox Manage server sends the policy in Device Management Profile to the device on a regular basis. When you set the profile update interval, a policy update is requested according to the schedule set for all device platforms to which the profile has been assigned. To set the update interval for each profile, see Setting the profile update interval. To set the profile update interval, follow the steps below: 1. Go to Settings > Configuration. 2. Click Profile Update Interval Setting on the top of the window. 3. Set the interval by selecting values for the Weekday, Time zone, and Start Time. Start Time: Enter a 4-digit value between 0000 and 2359 in HHMM format. 4. Click Save. Setting SEG profile You can configure API keys in SEG profile settings to direct install Knox Manage and register user device through UMC (Universal MDM Client), which is preloaded in SAM- SUNG Galaxy devices. For direct installation and registration, it is necessary to connect with SEG (SAMSUNG Enterprise Gateway). To configure the SEG profile, follow the steps below: 1. Go to Settings > Configuration. 2. Click SEG Profile Setting on the top of the window. 39

9 You can modify the SEG profile, click from the SEG server. on Profile ID for checking the response Item Profile ID Profile Name Tenant ID Domain SEG Region EMM Client APK EMM EULA Additional EULAs SEG profile ID is the information provided by Knox Manage. SEG profile name. Tenant ID to be linked with the SEG profile. Domain information mapping with the domain of the user . This domain information used as the domain of address in user invitation message. This indicates the Region information of the SEG server. Select the same Region as that of Knox Manage. This is the download URL for the Knox Manage Client APK file provided by Knox Manage. This is the EULA for Knox Manage that appears when a user enrolls their device through Direct Installation to obtain their agreement to the collection of personal information. URL address for other EULAs, Terms of Services and User Agreements displayed to users. 3. Click Save. 40

10 Managing Limited Enrollment IMEI is the International Mobile Equipment Identity number of mobile device, in which you can configure to enroll devices that are registered with IMEI. You can register the IMEI individually or collectively using a CSV file. You can enter Serial Numbers instead to enroll Wi-Fi-only devices that don't have IMEIs. To register IMEIs individually, follow the steps below: To register IMEI, go to Settings > Configuration, select TRUE in Limited Enrollment field. 1. Go to Settings > Android > Limited Enrollment. 2. Click and select Add Single Device. 3. Enter IMEI in the Add Single Device window. Enter Serial Numbers for Wi-Fi-only devices that don't have IMEIs. 4. Click Save. To upload a CSV file, follow the steps below: 1. Go to Settings > Android > Limited Enrollment. 2. Click and select Add Multiple Devices. 3. Click Download Template for bulk registration and save the CSV file in your PC. 4. Enter the IMEI number in the downloaded CSV file, and save it. Enter Serial Numbers for Wi-Fi-only devices that don't have IMEIs. 5. Click Browse and select the file to upload. 6. Click OK. 41

11 Setting an APNs certificate For Knox Manage to communicate securely with Apple ios devices, they need a trusted certificate that is signed by both Knox Manage and Apple certification authorities. This certificate is called the Apple Push Notification Service (APNs) certificate. This section describes how to get this certificate and upload it to Knox Manage. To get the APNs certificate, you need to prepare your Apple ID in advance to receive the APNs certificate from the Apple site. Please refer to the following site information, - This web site is to create an Apple ID for sign in to the Apple site. - You need to use the same ID when renewing a certificate, create and use an ID for certificate generation. For more details the APNs certificate information, see ceptual/remotenotificationspg/apnsoverview.html. Creating an APNs certificate You use Admin Portal to generate and download the Certificate Signing Request file (CSR), and then upload that file to the Apple Push Certificates Portal. Apple generates the completed APNs certificate, which you then upload to Admin Portal. Also, an APNs certificate is renewed in the same way. An APNs certificate registered can be checked in Advanced > Certificates > External Certificates and it is not possible to register, renew or delete the certificate. To register an APNs certificate, follow the steps below: 1. Go to Settings > ios > APNs Setting. If an APNs certificate has already been registered, the currently registered certificate information and the expiration date appear on the top of the window. 42

12 2. To create the Certificate Signing Request (CSR) file in the APNs Setting screen, click Generate Request and save the file. After generating the public key and private key, the CSR is created. The CSR file with the vendor signature added is downloaded to the administrator s PC. 3. Create an APNs certificate: To request an APNs certificate by uploading a CSR file created in step 2 for, log in to with your Apple ID. a. Click Create a Certificate and read and accept the terms and conditions. Click Choose File to select the CSR file just generated in step 2 and then click Upload to import the file into the Apple Push Certificates Portal. b. Click Download in the Confirmation window and an APNs certificate file of PEM format is generated. Depending on your web browser s settings, your web browser may automatically save the file in a predetermined location or it may prompt you to save the file. 4. To upload an APNs certificate file in step 3 that you saved on your PC to Knox Manage, click Upload APNs Certificate, select the downloaded APNs certificate file of PEM format and click OK. The registered certificate information and expiration date appear at the top of the window. Click Download APNs Certificate to download an APNs Certificates (PKCS#12) file for other purposes. Enter the password to set the password for the certificate, and then click OK. 43

13 To download an APNs certificate issued by a CSR created externally, click Import APNs Certificate. Select an APNs certificate file of PKCS#12 format, enter the password and click OK. Renewing an APNs Certificate The expiration date for an APNS certificate is shown at the top of the window. You can renew it any time before the expiration. The new certificate is valid for one year from the date of renewal, and an APNs certificate renewal method is the same as the creation method. Also, when the certificate expires, the administrator of Admin Portal can t send devices control commands to the user's ios devices. Even if the certificate is renewed on the user devices, there is no need to reinstall Knox Manage. 44

14 Managing message templates You can manage message templates to send an or SMS to users. Also, you can add, modify, copy, and delete the default message template that the Admin Portal provides. Default templates for installation and administrator authentication are provided on the Admin Portal and are subject to restrictions on modification or deletion. Other templates for general purpose or temporary password transmission can be registered, modified, copied, or deleted by the administrator. Default message templates provided on Knox Manage are as follows: Template type Message type Template name Agent Installation _Agent Installation : To install Knox Manage, a URL link and QR code for each platform will be sent. Administrator Authentication Administrator Account Information Administrator Temporary Password User Temporary Password Apple VPP _Admin OTP _Admin ID _Admin Temporary Password _User Password Reset _Apple VPP Invite : This is the VPP invitation message template used to add VPP users. Once you add VPP users in Settings > ios > VPP User Management, this template is sent. _Apple VPP Redeem : This is the message template used to install VPP applications registered using redemption codes. For applications that have been registered using redemption codes shown in Applications > VPP Applications, this template is sent to the addresses registered to the users' Apple IDs. The users can click the link in the template to install the relevant applications. 45

15 Template type Message type Template name SMS Agent Installation User Credential Public Store Address Direct Installation KME Activation Address Administrator Authentication Administrator Temporary Password Admin OTP SMS Admin Temporary Password To add a message template, follow the steps below: 1. Go to Settings > Message Template. 2. Click on the top of the window. 3. Enter the following information in the Add Message Template window. Template Name: Enter the message template name. Type: Select the template type. For a general type of template, click to select a reference item for the desired template type. You must select $(UserTempPassword} from the reference item for the temporary password transmission template. : Enter the message template name. Subject: Enter the message subject. Content: Enter the message content. 46

16 4. Click to view reference items that are replaced with actual values when sending an . Double click the item to add in the message template. 5. Click Save after finishing the message template. The added message template can be checked in the message template list. Note: Among listed items in the Reference Items window, EMM/TMS Service URL, Copyright, and Authentication Code Issuing URL are provided by Knox Manage. When selecting items, the relevant values are automatically added to the Template. If the values remain blank, contact the Technical Support Team. To add an image to the message template, click Source Edit in the Add Message Template window and add the image in the URL format. When you enter an template, due to security issues XSS (Cross-site Scripting), certain characters are converted as follows: E.g.) when you enter onclick, it's converted to on-click. The following characters are also converted: onafterprint, onbefor, onerror, onhashchange, onload, onmessage, onoffline, ononline, onpage, onpopstate, onresize, onstorage, onunload, onblur, onchange, oncontextmenu, onfocus, oninput, oninvalid, onreset, onsearch, onselect, onsubmit, onkey, onclick, ondblclick, ondrag, ondrop, onmouse, onscroll, onwheel, oncopy, oncut, onpaste, onabort, oncanplay, oncuechange, ondurationchange, onemptied, onended, onpause, onplay, onprogress, onratechange, onseek, onstalled, onsuspend, ontimeupdate, onvolumechange, onwaiting, onshow, ontoggle, script, frame, object, embed, meta, div, style, form, isindex, body, base, bgsound, xml, document, applet, grameset, layer, alert 47

17 Setting master data You can manage the standard information for Knox Manage, which is classified into categories. You cannot add new categories to the master data but can configure and modify the key, value, selected value and reference code in the Admin Portal. Information managed in the master data are as follows. Device: Device model, status, ownership, platform, firmware and carrier information Language: Supported languages per platform when searching for public application and when registering E-FOTA group Profile: Network setting information depending on the platform User information: Managing position, site, and security level To add the master data, follow the steps below: The master data for Knox Manage is classified into categories. 1. Go to Settings > Master Data. 2. Click on the top of the window. 3. Click Master Data tab, and enter the Category, Key, Value and Selected Value in the Add Master Data window. Adding master Data: Fill out the required fields. Key: Enter the key value of the selected category - When creating a report from Settings > Admin Console > Reports, the key value of the master data is used as the value of the query condition. Value: Enter the key value Category: Select a category Selected Value: When clicking Select, the key value becomes the default value and this value is moved to the top of the category. 4. Add the values in the Reference Information tab: Reference Code: Enter only if reference code exists. 48

18 To add reference information, click, and enter the Reference Code in the Add Reference Code window, and click OK. 5. Click Save. Configuring master data The key value configured in the master data is used and can be checked in the Admin Portal as follows: Master data key value Android OS Version Android Version ios OS Version ios Version Ownership Device Status Platform Windows OS Version Windows Device Type Android Firmware ios Firmware Device Country Device Model Device Network Mandatory App App Client Language Android Market Lang ios Market Lang Position Security Level Site Methods for checking master data Go to Devices & Users > Devices. Check the device information of Status, Platform in the Devices menu. Go to Devices & Users > Devices. Click Mobile ID and check the device model, firmware, SIM Country/Network, Current Country/Network in the Device Detailed Information windows. Go to Devices & Users > Devices. Click Mobile ID and check the Mandatory column in the Application tab in the Device Detailed Information window. Go to Applications > Public Applications. Click, and check Set Country of the App Store in the Add Public Application window. Also, when the app is installed on the device, it is installed in the default language set in AppClientLanguage, en (English), and the language can t be modified. Go to Devices & Users > Users & Organization. Click and select Add Single User, and check Position, Site, and Security Level in the Add Single User window. Device Profile Configuration Go to Profiles > Device Management Profile. Click each platform and check Category of Settings in Android, ios, and Windows tab in the Device Management Profile window. User Defined Organization Field User Defined User Field User and organization information used for mapping users and organizations. 49

19 Setting Logo You can change the logo in the upper-left corner of the Admin Portal to a corporate logo. To set the logo as well as the background and font colors for the Header field, follow the steps below: 1. Go to Settings > Admin Console > Logo Setting. 2. In the Logo Setting screen, select a Logo Image, Header Color, and Header Font Color. You can upload a 224 x 23 image that is 1MB or less in.gif,.jpg,.png,.bmp format. The chosen Logo Image, Header Color, and Header Font Color appear in the Preview area below. To revert to the default logo and color, click Default. 3. Click. The Admin Portal screen is refreshed, and then the changed status is applied immediately. 50