the definite enterprise guide for ios 11.3 Document version 1.1 Document author: Björn Kemps 3/27/18 mobco

Transcription

1 the definite enterprise guide for ios 11.3 Document version 1.1 Document author: Björn Kemps 3/27/18 mobco

2 Table of contents 1 Context 3 2 Before you start 3 3 What s new in ios 11.3? Managed ios software updates Prevent unmanaged apps from accessing contacts in managed accounts imessages in icloud Disable USB Restricted Mode Installed Application List enhancements Enable / disable Bluetooth Arrange WebClips on the Home Screen Layout Specific Version for ios Updates Install Application enhancements Skip the Proximity Setup screen on first reboot Skip the Privacy screen during setup Restrict the Remote app Allow MMS messages bypass Always-On IKEv2 VPN Safari Battery and Performance 11 4 Other new features 11 5 Contact Mobco 12 Mobco bvba Kerkberg Dilbeek, Belgium VAT KBC IBAN BE BIC KREDBEBB Represented by Ulrik Van Schepdael uvs@mob.co Founding member of the Enterprise Mobility Expert Alliance 2

3 1 Context Since ios 9 the x.3 version has always been the major intermediate release. The ios 11.3 release is different and this time it is packed with new exciting business features. We can safely state that this new version of ios is one of the most important ones for the enterprise since Apple s focus on business integration and digital transformation. This document puts the focus on ios 11.3 and is based on the publicly available information at the time of publication. In this document you will discover all enhancements and major new features that will probably impact the digital evolution in your company. Enjoy the reading! 2 Before you start Curious about all current enterprise features packed in ios? Check out our Mobco Academy website or request the ios 11 for Business Whitepaper online. For the updated training schedule, please visit Concerning ios Beta and public Beta programs, you should be aware that: Your employees can take part in this program, unless you tell them t too. There s security risk the MDM protocol is NOT changing. However, your management system will t recognize the exact mobile OS version and could take unexpected measures such as quarantining the mobile device. Certain apps might t be working correctly or fail to work on BETA ios versions. Our recommendation is to advise your employees to install the BETA only on private or test devices that are NOT managed by your MDM or EMM system. Remember a roll-back to a previous ios version is t supported. In this paper we will only focus on those new features that deliver a true enterprise value or facilitate data security/privacy. This document does t summarize all new ios 11.3 features; please refer to for more details on the complete listing. Check for the latest updates. No information available through this program is part of this whitepaper. If you have a developer account, check the enterprise resources for detailed protocol and profile reference details. 3

4 3 What s new in ios 11.3? 3.1 Managed ios software updates Probably the number 1 feature request from enterprise customers over the last couple of years, finally it s here! For any supervised ios device, you can set an MDM restriction that prevents users from manually updating a device over-the-air for a specified time. Users can still update their devices with Apple Configurator or itunes if they have access. When you implement this restriction, the default delay is 30 days, and is triggered the moment Apple releases an ios update. This gives administrators more time to test compatibility of their apps and devices with the latest OS before users start upgrading their devices. However, you can change the default number of days you prevent updates, anywhere from one to 90 days. Once the delay expires, users get a tification to update to the earliest version of ios that was available when the delay was triggered. Currently this restriction is t yet part of the standard EMM profiles on MobileIron, Airwatch, Blackberry. Our mobco experts can assist you with a custom profile for your implementation if you already want to start using this functionality. Contact us for more information and assistance on this must-have enterprise feature. This feature will also be available on MacOS v * User Experience: *** Security: *** 4

5 3.2 Prevent unmanaged apps from accessing contacts in managed accounts If managing ios updates is the number 1 request for Enterprise, this one will share the podium as a top request from Enterprise. WhatsApp, Facebook Messenger, Waze, are all popular consumer apps which are heavily used in Enterprise. All these apps have access to the corporate contacts in managed accounts. In ios 11.3, unmanaged apps (apps which are t installed via EMM, typically users personal apps) will longer be able to access contacts in Managed accounts. This will prevent, for example, WhatsApp reading contacts from the corporate account that has been deployed to the device by EMM. With the upcoming GDPR privacy legislation in the EC, this will help Enterprise customers to protect their corporate contacts. This new feature will be managed through the restrictions profile. Mobco can help you configuring your EMM to prevent your business contacts will be synced to unmanaged apps. It s seldom a feature scores maximum points on all areas we evaluate, but this was certainly does and allows the user to install just any app without any security risk. * User Experience: **** 5

6 3.3 imessages in icloud ios 11.3 will allow storing Messages to icloud and syncing them between all devices linked to the same Apple ID. This may pose some Enterprise challenges if imessages are used to conduct business purposes. These could w end up on the users personally owned devices. Or the way around, where imessages from personally-owned devices could end up on company-owned devices, potentially triggering a privacy/gdpr concern. On the plus side, syncing Messages to icloud should make it much easier to move users from old to new devices without having to do a full device restore. User Experience: **** Security: ** 3.4 Disable USB Restricted Mode USB Restricted Mode is a security feature requiring users to enter their passcode or reconnect the accessory while the device is unlocked at least once a week, or the accessory will longer function when the device is locked. It provides a protection for those devices potentially under attack using USB cable connection. User Experience: ** 6

7 3.5 Installed Application List enhancements The Installed Application List MDM command returns a list of apps installed on devices. In ios 11.3 it w returns these additional pieces of information about each app: AppStore Vendable Device Based VPP BetaApp AdHoc Code Signed Has Update Available Has Update Available should greatly enhance the implementation of enterprise app stores by the EMM vendors, which can currently be unreliable and when it comes to displaying to users which apps need to be updated. * User Experience: **** Security: *** 3.6 Enable / disable Bluetooth Bluetooth can w be turned on or off over-the-air on Supervised devices. There is already a restriction that prevents a user from changing the current Bluetooth status from on to off and visa-versa, this new function actually allows turning on or off Bluetooth, similar to how roaming can be turned on/off over-the-air. Although this sounds like a heavy restriction, it is actually providing a better user experience in those circumstances where a Bluetooth is required to connect to peripherals (such as a e- ID Bluetooth card reader) t all users understand the necessity of enabling Bluetooth and could be calling the helpdesk for card reading troubleshooting. * User Experience: *** Security: *** 7

8 3.7 Arrange WebClips on the Home Screen Layout Arranging apps on the Home Screen was already possible. In ios 11.3 this has w been extended to Web Clips. Web Clips can also be grouped so you can create a clean and comprehensive layout of corporate devices. User Experience: **** Security: ** 3.8 Specific Version for ios Updates Previously, devices receiving the command to force an OS update were required to download and install the latest available ios version supported by the hardware. With the latest release, the ability to force an OS update can w specify an ios version for the device to install, provided it is higher than the device s current ios version and compatible with the device model. When combined with the upgrade restriction, this feature enables full control over what version of the OS is deployed and used in your organization! * User Experience: *** 3.9 Install Application enhancements With ios 10, you can remove some built-in system apps from the Home screen on your iphone, ipad, ipod touch, or Apple Watch. In ios 11.3 the Install Application MDM command can be used to re-install previously removed system apps. An interesting feature to ensure a maximum user experience in a more controlled environment and perfectly compatible with predefined arrangement of icons (w including web clips as well) on the home screen of your employees. User Experience: *** Security: ** 8

9 3.10 Skip the Proximity Setup screen on first reboot Proximity Setup allows a user quickly setup a blank device by syncing settings and data from their old device by holding them near each other and allowing a direct transfer. EMM solutions w have the ability to prevent Proximity Setup from being used when a device has been wiped. * User Experience: ** 3.11 Skip the Privacy screen during setup The Device Enrolment Program (DEP) allows skipping certain screens during the setup wizard of new devices, the Privacy screen can w be skipped as well. For a complete guide on Device Enrollment Program automation, please contact our support team or download our white paper on DEP! User Experience: *** Security: *** 3.12 Restrict the Remote app Allows an organization to specify a whitelist of Apple TV s that the Remote app on a given ios device is allowed to control. With the proliferation of Apple TV in the enterprise for both AirPlay enabled meeting rooms, as for signage applications, more and more of these types of features will become available. * User Experience: ** 9

10 3.13 Allow MMS messages bypass Always-On IKEv2 VPN It is currently possible to setup an always on VPN from ios devices to route all traffic down the tunnel except specific services, such as voic and AirPrint. This new option allows cellular services such as MMS messages to also bypass the VPN. Since the availability of per-app-vpn we have been eliminating full device VPN functionalities for most use cases. Only in fully controlled environments the full device VPN is still in use (or should be in use). User Experience: ** 3.14 Safari 11.1 ios 11.3 (and macos ) ship with Safari This new version has a number of new features, including: Service Workers: implement background scripts for offline web applications and faster webpages Payment Request: provide a consistent user payment experience in Safari using a standards-based API Security Improvements: improved protection against memory corruption and code execution attacks. Web Inspector Updates: new designs for the Network Tab and the Styles sidebar in the Elements Tab. Users can expect better password autofill (including in apps that use Web View), a better Reader mode, and improved protection against cross-site web tracking. The updated Safari browser also provides an extra benefit for your employees given the fact more and more HTML5 apps (web apps with offline capabilities) are reaching them because. User Experience: *** 10

11 3.15 Battery and Performance As promised, Apple will bring some much-needed power management to the battery settings in ios Apple says users will w be able to see their overall battery health and will recommend if it needs to be serviced. You will also be told if your battery is triggering a chip slowdown and can choose to turn that feature off. The switch will only be available for iphone 6, iphone 6 Plus, iphone SE, iphone 6s, iphone 6s Plus, iphone 7 and iphone 7 Plus. The feature can be found in Settings > Battery > Battery Health (Beta). You will see the peak capacity (relative to a brand-new battery) and whether or t your phone is capable of sustaining peak performance. If your older iphone is subject to slowing down because the battery can longer deliver the necessary peak voltage for full performance, this is where you would see it. This is also where you would disable such throttling. User Experience: **** Security: ** 4 Other new features In the previous chapter we ve listed the most important ios 11.3 features which will have a direct impact to ios in the enterprise. But ios 11.3 includes some other nice features which are t considered as business features, but will have a positive impact on the user experience: advanced Mobile Location for sending your location to emergency services when calling from iphone App Store lists version number and update size on Updates screen a batch of new Animoji for iphone X visual aid for the Confirm with Side Button prompt for purchases in the App Store on iphone X. 11

12 5 Contact Mobco Operations and Support or Sales info@mob.co Accounting accounting@mob.co