7PMDM Server x - Microsoft Windows Phone 8 7P Mobile Device Management. Doc.Rel: 1.0 / Doc.No.: Windows_ Phone 8 _EN

Size: px

Start display at page:

Download "7PMDM Server x - Microsoft Windows Phone 8 7P Mobile Device Management. Doc.Rel: 1.0 / Doc.No.: Windows_ Phone 8 _EN"

Austen Harris
5 years ago
Views:

1 7PMDM Server x - Microsoft Windows Phone 8 7P Mobile Device Management Doc.Rel: 1.0 / Doc.No.: Windows_ Phone 8 _EN

2 Table of Contents 1 Objectives and Target Groups Legal statements Legal disclaimer - System/AllowUserToResetPhone Legal disclaimer - Experience/AllowManulMDMUnenrollment Windows Phone 8.x enterprise management solution Company Hub Connecting to the MDM Server infrastructure (enrollment) Registering the Windows Phone 8.x.x device to the MDM server Windows Phone 8.x username and password Adding a Windows Phone 8.x user to MDM server Adding a Windows Phone 8.x device to MDM server user Registering the MDM server on the Windows Phone 8.x device Device access to Company Hub Manual account verification Administrator removal of MDM enrollment User removal of MDM enrollment PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 2 / 17 ^Home

3 Table of Figures Figure 1 Add new user Figure 2 Device settings Figure 3 Device at "company apps"... 9 Figure 4 Configuring details Figure 5 Account added indication Figure 6 Successful enrolment Figure 7 Company Hub menu item displayed Figure 8 User access challenged Figure 9 Company Hub contents Figure 10 Corporate account details Figure 11 Windows Phone 8 device details Figure 12 Administrator removal of MDM profile Figure 13 Commence disconnection process List of Tables Table 1 WP 8.x username elements PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 3 / 17 ^Home

4 1 Objectives and Target Groups Objectives: The aim of this document is to provide the customers of SEVEN PRINCIPLES AG to describe how to enroll a WP 8 compatible device into the 7P Mobile Device Management (MDM) server. This manual reflects the current functions of the 7P MDM system again and therefore experiences regular updates and enhancements that are made promptly. Target group: This document was created specifically for the customers of SEVEN PRINCIPLES AG Legal statements According to Microsoft's documentation, disclaimers must be issued if the following features are to be used: Legal disclaimer - System/AllowUserToResetPhone "This feature should only be used on devices that are owned or provided by an enterprise company or organization or on a user owned device where the user allowed the device to be fully managed by the enterprise company. Legal disclaimer - Experience/AllowManulMDMUnenrollment As a Mobile Device Management Solutions Vendor, you must provide the following disclaimer to the IT administrator prior to the use of the feature. This feature may cause the device to fail or lose connectivity and require that the device be serviced at a Nokiaauthorized repair centre to reset to factory settings. Microsoft is not liable for any damage to the device or any loss of productivity that results from use of this feature. Microsoft requires that software vendors provide disclaimers to users when their products expose this feature and capabilities." 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 4 / 17 ^Home

5 2 Windows Phone 8.x enterprise management solution Windows Phone 8.x provides an enterprise management solution to help IT professionals manage company security policies and business applications, while avoiding compromise of the users privacy on their personal phones. A built-in management component can communicate with a management server. There are two parts to the Windows Phone 8.x management component: The enrollment client, which enrolls and configures the device to communicate with the enterprise management server. The device management client, which periodically synchronizes with the management server to check for updates and apply the latest policies, set by the MDM server administrator for the device. A custom designed Windows Phone 8.x application can be downloaded during enrollment, allowing the user to discover and install available company apps from an enterprise app catalogue. This app is created as a custom Company Hub. The 7P MDM server can manage WP 8 devices by using the Enterprise Device Management protocol. The 7P MDM server has the same consistent user experience for enrolment, which also provides simplicity for WP users. MDM servers do not need to create or download a client to manage Windows Phone 8.x. 2.1 Company Hub Company Hub is an application that acts as a portal to a company specific experience on the Windows Phone 8 device. It is created and signed by the company who wish to distribute "in-house" developed applications to their employees without using the Windows Phone Store. It is normally distributed to devices during the enrollment process (of the MDM server) to the company apps location on the WP8 device(s). The Company Hub can also be used for deploying apps from the Microsoft Market Place, because these are signed by Microsoft for public distribution. The applications that reside in Company Hub must be signed with the same certificate as the Company Hub application. Company Hub 1.0 features: Show list of installed company apps Allow launching of the company apps from inside the Hub Show list of applications from MDM Server that can be downloaded and installed Allow installing company apps from MDM server and other apps from Store. 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 5 / 17 ^Home

6 3 Connecting to the MDM Server infrastructure (enrollment) This section describes both processes required for Windows Phone 8 enrollment. Registration of the WP 8.x device to the MDM server. Registration of the MDM server on the WP 8.x device. Once enrolled, the Windows Phone 8 device will receive commands from the trusted MDM server Registering the Windows Phone 8.x.x device to the MDM server WP 8.x devices can only be added to existing users. If the proposed user does not exist on the MDM server, they must be added. Once a device is registered to the MDM server, the WP 8.x device will connect hourly, (Microsoft default) to the MDM server. Windows Phone 8.x username and password The username and password for enrollment must be defined using an explicit format in the MDM Server Users & devices page as WP 8.x user name and WP 8.x password for every user to enroll their Windows Phone. The username for enrollment defines where the WP 8.x device will find the "Auto- discovery service" and must consist of following parts: Username.mdm_instance@Name_of_Autodiscovery_Server e.g. tonyd.7pmdm@dmass.de Windows Phone 8.x Username Dot MDM5 WP8 auto-discovery server URL value A unique name (for example, tonyd) A dot (.) delimiter The MDM Server instance (for example 7Pmdm) delimiter Server address (dmass.de) Table 1 WP 8.x username elements This Windows Phone 8 username and password must be communicated to the user of the registered device to allow them access to the Company Hub. The WP 8.x username is case sensitive and must be unique within the "Auto-discovery service", MDM tenancy and MDM server schema. Duplicate WP 8.x usernames are detected when initially entered into a user's profile ( Organization > Users and devices > users). The MDM server will display the following message if a WP 8.x username already exists. "User with the same WP 8.x username already exists" If a device is added to the MDM server without a defined IMEI, then the MDM server will create a new device entry, which will need to be deleted ( no data). 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 6 / 17 ^Home

7 If a user had registered a WP 8.x device (IMEI) and then passed the WP 8.x device to another colleague, on registration, the device will be assigned to the previous user, unless the device ( and IMEI) had been deleted from the previous user's profile. If the user is in possession of their correctly formed WP 8.x username, and WP 8.x password, they can enroll their WP 8.x device into their MDM server by selecting the following on their device: On their WP 8.0 device navigate to: Settings System Company Apps On their WP 8.1 device navigate to: Settings System Workplace Select enroll, insert their WP 8.x username and password. The enrollment process is initiated by the device user. When a device is successfully enrolled, the MDM server will display the "Device name" as "WP". The administrator may change the device name by editing the "Device name" in the "contact and enrollment information" ( Organization > Users and devices > device detail> Contact and enrollment information). The server name "dmaas.net" reflects the service that is offered to customers of 7P. However, customers are allowed to configure their own enrollment service, allowing them to specify another server address other than "dmass.net". 3.3 Adding a Windows Phone 8.x user to MDM server Navigate to Organization > Users & Devices. The "New user data" window will open. Figure 1 Add new user. Insert the details of the new user, and press "Save". The new user will be created in the MDM server database. When a WP 8 device enrolls to the MDM server, part of the enrollment process includes the automated delivery and installation of the MDM servers AET (Application Enrollment Token) which is necessary for the correct installation of the Company Hub application and all supplied (in-house signed) applications. 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 7 / 17 ^Home

8 3.4 Adding a Windows Phone 8.x device to MDM server user Navigate to Organization >Users & Devices, select the user and ensure that a valid WP 8.x username and password exist. This username and password must be conveyed to the user. The WP 8.x device only requires the WP 8.x username and password to be defined in order to enroll into the MDM server. The enrollment process is initiated by the device user. The time and date must be set correctly prior to enrollment. Authentication will fail if the data and time are incorrect ( with server time). 3.5 Registering the MDM server on the Windows Phone 8.x device To enable enterprise management, the WP 8.x device must be configured to securely communicate with the MDM server. The connection to the management infrastructure (enrollment) service verifies that only authenticated and authorized devices can be configured to be managed by their enterprise s device management, the 7P MDM server. The following example uses the enrollment client's built-in UI. On the WP 8 device navigate to: Settings > System > Company Apps On the WP 8.1 device navigate to: Settings > System > workplace WP 8.0 WP 8.1 Figure 2 Device settings. From the system application screen, tap "company apps". 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 8 / 17 ^Home

9 The company apps page will be displayed. WP 8.0 WP 8.1 Tap "add account" Figure 3 Device at "company apps" Insert the Windows Phone 8.x username and password received from your MDM server administrator; confirm these entries by tapping Sign in. WP 8.0 WP 8.1 Figure 4 Configuring details. Microsoft is expecting the MDM server to be https secured by a known certificate authority (CA). If the MDM server is secured with either a self-signed, or invalid certificate, then the following warning may be seen: "Problem with the certificate. The company that issued the certificate for enterprise enrolment is unknown, or we can't verify if the company revoked the certificate. Do you want to continue setting up this account anyway?" 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 9 / 17 ^Home

10 Figure 5 Account added indication. The check box must be selected to install the Company Hub, then tap "done." On successful completion of the enrolment process, the following screen will be displayed on the WP 8.x device. WP 8.0 WP 8.1 Figure 6 Successful enrolment. The corporate data, in this instance "7P MDM Server" will be shown, along with "enrolled" indicating enrollment confirmation. 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 10 / 17 ^Home

11 4 Device access to Company Hub On successful completion of enrollment to the MDM server, a new menu item, in this instance "7P Company Hub" will be present on the WP 8.x device app list. WP 8.0 WP 8.1 Figure 7 Company Hub menu item displayed. When the "7P Company Hub" icon is selected the Company Hub application opens, requesting username and password authentication. Figure 8 User access challenged. The user would insert their MDM server registered WP 8 username and password. When this is accepted, the Company Hub is accessible and the loaded content is made available to the user. 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 11 / 17 ^Home

12 Figure 9 Company Hub contents. By selecting the icon, the user is agreeing to the download and installation of the selected (in-house) application. 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 12 / 17 ^Home

13 5 Manual account verification The corporate account settings can be reviewed by selecting a corporate account, for example, 7P MDM server. Figure 10 Corporate account details. The initial connection to the MDM server is done automatically. Once the initial connection has been made, a complete inventory of the device will be displayed in the MDM server. Figure 11 Windows Phone 8 device details. Following the initial connection, the Windows Phone 8.x device will periodically connect (currently 1 hour intervals) with the MDM server. If, however, the server administrator require a current inventory of the Windows Phone 8.x device then they can select the "refresh" button which will force a connection to the MDM server of the Windows Phone 8.x device. 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 13 / 17 ^Home

14 6 Administrator removal of MDM enrollment The Windows Phone 8.x can be manually disconnected from the management infrastructure by the MDM server administrator. A typical reason for this operation is when a user changes employer. During the removal of MDM enrollment (disconnection) the Windows Phone 8.x management client does the following. Removes the enterprise token that allowed installing and running in-house signed apps. Any business applications associated with this enterprise token are removed as well. Removes certificates that are configured by MDM server. Ceases enforcement of the settings policies that the management infrastructure has applied. Removes the device management client configuration, including the scheduled maintenance task. The client remains dormant unless the user reconnects it to the management infrastructure. Reports successful initiated disassociation to the management infrastructure if the admin initiated the process. The administrator would navigate to Organisation > Users and devices> device> Actions Within the Actions tab, there is a facility to "Remove MDM profile Figure 12 Administrator removal of MDM profile Select the "Remove MDM profile" button. The MDM server will acknowledge the administrators request, by displaying a "success" pop-up. The MDM profile will be removed from the selected device on the next device synchronisation. 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 14 / 17 ^Home

15 7 User removal of MDM enrollment The Windows Phone 8.x enrollment can be manually disconnected from the management infrastructure. A typical reason for this operation is when a user changes employer. During the removal of MDM enrollment (disconnection) the WP 8.x management client does the following. Removes the enterprise token that allowed installing and running in-house signed apps. Any business applications associated with this enterprise token are removed as well. Removes certificates that are configured by MDM server. Ceases enforcement of the settings policies that the management infrastructure has applied. Removes the device management client configuration, including the scheduled maintenance task. The client remains dormant unless the user reconnects it to the management infrastructure. Reports successful initiated disassociation to the management infrastructure if the admin initiated the process. For the user to remove the MDM enrollment profile, the user must: On the WP 8 device navigate to: Settings > System > Company Apps On the WP 8.1 device navigate to: Settings > System > workplace WP 8.0 WP 8.1 Figure 13 Commence disconnection process. User-initiated removal of MDM enrollment is not reported to the server. 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 15 / 17 ^Home

16 The 7P MDM server details will be displayed. Tap delete (trash can icon) Tap delete to confirm Confirmation tap close The user completes the removal of MDM enrollment by selecting the Close button. 7PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 16 / 17 ^Home

17 List of changes Version Date Changes Reason Author Version release Tony Dargis Author: Tony Dargis Version: English Date: DocNr: n/a Proprietary Notice: All rights reserved. No part of the document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the written permission of SEVEN PRINCIPLES, Erna-Scheffler-Straße 1a, Köln. The information in this document is subject to change without notice. Schutzrechte: Alle Rechte vorbehalten. Kein Teil dieses Dokuments darf in irgendeiner Form (Druck, Photokopie oder einem anderen Verfahren) ohne schriftliche Genehmigung der Firma SEVEN PRINCIPLES, Erna-Scheffler-Straße 1a, Köln reproduziert oder unter Verwendung elektronischer Systeme verarbeitet, vervielfältigt oder verbreitet werden. Die Firma SEVEN PRINCIPLES behält sich vor, ohne vorherige Ankündigung den Inhalt dieses Dokuments teilweise oder vollständig zu ändern. COPYRIGHT SEVEN PRINCIPLES PMDM_Client_WindowsPhone_v5.06.0x_EN_1.0.docx Page 17 / 17 ^Home

7PMDM Server x - CSV Import 7P Mobile Device Management. Rel: 1.0 /

7PMDM Server x - CSV Import 7P Mobile Device Management. Rel: 1.0 / 7PMDM Server 5.08.0x - CSV Import 7P Mobile Device Management Rel: 1.0 / 2015-09-03 Doc.No.: n/a Table of Contents 1 Introduction... 3 1.1 Table of values... 4 1.2 UserID or Email?... 5 1.3 CSV delimiter...