Feb 2012 v8.0 Mobile Device Management Administrator Guide Android https://mdm.telstra.com
Contents Purpose... 4 Overview of Mobile Device Management... 4 Getting Help... 4 Pre-requisites... 4 Customer Admin Login... 5 Web Portal Address... 5 Getting Login Access... 5 First Time Login... 6 Forgotten Password... 6 Password Security... 8 Multiple Customer Logins... 9 Searching For Mobile Users... 9 Device Enrolment... 11 Device Diagnostics... 13 Deploy Enterprise Software... 15 Upload Enterprise Software... 15 Install Enterprise Software... 15 Query Software... 17 Uninstall Software... 17 Security... 18 Lock... 18 Wipe... 20 Unlock... 20 Managing Groups of Users... 21 Making Use of Groups... 22 Create a New Group... 22 Move Users between Groups... 23 Creating New User Logins... 23 Assigning User Login Roles and Privileges... 24 Assigning User Login Groups... 24 Creating New User Logins... 25 Telstra Mobile Device Management Guide Android Page 2
Auto-Provisioning Rules... 25 Reporting... 26 FAQs... 28 Definitions... 29 Telstra Mobile Device Management Guide Android Page 3
Purpose This user guide is for IT administrators who want to remotely manage their fleet of mobile devices via the Telstra Mobile Device Management ( MDM )portal. This userguide is not intended to be used by the mobile users. Overview of Mobile Device Management Telstra s MDM web portal allows nominated IT administrators to remotely install a client on Android devices so that these devices can be managed over the air. The following features are available for Android devices using the Telstra MDM portal: Send SMS Messages Diagnostics Device Security Deploy Enterprise Software Grouping Capability Create User Logins Auto-provisioning rules Scheduling Reporting Description SMS messages can be sent to individuals or entire groups Get information back about the device eg firmware Lock and full wipe Install and uninstall enterprise software (*.apk) Employees can be grouped into different lines of business making it easier to manage large numbers of people Ability to manage separate user logins and assign different roles and privileges to these user logins Enforce that certain applications are installed on the device immediately after a successful device enrolment Sending out software in bulk to a number of mobile users at certain dates/times Run and export standard reports eg list of devices enrolled etc Getting Help Telstra provides assistance during business hours 8am- 6pm, for customers wishing to use Telstra MDM. All correspondence should be initiated via email to wireless@team.telstra.com and a customer support representative will get back to you. The customer support representative can only assist you if we have you listed as an authorised representative on the account who has the authority to remotely manage the company s devices. Pre-requisites To use Telstra MDM, the following items need to be in place: You must have at least one Telstra Android mobile device as listed on Telstra s support page www.telstra.com/tmcshandsets. You must have at least one active Telstra SIM and the mobile service MUST be connected with a Telstra Mobile Connect data plan. For more information on Mobile Connect data plans see here http://www.telstra.com/mobileconnectsolution The device MUST always have internet access to https://dm2.mobile.telstra.com in order to operate correctly with Telstra MDM. Telstra Mobile Device Management Guide Android Page 4
The mobile devices must be turned on and in mobile network coverage area All mobile devices you want to manage must be grouped under a single Telstra mobile billing account. If unclear about this requirement please contact your Telstra sales person or Telstra service delivery/billing contact and they can discuss implications of grouping mobile services under a single billing account. You will require a first time login password to access the Telstra MDM portal. o A first time login password can be requested from the Telstra MDM helpdesk via email wireless@team.telstra.com o You will need to provide proof that you are an authorised representative of your company and have the authority to remotely manage employee/contractor devices. Note: To install the Telstra MDM client, the device must be setup to allow the installation of nonmarket applications. Some devices also require an SD card to be present and other settings to be enabled/disabled eg disable data manager Customer Admin Login Web Portal Address Nominated IT administrators can login to the Telstra MDM portal at https://mdm.telstra.com Getting Login Access The following credentials will be required to gain access Username Password This is your 10 digit Telstra mobile account number under which your mobile users are grouped. If uncertain about your Telstra mobile account number please contact the Telstra MDM helpdesk at wireless@team.telstra.com This is your unique Telstra MDM password which you will manage. The very first time you use the Telstra MDM portal, you will be required to request a password from the Telstra MDM helpdesk at wireless@team.telstra.com Note: You will need to provide proof that you are an authorised representative of your company and have the authority to remotely manage employee/contractor devices before Telstra will issue a password. Telstra Mobile Device Management Guide Android Page 5
First Time Login The very first time you login, you will be required to change your password. o Password has to be at least 6 characters o Password maximum length is 14 characters o Password cannot have 3 consecutive characters or numbers o Password must be alphanumeric (no special Characters) You should also enter your email address (or a distribution email address) and answer to a secret question as described below so that if you forget your password in future, this can be reset for you online without needing to contact Telstra. Forgotten Password If you have forgotten your password, this can be automatically reset and a new password issued online without you needing to contact Telstra. Alternatively if you get stuck, Telstra s MDM helpdesk can reset the password. Send an email to wireless@team.telstra.com and you will then be asked to verify your details before the password is changed Pre-requisites: When you login successfully for the first time you should setup your email address and the answer to a secret question from the administration>user screen. Alternatively click on My Account in the top right hand corner to go directly to this page. Telstra Mobile Device Management Guide Android Page 6
You should also setup an answer to a secret question from the administration>user>modify security screen When you forget your password: When you enter your username(telstra 10 digit billing account number) and an incorrect password, you will be asked if you have forgotten your password and given the opportunity to have this reset. Telstra Mobile Device Management Guide Android Page 7
You will then be asked to enter your username and email address You will then be asked for your answer to a secret question Your password will then be reset and you will be asked to enter a new one. You will also receive a confirmation email that the password was reset Password Security The Telstra MDM portal will require that you change your password every 60 days Your login will timeout after 60 minutes of inactivity and you will be required to login again Passwords will be locked out after three incorrect attempts Accounts will be locked after 60 days if you have not logged in during that time. It is your responsibility to keep your password secret and secure. You should NOT pass these details to any person outside your organisation and should change password details if employees leave the organisation. Telstra Mobile Device Management Guide Android Page 8
Multiple Customer Logins Only one person at a time can login using the same username/password. If a second person tries to login using the same username/password the other person s login will timeout. You can create additional user logins for each user that has permission to manage devices and give these user logins different roles and privileges. See the User Login section for more information. Searching For Mobile Users After login you will be presented with the default search home screen to make it easy for you to find mobile users. However at any time you can also search for a mobile number or email address by entering this in the top right hand corner. Alternatively, you can click on the advanced search option and search for all the users with a certain make/model of device The Telstra MDM portal will then search for the mobile number and display a picture of the handset model associated with that mobile number. Telstra Mobile Device Management Guide Android Page 9
Search Problem Resolution The device cannot be found Check that the mobile number has a Mobile Connect plan activated Check that the mobile number belongs to the Telstra billing account number you are using to login. That is, if you logged into Telstra MDM using the mobile billing account number 1234567890, check that the mobile number you are searching for is being billed under that Telstra account number. Telstra automatically refreshes mobile number information each night, and if a Mobile Connect plan is activated, this mobile number will be displayed the following day. Device model is shown as unknown If the serial number of the device is missing contact Telstra support at wireless@team.telstra.com to correct. If the serial number of the device is present, the device model being used is not supported by the Telstra MDM portal. For a list of supported device models see www.telstra.com/tmcshandsets Should a user swap devices, Telstra automatically refreshes handset information each night and it will be displayed the following day. If you believe the mobile number or handset model is not being displayed correctly please contact the Telstra MDM helpdesk at wireless@team.telstra.com Telstra Mobile Device Management Guide Android Page 10
Device Enrolment Enrolment is a process of establishing authentication between the device and the Telstra MDM portal. A device MUST be successfully enrolled before the Telstra MDM portal can then send settings and policies to the device. To enrol a device: From the configuration tab, click on the send button next to the Telstra Install DM setting and the server will send an SMS to the mobile user requesting they download a client. The mobile user will receive an SMS with a link and will need to download the software client and install and run this software on their device. Under the Recent Actions panel on the Telstra MDM Portal the status of will be shown. If the client is correctly installed by the user you will see status will go from pending>sent>success. You will also notice the screen showing the vital signs of the device eg battery, memory, coverage information become visible after the device has been successfully enrolled. Telstra Mobile Device Management Guide Android Page 11
Recent Actions Status Meaning The Telstra MDM server is in the process of sending the message to the device. If the status remains frozen in pending it means that the Telstra MDM server is having trouble sending the message The Telstra MDM server has sent the message to the device and is waiting for a Telstra Mobile Device Management Guide Android Page 12
response If the status remains frozen in sent it means the message has not been delivered OR the handset is not responding to the message. The transaction was successful and the device has reported that the setting has been successful The transaction was unsuccessful either because the handset rejected the message OR the server timed out after 3 minutes Important: To install the Telstra MDM client, the device must be setup to allow the installation of nonmarket applications. Some devices also require an SD card to be present and other settings to be enabled/disabled eg disable data manager Enrolment only needs to be done once for each mobile device (unless the user chooses to remove the client or wipe the device, in that case the process will need to be repeated for that device). The client MUST be running on the device for the Telstra MDM server to be able to successfully communicate with it. The user must open and run the client after it is installed. By default the client will start running whenever the user powers-up the device. If the user deletes the client, it must be re-installed so the Telstra MDM server can communicate with the device. The Telstra MDM server will timeout after 3 minutes if it does not receive a successful notification from the device client that it has been installed and is running. Device Diagnostics After a device has been successfully enrolled, the IT administrator can then view information about that particular device eg firmware version etc. From the Diagnostic screen click Check All The Telstra MDM portal will then query the device for diagnostics Once successful, information about the device will be available from the Diagnostics>Details tab. Connection settings on the device will also be retrieve and shown on the Diagnostics>Settings tab Telstra Mobile Device Management Guide Android Page 13
To refresh the diagnostic information click the Check All button and the server will request an updated set of values. Telstra Mobile Device Management Guide Android Page 14
Deploy Enterprise Software The Telstra MDM portal allows you to upload enterprise software for Android devices (.apk files) and then send these to users for installation. An enterprise application can also be uninstalled and you can query the device for a list of software. Upload Enterprise Software From the Administration>Software>Add screen input the following items: Manufacturer/Model Software Name (this must NOT contain any spaces) *.apk file to upload (this filename must NOT contain any spaces) Software version number (optional) Click Add Install Enterprise Software Once the enterprise software has been uploaded, it can then be installed onto the relevant device make/model. From the Diagnostic>Software>Install Software tab a list of uploaded software will be shown for that particular make/model. Select the Install option and click Send The Telstra MDM portal will then send the software to the device and prompt the user to install. Telstra Mobile Device Management Guide Android Page 15
The Telstra MDM server will return a successful result once the software is available for the user to install. It is up to the user to install the software on their device when prompted and the Telstra MDM server cannot force an install. Important: Software installation will fail if the device rejects the file. The *.apk file needs to be compatible with the device you are trying to install it on. When uploading the software, the name and filename must NOT contain any spaces otherwise the installation of the software will fail on the device. It is up to the user to install the software on their device once they receive a pop-up. The Telstra MDM server cannot force an install. The Telstra MDM server will signal a success when the software arrives on the device, not when the software is installed on the device. Telstra Mobile Device Management Guide Android Page 16
Query Software After the Telstra MDM portal has successfully installed enterprise software on a device, you can query the device to view it s software inventory. From the Diagnostic>Software tab click Check Software. The Telstra MDM portal will then query the device and return a list of software that has been installed by the Telstra MDM portal. Important: The device will return all software applications on the device that have been sent via the Telstra MDM server, side loaded or downloaded from the Android market. It will NOT return software loaded onto the SD card Uninstall Software After the Telstra MDM portal has installed enterprise software, this software can be uninstalled from the device silently without user interaction. From the Diagnostic>Software>Uninstall Software tab click Uninstall The user will be prompted to uninstall the software from the device Telstra Mobile Device Management Guide Android Page 17
Important: It is up to the user to un-install the software on their device once they receive a pop-up. The Telstra MDM server cannot force the application to be removed. The Telstra MDM server will signal a success when the user accepts or declines the request to un-install the software ie if the user chooses to cancel the request this will be shown as a success. Security Lock The lock feature will allow an administrator to remotely lock the device when in coverage and the Telstra MDM client is running. This will bring up a lock screen and make the device unusable until it is unlocked again by the Telstra MDM portal. Go to Diagnostics>Security tab Click lock device button If you want the device to start screaming like a burglar alarm click screaming Click Send Telstra Mobile Device Management Guide Android Page 18
Note: Once locked, the mobile user will see a lock screen. The device will not be usable until an unlock request is sent via the Telstra MDM portal ie the user will not be able to make calls(other than emergency calls), answer calls or use the device. Telstra Mobile Device Management Guide Android Page 19
Wipe The IT administrator can remotely wipe sensitive data on the device and SD card at any time when the device is in coverage and the Telstra MDM client is running. The Telstra MDM portal will lock the device so it is unusable and will wipe the following data: Call logs SMS Internal memory videos Internal memory images ActiveSync account Contacts Calendar SD card To wipe the device Go to Diagnostics>Security tab Click wipe device button Note: This is NOT a full wipe eg device connection settings and software applications will remain on the device. Rather it will wipe confidential items like sms/call logs, calendar, contacts, pictures/video, ActiveSync and SD card. The device will be locked and unusable until the Telstra MDM server unlocks Unlock The unlock feature allows you to remove the Telstra MDM device lock screen when the device is in coverage. Telstra Mobile Device Management Guide Android Page 20
Go to Diagnostics>Security tab Click unlock device button Managing Groups of Users The Telstra MDM Portal has a feature that allows companies to group employees into different lines of business so that they are easier to manage and report on. This can be useful when you want to give one group of employee s different IT policies than other groups for example. It is up to each company to decide how they want to group and mange employees, however a typical structure could look like this Company 1267128070 Acme Co Ltd Business Unit Sales Finance Line of Business Northern Southern Operations Telstra Mobile Device Management Guide Android Page 21
In this example, settings or software could be pushed to all employee devices in a company, business unit or line of business. Making Use of Groups Groups can be used in the following ways to manage your employee devices Software applications can be uploaded so they are only available to employees in certain groups You can create different logins for administrators so they only have access to manage certain employees. For example, you could create a login for your sales operation team administrator and they will only be able to see and manage the sales people. You can run reports against different groups You can schedule bulk batch jobs to provision devices in certain groups Add auto-provisioning rules for employees in groups ie automatically adding a password policy Create a New Group Goto Administration>Group>Add Enter a group name and description. The group name must NOT have any spaces Select the roles the group has (select all roles) To view your group hierarchy Got administration>group>group Search Click Search Telstra Mobile Device Management Guide Android Page 22
Move Users between Groups Once a group has been created, you can move one or more employees into this new group Goto administration>bulk Ops and search for the employees you want to move Select the employee(s) you want to move and the group you want to move them to Creating New User Logins By default, Telstra will create a single user login for your company when requested. This user login will be given the maximum privileges allowable The user login will be a 10 digit number that matches your Telstra billing account. However, each person who is authorised to manage devices should have their own user login and you can create and manage your own user logins. When creating a user login there are two considerations 1. What privileges do you want to give this login 2. What group of devices do you want this user login to manage ie all devices or just a single group of devices Telstra Mobile Device Management Guide Android Page 23
Assigning User Login Roles and Privileges Below is a summary of the roles and associated privileges you can give when setting up a new user login User Login Role CORP_ADMIN Administrator CORP_VIEW Supervisor Privileges assigned This role has the maximum privileges that can be assigned to a user login. It will allow a person to perform the following tasks Search for mobile users Enrol devices and send settings to devices Perform administration tasks: o Run reports o Upload software o Create new Groups and move devices between groups o Create new user logins This role has a reduced set of privileges and will allow a person to perform the following tasks: Search for mobile users Enrol devices and send settings to devices Assigning User Login Groups When a new user login is created, this can be assigned to a group or groups. When a user login is assigned to a specific group it can only manage and see employees under that group. For example, in the diagram below, user login #1 can manage all devices in the company, user login #2 can manage only devices at the business unit level, and user login #3 can only manage devices at the line of business level. Company User Login #1 Business Unit User Login #2 Line of Business User Login #3 Telstra Mobile Device Management Guide Android Page 24
Creating New User Logins Goto Administration>Users>Add Complete these fields and then click Add User s first name and last name User s email address The user login The user login password The role you want to give the user login (either CORP_ADMIN or CORP_VIEW depending on privileges you want to give) The group of devices you want the user login to manage After successfully adding a new user login, that person will receive an email with their login details. Auto-Provisioning Rules The Telstra MDM Portal allows you to setup auto-provisioning rules for devices in a particular group or groups. Immediately after a device is successfully enrolled, an auto-provisioning rule can be triggered that will automatically send software application(s) to the device. For example, if you wanted a device to always have an enterprise software application installed after enrolment, an auto-provisioning rule allows you to enforce this. Goto administration>groups and search for the group you want to apply the auto-provisioning rule for. Click on the group name. Select the Auto Install Link Telstra Mobile Device Management Guide Android Page 25
Select the configuration software you want to be automatically provisioned on devices in the group NB: The auto provisioning rule is only triggered immediately after a device has been successfully enrolled. Reporting From the Admin Reports screen, standard reports are available. Once a report has been run, data can be exported to a.csv file for further manipulation. All reports can be run on an ad-hoc basis(ie as needed). The command history report can also be run on a recurring basis(ie daily, weekly, monthly). To run an adhoc report: Go to Administration>Reports Click the add (+) link in the Ad-hoc report row Select the report you want to run Telstra Mobile Device Management Guide Android Page 26
The following standard reports are available on the Telstra MDM portal: Report Name Description Type of Report User/Device Inventory A list of all your mobile numbers, device models and device serial numbers(imei) Can be run on an ad-hoc basis only ie once off as needed Device Application Inventory Provides a list of software installed on the device by the Telstra MDM server Can be run on an ad-hoc basis only ie once off as needed Device Firmware Summary A list of firmware version returned from the device when queried by the Telstra MDM server Can be run on an ad-hoc basis only ie once off as needed Traffic and Downloads Report Command Details Report A view of how much data is being transferred between the Telstra MDM Server and each device List of all the settings that have been sent to the device Can be run on an ad-hoc basis only ie once off as needed Can be run once, daily, weekly or monthly Recurring reports can be scheduled from a set date/time and will then be run automatically by the Telstra MDM Portal every day, week or month. The Telstra MDM Portal will save these recurring reports for a period of 90 days and then delete them. To schedule a recurring report click the add (+) link to create either a daily, weekly or monthly report. Select the report you wish to run from the drop down list Give the report a name Select the date and time you want the report to run from Telstra Mobile Device Management Guide Android Page 27
The Telstra MDM Portal will then schedule your report to run and a list of scheduled reports and status are listed when you click the listed (L) link from the Admin Reports main screen. To delete a recurring report click the delete link. Once a report has been successfully run, the report can be viewed and exported by clicking on the view (V) link from the Admin Reports main screen. FAQs How do I access the Telstra MDM Portal? How do I get a login? How do I get support? What is enrolment? https://mdm.telstra.com The first time you login you will need to contact the Telstra MDM helpdesk at wireless@team.telstra.com and get a password Send an email to wireless@team.telstra.com A process of setting up authorised authentication between Telstra Mobile Device Management Guide Android Page 28
What if an employee leaves the organisation? Will Exchange Server security settings clash with the Telstra MDM settings? Can I get Telstra MDM access on standard data plans? Will Telstra MDM work with other carrier s SIM cards Are my passwords and settings sent to devices protected Will Telstra MDM work while the user is roaming internationally Will Telstra MDM work with other carrier s devices Why doesn t the Telstra MDM portal display a picture of the users device? How do I know when a setting has been successfully sent to the device. Why do I need to group my mobile users under a single billing account? the device and the Telstra MDM portal. Only needs to be done once per device (unless the device is wiped) The device can be wiped remotely and the user will need to restore personal items via the desktop No. The device will use the most secure setting No, each user must have a Telstra Mobile Connect data plan to be eligible No Yes the Telstra MDM server sends all settings to the device via SSL encryption Yes, however international roaming charges apply. It is also only available in countries where Telstra has International Roaming arrangements with carriers. Features and capabilities can differ from network to network & will depend on the devices you are using. Telstra cannot guarantee that services will be available at all times. Android devices from other carriers may work on Telstra s MDM portal if the device is using a Telstra SIM. However, Telstra cannot guarantee that it will. The device has either been swapped recently or is not supported on the portal. Telstra refreshes device information every night. Under the recent actions panel the status of all settings you send are listed. Note that it can take up to 3 minutes for the Telstra MDM Portal to return a failure as this is how long it takes to timeout This allows you to manage all these users with a single login. You would need to manage multiple logins and passwords otherwise. Definitions Telstra MDM Enrolment Configuration Setting Configuration Profile IT administrator Telstra Mobile Device Management Process of setting up authentication between the device and the Telstra MDM portal. If successful, server authentication credentials are stored on the device and the server can send settings to the device silently Sends the device instructions to add or change it s settings. Configuration settings are created using pre-defined configuration profiles where the various values to be used with the configuration setting are defined. Used to create configuration settings. Configuration profiles define the various values a configuration setting can change on the device. A person or persons nominated by the customer to manage their fleet of devices Telstra Mobile Device Management Guide Android Page 29
APN VPN IMEI Access Point Name. A connection address used by your device to connect to the internet or private network. Virtual private network. Allows a device to connect to company resources in a private manner over the internet. Unique 15 digit serial number of a device Android and the Android Logo as well as Android Market and the Android Market Logo are trade marks of Google, Inc. Telstra Mobile Device Management Guide Android Page 30