AirWatch Cntainer Admin Guide Cnfiguring and Deplying AirWatch Cntainer AirWatch v9.2 Have dcumentatin feedback? Submit a Dcumentatin Feedback supprt ticket using the Supprt Wizard n supprt.air-watch.cm. This prduct is prtected by cpyright and intellectual prperty laws in the United States and ther cuntries as well as by internatinal treaties. VMware prducts are cvered by ne r mre patents listed at http://www.vmware.cm/g/patents. VMware is a registered trademark r trademark f VMware, Inc. in the United States and ther jurisdictins. All ther marks and names mentined herein may be trademarks f their respective cmpanies. 1
Revisin Table The fllwing table displays revisins t this guide since the release f AirWatch v9.2. Date Reasn September 2017 Initial uplad. 2
Table f Cntents Chapter 1: Overview 4 Intrductin t the AirWatch Cntainer 5 Security and Encryptin 5 In This Guide 6 Requirements 6 Chapter 2: Initial Cnfiguratins 7 AirWatch Cntainer Enrllment 8 Terms f Use 9 Create Enrllment Terms f Use 10 Cnfigure Prfile Paylads 10 Chapter 3: Applicatin Cnfiguratin 12 Cnfiguring AirWatch Cntainer Settings 13 Chapter 4: Applicatin Deplyment 14 Cnfiguring and Deplying Applicatins 15 Managing frm the Device Dashbard 16 Managing AirWatch Cntainer Devices 16 Appendix: SDK Prfiles, Plicies and Settings Cmpatibility 17 Accessing Other Dcuments 20 3
Chapter 1: Overview Intrductin t the AirWatch Cntainer 5 Security and Encryptin 5 In This Guide 6 Requirements 6 4
Chapter 1: Overview Intrductin t the AirWatch Cntainer AirWatch Cntainer ffers a flexible apprach t Bring Yur Own Device (BYOD) management by pushing a secure wrk space t a persnal device. Businesses can distribute AirWatch applicatins and internal applicatins t the AirWatch Cntainer fr emplyees t use n their mbile devices. Applicatins are visible inside and utside the AirWatch Cntainer, but the enterprise applicatins are secure thrugh a cmmn SDK framewrk and a cntainer passcde. These apps can interact seamlessly using single sign n authenticatin and can cnnect securely t the Internet thrugh an app tunnel VPN. Fr instructins n hw t use the AirWatch Cntainer n a device, see the VMware AirWatch Cntainer User Guide fr ios r the AirWatch Cntainer User Guide fr Andrid. Business Friendly Create a practical and cnvenient slutin fr bth businesses and emplyees. Cst-effective fr emplyers There is n need t buy r distribute crprate devices. Crprate data can be managed and mnitred frm the AirWatch Cnsle. Separatin between wrk and play Persnal data is separated frm crprate data. AirWatch Cntainer cannt track persnal infrmatin and des nt have the ability t wipe any persnal items. Intuitive user experience Add custm branding and custmize menus. Allw users t seamlessly access apps withut entering credentials every time. Easily Managed Take advantage f AirWatch capabilities while allwing emplyees t use their devices freely. Wrks with a hybrid device deplyment Add AirWatch Cntainer functinality t yur current deplyment. Add devices t the desired rganizatin grup t adpt the settings frm that grup. Uses applicatin-level management Prductivity tls are granted t end users thrugh AirWatch apps and internal apps that are wrapped. These can be managed at the app-level rather than the device level. N MDM Required End users d nt have t wrry abut MDM restrictins. Emplyees can feel cmfrtable maintaining a single device fr all their needs. Security and Encryptin Standardize security and data lss preventin strategies acrss mbile devices. Enfrces Passcde/Encryptin nly within AirWatch Cntainer Set cmplex passcdes that d nt intrude n persnal use because encryptin is nly enfrced lcally within the applicatins. ios devices are secured with FIPS 140-2 encryptin and allws fr the use f Tuch ID r EyeVerify. Prevents data leakage utside f the app Use AirWatch security cntrls built int AirWatch apps, third-party integrated apps, wrapped apps, Web Clips and Bkmarks. Incrprates email With AirWatch Inbx r IBM Ntes Traveler n Andrid devices, end users can access email frm their secure AirWatch Cntainer instead f having t maintain tw devices. 5
Chapter 1: Overview In This Guide The fllwing sectins are available in this guide: Initial Cnfiguratins Cmplete the fllwing cnfiguratins t ensure ptimal app perfrmance. Applicatin Cnfiguratin Cnfigure default SDK Settings t define behavirs that apply t all AirWatch apps. Cnfigure app specific System Settings t define unique applicatin behavir. Applicatin Deplyment Recmmend and deply yur app publicly. Requirements Meet the fllwing requirements t facilitate a successful deplyment f AirWatch Cntainer: Supprted Devices and Sftware Andrid v4.4+ (KitKat) ios v6.0+ Cnsle Requirements AirWatch Cnsle v6.5 + Other Requirements AirWatch App Catalg enabled fr ios devices 6
Chapter 2: Initial Cnfiguratins AirWatch Cntainer Enrllment 8 Terms f Use 9 Create Enrllment Terms f Use 10 Cnfigure Prfile Paylads 10 7
Chapter 2: Initial Cnfiguratins AirWatch Cntainer Enrllment Each device in yur rganizatin's deplyment must be enrlled befre it can cmmunicate with AirWatch and access internal cntent and features. Enrll devices using ne f three methds: Basic, Directry, Authenticatin Prxy. Als, AirWatch Cntainer supprts Autdiscvery and Security Assertin Markup Language (SAML) integratin t help simplify enrllment. Enrlling Devices 1. Navigate t Devices > Device Settings > Devices & Users > General > Enrllment > Authenticatin. 2. Select the Authenticatin Mde. Chse either Basic, r Directry, r Authenticatin Prxy methds. Mre Help: T learn abut chsing types f enrllment, see the Enrllment sectin f the VMware AirWatch Mbile Device Management Guide. 3. If desired, chse t use Autdiscvery t assciate devices with an email dmain. T learn mre, see the Autdiscvery sectin in the VMware AirWatch Mbile Device Management guide. Integrating with SAML Chse t set up SAML 2.0 integratin t enable single sign n architecture r federal authenticatin. Begin by navigating t Grups & Settings > All Settings > System > Enterprise Integratin > Directry Services. 8
Chapter 2: Initial Cnfiguratins Nte: Fr infrmatin n SAML enrllment, see the VMware AirWatch SAML Integratin guide. Terms f Use Ensure that all users with managed devices agree t the plicy by defining and enfrce terms f use (TOU). If necessary, users must accept the TOU befre prceeding with enrllment, installing apps, r accessing the AirWatch Cnsle. The AirWatch Cnsle allws yu t custmize fully and assign a unique TOU t each rganizatin grup and child rganizatin grup. The terms f use displays during each device enrllment. Get access the fllwing functins. Set versin numbers. Set platfrms t receive the terms f use. Ntify users by email with the terms f use updates. Create language-specific cpies f the terms f use. Create multiple terms f use agreements and assign them t rganizatin grups based n platfrm r the type f wnership. Meet the liability requirements f specific grups by custmizing terms f use. 9
Chapter 2: Initial Cnfiguratins Create Enrllment Terms f Use Yu can create an agreement abut terms f use (TOU) specific t enrllment purpses. Yu can als limit devices allwed fr enrllment by device platfrm, wnership type, and enrllment type. 1. Ensure that yur current active rganizatin grup is crrect fr the TOU yu are creating. 2. Navigate t Devices > Device Settings > Devices & Users > General > Enrllment and select the Terms f Use tab. 3. Select Add New Enrllment Terms f Use. 4. Enter a unique Name f the new TOU. The Type f TOU is pre-ppulated as Enrllment. 5. Chse Any fr the settings Platfrms, Device Ownership, and Enrllment Type if yur TOU applies t any kind f device fr that categry. 6. If yu prefer t specify a device type, yu can select ne r mre f these categries and define the limitatins specific t yur TOU. If yu select Selected Platfrm ptin, then chse yur desired platfrms frm the list that appears. Yur TOU applies t the device platfrms yu select, excluding all thers. If yu select Selected Ownership Types ptin, then yu must chse yur desired wnership frm the list that appears. Yur TOU applies t the wnership types yu select, excluding all thers. If yu select Selected Enrllment Types ptin, then yu must chse yur desired enrllment frm the list that appears. Yur TOU applies t the types f enrllment yu select, excluding all thers. 7. Send an email t users whenever the TOU is updated by selecting the Ntificatin check bx. a. Optinally, fr lcalizatin purpses, yu may enter a TOU agreement fr each language applicable t yur needs by making a chice in the Select Language drp-dwn. 8. In the text bx prvided, enter yur custmized TOU. The editr prvides a basic text entry tl t create a TOU r paste in an existing TOU. T paste text frm an external surce, right-click the text bx and chse Paste as plain text t prevent any HTML r frmatting errrs. 9. Select Save. Yu can enfrce MDM terms f use acceptance by creating a cmpliance plicy fr MDM Terms f Use Acceptance. This enfrcement des nt apply t devices using AirWatch Cntainer. Cnfigure Prfile Paylads Use Mbile Device Management (MDM) functinality t enhance app perfrmance by cnfiguring a prfile paylads in a tw-step prcess. First, cnfigure general settings. Then, specify the type f restrictin r setting t apply t the device by selecting a paylad frm the list. The available paylads and their cnfigurable settings differ between platfrms. This sectin prvides a descriptin f applicable paylads and brief instructins t help yu get started. 1. Navigate t Devices > Prfiles > List View > Add and select Add Prfile. 2. Select the apprpriate platfrm fr the prfile that yu want t deply. 10
Chapter 2: Initial Cnfiguratins 3. Cnfigure General settings t determine hw the prfile deplys, wh receives it, and ther verall settings. 4. Select and cnfigure a Paylad. Paylad Descriptin ios Andrid General Create a custmized prfile t deply t yur devices. Wi-Fi EAS via AirWatch Inbx Allw devices t cnnect t crprate netwrks, including hidden/encrypted/passwrd prtected netwrks. Create an email prfile fr AirWatch Inbx. EAS via IBM Ntes Create an email prfile fr IBM Ntes. Webclips Publish a prfile f web clips t yur devices. Bkmarks Create a web link yur users can quickly access frm yur devices. 5. Fr step-by-step instructins n cnfiguring a specific Paylad fr a particular platfrm, please refer t the applicable Platfrm Guide, available n AirWatch Resurces. Select Save & Publish. 11
Chapter 3: Applicatin Cnfiguratin Cnfiguring AirWatch Cntainer Settings 13 12
Chapter 3: Applicatin Cnfiguratin Cnfiguring AirWatch Cntainer Settings Cnfigure default SDK Settings t define behavirs that apply t all AirWatch apps. Cnfigure app specific System Settings t define unique applicatin behavir. 1. Navigate t Grups and Settings > All Settings > Apps > Cntainer. 2. Select whether t Inherit r Override the displayed settings: Inherit Use the settings f the current rganizatin grup's parent OG. Override Edit and mdify the current OG's settings directly. 3. Cnfigure the relevant settings: Setting Apple Andrid Applicatin Type Descriptin Ntificatin Select t set ios device system preferences. Select t set Andrid device system preferences. Leave the applicatin type as System r select Internal t set system preferences. System Dwnlad this app type frm an app stre. Internal Uplad this app type t the AirWatch Cnsle. Applicatin Name Bundle ID Prvide an app name fr Internal applicatins. AirWatch recmmends that yu navigate t Apps & Bks > Internal List Viewand scan the list fr an app name that matches the app name yu entered. This list view nly displays internal applicatins were upladed with a matching APNs certificate. Review the aut-ppulated field. This Bundle ID matches the applicatin bundle ID that was upladed internally r selected frm the drp-dwn menu. 4. Save. 13
Chapter 4: Applicatin Deplyment Cnfiguring and Deplying Applicatins 15 Managing frm the Device Dashbard 16 Managing AirWatch Cntainer Devices 16 14
Chapter 4: Applicatin Deplyment Cnfiguring and Deplying Applicatins Yu can distribute applicatins t end users autmatically nce an app is activated in the AirWatch Cnsle r ndemand thrugh an App Catalg. Fr mre n managing apps with the App Catalg, please see the VMware AirWatch Mbile Applicatin Management Guide. Refer t the Appendix fr an extensive list f capabilities by platfrm, SDK and App Wrapping. The fllwing infrmatin applies t different types f apps yu can publish: AirWatch applicatins These apps include AirWatch Inbx, VMware Cntent Lcker and VMware Brwser. Internal applicatins Internal apps can be wrapped apps r apps that yu have integrated with the AirWatch SDK. Apps that are nt wrapped must have a Default Scheme built int the app, which is extracted and saved when the app is upladed t the AirWatch Cnsle. Andrid end users are prmpted t install all assigned internal apps autmatically after enrllment. Fr ios devices, yu must enable the App Catalg fr applicable rganizatin grups s internal apps can be launched directly frm the AirWatch Cntainer. Public/Purchased applicatins Public apps are nly available as n-demand, recmmended apps. They are nt cnsidered cntainerized and d nt supprt SSO, branding, cnsle cmmands, r updated badges. These apps can be installed frm the AirWatch Cntainer springbard if a Default Scheme is included in the applicatin infrmatin in the AirWatch Cnsle. If the Default Scheme is nt included in the applicatin infrmatin, the app will be available in the App Catalg. T review an applicatin's Default Scheme, navigate t Apps & Bks > List View. Frm the Actins menu, select Edit t see the applicatin infrmatin. If n default scheme ppulates in the applicatin infrmatin, then cntact the apprpriate vendr fr that infrmatin. T imprve app functinality n Andrid devices, AirWatch recmmends that yu push AirWatch Apps t enrlled devices as managed apps frm the Cnsle, even if the apps have already been dwnladed. Fr AirWatch Inbx n ios devices, make sure the crrect Default Scheme (awemailclient) has been entered in the AirWatch Cnsle. Nte: The AirWatch Cntainer fr ios des nt supprt the deplyment f ios applicatins purchased thrugh Apple's Vlume Purchase Prgram (VPP). Web Clips and Bkmarks Web Clips fr ios and Bkmarks fr Andrid are hyperlinks t web addresses and appear as icns n the device springbard. VMware Brwser is required t pen these links. If VMware Brwser has nt been dwnladed t the device, then the user will be prmpted t dwnlad it t pen these links. Ensure that Web Clips r Bkmarks have the Shw in the App Catalg checkbx selected in the apprpriate paylad in AirWatch Cnsle. 15
Chapter 4: Applicatin Deplyment Managing frm the Device Dashbard Once AirWatch Cntainer is enabled and users begin t enrll their persnal devices, the AirWatch Cnsle detects thse devices and displays the infrmatin n the Device Dashbard. Search fr specific devices in yur fleet that are AirWatch Cntainer-nly and perfrm AirWatch Cntainer-specific actins n thse devices. Imprtant: When users unenrll frm AirWatch Cntainer, they must unenrll the app befre deleting it. If AirWatch Cntainer is simply deleted, the users' devices are still tracked in the AirWatch Cnsle. Managing AirWatch Cntainer Devices Lcate a single device frm either the Device Dashbard r by searching fr the device using the Glbal Search feature. Use the Filters t find all AirWatch Cntainer-nly devices if desired. The List View screen prvides device infrmatin. Frm here, select multiple devices r select a specific device t perfrm remte actins. Applicable remte actins are listed belw: Lck SSO End any current app sessins and prmpt user t enter their passcde again. If a user is n lnger with the rganizatin r if their device is lst r stlen, take immediate actin and lck the SSO sessin. This frces the user t enter their credentials again. Clear SSO Passcde Clear the current passcde used t sign int apps and prmpt the user t enter a new ne. Frgetting a passcde is the mst cmmn issue users face, but it is als the easiest t rectify. Use this actin t reset a user's passcde and create a new ne. Enterprise Wipe Unenrll the user frm AirWatch Cntainer and remve any applicatin data frm internal apps using the AirWatch SDK. Similar t the Device Lck feature, Enterprise Wipe can be used if a device is lst r stlen. Mre than simply ending an SSO sessin, an enterprise wipe remves all rganizatin-related cntent and features. When a device is unenrlled frm AirWatch Cntainer, all internal apps and public apps remain n the device, but the data frm the internal applicatins is deleted if theapps use the AirWatch SDK. Push Email Prfile Send a newly cnfigured r updated email prfile t the device fr access within AirWatch Cntainer. Email access is ften a user's primary need when it cmes t access n-the-g. Use the Push Email Prfile actin t send dwn new email credentials r updated credentials t ensure access is never lst. Push Ntificatins Send messages directly frm the AirWatch Cnsle t AirWatch Cntainer. Send imprtant ntificatins t end users' devices. 16
Appendix: SDK Prfiles, Plicies and Settings Cmpatibility Appendix: SDK Prfiles, Plicies and Settings Cmpatibility AirWatch Cntainer leverages several existing AirWatch apps and features, each f which hsts a variety f available settings and plicies (Grups & Settings > All Settings > Apps > Settings and Plicies). These settings als extend t wrapped applicatins and applicatins built with the AirWatch SDK. The matrix belw utlines all available settings and ptins and hw each platfrm, feature and applicatin is affected. Settings and Plicies Supprted Optins fr AirWatch Applicatins UI Label ios Cntainer Andrid Passcde: Authenticatin Timeut Passcde: Maximum Number Of Failed Attempts Passcde: Passcde Mde Numeric Passcde: Passcde Mde Alphanumeric Passcde: Allw Simple Value Passcde: Minimum Passcde Length Passcde: Minimum Number Cmplex Characters Passcde: Maximum Passcde Age Passcde: Passcde Histry Bimetric Mde: Fingerprint x Username and Passwrd: Authenticatin Timeut Username and Passwrd: Maximum Number f Failed Attempts Single Sign On: Enable Integrated Authenticatin: Enable Kerbers x x Integrated Authenticatin: Use Enrllment Credentials Integrated Authenticatin: Use Certificate Offline Access: Enable 17
Appendix: SDK Prfiles, Plicies and Settings Cmpatibility UI Label Cntainer ios Andrid Cmprmised Prtectin: Enable App Tunnel: Mde x App Tunnel: URLs (Dmains) x Cntent Filtering: Enable x x Gefencing: Area x x DLP: Cpy and Paste x x DLP:Printing x x DLP: Camera x x DLP: Cmpsing Email x x DLP: Data Backup x x DLP: Lcatin Services x x DLP: Bluetth x x DLP: Screensht x x DLP: Watermark x x DLP: Limit Dcuments t Open Only in Apprved Apps x x DLP: Allwed Applicatins List x x NAC: Cellular Cnnectin x x NAC: Wi-Fi Cnnectin x x NAC: Allwed SSIDs x x Branding: Tlbar Clr Branding: Tlbar Text Clr Branding: Primary Clr x x Branding: Primary Text Clr Branding: Secndary Clr x Branding: Secndary Text Clr x x Branding: Organizatin Name x x 18
Appendix: SDK Prfiles, Plicies and Settings Cmpatibility UI Label Cntainer ios Andrid Branding: Backgrund Image iphne and iphne Retina x Branding: Backgrund Image iphne 5 (Retina) x Branding: Backgrund Image ipad and ipad (Retina) x Branding: Backgrund Small, Medium, Large, and XLarge x Branding: Cmpany Lg Phne, Phne High Res, Tablet, Tablet High Res x Lgging: Lgging Level x x Lgging: Send Lgs Over Wi-Fi x x Analytics: Enable x x Custm Settings: XML entries x x * This ptin is supprted but is nt cnfigured using Settings and Plicies. ** This ptin requires Andrid Ice Cream Sandwich and KitKat. 19
Accessing Other Dcuments Accessing Other Dcuments While reading this dcumentatin yu may encunter references t dcuments that are nt included here. The quickest and easiest way t find a particular dcument is t navigate t https://my.airwatch.cm/help/9.2/en/cntent/release_ntes/dc_list_pdfs.htm and search fr the dcument yu need. Each release-specific dcument has a link t its PDF cpy n AirWatch Resurces. Alternatively, yu can navigate t AirWatch Resurces n myairwatch (resurces.air-watch.cm) and search. When searching fr dcumentatin n Resurces, be sure t select yur AirWatch versin. Yu can use the filters t srt by PDF file type and AirWatch v9.2. 20