Sophos Mobile Control Startup Guide

Sophos Mobile Control
Startup guide
Product version: 4
Document date: May 2014
Contents
1 About this guide........................................................................................................................................3
2 What are the key steps?.............................................................................................................................5
3 Log in as a super administrator................................................................................................................6
4 Activate Sophos Mobile Security and Sophos Mobile Encryption licenses...........................................7
5 Check your licenses...................................................................................................................................8
6 Create a new customer..............................................................................................................................9
7 Switch to the new customer....................................................................................................................11
8 Create an administrator for the new customer.....................................................................................12
9 Configure settings...................................................................................................................................13
10 Create and upload an APNs certificate ...............................................................................................17
11 Configure compliance rules..................................................................................................................19
12 Create device groups.............................................................................................................................21
13 Configure iOS devices...........................................................................................................................22
14 Configure Android devices...................................................................................................................25
15 Update Self Service Portal settings.......................................................................................................28
16 Create a Self Service Portal user with internal user management......................................................29
17 Test provisioning through the Self Service Portal...............................................................................30
18 Upload your user list to Sophos Mobile Control with internal user management...........................31
19 Technical support..................................................................................................................................32
20 Legal notices..........................................................................................................................................33
2
Startup guide
1 About this guide
This guide tells you how to initially configure Sophos Mobile Control step by step to manage your
mobile devices.
Further information is available in the Sophos Mobile Control administrator guide.
This guide focuses on iOS and Android as the most common mobile platforms. The settings apply
to other operating systems in a similar way.
1.1 Terminology
In this guide, the following terms are used:
Term
Explanation
Device
The mobile device to be managed (for example smartphone or
tablet).
Sophos Mobile Control client
The Sophos Mobile Control client component that is installed on
the device.
End user
The end user of the device.
Web console
The web interface of the server that is used to manage devices.
Customer
The tenant that manages devices.
Provisioning
The process of equipping devices with the Sophos Mobile Control
client.
Note: This process is also called enrollment.
Task bundle
A package you can create in the web console to bundle several
tasks for mobile devices in one transaction. You can bundle all
tasks necessary to have a device fully registered and running.
Self Service Portal (SSP)
The Sophos Mobile Control web interface that allows end users
to register their own devices and carry out other tasks without
having to contact the helpdesk.
Sophos Mobile Security
A security app for Android phones and tablets that can be
managed from Sophos Mobile Control. The Sophos Mobile
Security management functionality is an optional Sophos Mobile
Control module. In order to manage the Sophos Mobile Security
app from Sophos Mobile Control, an SMC Advanced license
needs to be available and activated in the Sophos Mobile Control
web console.
3
Sophos Mobile Control
4
Term
Explanation
SMSec
Abbreviation for Sophos Mobile Security used in the Sophos
Mobile Control web console user interface.
Sophos Mobile Encryption
An encryption app for iOS phones and tablets that can be managed
from Sophos Mobile Control. The Sophos Mobile Encryption
management functionality is an optional Sophos Mobile Control
module. In order to manage the Sophos Mobile Encryption app
from Sophos Mobile Control, an SMC Advanced license needs
to be available and activated in the Sophos Mobile Control web
console.
Startup guide
2 What are the key steps?
You carry out these steps:
1. Log in to the Sophos Mobile Control web console as a super administrator.
2. Activate your SMC Advanced license for managing Sophos Mobile Security and Sophos Mobile
Encryption.
Note: Sophos Mobile Security and Sophos Mobile Encryption management is an optional
Sophos Mobile Control module. If you did not purchase an SMC Advanced license, this step
is not required.
3. Check your licenses.
4. Create a new customer for managing your devices.
5. Switch to the new customer.
6. Create an administrator for the new customer and log in at the web console with it.
7. Configure personal settings, settings for the use of the Self Service Portal and password policies.
8. Create and upload Apple Push Notification service certificate.
9. Configure technical contact.
10. Configure compliance rules.
11. Create device groups.
12. Configure devices.
13. Update Self Service Portal settings, add a Self Service Portal user and test Self Service Portal
provisioning.
14. Upload your user list to Sophos Mobile Control.
5
Sophos Mobile Control
3 Log in as a super administrator
Before you can start to configure Sophos Mobile Control, you have to log in to the Sophos Mobile
Control web console as a super administrator at the super administrator customer. The super
administrator customer offers a specific view of the Sophos Mobile Control web console that is
customized for super administrator tasks.
Note: For a detailed description of how to use the Sophos Mobile Control web console as a super
administrator, refer to the Sophos Mobile Control super administrator guide.
Prerequisites:
■
A super administrator customer has been created during Sophos Mobile Control setup. For
further information, see the Sophos Mobile Control installation guide.
■
A super administrator account has been created during Sophos Mobile Control setup and you
have the credentials (customer, user name and password) for the account.
1. Enter the Sophos Mobile Control web console URL in your preferred web browser.
The Sophos Mobile Control login page is displayed.
2. In the Customer field, enter the super administrator customer.
3. In the User and Password fields, enter your super administrator user name and password.
4. Click Login.
You are logged in to the super administrator customer. The super administrator customer
Dashboard is displayed. In the Customer field, the super administrator customer is marked by
an asterisk and shown at the top of the dropdown list.
6
Startup guide
4 Activate Sophos Mobile Security and Sophos Mobile
Encryption licenses
Note: For Sophos Mobile Security and Sophos Mobile Encryption management you need an SMC
Advanced license. If you did not purchase it, this step is not required.
■
Sophos Mobile Security is a security app for Android phones and tablets that protects devices
from malicious apps and assists end users in detecting apps permissions that could be a security
risk.
■
Sophos Mobile Encryption is an app for iOS phones and tablets that allows users to access
encrypted files stored in the cloud. Files can be decrypted and viewed in a seamless way.
Encrypted files can be handed over by other apps and uploaded to one of the supported cloud
storage providers. Alternatively the documents can be stored locally within the app.
You can view Sophos SafeGuard encrypted files stored in cloud storage of these providers and
in iTunes.
With Sophos Mobile Encryption you can read files encrypted by SafeGuard Cloud Storage or
SafeGuard Data Exchange. Both are modules of SafeGuard Enterprise or one of its different
editions. They allow to encrypt files using a local key. These local keys are derived from a
passphrase that is entered by a user. You can only decrypt a file when you know the passphrase
that was used to encrypt the file.
For details on the SafeGuard Cloud Storage and SafeGuard Data Exchange modules please
refer to the SafeGuard Enterprise 6.1 documentation on www.sophos.com.
In order to manage the Sophos Mobile Security and the Sophos Mobile Encryption apps from
Sophos Mobile Control, a license needs to be available and activated in the Sophos Mobile Control
web console.
1. In the web console menu bar, go to Settings and click System setup.
The System setup view is displayed.
2. In the License tab, enter the SMC Advanced license key you have received from Sophos in the
License key field and click Activate.
Now you can manage Sophos Mobile Security and Sophos Mobile Encryption from Sophos Mobile
Control. The Active license key field shows the activated license key. The Number of licenses
field shows the number of available end users. The Valid until field shows the license expiry date.
When you create a new customer, you can assign the number of end users you want to manage
for this customer. You can enable management functionality for Sophos Mobile Security and
Sophos Mobile Encryption for each customer separately.
7
Sophos Mobile Control
5 Check your licenses
Note: For Sophos Mobile Control a user-based license scheme applies. All devices assigned to one
user count as one license. Devices without any user assignment are counted as one user.
In the web console menu bar, click About and check the license information shown in the About
view:
■
Number of user licenses:
Shows the number of end users that can be managed from the web console.
Licenses used:
Shows the number of licenses in use.
Licenses valid until:
Shows the license expiry date.
If you have any questions or concerns regarding the license information shown, contact your
Sophos Sales representative.
8
Startup guide
6 Create a new customer
To be able to manage devices in the Sophos Mobile Control web console, you have to create a
customer (tenant for device management).
1. In the super administrator customer Dashboard under Customer management, click the
Create customer button.
The Edit customer view is displayed.
2. Enter a Name and a Description for the new customer.
3. In the Maximum number of licenses field, define how many end users can be managed for
this customer.
4. Select the Advanced licenses field to activate management capability for the Sophos Mobile
Security and Sophos Mobile Encryption apps for this customer.
Note: For Sophos Mobile Security and Sophos Mobile Encryption management you need an
SMC Advanced license. If you did not purchase it, this step is not required.
5. In the Valid until field, specify the expiry date for the customer. If you do not enter an expiry
date here, the Valid until field is set to unlimited.
6. Under Activated platforms, select the platforms for which devices may be registered for the
customer.
7. Under Located devices, select Localization activated to enable users to locate their devices in
case of loss or theft. Select Localization for Administrator to enable administrators to locate
devices.
8. Under Clone settings - Settings and packages, you can select that all settings and packages
should be cloned for this customer. For further information, see the Sophos Mobile Control
super administrator guide.
9. Under User directory, select the data source for the Self Service Portal (SSP) users to be managed
by Sophos Mobile Control.
■
None. No SSP and user-specific profiles available.
Select Internal directory to use internal user management for users of the Sophos Mobile
Control Self Service Portal. In this guide, internal Self Service Portal user management is
described as an example.
■ Select External directory to use external user management for users of the Sophos Mobile
Control Self Service Portal. Click Configure external directory to specify the server details.
■
For further information, see the Sophos Mobile Control super administrator guide.
Before you select one of the User directory options, you need to decide which type of user
management you want to use.
10. Click the Save button.
9
Sophos Mobile Control
The new customer is created. In the next step, you switch to the new customer to continue.
10
Startup guide
7 Switch to the new customer
Switch to the new customer to carry out further required steps:
1. In the super administrator customer Dashboard, go to the Customer field.
2. Select the customer you have created from the dropdown list.
The Sophos Mobile Control web console changes from the specific super administrator view to
the regular view. You can now carry out further required steps for initial configuration.
11
Sophos Mobile Control
8 Create an administrator for the new customer
1. In the web console menu bar, click Administrators.
The Show administrators view is displayed.
2. Click the Create administrator button.
The Edit administrator view is displayed.
3.
4.
5.
6.
7.
8.
Enter a Login name for the new user.
In the Role field, select the user role Administrator.
Enter the Last name and the First name of the new user.
Enter the Email address of the new user.
Enter a onetime Password for the first login at the web console and confirm it.
Click the Save button.
The new administrator is created. To carry on with the next steps, you need to log out from the
web console and log in with the new credentials (user, customer and one-time password) again.
You will be prompted to change the password at first login.
12
Startup guide
9 Configure settings
The following settings need to be configured:
■
The platforms you want to use
■
Password policies
■
Settings for the use of the Self Service Portal by end users
You configure these settings by using the Settings function.
9.1 Configure platforms
To use the Sophos Mobile Control web console more efficiently, you can customize the user
interface to show only the platforms you work with.
Note: By configuring the platforms you only change the view of the currently logged on user. You
cannot deactivate any functions here.
Prerequisites: You have logged in at the web console with the administrator you have created for
the new customer.
1. In the web console, go to Settings and click General.
The General settings view is displayed.
2. In the Personal tab under Activated platforms, select the platforms you want to use with
Sophos Mobile Control:
■
■
■
■
■
Android
BlackBerry
iOS
Windows Phone 8
Windows Mobile
Note: The list of available platforms depends on your platform settings from the super
administrator configuration. For further information, see the Sophos Mobile Control super
administrator guide.
Note: This guide focuses on iOS and Android as the most common mobile platforms. For
further information on all available platforms, see the Sophos Mobile Control administrator
guide.
The menu is customized according to your settings. Unnecessary items are hidden.
3. Click the Save button.
In the next step, you configure password policies under General Settings.
13
Sophos Mobile Control
9.2 Configure password policies
To enforce password security, configure password policies for users of the Sophos Mobile Control
web console and the Self Service Portal.
Note: If you use internal user management, the password policies apply to web console users and
Self Service Portal users. If you use external user management, these password policies only apply
to web console users and not to Self Service Portal users. In this guide, internal Self Service Portal
user management is described as an example. For further information on external user management,
see the Sophos Mobile Control super administrator guide.
1. In the General Settings view, go to the Password Policies tab.
2. Under Password policies for SMC web console user and SSP user - Rules, define the required
minimum values for the password.
3. Under Password policies for SMC web console user and SSP user - Settings, define the
following settings:
■
Password change interval (days): You can enter a value from 0 (no password change
required) to 730 days.
■ Number of previous passwords which must not be reused: You can select a value between
1 and 10.
■ Maximum number of failed login attempts: You can select a value between 2 and 10.
4. Under Reset password settings, configure the emails to be sent to users after they have requested
a password reset.
a) In the Originator field, enter the email sender address.
b) Under Email with reset link, the email subject and content is predefined. You can edit this
according to your requirements. For further information, see the Sophos Mobile Control
administrator guide.
Note: Do not remove the placeholder _RESET_TOKEN_LINK_ from the email content.
c) Under Email with new password, the email subject and content is predefined. You can edit
this according to your requirements. For further information, see the Sophos Mobile Control
administrator guide.
Note: Do not remove the placeholder _NEW_PASSWORD_ from the email content.
5. Click the Save button.
9.3 Configure Self Service Portal settings
1. In the web console menu bar, go to Settings and click Self Service Portal.
The Self Service Portal view is displayed.
14
Startup guide
2. In the Configuration tab, configure the Self Service Portal settings as required. For further
information on all available settings, see the Sophos Mobile Control administrator guide. If you
are not sure which settings to apply at this stage, you can also leave all options at their default
settings.
3. Go to the Agreement tab and configure the following:
a) Under Agreement text, you can configure a mobile policy, disclaimer or agreement text
that is displayed as a first step when end users register their devices. Users have to confirm
that they have read this text to be able to continue.
Simple HTML formatting tags are supported for the text. The text will be displayed in the
relevant browser accordingly.
b) Under Post install text, you can configure a text to be displayed after the automatic
installation steps in the Self Service Portal to give the user guidance for the next required
steps, for example configuring the server in the iOS app or configuring the Android mail
client.
Simple HTML formatting tags are supported for the text. The text will be displayed in the
relevant browser accordingly.
4. Go to the Welcome email tab. In this tab, you configure the welcome email to be sent to Self
Service Portal users to inform them about their logon credentials. This email is required to
enable users to log in to the Self Service Portal.
Note: This tab is only available, if internal user management is enabled for the customer. The
email is only sent to Self Service Portal users managed by internal user management. In this
guide, internal Self Service Portal user management is described as an example. For further
information, see Create a new customer (section 6) and the Sophos Mobile Control administrator
guide.
5. In the Originator field, enter the email sender address. In the Subject field an email subject is
predefined. You can edit this according to your requirements.
6. In the text field, the email content is predefined. You can edit this according to your
requirements. For further information, see the Sophos Mobile Control administrator guide.
Note: Do not remove the placeholders _CUSTOMERNAME_, _LOGINNAME_ and
_RESET_TOKEN_LINK_ from the email content.
7. Click the Save button.
9.4 Configure technical contact
To support users in case of questions or problems, you can configure technical contact information.
1. In the web console menu bar, go to Settings and click General.
The General settings view is displayed.
15
Sophos Mobile Control
2. Go to the Technical contact tab and enter the required information for the technical contact.
Under Additional information, you can enter any additional information for supporting users
in case of questions or problems.
3. Click the Save button.
16
Startup guide
10 Create and upload an APNs certificate
To use the built-in Mobile Device Management (MDM) protocol of devices running Apple iOS
4 (or higher), Sophos Mobile Control must use Apple’s Push Notification service (APNs) to trigger
iOS devices.
Prerequisites:
■
You have configured the iOS platform for this customer, see Configure platforms (section 9.1).
■
To create an APNs certificate, you use the APNs Certificate Wizard. The wizard is included in
your product delivery. It is also available for download in the web console. In the web console
menu bar, go to Settings, click System Setup and go to the iOS settings tab. To download the
wizard, click the download link available under APNS.
1. Start the APNs Certificate Wizard by double-clicking the file Sophos Mobile Control APNs
Certificate Wizard.exe.
The APNs Certificate Wizard welcome dialog is displayed.
2. Click Next.
The License Agreement dialog is displayed.
3. Click I agree.
The Create Certificate Signing Request dialog is displayed.
4. Enter your Company Name and your Country code (for example US or UK). These fields are
mandatory.
Note: Below these fields, the dialog shows where all data of the process is stored. Make a note
of this information.
5. Click Next.
The Upload PLIST dialog is displayed.
6. In this step, you upload the Certificate Signing Request to Apple. Follow the instructions in
the dialog:
a) Open the Apple site indicated in the dialog in your browser.
Note: Do not use Internet Explorer to open the Apple site as this may cause problems. Use
Firefox, Chrome or Safari instead. We recommend that you use the latest browser versions.
b) Log in with your Apple ID. If you do not have an Apple ID, create one.
17
Sophos Mobile Control
We recommend you create a Corporate Apple ID not a personal.
c) In the first dialog of the Apple Push Certificates Portal, click Create a Certificate.
d) Accept the terms and conditions.
e) Browse for your Certificate Signing Request (*.plist) and click Upload.
You find the file name and the path in the Upload PLIST dialog of the Sophos APNs
Certificate Wizard.
Your Apple push certificate is created.
f) Download and save the certificate file (*.pem) in the directory indicated in the Upload
PLIST dialog.
7. Click Next.
The Create P12 dialog is displayed.
8. In this step, you create your APNs certificate for Sophos Mobile Control. Enter a password for
the APNs certificate. You need this password later, when you upload the .P12 certificate file to
Sophos Mobile Control.
Note: The Create P12 dialog shows the directory the certificate will be stored in. Make a note
of this information. We recommend that you create a backup of the folder that contains the
certificate files.
9. Click Next.
The Sophos Mobile Control APNs Certificate Wizard finished dialog is displayed.
10. Click Finish.
11. In the web console menu bar, go to Settings, click System Setup and go to the iOS settings
tab.
12. Browse for the .p12 certificate file you have created, enter your password. Optionally you can
enter your Apple ID for future reference. Click Upload.
After the file has been uploaded successfully, a confirmation message is displayed in the header
and the Topic, Type and Expiry date information of your APNs certificate is shown.
13. Click Save.
18
Startup guide
11 Configure compliance rules
In the web console, you can:
■
Configure compliance rules for all available device types (platforms).
■
Define actions to be taken if devices no longer comply with the rules specified.
■
Define multiple compliance rules and assign them to device groups. In device groups, you can
select different compliance rules for company or employee devices. This allows you to apply
different levels of security for different device groups.
For further information, see the Sophos Mobile Control administrator guide.
1. In the web console menu bar, click Compliance rules.
The Compliance rules list view is displayed.
2. Click the Create compliance rules button.
The Compliance rules view with tabs for all available device platforms is shown.
3. Enter a Name and a Description for the new compliance set.
4. Go to the required device platform tab.
5. Make sure that the Enable platform field is selected.
Note: If this field is not selected, devices of the relevant platform cannot be checked for
compliance.
6. Under Rule, configure the compliance requirements for the selected device type. For a
description of all settings available for each device type, see the Sophos Mobile Control
administrator guide.
7. To disallow email access if particular rules are not met, select the checkbox Deny ActiveSync
next to the corresponding rules.
Note: This setting only becomes effective, if you use the Sophos Mobile Control EAS Proxy
server. For further information, see the Sophos Mobile Control installation guide.
8. To disallow network access if particular rules are not met, select the checkbox Deny network
access next to the corresponding rules.
Note: This setting is only available, if the network access functionality has been activated. For
further information, see the Sophos Mobile Control super administrator guide.
9. To notify administrators if particular rules are not met, select the checkbox Notify admin next
to the corresponding rules.
19
Sophos Mobile Control
10. Under Transfer task bundle, you can select task bundles to be transferred for the required
Rule settings. Leave the fields unchanged at this stage. When used improperly, task bundles
may misconfigure or even wipe devices. To assign the proper task bundles to compliance rules,
a deeper knowledge of the system is required.
11. After you have defined all settings in all required device type tabs, click the Save button.
The new compliance rule is displayed in the Compliance rules list view.
12. If you have specified that administrators receive email notifications when devices are not
compliant, specify the relevant recipients under Compliance mail recipients and a notification
schedule under Compliance mail timetable. Use semicolons (;) to separate several
administrators in the Compliance mail recipients field. Click the Save button.
To add further compliance rules, repeat the described steps. You can assign the created compliance
rules when you create a device group in the next step. If you plan to manage corporate and private
devices, we recommend that you define separate rules for at least these two device types.
20
Startup guide
12 Create device groups
We recommend that you put devices into groups. This helps you to manage them efficiently as
you can carry out tasks on a group rather than on individual devices.
Note: We recommend that you only group devices with the same operating system. This makes
it easier to use groups for installations and other operating system specific tasks.
To create a new device group:
1. In the web console menu bar, go to Inventory and click Device groups.
The Device groups view is displayed.
2. Click the Create device group button.
The Edit device group view is displayed.
3. Enter a Name and a Description for the new device group.
4. Under Compliance rules in the fields Company devices and Employee devices, select the
compliance rules you want to apply.
5. Click the Save button.
The new device group is created and shown in the Device groups view. You can now add devices
to the new group.
Note: If you delete a device group, the group's members are moved to another group that needs
to be specified. If there is no other group left to move the devices to, the group cannot be deleted.
Before a group is deleted a warning message is displayed.
21
Sophos Mobile Control
13 Configure iOS devices
13.1 Create profiles for Apple iOS devices
In this step, you create a profile for initial configuration of iOS devices. A recommended initial
configuration should include your passcode policies and the restrictions you want to apply to
devices. We recommend to include Exchange, VPN or WiFi settings in separate profiles.
Note: Sophos Mobile Control offers two methods for creating profiles for iOS devices:
■
You can create iOS profiles directly in the web console.
■
You can import profiles created with the Apple iPhone Configuration Utility into the web
console.
This section describes how to create profiles directly in the web console. For further information
on how to import profiles created with the Apple iPhone Configuration Utility, see the Sophos
Mobile Control administrator guide.
1. In the web console menu bar, go to Profiles and click Apple iOS.
The Profiles view is displayed.
2. Click the Create profile button.
The Edit profile view is displayed.
3. Enter a Name and a Version for the new profile.
We recommend that you use the name "iOS SSP profile" for profiles that are applied during
the enrollment process through the Self Service Portal.
4. In the ID field, enter a unique ID for the profile, for example "com.mycompany.smc.baseprofile".
Note: Special characters like ä or ö or spaces are not supported in iOS profile IDs.
5. In the Organization field, enter the name of the organization for the profile, for example a
company name.
6. In the Description field, enter a description for the profile, for example "base profile".
7. In the User can remove profile field, select whether users may remove the profile from their
device:
■
Always
■ With authentication
■ Never
Note: We recommend that you select the option Never.
22
Startup guide
8. In the Automatically remove on field, you can enter a date for the automatic removal of the
profile from end user devices.
Note: We recommend that you do not configure a date for the automatic removal of the
profile.
Note: This function is supported as of iOS 6.
9. Under Operating systems, select the operating system the profile should apply to. Select all
iOS versions for this profile.
Note: The operating system list is created according to devices registered with the system. At
this stage, it may show only iOS. The setting iOS covers all iOS versions.
10. Click the Add button to add configurations with iPhone configuration settings to the profile.
The Available configurations view is displayed.
11. Select Password policies and click Next.
The Password policies view is displayed.
12. Specify the password policies settings for this profile. For a detailed description of all settings
available, refer to the Sophos Mobile Control administrator guide.
13. Click the Apply button.
The Password policies configuration is displayed in the Edit profile view under Configurations.
14. To add a Restrictions settings profile, click the Add button again.
Note: Supported settings may depend on the iOS version in use on individual devices.
Depending on the end user device, some settings may not have any effect. For further
information, see the feature matrix in the Sophos Mobile Control technical guide.
15. In the Available configurations view, select Restrictions and click Next.
The Restrictions view is displayed.
16. Specify the restrictions settings for this profile. For a detailed description of all settings available,
see the Sophos Mobile Control administrator guide.
17. Click the Apply button.
The Restrictions configuration is displayed in the Edit profile view under Configurations.
18. Click the Save button.
The profile is available for transfer. It is displayed in the Profiles view. To configure profiles with
Exchange, VPN and WiFi settings, repeat the steps described.
23
Sophos Mobile Control
13.2 Create task bundles for iOS devices
1. In the web console menu bar, click Task bundles.
The Task bundles view is displayed.
2. Click the Create task bundle button.
The Edit task bundle view is displayed.
3. Enter a Name and a Version for the new task bundle.
We recommend that you use the name "iOS SSP task bundle" for task bundles that are applied
during the enrollment process through the Self Service Portal.
4. Under Operating systems, select the operating systems the task bundle applies to. Select all
iOS versions for this task bundle.
Note: The operating system list is created according to devices registered with the system. At
this stage, it may show only iOS. The setting iOS covers all iOS versions.
5. Under Tasks, click the Create task button.
6. As a first task, select the task type Bootstrap the iOS MDM client and click Next. Give the task
a meaningful name, for example "MDM bootstrap", and click Next.
Note: The name you define here is shown in Self Service Portal while tasks are processed.
7. Add a second task of the type Install an iOS profile and click Next. Select the profile you have
created ("iOS SSP profile", if you have used the suggested name) and click Next. Give the task
a meaningful name, for example "Install provisioning profile", and click Next. If you have
configured profiles with Exchange, VPN and WiFi settings, repeat this step for each profile.
8. Add a third task of the type Install a software package. Select the Sophos Mobile Control Client
package and click Next. Give the task a meaningful name, for example "Install SMC app", and
click Next.
9. Repeat this procedure to add further tasks. You can set the order for installation for selected
tasks by using the sort arrows on the right-hand side of the Tasks list.
10. After you have added all required tasks to the task bundle, click the Save button in the Edit
task bundle view.
The task bundle is available for transfer. It is displayed in the Task bundles view.
24
Startup guide
14 Configure Android devices
14.1 Create profiles for Android devices
In this step, you create a profile for initial configuration of Android devices. A recommended
initial configuration should include your password policies and the restrictions you want to apply
to devices. We recommend that you include Exchange, VPN or WiFi settings (if your Android
devices support these settings) and upload root and client certificates in separate profiles.
1. In the web console, go to Profiles and click Android.
The Profiles view is displayed.
2. Click the Create profile button.
The Edit profile view is displayed.
3. Enter a Name and a Version for the new profile.
We recommend that you use the name "Android SSP profile" for profiles that are applied
during the enrollment process through the Self Service Portal.
4. In the ID field, enter a unique ID for the profile, for example "com.mycompany.smc.baseprofile".
5. In the Description field, enter a description for the profile, for example "base profile".
6. Under Operating systems, select the operating system the profile should apply to. Select all
Android versions for this profile.
Note: The operating system list is created according to devices registered with the system. At
this stage, it may show only Android. The setting Android covers all Android versions.
7. Click the Add button to add configurations with Android configuration settings to the profile.
The Available configurations view is displayed.
8. Select Password policies and click Next.
The Password policies view is displayed.
9. In the Password type field, select the type of password you want define (for example Complex)
and click Next.
10. Specify the password policies settings for this profile. For a detailed description of all settings
available, refer to the Sophos Mobile Control administrator guide.
11. Click the Apply button.
The Password policies configuration is displayed in the Edit profile view under Configurations.
25
Sophos Mobile Control
12. To add a Restrictions settings profile, click the Add button again.
Note: Supported settings may depend on the Android version in use on individual devices.
Depending on the end user device, some settings may not have any effect. For further
information, see the feature matrix in the Sophos Mobile Control technical guide.
13. In the Available configurations view, select Restrictions and click Next.
The Restrictions view is displayed.
14. Specify the restrictions settings for this profile. For a detailed description of all settings available,
refer to the Sophos Mobile Control administrator guide.
15. Click the Apply button.
The Restrictions configuration is displayed in the Edit profile view under Configurations.
16. Click the Save button.
The profile is available for transfer. It is displayed in the Profiles view.
14.2 Create task bundles for Android devices
1. In the web console menu bar, click Task bundles.
The Task bundles view is displayed.
2. Click the Create task bundle button.
The Edit task bundle view is displayed.
3. Enter a Name and a Version for the new task bundle. These two fields are mandatory.
We recommend that you use the name "Android SSP task bundle" for task bundles that are
applied during the enrollment process through the Self Service Portal.
4. Under Operating systems, select the compatible operating systems for the new task bundle.
Select all Android settings for this task bundle.
Note: The operating system list is created according to devices registered with the system. At
this stage, it may show only Android. The setting Android covers all Android versions.
5. Under Tasks, click the Create task button.
a) As a first task, select the task type Install the MDM agent and click Next. Select the Sophos
Mobile Control Android client and click Next. Give the task a meaningful name and click
Next.
Note: The name you define here is shown in Self Service Portal while tasks are processed.
b) Add a second task of the type Install an Android profile and click Next. Select the profile
you have created ("Android SSP profile", if you have used the suggested name) and click
26
Startup guide
Next. Give the task a meaningful name and click Next. If you have configured further
profiles, repeat this step for each profile.
c) Repeat this procedure to add further tasks. You can set the order for installation for selected
commands by using the sort arrows on the right-hand side of the Tasks list.
6. After you have added all required tasks to the task bundle, click the Save button in the Edit
task bundle view.
The task bundle is available for transfer. It is displayed in the Task bundles view. To create further
task bundles, repeat the steps described.
27
Sophos Mobile Control
15 Update Self Service Portal settings
After you have created the task bundles to be transferred when users register their devices with
the Sophos Mobile Control Self Service Portal, you need to update the Self Service Portal settings
with the required group settings:
1. In the web console menu bar, go to Settings and click Self Service Portal.
The Self Service Portal view is displayed.
2. Go to the Group settings tab.
3. Under Group settings, click the Edit pencil icon next to the Default Self Service Portal group.
4. Under Platform, select the device types that should be available in the Self Service Portal:
■
Android
iOS
■ Windows Phone 8
■ Windows Mobile
■
Note: This guide focuses on iOS and Android as the most common mobile platforms. For
further information on all available platforms, refer to the Sophos Mobile Control administrator
guide.
5. In the Add to device group field, select the group that devices registered through the Self Service
Portal should be added to.
6. In the Enrollment package field, select the task bundles you have created for iOS and Android
devices and click Apply.
7. In the Self Service Portal tab, click the Save button.
28
Startup guide
16 Create a Self Service Portal user with internal user
management
To test provisioning through the Self Service Portal, create a Self Service Portal user account for
yourself. With this user account you can log in to the Self Service Portal.
Note: The steps described refer to internal Self Service Portal user management. In this guide,
internal Self Service Portal user management is described as an example. For further information
on external user management, see the Sophos Mobile Control super administrator guide.
1. In the web console menu bar, click Users.
The Show users view is displayed.
2. Click the Create user button.
The Edit user view is displayed.
3. Enter the following information for the new Self Service Portal user:
a) Make sure that the Send welcome mail field is selected. This field is shown, if you have
configured a welcome mail in the Welcome mail tab in Settings under Self Service Portal.
If the field is not displayed, configure a welcome mail first. The welcome mail has to include
all required login credential information.
b) User name
c) Last name
d) First name
e) Email
f) Phone number (optional)
The new Self Service Portal user is displayed in the Show users view. A welcome email is sent to
the email address specified.
29
Sophos Mobile Control
17 Test provisioning through the Self Service Portal
We recommend that you test provisioning through the Self Service Portal with one user before
you roll out Self Service Portal use to further users.
Log in to the Self Service Portal with the Self Service Portal user account you have created for
yourself and register and provision devices. We recommend that you run a test for all platforms
that you want to use with Sophos Mobile Control.
For further information on how to use the Self Service Portal, refer to the Sophos Mobile Control
user guides for Android, Apple iOS, Windows Phone 8 and Windows Mobile.
Note: This guide focuses on iOS and Android as the most common mobile platforms. For further
information on all available platforms, see the Sophos Mobile Control administrator guide.
30
Startup guide
18 Upload your user list to Sophos Mobile Control with
internal user management
After you have tested provisioning through the Self Service Portal, you can import your user list
to Sophos Mobile Control.
Note: The steps described refer to internal Self Service Portal user management. In this guide,
internal Self Service Portal user management is described as an example. For further information
on LDAP user management, see the Sophos Mobile Control super administrator guide. This step is
not necessary for external user management. In this case all users assigned to Sophos Mobile
Control can log in to the system.
1. In the web console menu bar, click Users.
The Show users view is displayed.
2. Click the Import users button.
The Import users view is displayed.
If you do not have a .csv file with users yet, you can download a sample file now and use it for
creating your import file.
3. Make sure that the Send welcome mails field is selected. This field is shown, if you have
configured a welcome email in the Welcome email tab in Settings under Self Service Portal.
If the field is not displayed, configure a welcome mail first. The welcome mail has to include
all required login credential information.
4. Select the .csv file you want to import and click Upload file.
The entries in the.csv file are checked for errors and displayed on the import page.
Note: If there are any errors in the .csv file, it cannot be imported. An error message is displayed
next to the relevant entries. Edit the .csv file accordingly and try again.
5. If all entries are correct, click the Finish button.
The users are imported and displayed in the Show users view. They can use the Self Service Portal
for registering and provisioning their devices.
31
Sophos Mobile Control
19 Technical support
You can find technical support for Sophos products in any of these ways:
32
■
Visit the SophosTalk community at http://community.sophos.com/ and search for other users
who are experiencing the same problem.
■
Visit the Sophos support knowledgebase at http://www.sophos.com/en-us/support.aspx.
■
Download the product documentation at
http://www.sophos.com/support/documentation/mobile-control.aspx.
■
Send an email to [email protected], including your Sophos software version number(s),
operating system(s) and patch level(s), and the text of any error messages.
Startup guide
20 Legal notices
Copyright © 2011 - 2014 Sophos Ltd. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any
form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you
are either a valid licensee where the documentation can be reproduced in accordance with the
license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos is a registered trademark of Sophos Ltd. All other product and company names mentioned
are trademarks or registered trademarks of their respective owners.
33
">