Sophos Mobile Control Administrator help
โฆษณา
โฆษณา
Sophos Mobile Control (in
Sophos Central) administrator help
Product version: 7
2
Contents
12.2 Import iOS device profiles created with Apple Configurator...................................53
13.5 Transfer task bundles to individual devices or to device groups...........................156
3
4
19.5 Configure a connection to the internal EAS proxy server.....................................192
19.6 Configure a connection to the external EAS proxy server....................................192
21.2 Configure web filtering settings for Sophos Mobile Security.................................196
administrator help
1 About this help
This help describes how to manage Sophos Mobile Control through the Sophos Central Admin console.
Note: What you can do in the Admin console depends on your assigned administrator role and on your activated licenses.
Document conventions
The following conventions are used in this help:
■
Unless otherwise noted, Windows Mobile refers to Windows 10 Mobile and Mobile Enterprise editions and to Windows Phone 8.1.
■
■
Unless otherwise noted, Windows Desktop or Windows 10 Desktop refers to Windows 10 Pro,
Enterprise, Education, and Home editions.
Unless otherwise noted, all procedures assume that you already have opened the Mobile view from the My Products section of the main menu in Sophos Central Admin.
5
6
Sophos Mobile Control (in Sophos Central)
2 Key steps for managing devices with
Sophos Mobile Control
Sophos Mobile Control offers a wide range of Mobile Device Management functions depending on device types, corporate security policies and specific requirements in your company.
The key steps for managing devices with Sophos Mobile Control are:
■
Configure compliance rules for devices. See
■
Create device groups. See
(page 51).
Device groups are used to categorize devices. We recommend that you put devices into groups. This helps you to manage them efficiently as you can carry out tasks on a group rather than on individual devices.
■
Enroll and provision devices. See
(page 33) and
Devices can either be enrolled and provisioned by administrators through the Sophos Mobile
Control console or by device users through the Sophos Central Self Service portal.
■
■
■
■
Set up profiles and security settings for devices. See
(page 52).
Create task bundles. See Task bundles
(page 149).
Configure the available features of the Sophos Central Self Service portal. See
Apply new or updated profiles and security settings to enrolled devices.
administrator help
3 Dashboard
The customizable Dashboard is the regular start page of Sophos Mobile Control and provides access to the most important information at a quick glance. It consists of several widgets providing information about:
■
■
Devices, all or per group
Compliance status by platform or for all devices
■
■
Managed status by platform or for all devices
The SSP registration status
■
The platform versions in use
There also is a special widget Add device to start the device enrollment wizard. See
Use the device enrollment wizard to assign and enroll new devices
(page 35).
The following options are available to customize the Dashboard:
■
To add a widget to the page, click Add widget.
■
■
■
To remove a widget from the page, click the Close button in its header.
To reset the page to its default layout, click Restore default layout.
To rearrange the widgets on the page, drag a widget header.
7
8
Sophos Mobile Control (in Sophos Central)
4 Reports
With Sophos Mobile Control you can create various reports from the following areas:
■
Devices
■
■
Apps and documents
Compliance violations
■
Malware
To create a report:
1. On the menu sidebar, under INFORM, click Reports, and then click the name of the required report.
2. In the Choose format dialog, click one of the available icons to select the output format:
■
■
Click to export the report to a Microsoft Excel file.
Click to export the report to a comma-separated values (CSV) file.
The report file is saved to your local computer, using the download settings of your web browser.
administrator help
5 Tasks
The Task view page gives you an overview of all tasks you created and started and displays their current state.
You can monitor all your tasks and intervene in case of problems. For example, you can delete a task that obviously cannot be completed but blocks the device.
To delete a task, click the Delete icon next to it.
You can filter tasks according to Type and State and sort them by device name, package name, creator and scheduled date.
5.1 Monitor tasks
In the Sophos Mobile Control console, you can monitor all existing tasks for devices.
■
The Tasks page shows all unfinished and failed tasks as well as the finished tasks of the last few days. The Task view page is refreshed automatically, so you can watch the states of the tasks evolve.
■
■
The Task details page shows general information about a task from the Tasks page or the
Task archive page.
The Task archive page shows all tasks.
5.1.1 View unfinished, failed and latest finished tasks
1. On the menu sidebar, under INFORM, click Tasks.
2. On the Task view page, the State column shows the task status, for example, Completely
failed.
3. In the Refresh interval (in sec.) field, you can select how often the Task view page is to be refreshed.
4. To view further details about a task, click the Show magnifier icon next to the required task.
The Task details page is displayed. Besides general information on the task (for example, device name, package name and creator) it shows the states a specific task went through, including timestamps and error codes. If there are commands to be executed by the device, an additional Details button is available on the Task details page.
5. If available, click Details to view the commands to be executed by the device.
The commands sent to the device are part of the task. They are executed by the SMC app or by the MDM client. Results indicating the success or failure are transferred back to the server.
If there was no error, the error code is “0”. If a command has failed, the error code is displayed.
In most cases there is also a description of what may have caused the command to fail.
6. To return to the Task details page, click Back.
9
Sophos Mobile Control (in Sophos Central)
5.1.2 View task archive
1. On the menu sidebar, under INFORM, click Tasks.
2. On the Task view page, click Task archive.
The Task archive page is displayed. It shows all finished and failed tasks in the system.
3. On this page, you can:
■
■
■
Click Reload to refresh the Task archive page.
Delete a task from the archive by clicking the Delete icon next to the relevant task.
Select several tasks and click Delete selected to delete them from the archive.
To go back to the Task view page, click Tasks on the menu sidebar.
5.1.3 Task states
The following table provides an overview of the task states shown on the Task view and on the
Task archive pages.
Every state is associated with a color code that indicates the state category.
Color code State
Accepted
Will be retried
Description
Task has been created.
Task will be retried later.
Started
In progress
Task bundle in progress
Notified
Task has been started.
Execution of the task is being prepared.
Execution of the task bundle is being prepared.
SMC app was notified.
Commands sent
Result evaluation started
Result incomplete
Waiting for user interaction
SMC app has received the package and/or the commands.
SMC app has answered and the evaluation of the result has been started.
Result evaluation showed that not all commands’ results have been received by now.
There is a pending user action on the device.
10
administrator help
Color code State
Device is locked
Successful
Installed
Result evaluation failed
Task partly failed
Delayed
Failed (retry queued)
Task failed
Completely failed
Not started
Session requested
Unknown
Description
Task waits for the device to become unlocked (iOS only).
Package has been installed or the commands have been successfully executed.
Note: For the initial provisioning of the Sophos Mobile
Control app the task must finish with the state Installed.
The Sophos Mobile Control app has been installed successfully. The device is provisioned now.
Result evaluation could not be executed.
Not all commands of the task could be executed successfully.
Task will be restarted later.
Task has failed and will be retried later.
Task has failed and no further retries are queued.
Task has failed, and it is not possible to retry it.
Task is part of a task bundle and was not processed yet.
An AirPlay session was requested (iOS only).
The server has no information about the task status.
Color code Category
Open
In progress
Success
Failure
Other
11
Sophos Mobile Control (in Sophos Central)
6 General settings
On the General settings page you can configure some basic settings of Sophos Mobile Control.
6.1 Configure personal settings
To use the Sophos Mobile Control console more efficiently, you can customize the user interface to show only the platforms you work with.
Note: By configuring the platforms you only change the view of the user who is currently logged in. You cannot deactivate any functions here.
1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Personal tab.
2. Configure the following settings:
Option Description
Timezone
Unit system
Lines per page in tables
Select the timezone in which dates are shown.
Select the unit system for length values (Metric or Imperial).
Select the maximum number of table lines you want to display per page.
Show extended device details
Select this check box to show all available information about the device. The Custom properties and Internal properties tabs will be added to the Show device page.
Activated platforms
Select the platforms you want to manage for the customer:
Android iOS
Windows Mobile (includes Windows Phone 8.1 and Windows 10
Mobile operating systems)
Windows Desktop
Based on your platform selection, the user interface of the Sophos
Mobile Control console is adjusted. Only views and features that are relevant for the selected platforms are shown.
3. Click Save.
12
administrator help
6.2 Configure SMC app settings
On the SMC app tab of the General settings page, you configure settings for the Sophos Mobile
Control app on Android, iOS and Windows Mobile devices.
1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the SMC app tab.
2. Configure the following settings:
Option Description
Disable unenrollment through app
Remove the Unenroll button from the Sophos Mobile Control app to prevent users from unenrolling their device through the app.
Note: To completely prevent user-initiated unenrollment, also disable the Unenroll device option in the Self Service Portal settings. See
Configure Self Service Portal settings (page 16).
3. Click Save.
6.3 Enable Baidu Cloud Push service
Sophos Mobile Control uses the Google Cloud Messaging (GCM) service to send push notifications to Android devices, to trigger them to contact the Sophos Mobile Control server. In China, GCM will likely not work. Therefore, Sophos Mobile Control can also use Baidu Cloud Push, which is a Chinese push notification service.
If you manage Android devices that are located in China, enable the Baidu Cloud Push service as follows:
1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Android tab.
2. In the Baidu Cloud Push service section, select Enable Baidu Cloud Push service.
3. Click Save.
When Baidu Cloud Push is enabled, Sophos Mobile Control sends all push notifications through
GCM and through Baidu Cloud Push.
6.4 Configure iOS settings
On the iOS tab of the General settings page, you configure settings that are specific to iOS devices.
1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the iOS tab.
13
Sophos Mobile Control (in Sophos Central)
2. Configure the following settings:
Option
Activation Lock bypass
Description
Select Enable to be able to clear the Activation Lock on supervised devices.
When this option is selected, Sophos Mobile Control retrieves a bypass code when syncing with a supervised device that has
Activation Lock enabled. If required, you can perform the Activation
Lock bypass action from the device's Show device page to clear
Activation Lock when the device needs to be erased and re-deployed.
Activation Lock is an iOS security feature to prevent the reactivation of lost or stolen devices. Normally, you need the correct Apple ID and password to clear Activation Lock. With the Activation Lock bypass feature, you can clear Activation Lock by providing the bypass code only.
Synchronize device name
Select Enable to manage iOS devices under the name that is configured on the device.
When this option is selected, the device name that Sophos Mobile
Control uses is set every time the device synchronizes with Sophos
Mobile Control.
When this option is deselected, you set the device name during device enrollment.
3. Click Save.
6.5 Configure polling interval for Windows devices
For Windows devices, you can configure the polling interval at which the Windows MDM client contacts the Sophos Mobile Control server. Usually, the server contacts the client using push notifications. Polling is used as a safety measure when the push notification service is not available.
Note: The default values are sufficient in most cases. Using shorter intervals impacts battery life and data consumption and causes higher server load.
1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Windows tab.
2. Select polling intervals for the different Windows operating systems.You can configure individual settings for:
■
■
Windows 10 Mobile and Windows Phone 8.1 devices
Windows 10 Desktop devices
3. Click Save.
14
administrator help
6.6 Configure Email
On the Email configuration tab, you can configure settings for emails that are sent by Sophos
Mobile Control to the users.
1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Email
configuration tab.
2. In the Language list, select the email language.
3. Click Save.
6.7 Configure technical support contact details
To support users who have questions or problems, you can provide them with details of how to contact technical support. The information that you enter here is displayed in the Sophos Mobile
Control app.
1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Technical
contact tab.
2. Enter the required information for the technical contact.
3. Click Save.
6.8 Define customer properties
You can define customer-level properties.
When you define a property with name my property
, you can refer to the value of the property in profiles and policies by using the placeholder
%_CUSTPROP(my property)_%
. For example, you can use this to refer to a domain that is specific to the customer.
For details on profile and policy placeholders, see
Placeholders in profiles and policies
(page 55).
To define a customer property:
1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Customer
properties tab.
2. Click Add customer property.
3. Enter a Name and a Value for the new property.
4. Click Apply to add the property.
5. Click Save to save the changes to the customer settings.
15
Sophos Mobile Control (in Sophos Central)
7 Configure Self Service Portal
With the Self Service Portal you can reduce IT efforts by allowing users to enroll devices on their own and carry out other tasks without having to contact the helpdesk.
On the menu sidebar, you can configure settings for the use of the Self Service Portal, for example:
■
The platforms for which devices can be enrolled.
■
■
The available functions.
The users that are allowed to access the Self Service Portal.
7.1 Configure Self Service Portal settings
1. On the menu sidebar, under SETTINGS, click Setup, and then click Self Service Portal.
The Self Service Portal page is displayed.
2. On the Configuration tab, configure the following settings: a) In the Maximum number of devices list, select the maximum number of devices a user can enroll through the Self Service Portal. This ensures that the number of available licenses is not exceeded.
b) In the Device owner preselection list, select if new devices are classified as corporate or personal devices, and if the users are able to change this classification when they enroll their devices through the Self Service Portal. You can select one of the following settings:
■
no preselection: The owner field in the Self Service Portal is left blank. Users can select the device type.
■
corporate preselected: On the Self Service Portal, Corporate device is preselected.
Users can change the setting to Personal device.
■
corporate fixed: Device type cannot be selected. Company is listed as owner.
■
personal preselected: On the Self Service Portal, Personal device is preselected.
Users can change the setting to Corporate device.
■
personal fixed: Device type cannot be selected. Employee is listed as owner.
c) Under Available functionality, select the functions that should be available for users of the Self Service Portal. The functions supported vary according to the device platform. See
Available Self Service Portal settings
(page 17).
3. On the Terms of use tab, you configure a mobile policy, disclaimer or agreement text that is displayed as a first step when users enroll their devices. Users must accept the text to be able to continue.
HTML formatting tags are supported for the text. The text will be displayed in the relevant browser accordingly.
16
administrator help
4. On the Post-install text tab, you configure text to be displayed on the Self Service Portal after automatic installation. This text can tell the user what must be done next, for example configuring the server in the iOS app or configuring the Android mail client.
HTML formatting tags are supported for the text. The text will be displayed in your chosen browser accordingly.
5. On the Group settings tab, you configure the group settings, for example, the device groups enrolled devices will be added to and the task bundle that will be transferred to the devices.
Important: Because of the complexity of the group settings configuration, we recommend that you test device enrollment for different user groups before you roll out the settings to your actual users.
a) Click Add.
The Edit group settings page is displayed.
b) Enter a Name for the Self Service Portal configuration group.
c) In the Directory group field, enter the Self Service Portal Group you have defined. You can use an asterisk (*) as the first, the last or the only character in this field to specify several groups. For example: Enter
Dev*
to specify all group names that start with the string
Dev
. Enter
*
to specify all available groups.
d) Select if the texts that are configured in the Terms of use and Post-install text tabs will be displayed.
e) In columns Initial package - corporate device and Initial package - personal device, select the task bundle (for Android and iOS) or policy (for Windows Mobile and Windows
Desktop) to be executed on corporate and personal devices.
f) In column Active, select the platforms that should be available on the Self Service Portal.
You must select an initial package before you can select a platform.
g) In column Add to device group, select the group the device should be added to.
Note: On the menu sidebar, a Default device group is available. If you have not defined your own device groups yet, you can add devices to this group. For further information,
h) Click Apply.
6. The Self Service Portal page is displayed. Click Save.
7.2 Available Self Service Portal settings
The following table shows the functions of the Self Service Portal that you can enable or disable as described in
Configure Self Service Portal settings (page 16), and the device platforms for
which a function is supported.
17
Sophos Mobile Control (in Sophos Central)
Setting Description
Locate device
Lock device
With this function users can locate devices if they are lost or stolen.
With this function users can lock their devices if they are lost or stolen.
Reconfigure device
Show compliance violations
With this function users can reconfigure their devices if
Sophos Mobile Control has been removed from the device, but the device is still enrolled.
With this function users can view the compliance violations for their devices.
Refresh data
Reset password
With this function users can manually synchronize their devices with the Sophos
Mobile Control Server. This is useful, for example, if the device has been switched off for a long period of time and therefore has not been synchronized with the server.
In this case, the device may be non-compliant (depending on the compliance rules configured) and needs to be synchronized with the server to make it compliant again.
With this function users can reset their unlock screen password. For Android and iOS devices, a temporary password is displayed on the
Self Service portal. The device can only be unlocked with this password. After unlocking their devices, users can set a new password. For iOS, the password is completely deleted. The user has to set a new password within 60 minutes.
Android iOS Windows
Mobile
Windows
Desktop
18
administrator help
Setting Description
Wipe
With this function users can reset their enrolled devices to their factory settings if devices are lost or stolen. All data on the device is deleted.
For devices that are enrolled with Android for Work, only the work profile is removed. The device itself is not reset.
Unenroll device
With this function users can decommission devices that they no longer use. This is useful, for example, if the number of devices users can enroll through the Self Service
Portal is limited or users get new devices.
Delete unmanaged device
With this function users can delete decommissioned devices.
Reset App Protection password
With this function users can reset their App Protection password on Android devices.
The App Protection password protects defined apps and has to be entered each time users start these apps. The password will be deleted and they have to set a new one.
Reset Sophos container password
With this function users can reset their Sophos container password. The Sophos container password has to be entered each time users start one of the container apps. The password will be deleted and they have to set a new one.
Reconfigure the SMC app
With this function users can reconfigure an already installed Sophos Mobile
Control app.
Android iOS Windows
Mobile
Windows
Desktop
19
Sophos Mobile Control (in Sophos Central)
8 System setup
8.1 Apple Push Notification service certificates
To use the built-in Mobile Device Management (MDM) protocol of iOS devices, Sophos Mobile
Control must use the Apple Push Notification service (APNs) to trigger the devices.
APNs certificates have a validity period of one year. To notify when the certificate is about to expire, Sophos Mobile Control sends several email reminders to the administrators, starting 30 days prior to the expiry date.
The following sections describe the requirements that must be fulfilled and the steps you must take to get access to the APNs servers with your own client certificate.
8.1.1 Requirements
For communication with the Apple Push Notification Service (APNs), TCP traffic to and from the following ports must be allowed:
■
The Sophos Mobile Control server needs to connect to gateway.push.apple.com:2195
TCP (17.0.0.0/8)
■
Each iOS device with Wi-Fi only access needs to connect to
*.push.apple.com:5223
TCP (17.0.0.0/8)
8.1.2 Create an APNs certificate
This procedure assumes that you have not uploaded a certificate for the Apple Push Notification service (APNs) to Sophos Mobile Control yet.
To renew an existing certificate, see
Renew an APNs certificate (page 21).
Tip: You can use the same certificate for several customers. See
Copy an APNs certificate to another customer
(page 22).
1. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS
APNs tab.
The description on that tab guides you through the steps you have to perform to request a certificate from Apple and to upload it to Sophos Mobile Control.
2. In the Download certificate signing request step, click Download certificate signing
request.
This saves the certificate signing request file apple.csr
to your local computer. The signing request file is specific to the current customer.
20
administrator help
3. You need an Apple ID. Even if you already have an ID, we recommend that you create a new one for use with Sophos Mobile Control. In the Create Apple ID step, click Create a new
Apple ID.
This opens an Apple web page where you can create an Apple ID for your company.
Note: Store the credentials in a safe place where your colleagues can access them. Your company will need these credentials to renew the certificate each year.
4. For your reference, enter your new Apple ID in the Apple ID field on the top of the iOS APNs tab.
When you renew the certificate each year, you must always use that same Apple ID.
5. In the Create or renew APNs certificate step, click Apple Push Certificates Portal.
This opens the Apple Push Certificates Portal.
6. Log in with your Apple ID and upload the certificate signing request file apple.csr
.
7. Download the
.pem
APNs certificate file and save it to your computer.
8. In the Upload APNs certificate step, click Upload certificate and then browse for the
.pem
file that you received from the Apple Push Certificates Portal.
9. Click Save to add the APNs certificate to Sophos Mobile Control.
Sophos Mobile Controls reads the certificate and displays the certificate details on the iOS APNs tab.
8.1.3 Renew an APNs certificate
This procedure assumes that you already have uploaded a certificate for the Apple Push Notification service (APNs) to Sophos Mobile Control that is about to be expire and needs to be renewed.
To create and upload a new certificate, see
(page 20).
Important: On the Apple portal, it is important that you select the correct APNs certificate for renewal. If you renew the wrong certificate, you might need to re-enroll all iOS devices.
1. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS
APNs tab.
2. In the Download certificate signing request step, click Download certificate signing
request.
This saves the certificate signing request file apple.csr
to your local computer.
3. Skip the step Create Apple ID. This step is only required if you are creating an APNs certificate for Sophos Mobile Control for the first time.
4. In the Create or renew APNs certificate step, click Apple Push Certificates Portal.
This opens the Apple Push Certificates Portal.
5. Log in with your Apple ID. This must be the same ID that you used for the creation of the initial
APNs certificate.
6. On the Apple Push Certificates Portal, click Renew next to your Sophos Mobile Control APNs certificate.
7. Upload the certificate signing request file apple.csr
you prepared before.
8. Download the
.pem
APNs certificate file and save it to your computer.
21
Sophos Mobile Control (in Sophos Central)
9. In the Upload APNs certificate step, click Upload certificate and then browse for the
.pem
file that you received from the Apple Push Certificates Portal.
10. Click Save.
Important:
If the following message is shown, you are not renewing the correct certificate:
"The topic of the new certificate does not correspond to the old one.
If devices have been
set up with the previous certificate, they have to be set up again. Do you really want to save
your changes?"
This message indicates that you are about to create a new APNs certificate with a different identifier. If you confirm the message, all existing iOS devices are not manageable any more and you have to re-enroll them.
For information how to select the correct certificate, see
Identify the correct APNs certificate for renewal (page 23).
8.1.4 Copy an APNs certificate to another customer
You can copy a certificate for the Apple Push Notification service (APNs) to another instance of
Sophos Mobile Control.
Important: If there already exists an APNs certificate at the target location, it is important that the Topic property of the certificate that you want to copy is identical to the Topic of the existing certificate. If you copy the wrong certificate, you might need to re-enroll all iOS devices of the customer.
Download the certificate from the source location:
1. Log in to the Sophos Mobile Control console as an administrator of the customer whose APNs certificate you want to copy.
2. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS
APNs tab.
3. Make a note of the Topic value that is displayed in the certificate details.
4. Click Download certificate as PKCS #12 file.
5. In the confirmation dialog, the password for the certificate file is displayed. Make a note of that password and then click Download.
This saves the certificate file apns_cert.p12
to your local computer.
Upload the certificate to the target location:
6. Log in to the Sophos Mobile Control console as an administrator of the customer to whom you want to upload the certificate.
7. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS
APNs tab.
8. If there already exists an APNs certificate, verify that the Topic value is identical to the value of the certificate you are about to copy.
22
administrator help
9. In the Upload APNs certificate step, click Upload certificate and then browse for the apns_cert.p12
file that you downloaded before.
10. Enter the password and then click Apply.
11. Click Save.
8.1.5 Identify the correct APNs certificate for renewal
When you renew your Apple Push Notification service (APNs) certificate for the Sophos Mobile
Control server as described in Renew an APNs certificate (page 21), it is important that on the
Apple portal you select the correct APNs certificate for renewal.
This section describes how to identify the APNs certificate that is currently uploaded to the Sophos
Mobile Control server.
Retrieve the certificate identifier:
1. Log in to the Sophos Mobile Control console with an administrator account for the customer whose APNs certificate needs to be renewed.
2. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS
APNs tab.
3. In section Content of the Apple Push Notification keystore, the properties of the uploaded
APNs certificate are displayed.
4. Make a note of the value that is displayed for Topic.
This is the identifier of your APNs certificate.
Identify the certificate:
5. Use your web browser to open the URL of the Apple Push Certificates Portal, https://identity.apple.com/pushcert/ .
If you are experiencing issues with certain features of the Apple portal when using Microsoft
Internet Explorer, we recommend that you use the latest version of the Firefox, Opera, Chrome or Safari browser instead.
6. Log in with the Apple ID that you used for the creation of the initial APNs certificate.
7. In the list of APNs certificates, click the Certificate Info icon next to a certificate entry.
This displays the certificate details.
8. In field Subject DN, locate the value that follows the string
UID=
. If this matches the identifier that you determined in the Sophos Mobile Control console, you have identified the correct certificate.
8.1.6 Check APNs connectivity of devices
Users of the Sophos Mobile Control app for iOS can check if their devices are able to connect to the Apple Push Notification service (APNs) server.
1. In the Sophos Mobile Control app, tap the Information icon to open the About screen.
2. Tap Check APNs.
The app tries to connect to the Apple APNs server. The expected server response time is 5 seconds or less.
23
Sophos Mobile Control (in Sophos Central)
If the app notifies you that the APNs server could be reached, the device is able to receive commands from Sophos Mobile Control server through APNs.
If the app notifies you that the APNs server could not be reached, your network does not allow
APNs communication and thus Sophos Mobile Control is not able to manage iOS devices. To
correct this, make sure that the requirements described in Requirements
(page 20) are met.
8.2 Configure iOS AirPlay destinations
With Sophos Mobile Control you can remotely trigger AirPlay mirroring between an iOS device and predefined AirPlay destinations (for example AppleTV).
Note: AirPlay only works for devices within the same network.
You can define destinations for AirPlay mirroring.
1. On the menu sidebar, under SETTINGS, click Setup and then System setup, and go to the
iOS AirPlay tab.
2. In the AirPlay destinations section, click Create AirPlay destination.
The AirPlay destination page is displayed.
3. Enter the Device name (required) and the MAC address (optional). If necessary, enter the
Password for the AirPlay destination device.
4. Click Apply.
The device is shown under AirPlay destinations in the iOS AirPlay tab of the System setup page.
5. Click Save.
You can trigger AirPlay mirroring between an iOS device and this destination by clicking Request
AirPlay mirroring from the Actions menu on the Show device page for the relevant device.
8.3 Samsung Knox license
If your company has purchased a Samsung Knox Premium license, you have to enter your license key, the number of licenses and the expiry date on the Samsung Knox license tab in order to manage the Knox container on your Samsung Knox devices with Sophos Mobile Control.
8.4 Configure SCEP
You can configure Simple Certificate Enrollment Protocol (SCEP) to provide certificates. This allows devices to obtain certificates from a Certificate Authority by using SCEP.
You can configure all the settings required to access a Certificate Authority server with SCEP in the Sophos Mobile Control console.
You can define the settings required for devices in an SCEP Device profile for Android and iOS or a policy for Windows Mobile.
24
administrator help
8.4.1 Prerequisites
In order to use the Simple Certificate Enrollment Protocol, the following prerequisites must be fulfilled:
■
■
An SCEP-enabled Windows CA exists in the environment.
Login credentials for a user who can create a challenge code are available.
■
The Sophos Mobile Control server has http or https access to the following sites:
■ https://YOUR-SCEP-SERVER/CertSrv/MSCEP_ADMIN
■ https://YOUR-SCEP-SERVER/CertSrv/MSCEP
8.4.2 Configure SCEP
1. On the menu sidebar, under SETTINGS, click Setup and then System setup, and go to the
SCEP tab.
2. Specify the following: a) In the SCEP server URL field, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP.
b) In the Challenge URL field, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP_ADMIN.
Note: If you use a Windows 2003 server as the SCEP server, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP.
c) In the User and Password fields, enter the user credentials of the user who can create a challenge code.
Note: In the User field, enter a user who has the necessary rights to enroll certificates.
Use the logon format: username@domain d) In the Challenge characters field, select the character types that are used for the challenge password.
e) In the Challenge length field, accept the default length.
f) Optional: Clear the Use HTTP proxy option if you want Sophos Mobile Control to bypass the HTTP proxy when connecting to the SCEP server. This option is only available if the
HTTP proxy is enabled.
3. Click Save.
Sophos Mobile Control tests the connection to your SCEP server.
To deploy a profile using SCEP, you must add a SCEP configuration to an Android or iOS device profile or to a Windows Mobile policy.
25
Sophos Mobile Control (in Sophos Central)
9 Compliance rules
With compliance rules you can:
■
Allow, forbid or enforce certain features of a device.
■
Define actions that are executed when a compliance rule is violated.
You can create various sets of compliance rules and assign them to device groups. This allows you to apply different levels of security to your managed devices.
Tip: If you are planning to manage both corporate and private devices, we recommend that you define separate sets of compliance rules for at least these two device types.
Note: There are two predefined compliance rules available. These are based on the HIPAA and the PCI DSS security standards.
9.1 Create compliance rules
To create compliance rules:
1. On the menu sidebar, under CONFIGURE, click Compliance rules.
2. On the Compliance rules page, click Create compliance rules.
3. Enter a Name and an optional Description for the new set of compliance rules.
The Compliance rules page contains individual tabs for the device platforms that are activated for the customer. Repeat the following steps for all required platforms.
4. Make sure that the Enable platform check box on each tab is selected.
If this check box is not selected, devices of that platform are not checked for compliance.
5. Under Rule, configure the compliance rules for the particular platform.
Each compliance rule has a fixed severity level (high, medium, low) that is depicted by a blue icon. The severity helps you to assess the importance of each rule and the actions you should implement when it is violated.
If you have defined app groups, you can assign these to the compliance rules Allowed apps,
Forbidden apps and Mandatory apps.
26
administrator help
6. Under If rule is violated, define the actions that will be taken when a rule is violated:
Option
Deny email
Description
Forbid email access.
This action can only be taken if you have configured a connection to the internal or to the standalone EAS Proxy. See
Configure a connection to the internal EAS proxy server
(page 192) or
Configure a connection to the external EAS proxy server
(page 192).
Lock container
Notify admin
Disable the Sophos Secure Workspace and Secure Email apps. This affects document, email and web access that is managed by these apps.
This action can only be taken when you have activated a Mobile
Advanced license.
This option is only relevant for Android and iOS devices.
Send compliance emails to selected recipients.
The list of recipients and the time schedule is specified collectively for all sets of compliance rules that you create. See the instructions later in this section.
Transfer task bundle
Transfer a specific task bundle to the device.
Select a task bundle from the list, or select None to transfer no task bundle when the compliance rule is violated.
Important: When used incorrectly, task bundles may misconfigure or even wipe devices. To assign the correct task bundles to compliance rules, an in-depth knowledge of the system is required.
7. When you have made the settings for all required platforms, click Save to save the set of compliance rules under the name that you specified.
The new set is displayed on the Compliance rules page.
8. If you have selected the Notify admin action for one of the compliance rules, click Compliance
email settings to specify the recipients that will receive compliance emails and the times when compliance emails are sent.
You can specify the recipients either by entering the name of an administrator or by entering a valid email address.
Note: These are common settings that apply to all compliance rules that have a Notify admin action.
9. Click Save to save the compliance email settings.
27
Sophos Mobile Control (in Sophos Central)
9.2 Available compliance rules
The following table shows the compliance rules you can select for the individual platforms under
Rule in the relevant Compliance rules tabs.
Windows
Mobile
Windows
Desktop
Setting Description
Managed required
Minimum SMC app version
Define the action that will be executed when a device is no longer managed.
Enter the minimum Sophos
Mobile Control app version that has to be installed onto the device.
Root rights allowed
Select whether devices with root rights are allowed.
Note: For Sony devices with
Enterprise API version 4 or above and for Samsung devices with Knox version 5.5
or below, this includes all devices that are classified
insecure by the MDM API, for example because the bootloader is unlocked.
Apps from unknown sources allowed
Select whether apps from unknown sources are allowed.
Android Debug Bridge
(ADB) allowed
Select whether ADB (Android
Debug Bridge) is allowed.
Allow jailbreak
Select whether jailbroken devices are allowed.
Password required
Select whether a device password or other screen lock mechanism (like pattern or
PIN) is required.
For Android, this includes the display lock types Pattern, PIN and Password, but not Swipe.
Android iOS
28
administrator help
Setting Description
Min. OS version
Max. OS version
Select the earliest operating system version required.
Select the latest operating system version allowed.
Max. synchronization gap
Specify the maximum interval between synchronization processes for devices.
Maximum SMC app synchronization interval
Max. SMSec scan interval
Specify the maximum interval between iOS app synchronization processes for devices.
This field is only displayed if
Sophos Mobile Security is available for this customer. For further information, see
(page 194). In this field, you can specify the maximum scan interval for malware scans performed by the Sophos Mobile Security app on the device.
Denial of SMSec permissions allowed
Sophos Mobile Security needs permissions on the device to work properly. The user has to grant these permissions when the app is installed.
Select whether a denial of the required permissions results in a compliance violation.
Malware apps allowed
This field is only displayed if
Sophos Mobile Security is available for this customer.
Select whether detected malware apps are allowed.
Android iOS Windows
Mobile
Windows
Desktop
29
Sophos Mobile Control (in Sophos Central)
Setting Description
Suspicious apps allowed
PUAs allowed
This field is only displayed if
Sophos Mobile Security is available for this customer.
Select whether detected suspicious apps are allowed.
This field is only displayed if
Sophos Mobile Security is available for this customer.
Select whether detected PUAs
(Potentially Unwanted Apps) are allowed on devices.
Encryption required
Select whether encryption is required for devices.
On devices with Android 5 or higher, users must additionally enable the Require PIN to
start device or Require
Password to start device
setting when they set a screen lock. See Sophos knowledgebase article
123947 .
Data roaming allowed
Select whether data roaming is allowed for devices.
Locate permission required
This setting refers to the
Locate function. Select whether the user has to allow the Sophos Mobile Control app at installation time to retrieve location data in order to be compliant.
Denial of SMC permissions allowed
The Sophos Mobile Control app needs permissions on the device to work properly. The user has to grant these permissions when the app is installed.
Select whether a denial of the required permissions results in a compliance violation.
Android iOS Windows
Mobile
Windows
Desktop
30
administrator help
Setting Description
App is able to locate
Location services must be turned on and the Sophos
Mobile Control app must be allowed to use them.
For Windows Mobile, this rule only affects Windows Phone
8.1 devices.
Process control permission required
Sophos Mobile Security needs usage access to ensure that blocked apps cannot be opened and protected apps will ask for a password.
Select whether a denial of usage access results in a compliance violation.
Allowed apps /
Forbidden apps
Mandatory apps
You can specify either
Allowed apps or Forbidden
apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list. For information on creating app
166).
If you specify Allowed apps, only the listed apps are allowed. If other apps are detected the device will no longer be compliant.
Note: Android system apps are automatically allowed.
If you specify Forbidden
apps, the device will no longer be compliant if these apps are detected.
Specify apps that must be installed. Select the app group containing the mandatory apps from the list. For information on creating app groups, see
(page 166).
Android iOS Windows
Mobile
Windows
Desktop
31
Sophos Mobile Control (in Sophos Central)
Setting Description
Windows Defender must be turned on
Clean status from
Windows Defender required
The Windows Defender setting
real-time protection must be turned on.
Device is not compliant when
Windows Defender shows alerts.
Up-to-date Windows
Defender definitions required
Windows Defender must use the latest spyware definitions.
Android iOS Windows
Mobile
Windows
Desktop
9.3 Assign compliance rules to device groups
1. On the menu sidebar, under MANAGE, click Device groups.
The Device groups page is displayed.
2. Click the blue triangle next to the device group you want to assign a set of compliance rules to and then click Edit.
There is always a Default device group available. For information on how to create your own
device groups, see Create device group (page 51).
3. Under Compliance rules in the fields Corporate devices and Personal devices, select the compliance rules you want to apply.
4. Click Save.
The selected compliance rules are shown on the Device groups page for the relevant device group under Compliance rules (corporate) and Compliance rules (personal).
9.4 Check devices for compliance
After you have configured compliance rules, you can check if enrolled devices comply with the rules defined.
1. On the menu sidebar, under CONFIGURE, click Compliance rules.
The Compliance rules page is displayed.
2. Click Check now.
All enrolled devices are checked for compliance according to the rules defined in Compliance
rules. The specified actions are carried out. The pie chart on the Dashboard is updated accordingly.
32
administrator help
10 Devices
10.1 Add devices
Devices can be added to Sophos Mobile Control in the following ways:
■
Add devices manually. See
■
■
Use the device enrollment wizard to add a device to Sophos Mobile Control, assign it to a
Enable users to enroll devices on their own through the Self Service Portal. See Configure
Self Service Portal (page 16). This portal reduces IT effort by allowing users to carry out tasks
without contacting the helpdesk. The devices are provisioned by executing defined task bundles.
See
We recommend that you use device groups to group devices for easier administration. See
(page 51).
10.1.1 Add device
We recommend that you create one or more device groups before adding your first device to
Sophos Mobile Control. You can then assign each device to a device group, to simplify device
management. See Create device group (page 51).
To add a new device to Sophos Mobile Control:
1. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed.
2. Click Add and then select the platform from the Add device manually menu section.
The Edit device page is displayed.
3. On the Edit device page, specify the following device details: a) In the Name field, enter a unique name for the new device.
b) In the Description field, enter a description for the new device.
c) Under Owner, select Company or Employee.
d) In the Email address field enter an email address.
e) In the Phone number field, enter the phone number of the new device. Enter the phone number in international format, for example
+491701234567
.
f) Under Device group, select the device group the device is to be assigned to.
Note: A Default device group is available. If you have not defined your own device groups yet, you can add devices to this group. For information on how to create your own device
groups, see Create device group (page 51).
33
Sophos Mobile Control (in Sophos Central)
4. To assign a user to the device, click the Edit user assignment icon next to the User field and then click Assign user to device. For further information, see
(page 42).
5. To add custom properties to the device, go to the Custom properties tab and click Add
custom property. For further information, see
Define custom properties for devices (page
42).
6. After you have specified all relevant device details, click Save.
The new device is added to Sophos Mobile Control and displayed on the Devices page under
MANAGE. You can now provision and manage the device.
Note: For iOS devices, when you have configured Sophos Mobile Control to synchronize the device name with the device as described in
Configure iOS settings (page 13), the name you
entered in the Name field is replaced by the name set during synchronization.
10.2 Enroll devices
After you have added new devices in the Sophos Mobile Control console, they must be enrolled with Sophos Mobile Control. You have the following options:
■
You can enroll individual, unmanaged devices using the Devices function. For further information, see
(page 34).
■
You can use the device enrollment wizard to add a device to Sophos Mobile Control, assign
(page 35).
Note: If required, you can use the device enrollment wizard or the auto-enrollment method to enroll iOS devices without Apple ID. This can be useful, for example to preconfigure the
device before handing it over to a user. See Enroll iOS devices without Apple ID
(page 37).
To enroll and configure multiple devices efficiently, the following methods are recommended:
■
You can bundle the tasks that are necessary to enroll devices, apply required policies and install required applications (for example, managed apps for iOS devices). For further information, see
■
You can enable users to enroll devices through the Self Service Portal. To do so, include a task bundle for enrollment when configuring the settings for Self Service Portal use. For further information on how to create the task bundles required for enrollment, see the Sophos Mobile
Control startup guide or the Sophos Mobile Control as a Service startup guide . For further
information on how to select the task bundle in the Self Service Portal settings, see Configure
(page 16).
Note: If you only have a Mobile Security license activated in Sophos Central but no Mobile
Standard license, the device enrollment only affects the Sophos Mobile Security app. You can
manage Sophos Mobile Security with Sophos Mobile Control, as described in Manage Sophos
(page 194). Other features of Sophos Mobile Control are not available.
10.2.1 Enroll individual devices
1. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed.
34
administrator help
2. Select the desired device, click Actions and then click Enroll.
Note: It is possible to select several devices for enrollment.
3. Click Yes, when you are asked if you want to enroll the selected devices.
The enrollment task is started and displayed on the Task view page. An email with enrollment instructions is sent to the user.
10.2.2 Use the device enrollment wizard to assign and enroll new devices
You can easily enroll new devices with the device enrollment wizard. It provides a workflow that combines the following tasks:
■
■
Add a new device to Sophos Mobile Control.
Assign a user to the device.
■
■
Enroll the device.
Optional: Transfer a task bundle to the device.
To start the device enrollment wizard:
1. On the menu sidebar, under MANAGE, click Devices, and then click Add > Enrollment
wizard.
Tip: Alternatively, you can start the wizard from the Dashboard page by clicking the Add
device widget.
2. On the Enter user search parameters wizard page, enter search criteria to look up a user the device will be assigned to.
Click Next to continue.
3. The wizard displays a list of matching users.
Select the required user and click Next.
35
Sophos Mobile Control (in Sophos Central)
4. On the Device details wizard page, configure the following settings:
Option
Platform
Name
Description
Phone number
Email address
Owner
Device group
Description
The device platform. You can only select a platform that is enabled for the customer that you logged in to.
A unique name under which the device will be managed by Sophos
Mobile Control.
An optional description of the device.
An optional phone number. Enter the number in international format, for example
+491701234567
.
The email address to which the enrollment instructions will be sent.
Select the device owner: either Company or Employee.
Select the device group the device will be assigned to. If you have not created a device group yet, you can select the device group
Default, which is always available.
When you are ready, click Next.
5. On the Bundle selection wizard page, select a task bundle that will be transferred to the device after it has been enrolled, or select Only enroll device to enroll the device without transferring a task bundle.
Note: Only task bundles that contain an Enroll task are displayed.
When you are ready, click Next. The device is added to Sophos Mobile Control.
6. On the Enrollment wizard page, follow the instructions to install the Sophos Mobile Control app onto the device and to complete the enrollment and provisioning.
7. When enrollment has been completed successfully, click Finish to close the device enrollment wizard.
Note:
■
When you have made all the selections, you can close the wizard without having to wait for the Finish button to appear. An enrollment task is created and processed in the background.
■
■
If you have selected a task bundle to be transferred to the device after enrollment, you can
For iOS devices, when you have configured Sophos Mobile Control to synchronize the device
name with the device as described in Configure iOS settings (page 13), the name you entered
in the Name field is ignored and the name that is configured on the device is used instead.
36
administrator help
10.2.3 Auto-enroll iOS devices
You can configure iOS devices to auto-enroll with Sophos Mobile Control during device activation.
To do so, you use Apple Configurator 2 to assign devices to the Sophos Mobile Control MDM server. When the users switch on their devices for the first time, the iOS setup assistant starts.
During setup, the devices are automatically enrolled with Sophos Mobile Control.
Note: For auto-enrollment, it is required that the user that activates the device is registered for the Sophos Central Self Service Portal.
Note: For a detailed description of Apple Configurator 2, see the Apple Configurator 2 online help .
To configure auto-enrollment of iOS devices with Sophos Mobile Control:
1. As a one-time step to prepare auto-enrollment, create a device group that will be assigned to devices during auto-enrollment with Sophos Mobile Control. In the device group properties, select the Enable iOS auto-enrollment option. See
(page 51).
2. Make a note of the URL that is displayed in the Auto-enrollment URL field of the device group.
You need this URL when you configure devices with Apple Configurator 2.
3. Connect the iOS device you want to auto-enroll to an USB port of a Mac with Apple
Configurator 2 installed.
4. In Apple Configurator 2, use the Prepare Assistant to set up the device configuration.
5. Select Manual Enrollment and then enter the auto-enrollment URL of the device group.
6. Follow the further steps of the Prepare Assistant. You can optionally configure the following aspects of the device activation:
■
■
■
■
Enable device supervision mode.
Configure host computers to which the device is allowed to connect with, using USB ports.
For supervised devices, generate or choose a "supervision identity".
Disable configuration steps of the iOS setup assistant.
After you have completed the configuration, hand over the device to the user. When the user switches on the device for the first time, the iOS setup and the enrollment with Sophos Mobile
Control are performed as configured.
Tip: By default, Sophos Mobile Control manages auto-enrolled devices under a name that is composed from the device ID and the device type. Alternatively, Sophos Mobile Control can use
(page 13).
10.2.4 Enroll iOS devices without Apple ID
You can enroll an iOS device with Sophos Mobile Control without having to associate the device with an Apple ID first. This can be useful for example to preconfigure the device before handing it over to a user.
The standard enrollment method includes the installation of the Sophos Mobile Control app onto the device. Because the app is installed from the App Store and an Apple ID is required to access the App Store, you need to associate the device with the ID before starting the enrollment.
37
Sophos Mobile Control (in Sophos Central)
Alternatively, you can enroll an iOS device without installing the Sophos Mobile Control app, so there is no need to associate the device with an Apple ID. This is provided by:
■
The auto-enrollment method. See
(page 37).
■
The device enrollment wizard. See Use the device enrollment wizard to assign and enroll new devices
(page 35).
In the Device enrollment wizard, do as follows:
1. On the Enrollment page, select the Enrollment without Apple ID tab.
2. Use the device's web browser to open the enrollment URL. This opens a Sophos Mobile
Control enrollment form.
3. In that form, enter the token and then click Enroll.
4. Follow the instructions on the device to install the enrollment task bundle.
10.3 Unenroll devices
You can unenroll devices that will no longer be used, for example, if a user gets a new device.
This is useful, for example, if you have limited the number of devices a user can enroll through the Self Service Portal.
1. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed with all devices enrolled with Sophos Mobile Control for this customer.
2. Select the desired device, click Actions and then click Unenroll.
A message is displayed prompting you to confirm that you want to unenroll the device.
Note: It is possible to select several devices for unenrollment.
3. Click Yes.
The device is unenrolled. This results in the following:
Android devices:
■
The Sophos Mobile Control Client device administrator is disabled.
■
■
The server login data and all other data received are removed.
The container apps (Sophos Secure Workspace and Sophos Secure Email) and the Sophos
Mobile Security app are reset.
iOS devices:
■
All profiles are removed.
■
All managed apps are removed.
■
All certificates received through Mobile Device Management are removed.
■
The container apps (Sophos Secure Workspace and Sophos Secure Email) are reset.
38
administrator help
10.4 Manage devices
On the menu sidebar, under MANAGE > Devices and Device groups, you can keep track of devices and device groups and carry out a number of administrative tasks. After adding devices to Sophos Mobile Control you can, for example:
■
■
View and edit device details.
Allow or forbid email access for devices.
■
■
■
■
■
Lock or unlock devices remotely.
Reset device passwords.
Wipe the device remotely in case of loss or theft.
Decommission devices (Android and iOS).
Delete devices.
10.4.1 View devices
1. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed, showing all devices enrolled with Sophos Mobile Control for this customer.
2. Go to the required device and click its name.
The Show device page is displayed for the selected device.
Tip:
On the Devices page you can display additional information by pointing to certain elements:
■
■
Point to the "Not managed" icon of a device to display the actual status like Unenrolled or
Checked out.
Point to the "Not compliant" icon of a device to display the severity level (high, medium, low).
10.4.1.1 The Show device page
On the Show device page, all relevant information for an individual device is displayed.
In the upper part of the page, you can see the most important device information at a glance.
In the lower part of the page, detailed device information is displayed on several tabs. The tabs and information shown depend on the device platform.
■
Profiles (Android, iOS)
Shows the profiles (including provisioning profiles) installed on the device.
The tab also contains commands to install profiles onto the device or to remove them.
■
Policies
Shows the policies assigned to the device.
39
Sophos Mobile Control (in Sophos Central)
On this tab, the Assign policy button is available to assign a policy to the device.
■
Device properties
Shows device properties, for example, properties for model, model name, OS version. For
Android devices, rooted smartphones are detected and the relevant property is shown. For iOS devices, jailbroken smartphones are detected and the relevant property is shown.
■
Custom properties
Shows custom device properties. These are the properties that you can create yourself. Custom device properties can, for example, be used in placeholders if no Active Directory connection is available. When you edit a device, you can also add user-specific information here.
■
Internal properties
Shows internal device properties, for example, ActiveSync traffic allowed, IMEI.
■
Compliance violations
This tab is only displayed for non-compliant devices. It shows the compliance violations of the device and the actions taken because of the violation.
■
Installed apps (Android, iOS)
Shows the software installed onto the device.
For iOS devices, the Managed column on the Installed apps tab indicates managed apps.
With Sophos Mobile Control you can push such apps to iOS devices and also silently remove them.
For Android devices, Sophos Mobile Control differentiates between system apps and apps that the user has installed onto the device.
The Size column shows the disk space usage of an app itself. The Data column shows the additional disk space that an app uses for user data, configurations, and so on.
With the Install app button, you can install software onto the device. You can also remove managed apps from iOS devices by clicking the Delete icon next to the relevant app.
■
System apps (Android)
Shows Android system apps on the device.
Note: System apps cannot be removed from the device.
■
Knox apps (Android)
This tab shows the apps that the user has installed in the Samsung Knox container.
■
Knox system apps (Android)
This tab shows the system apps that are installed in the Samsung Knox container.
■
Scan results (Android)
40
administrator help
This tab is only available if the Sophos Mobile Security functionality is available for the customer you are logged in to. It shows the results of the last Sophos Mobile Security scan performed on the device. Sophos Mobile Security is a security app for Android devices that protects devices from malicious apps and assists users in detecting app permissions that could be a security risk. The app can be managed by Sophos Mobile Control. For further information, see
Manage Sophos Mobile Security (page 194).
■
Certificates
Shows the certificates in use on the device.
■
Tasks
This tab shows all unfinished and failed tasks for the device as well as the finished tasks of the last few days. You can also view these tasks, together with the tasks for all other devices, on the Task view page. See
From the Show device page, you can directly switch to the Edit device page. To edit the device you are viewing, click Edit.
10.4.1.2 Use the extended device filter
With the extended device filter, you can filter the device lists according to your needs.
To use the device filter:
1. On the Devices page, click the Extended filter button (magnifier icon) in the header bar.
The Device filter: Filter is not active. dialog box is displayed.
2. Define your filter criteria.
3. After you have selected the required criteria, click Filter.
The filter is activated and the list of devices is reloaded. The magnifier icon in the header bar changes its color from blue to green to indicate that the filter is active. To reset the filter, click
Extended filter again and click Reset in the filter dialog.
Note: Remember to reset filters manually when they are no longer needed. Otherwise, lists or reports may not include the results you expect.
10.4.2 Edit devices
1. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed with all devices enrolled with Sophos Mobile Control for this customer.
2. Click the blue triangle next to the required device and then click Edit.
The Edit device page is displayed for the selected device.
3. Make the necessary changes (for example, install or remove software on the Installed apps tab) and click Save.
Your changes are applied to the edited device.
41
Sophos Mobile Control (in Sophos Central)
Note: Property changes only become valid after you have clicked Save. If you do not save the changes you have made, they do not have any effect.
10.4.2.1 Assign a user to a device
1. On the menu sidebar, under MANAGE, click Devices.
2. On the Devices page, click the blue triangle next to the required device and then click Edit.
3. On the Edit device page, click the Edit user assignment icon next to the User field and then click Reassign user to device.
4. In the Enter user search parameters step of the assignment dialog, enter search parameter in one or more fields to filter the user list that will be displayed in the next step. For example, enter the user name or part of it.
5. In the Select user step, select the required user and then click Apply.
6. On the Edit device page, click Save.
10.4.2.2 Define custom properties for devices
You can define custom properties for individual devices.
When you define a property with name my property
, you can refer to the value of the property in profiles and policies by using the placeholder
%_DEVPROP(my property)_%
. For example, you can use this to refer to the user that is assigned to a device.
For details on profile and policy placeholders, see
Placeholders in profiles and policies
(page 55).
Note:
■
■
You cannot create a custom device property with the same name as a standard device property.
When you duplicate a device as described in , the new device receives the custom properties
of the source device.
■
As well as the device-level custom properties described here, you can also define customer-level custom properties. See
(page 15).
To define a custom device property:
1. On the menu sidebar, under SETTINGS, click Setup > General. On the Personal tab, make sure that the Show extended device details option is selected.
2. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed with all devices enrolled with Sophos Mobile Control for this customer.
3. Click the blue triangle next to the required device and then click Edit.
4. On the Edit device page, go to the Custom properties tab and click Add custom property.
5. Enter a Name and a Value for the new custom device property.
6. Click Apply to add the property.
7. Click Save to save the changes to the device.
42
administrator help
10.4.3 Lock device
You can lock a device that is managed by Sophos Mobile Control. This activates the screen lock.
1. On the menu sidebar, under MANAGE, click Devices.
2. On the Devices page, click the blue triangle next to the device that you want to lock or unlock and then click Show.
3. On the Show device page, click Actions > Lock.
A task to activate the lock screen is created and transferred to the device. Users must enter their device password (or their PIN or pattern, if configured) to unlock the device.
You can display the task status on the Task view page.
10.5 Apple DEP
With the Apple Device Enrollment Program (DEP), you can purchase iOS (and OS X) devices in volume for distribution within your company. DEP simplifies the deployment of mobile devices by providing the following features:
■
■
Configurable activation process.
Wireless enabling of supervision mode.
■
■
Over-the-air configuration.
Automatic enrollment of iOS devices with Sophos Mobile Control during device activation.
Tip: For detailed information on DEP, visit the Apple DEP website at http://www.apple.com/business/dep/ .
Preparation steps
To prepare the management of DEP devices with Sophos Mobile Control, perform the following one-time steps:
1. On the Apple DEP web portal, create a virtual MDM server and link it to Sophos Mobile Control.
See
(page 44).
2. In Sophos Mobile Control, create one or more DEP profiles that control various device attributes specific to DEP. With the DEP profile, you can also customize the iOS setup assistant that starts when a device is switched on for the first time. See
Deployment steps
When you purchase DEP devices, the typical deployment process includes the following steps:
1. Purchase the devices from Apple or an approved DEP vendor.
2. On the Apple DEP web portal, assign the devices to the Sophos Mobile Control MDM server.
For this and the next step, see Deploy DEP devices
(page 48).
3. In the Sophos Mobile Control console, assign a DEP profile to the devices.
4. Distribute the devices to your users.
43
Sophos Mobile Control (in Sophos Central)
5. When the users switch on their devices for the first time, the customized iOS setup assistant starts. During setup, the devices are enrolled with Sophos Mobile Control and the user is assigned to the device.
6. If required, you can transfer additional task bundles to the devices to complete the provisioning.
10.5.1 Set up a virtual MDM server
Prerequisite: This procedure assumes that you have already enrolled in the Apple Device
Enrollment Program (DEP) and set up an administrator account for the Apple DEP web portal.
Note: For detailed information on enrolling in DEP, visit the Apple DEP website at http://www.apple.com/business/dep/ or see the Apple Deployment Programs online help .
Tip: If you have already enrolled in the Apple Volume Purchase Program (VPP), you can use the same Apple ID for DEP.
To use Apple DEP with Sophos Mobile Control, you need to create a virtual MDM server on the
Apple DEP web portal and link it to the Sophos Mobile Control server. This includes a verification process to establish a secure connection between Sophos Mobile Control and the Apple DEP web service.
To set up a virtual MDM server for Sophos Mobile Control:
1. Log in to the Sophos Mobile Control console with an administrator account for the customer for which you want to manage the DEP devices.
2. On the menu sidebar, under SETTINGS, click Setup > System setup, and then click the
Apple DEP tab.
3. Click Download public key to download the Sophos Mobile Control public key file for Apple
DEP.
The file is saved to your local computer, using the download settings of your web browser.
4. Open the Apple DEP web portal at https://deploy.apple.com
in a new browser window.
You can do this by clicking the Apple DEP web portal link in Sophos Mobile Control.
5. Log in to the Apple DEP web portal with your company Apple ID.
6. On the portal, go to Device Enrollment Program > Manage Servers, and then click Add
MDM Server.
7. Enter a name for MDM server, for example
Sophos Mobile Control
.
8. In the next step, upload the public key file that you downloaded from Sophos Mobile Control.
9. In the next step, download the server token.
At this point, you may log out from the Apple DEP web portal.
10. On the Apple DEP tab of Sophos Mobile Control, click Upload a file and select the server token that you downloaded from the Apple DEP web portal.
The details of your virtual MDM server are displayed.
11. Click Save to save your changes.
The DEP server token is valid for one year. To notify when the token is about to expire, Sophos
Mobile Control sends several email reminders to all administrators of the relevant customer, starting 30 days prior to the expiry date.
Important: When you create a new server token on the Apple DEP web portal, you must use the same Apple ID that you used for the creation of the initial token.
44
administrator help
10.5.2 Create DEP profile
You need to set up the Apple Device Enrollment Program (DEP) before you can create DEP profiles. See
Set up a virtual MDM server (page 44).
A DEP profile is assigned to a DEP device and provides information to the Apple server when the device is activated. This information includes:
■
■
The MDM server (that is Sophos Mobile Control) assigned to manage the device.
Configuration options for the enrollment with Sophos Mobile Control.
■
■
A list of hosts that the device is allowed to pair with.
Customization options for the iOS setup assistant that starts when the device is switched on for the first time.
If required, you can create several DEP profiles to use different setup and enrollment settings for your DEP devices.
To create a DEP profile:
1. On the menu sidebar, under SETTINGS, click Setup > System setup, and then click the
Apple DEP profiles tab.
2. Click Add.
3. In the Edit DEP profile dialog, enter a name and optionally a description for the DEP profile.
4. Optional: In the Device group list, select a device group that will be assigned to devices when they are enrolled with Sophos Mobile Control.
For information on device groups, see Device groups (page 51).
Note: To simplify device management, we recommend that you use a separate device group for DEP devices.
5. Optional: In the Task bundle list, select a task bundle that will be transferred onto the devices when they are enrolled with Sophos Mobile Control.
The list includes all iOS task bundles that contain no enrollment task.
For information on task bundles, see
45
Sophos Mobile Control (in Sophos Central)
6. On the Enrollment tab, you can configure the following settings:
Option Description
Supervise device
Supervision mode is enabled.
User can remove MDM profile
The user is able to remove the Sophos Mobile Control enrollment profile through the iOS user interface.
This option can only be deselected for supervised devices.
Install SMC app
User can skip MDM profile assignment
Install the Sophos Mobile Control app onto the device.
If you enable this option, you must also disable the Skip Apple ID option on the iOS setup tab to make sure that Sophos Mobile Control can install the app from the App Store.
Note: Alternatively, if you are enrolled in the Apple Volume Purchase
Program (VPP), the Sophos Mobile Control app can be installed as a VPP app, even if the device is not associated with an Apple ID.
Devices must be in status managed and must use iOS 9 or higher.
See
(page 163).
The user is able to skip the setup step that applies the Sophos Mobile
Control enrollment profile.
46
administrator help
7. On the iOS setup tab, you can disable configuration steps of the iOS setup assistant that starts when the device is switched on for the first time.
Note: These settings only affect the iOS setup. If you disable a configuration step, the user is still able to enable the relevant option later. To completely disable a feature, use a
Restrictions configuration. See
Restrictions configuration (iOS device profile)
(page 100).
Option
Skip Apps & Data
Description
The page Apps & Data is not displayed. The user cannot restore data from an iCloud or iTunes backup, or transfer data from an
Android device.
Disable "Move Data from
Android"
On the Apps & Data page, the option Move Data from Android is not available. The user cannot transfer data from an Android device.
This can only be enabled when Skip Apps & Data is also enabled.
Skip Diagnostics
Skip Location Services
Skip Siri
Skip Display Zoom
Skip Apple ID
Skip Apple Pay
Skip Touch ID
Skip Passcode
Skip Terms and Conditions
The page Diagnostics is not displayed. Sending diagnostic and usage data to Apple is disabled.
The page Location Services is not displayed. The user cannot enable location services.
The page Siri is not displayed. The user cannot set up Siri.
The page Display Zoom is not displayed. The user cannot change the display view.
The page Apple ID is not displayed. The user cannot log in with their
Apple ID to access Apple services.
The page Apple Pay is not displayed. The user cannot add credit or debit card information for paying in stores or within apps using
Apple Pay.
The page Touch ID to is not displayed. The user cannot set up a fingerprint in place of a passcode.
The page Create a Passcode is not displayed. The user cannot set up a passcode to unlock the device.
The page Terms and Conditions is not displayed.
47
Sophos Mobile Control (in Sophos Central)
8. On the Support information tab, you can configure the following settings:
Option
Department
Description
The department or location name associated with the profile.
This name is included in the information that the user can access by clicking About Configuration during device setup.
Phone number
The support phone number for your company.
This field is pre-populated with the phone number from the technical support contact details. See
Configure technical support contact details (page 15).
Note: The phone number is stored internally in the DEP profile but is not available to the device user.
The support email address for your company.
This field is pre-populated with the email address from the technical support contact details. See
Configure technical support contact details (page 15).
Note: The email address is stored internally in the DEP profile but is not available to the device user.
9. On the USB pairing tab, you configure host computers to which the device is allowed to connect with, using USB ports.
This can be used to sync the device with iTunes or to manage it with Apple Configurator.
■
■
To allow USB connection with all hosts, select Allow USB pairing with all hosts.
To forbid USB connection or to restrict it to certain hosts, deselect Allow USB pairing with
all hosts and then upload a certificate file for each host to which the device is allowed to connect with.
10. When you have configured all tabs of the Edit DEP profile dialog, click Apply to save the
DEP profile.
11. To assign the profile to all new DEP devices to which no profile has been manually assigned to, select it in the Default DEP profile assigned to new devices list.
When you select None, you have to manually assign a DEP profile to new DEP devices as
described in Deploy DEP devices (page 48). Otherwise, DEP devices will not be enrolled with
Sophos Mobile Control when they are activated.
12. Click Save to save your changes.
10.5.3 Deploy DEP devices
Perform this procedure to connect your devices to Apple DEP and to enroll them with Sophos
Mobile Control.
48
administrator help
You can manage devices that you have purchased from Apple or from an approved DEP vendor.
Before you can connect devices to Apple DEP, you need to configure the device vendor on the
Apple DEP portal.
Note: In a typical DEP workflow, you perform this procedure before handing over the devices to your users for activation and usage.
Note: Only users that are registered for the Sophos Central Self Service Portal can activate DEP devices.
Note: For a detailed description of the Apple DEP portal, see the Apple Deployment Programs online help .
To assign your devices to Sophos Mobile Control and to assign a DEP profile to them:
1. Open the web portal for the Apple deployment programs at https://deploy.apple.com
in your web browser and then log in with your company Apple ID.
2. On the portal, go to Device Enrollment Program > Manage Devices.
3. Under Choose Devices By, select your new devices by serial number, by order number, or upload a CSV file containing the serial numbers of your devices.
Note: If you have purchased your devices from a reseller, they are available on the DEP portal within 24 hours after the reseller posts your order to Apple.
4. Under Choose Action, select Assign to Server and then select the virtual MDM server that you have set up for Sophos Mobile Control as described in
(page
44).
5. Click OK to perform the assignment.
At this point, you may log out from the Apple DEP web portal.
You may skip the remaining steps if you have configured a default DEP profile as described in
6. Log in to the Sophos Mobile Control console with an administrator account for the customer for which you want to manage the DEP devices.
7. On the menu sidebar, under MANAGE, click Devices and then click Apple DEP.
The Apple DEP devices page lists all devices that you have assigned to Sophos Mobile
Control on the Apple DEP web portal.
8. If the devices that you just assigned to Sophos Mobile Control do not appear in the list, click
Synchronize with Apple DEP portal.
Note: To limit the load on the Apple DEP server, repeated synchronization is possible only after a short queue time.
9. Select the new devices and then click Actions > Assign profile.
10. In the confirmation dialog, select the DEP profile you want to assign to the devices and then click OK.
When the purchased devices arrive at your company, you can hand them over to your users. No further configuration is required. When the users switch on their devices for the first time, the iOS setup and the enrollment with Sophos Mobile Control are performed as configured in the assigned
DEP profile.
49
Sophos Mobile Control (in Sophos Central)
10.5.4 Manage DEP devices
DEP devices are managed in Sophos Mobile Control just as non-DEP devices are. See
Specifically to DEP, you can assign a DEP profile to a device. The DEP profile provides information to the Apple server when the device is activated. See
Note: Because a DEP profile is only used for device activation, changing the assigned DEP profile has no effect on the device until it is reset and then activated again.
To change the DEP profile of a device:
1. On the menu sidebar, under MANAGE, click Devices and then click Apple DEP.
The Apple DEP devices page lists all devices that you have assigned to Sophos Mobile
Control on the Apple DEP web portal.
2. Click Synchronize with Apple DEP portal to update the DEP information.
Note: To limit the load on the Apple DEP server, the Synchronize with Apple DEP portal option is disabled after a synchronization and becomes available again after a few minutes.
3. Select the devices to which you want to assign a different DEP profile.
4. Click Actions > Assign profile.
5. In the confirmation dialog, select the DEP profile you want to assign to the devices and then click OK.
50
administrator help
11 Device groups
Device groups are used to categorize devices. They help you to manage devices efficiently as you can carry out tasks on a group rather than on individual devices.
A device always belongs to exactly one device group. You assign a device to a device group when you add it to Sophos Mobile Control.
Tip: Only group devices with the same operating system. This makes it easier to use groups for installations and other operating system specific tasks.
11.1 Create device group
1. On the menu sidebar, under MANAGE, click Device groups, and then click Create device
group.
2. On the Edit device group page, enter a Name and a Description for the new device group.
3. In the Compliance rules section, use the Corporate devices and Personal devices lists to select the compliance rules you want to apply.
4. Click Save.
Note: The device group settings contain the Enable iOS auto-enrollment option. This option
allows you to enroll iOS devices with the Apple Configurator. See Auto-enroll iOS devices
(page 37)
The new device group is created and shown on the Device groups page.
11.2 Delete device groups
1. On the menu sidebar, under MANAGE, click Device groups.
2. On the Device groups page, click the blue triangle next to the device group that you want to delete, and then click Delete.
3. In the confirmation dialog, select one of the remaining device groups to which devices from the current device group will be re-assigned.
This selection is not available when there are no devices assigned to the current device group.
4. Click Yes to delete the device group.
Note: When there is only one device group left and there are devices assigned to it, you cannot delete this device group.
51
Sophos Mobile Control (in Sophos Central)
12 Profiles and policies
Profiles
Profiles are settings that you define and then install onto a device or device group.
To install a profile on one or more devices, Sophos Mobile Control creates a task and executes it at the specified time. When you update a profile, you must install it again for the changed configurations to take effect on the device.
The following profile types are available:
Configurations for Android device profiles
(page 58)
Configurations for Android for Work policies
(page 75)
Configurations for Knox container profiles (page 94)
Configurations for iOS device profiles
(page 99)
Policies
Policies are settings that you define and then assign to a device or device group. You can only assign one policy of each type to one device.
If you assign a policy to a device, a sync is triggered and the settings take effect immediately.
Assigned policies are updated on the device each time a device connects to the Sophos Mobile
Control server. So when you update a policy, you do not have to explicitly re-apply it to the device.
The following policy types are available:
Configurations for Sophos container policies for Android (page 84)
Configurations for Mobile Security policies (page 94)
Configurations for Sophos container policies for iOS
(page 125)
Configurations for Windows Mobile policies
(page 134)
Configurations for Windows Desktop policies
(page 143)
12.1 Create profile or policy
Profiles and policies are made up of one or more configurations. By adding configurations, you define the scope of the profile or policy, that is, the areas that are managed on the devices.
1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click the platform for which you want to create the profile or policy.
2. On the Profiles and policies page, click Create. If there is more than one profile or policy type available for a platform, Create opens a menu from which you can select the required type.
For a list of available profile and policy types, see Profiles and policies (page 52).
52
administrator help
3. Enter a name, a version and a description.
Required fields are marked with a red asterisk.
4. For Sophos container policies, a General configuration is mandatory and is automatically added to the policy. On the Edit policy page, click General to open the configuration and make the required changes.
5. For Android for Work policies, a Restrictions configuration is mandatory and is automatically added to the policy. On the Edit policy page, click Restrictions to open the configuration and make the required changes.
6. To add more configurations to the profile or policy, click Add configuration and then select the configuration you want to add.
Note: The configurations supported may depend on the version of the operating system or on other device features. The requirements are indicated by a blue label.
7. In the settings page of the configuration, specify the required settings.
8. Optional: Repeat the previous steps to add more configurations.
9. After you have added all required configurations, click Save.
The profile or policy is created. For information on how to apply it to devices, see
Install a profile onto devices (page 56) or Assign a policy to devices (page 56).
12.2 Import iOS device profiles created with Apple
Configurator
You can import profiles created with Apple Configurator into Sophos Mobile Control.
Apple Configurator can be downloaded from the App Store.
Note: You import device profiles with the same procedure as provisioning profiles for your self-developed iOS apps. When you upload a profile file, Sophos Mobile Control analyzes its content in order to distinguish between the two profile types.
1. After you have created a profile in Apple Configurator, export it (unencrypted and unsigned) and save it on your computer.
2. On the menu sidebar, under CONFIGURE, click Profiles, policies > Apple iOS.
3. On the Profiles and policies page, click Create > Import profile.
The Edit profile page is displayed.
4. Enter a name, a description and, optionally, a version for the new profile in the relevant fields.
5. Click Upload a file and navigate to the file you have saved on your computer, select it and click Open.
6. Click Save.
The profile is created. It can be installed onto devices. See
Install a profile onto devices
(page
56).
53
Sophos Mobile Control (in Sophos Central)
12.3 Import provisioning profiles for iOS apps
When you develop your own iOS apps, you create provisioning profiles so that your apps can be installed from an IPA file instead of the App Store. You can upload these provisioning profiles to the Sophos Mobile Control server to subsequently distribute them to your devices.
For details on provisioning profiles, see the iOS Developer Library.
Note: You import provisioning profiles with the same procedure as device profiles created with
Apple Configurator. When you upload a profile file, Sophos Mobile Control analyzes its content in order to distinguish between the two profile types.
1. After you have generated a provisioning profile in your iOS development environment, save it on your computer.
2. On the menu sidebar, under CONFIGURE, click Profiles, policies > Apple iOS.
3. On the Profiles and policies page, click Create > Import profile.
The Edit profile page is displayed.
4. Enter a name, a description and, optionally, a version for the new profile in the relevant fields.
5. Click Upload a file and navigate to the file you have saved on your computer, select it and click Open.
6. Click Save.
The profile is created. It can be installed onto devices. See
Install a profile onto devices
(page
56).
12.4 Windows Desktop password complexity rules
Password complexity rules (for example length, number of uppercase and lowercase letters) for
Windows Desktop devices are fixed and cannot be set by a Sophos Mobile Control policy. Different rules apply for local and for Microsoft accounts.
Local accounts
■
■
■
Password must not contain the user's account name or more than two consecutive characters from the user's full name.
Password must be six or more characters long.
Password must contain characters from three of the following four categories:
■
■
■
■
Uppercase characters A-Z (Latin alphabet)
Lowercase characters a-z (Latin alphabet)
Digits 0-9
Special characters (!, $, #, %, etc.)
54
administrator help
Microsoft accounts
■
■
Password must be eight or more characters long.
Password must contain characters from two of the following four categories:
■
■
Uppercase characters A-Z (Latin alphabet)
Lowercase characters a-z (Latin alphabet)
■
■
Digits 0-9
Special characters (!, $, #, %, etc.)
12.5 Samsung Knox support
You can manage your Samsung Knox devices with Sophos Mobile Control.
Note: In order to manage Samsung Knox devices, a Samsung Knox Premium license key needs to have been entered in the Sophos Mobile Control System setup.
To install apps in a Samsung Knox container, see Add app (page 157).
To manage your Samsung Knox devices you can create task bundles for the following actions:
■
■
■
■
Knox container: lock
Knox container: unlock
Knox container: reset password
Knox container: remove (removes the container and all related configuration from the device)
To create a task bundle for a Samsung Knox device, see
Create task bundle (page 149).
12.6 Placeholders in profiles and policies
Profiles and policies may contain placeholders which are replaced by actual data at the time of task execution. The following placeholders can be used in profiles:
■
Placeholders for user data:
■ %_EMAILADDRESS_%
■
%_USERNAME_%
■
Placeholders for device properties:
■
%_DEVPROP(property name)_%
property name
can be either a standard property or a custom property of the device.
See
Define custom properties for devices
(page 42).
55
Sophos Mobile Control (in Sophos Central)
■
Placeholders for customer properties:
■ %_CUSTPROP(property name)_%
See
Define customer properties (page 15).
12.7 Install a profile onto devices
1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click one of the device platforms that support profiles:
■
■
Android
Apple iOS
The Profiles and policies page for the selected platform is displayed.
2. Click the blue triangle next to the profile to be installed and then click Install.
The Select devices page is displayed.
3. On this page, you can:
■
■
Select individual devices onto which you want to install the profile.
Click Select device groups and select one or several device groups.
4. After you have made your selection, click Next.
The Set execution date page is displayed.
5. Under Scheduled date, select Now or specify a Date and Time for the execution of the task.
6. Click Finish.
The Task view is shown.
The profile is installed onto the selected devices at the specified date and time.
Note: You can also install a profile by using one of the following options:
■
■
Create a task bundle with an Install profile or assign policy task and transfer it to the required devices or device groups.
On the device's Show device page, select the Profiles tab and click Install profile.
12.8 Assign a policy to devices
1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click one of the device platforms that support policies:
■
■
■
■
Android
Apple iOS
Windows Mobile
Windows Desktop
The Profiles and policies page for the selected platform is displayed.
56
administrator help
2. Click the blue triangle next to the policy to be assigned and then click Assign.
The Select devices page is displayed.
3. On this page, you can:
■
■
Select individual devices you want to assign the policy to.
Click Select device groups and select one or several device groups for assigning the policy.
4. After you have made your selection, click Finish.
The policy is assigned to the selected devices and a synchronization process for the selected devices is triggered.
Note: You can also assign a policy by using one of the following options:
■
■
Create a task bundle with an Install profile or assign policy task and transfer it to the required devices or device groups.
On a device's Show device page, select the Policies tab and click Assign policy.
Note: Policies cannot be removed from a device. To disable a policy, you must assign a different policy to that device.
12.9 Remove profile
Use one of the following procedures to remove a profile from devices:
■
On a device's Show device page select the Profiles tab. Click the blue triangle next to profile you want to remove and then click Remove.
■
Create a task bundle with a Remove profile task and transfer it to the required devices or device groups.
12.10 Download profiles and policies
You can download profiles and policies that you have configured in the Sophos Mobile Control console. This is useful, for example, if you need to pass the defined settings on to Sophos Support.
1. On the menu sidebar, go to Profiles, policies and click a device platform.
The Profiles and policies page for the selected platform is displayed.
2. Click the name of the required profile or policy.
The Show profile or Show policy page is displayed.
3. Click Download.
The profile or policy is saved to your local computer as follows:
■ iOS profiles are saved as XML Plist files with extension
.mobileconfig
.
■
Android profiles are saved as XML files with extension
.smcprofile
.
■
Android and iOS policies are saved as JSON files.
57
Sophos Mobile Control (in Sophos Central)
■
Windows Mobile policies are saved as XML files with extension
.windowsphoneconfig
.
■
Windows Desktop policies are saved as XML files with extension
.windowsdesktopconfig
.
12.11 Configurations for Android device profiles
With an Android device profile you configure various aspects of Android devices, like password policies, restrictions or Wi-Fi settings.
For information on how to create a device profile, see
Create profile or policy (page 52).
12.11.1 Password policies configuration (Android device profile)
With the Password policies configuration you define password rules for devices.
Note: The settings supported may depend on the version of the operating system or on other device features. The scope is indicated by a blue label in Sophos Mobile Control.
Password type
When you select the Password policies configuration, the Password type list is displayed. In this list, select the type of password you want to define:
Setting/Field
Any
Alphabetic
PIN
Alphanumeric
Complex
Description
Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock. No additional restrictions are imposed.
Users must set a Passwordscreen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.
Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.
Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length. See the following table.
Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.
58
administrator help
If you select Alphabetic, PIN, Alphanumeric or Complex, the following fields are displayed:
Setting/Field Description
Minimum password length
Idle time before password prompt
The minimum number of characters a password must contain.
The time (in seconds) after the device will be locked if it has not been used. The device can be unlocked by entering the password.
Maximum password age in days
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
Maximum number of failed attempts until device wipe
The maximum number of failed attempts to enter the correct password before the device is wiped.
Minimum history length
The number of old passwords that are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password. Value range: 1 to 5 or none.
If you select Complex, the following additional fields are displayed:
Setting/Field Description
Minimum number of letters
Minimum number of lowercase letters
Minimum number of uppercase letters
The minimum number of letters a password must contain.
The minimum number of lowercase letters a password must contain.
The minimum number of uppercase letters a password must contain.
Minimum number of non-alphabetic characters
The minimum number of non-alphabetic characters
(for example & or !) a password must contain.
Minimum number of numerals
The minimum number of numerals a password must contain.
59
Sophos Mobile Control (in Sophos Central)
Setting/Field
Minimum number of special characters
Description
The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.
12.11.2 Restrictions configuration (Android device profile)
With the Restrictions configuration you define restrictions for devices.
Security
Setting/Field
Force encryption
Force SD card encryption
Allow fast encryption
Allow factory reset
Allow developer options
Allow safe mode
Allow USB debugging
Allow firmware recovery
Description
Users must encrypt their devices.
When the profile is installed onto a device, the user must encrypt the SD card.
Note: For some device types, users can choose to cancel the encryption. They will be reminded again on the next SD card mount.
If the check box is cleared, the fast encryption options in the device settings are unavailable.
If the check box is cleared, users cannot reset their devices to factory state.
If the check box is cleared, users cannot change the developer options.
If the check box is cleared, users cannot boot the device in safe mode.
If the check box is cleared, USB debugging is turned off.
Note: For Sony devices with Enterprise API version 9 or above, clearing the Allow USB debugging checkbox makes all developer options unavailable.
If the check box is cleared, all types of firmware updates
(like over-the-air, download etc.) are turned off.
60
administrator help
Setting/Field
Allow backup
Allow settings changes
Allow clipboard
Enable shared clipboard
Allow screen capture
Allow mock GPS locations
Allow over-the-air firmware updates
Allow audio recording
Allow video recording
Allow Activation Lock
Allow S Beam
Allow S Voice
Description
If the check box is cleared, users cannot create system backups. Google backup is turned off. Other backup methods (for example Sophos Mobile Control backups) remain available.
If the check box is cleared, users cannot change device settings. Depending on individual devices the settings icon is removed.
If the check box is cleared, users cannot copy any contents to the clipboard.
Note: This setting applies to devices with Android 4.2.2 or higher.
Allows users to copy clipboard content between apps.
If the check box is cleared, each app has an individual clipboard.
This setting is only available if you select Allow clipboard.
If the check box is cleared, users cannot take a screenshot of the display.
If the check box is cleared, users cannot select a mock location app in the Android developer options.
If the check box is cleared, over-the-air firmware updates are turned off.
If the check box is cleared, users cannot perform audio recording.
If the check box is cleared, users cannot record videos. They can take pictures and stream videos.
If the check box is cleared, the Activation Lock options in the device settings are unavailable.
If the check box is cleared, the Samsung S Beam app is unavailable.
If the check box is cleared, the Samsung S Voice app is unavailable.
61
Sophos Mobile Control (in Sophos Central)
Setting/Field
Allow “Share via”
Description
If the check box is cleared, the Share via feature is turned off.
Accounts
Setting/Field
Allow multiple user accounts
Allow addition of new email accounts
Description
If the check box is cleared, multi-user support is turned off.
Users or other apps cannot create additional user accounts.
If the check box is cleared, users cannot add email accounts.
This does not affect the account creation through a device profile.
Allow removal of the Google account
Allow auto-sync for Google accounts
If the check box is cleared, users cannot remove the Google account from the device.
If the check box is cleared, Google accounts are not synchronized automatically. Users are still able to perform a manual sync from inside some apps like Gmail.
Network and communication
Setting/Field
Allow airplane mode
Allow sync while roaming
Allow emergency calls only
Force manual sync during roaming
Description
If the check box is cleared, users cannot enable airplane mode.
If the check box is cleared, synchronization while roaming is turned off.
Only emergency calls are allowed. All other calls will be blocked.
Automatic data synchronization is turned off when the device is roaming. This affects all configured accounts, such as
Google or Exchange.
62
administrator help
Setting/Field
Force mobile data connection
Allow SMS
Allow mobile data connection while roaming
Allow voice calls while roaming
Allow user mobile data limit
Allow VPN
Allow Wi-Fi Direct
Allow Android Beam
Allow Miracast policy
Allow Bluetooth
Allow NFC
Allow Wi-Fi
Description
Users cannot turn off cellular data.
If the check box is cleared, users cannot send text messages.
If the check box is cleared, mobile data connections while roaming are turned off.
If the check box is cleared, voice calls while roaming are turned off.
If the check box is cleared, users cannot set a mobile data limit.
If the check box is cleared, users cannot use VPN connections.
If the check box is cleared, data transfer through Wi-Fi Direct is turned off.
If the check box is cleared, data transfer through Android
Beam is turned off. This includes the Samsung S Beam app.
If the check box is cleared, data transfer through Miracast is turned off.
If the check box is cleared, Bluetooth is turned off.
If the check box is cleared, NFC (near field communication) is turned off.
If the check box is cleared, Wi-Fi is turned off.
63
Sophos Mobile Control (in Sophos Central)
Tethering
Setting/Field
Allow tethering
Allow Wi-Fi tethering
Allow USB tethering
Allow Bluetooth tethering
Allow configuring Wi-Fi tethering
Hardware
Setting/Field
Allow camera
Force GPS for location queries
Allow SD card
Allow moving apps to the SD card
Allow writing to the SD card
Allow microphone
Allow USB
Description
If the check box is cleared, all tethering is turned off. This includes tethering over Wi-Fi, USB and Bluetooth.
Note: If the check box is cleared, the settings Allow Wi-Fi
tethering, Allow USB tethering and Allow Bluetooth
tethering have no effect.
If the check box is cleared, Wi-Fi tethering (Wi-Fi hotspot) is turned off.
If the check box is cleared, USB tethering is turned off.
If the check box is cleared, Bluetooth tethering is turned off.
The user can configure the settings of the Wi-Fi hotspot.
Description
If the check box is cleared, the camera is unavailable.
GPS information is used for device location.
If the check box is cleared, SD cards cannot be used in devices.
If the check box is cleared, users cannot move apps from the internal storage to the SD card.
If the check box is cleared, it is not possible to write to unencrypted SD cards.
If the check box is cleared, the microphone is unavailable.
The USB mass storage mode and the USB media player are available on the device.
64
administrator help
Setting/Field
Allow USB media player
Description
If the check box is cleared, the Media Transfer Protocol
(MTP) is unavailable. Because Android uses MTP for USB file transfer, any file transfer over USB is blocked.
Applications
Setting/Field
Allow app install
Allow app uninstall
Allow unsigned app install
Allow Play Store
Allow apps from unknown sources
Allow native browser
Allow app crash reports
Allow wallpaper change
Allow camera on lock screen
Allow widgets on lock screen
Description
If the check box is cleared, users cannot install apps.
If the check box is cleared, users cannot uninstall apps.
If the check box is cleared, users can only install signed
APK files.
If the check box is cleared, the Google Play Store app is unavailable.
Note: This setting applies to devices with Android 4.2.2 or higher.
If the check box is cleared, users can only install apps through the Google Play Store app.
If the check box is cleared, the native browser is unavailable.
Third-party browser apps are not affected.
If the check box is cleared, apps cannot send crash reports.
If the check box is cleared, users cannot change the wallpaper.
If the check box is cleared, the camera is unavailable when the screen is locked.
If the check box is cleared, widgets are unavailable when the screen is locked.
65
Sophos Mobile Control (in Sophos Central)
Setting/Field Description
Allow Knox contact info for personal calls
By default, a Samsung Knox device displays contact information when the user receives a call from a Knox contact while in personal mode.
If the check box is cleared, Knox contact information is not displayed in personal mode.
Allow autofill in browser
Allow cookies in browser
Allow JavaScript in browser
Allow pop-ups in browser
The user can enable autofill in the settings of the native
Android browser. If enabled, web pages can provide suggestions when the user is filling in form data.
If the check box is cleared, autofill is turned off and the browser setting is unavailable.
The user can enable cookies in the settings of the native
Android browser. If enabled, web pages can store cookies on the device.
If the check box is cleared, cookies are turned off and the browser setting is unavailable.
The user can enable JavaScript in the settings of the native
Android browser. If enabled, web pages can execute
JavaScript code on the device.
If the check box is cleared, JavaScript is turned off and the browser setting is unavailable.
The user can enable pop-ups in the settings of the native
Android browser. If enabled, web pages can open new browser windows.
If the check box is cleared, pop-ups are turned off and the browser setting is unavailable.
Allow changing date and time settings
Allowed apps / Forbidden apps
The user can change the date and time settings.
You can configure either Allowed apps or Forbidden apps.
Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.
App installations initiated by the Sophos Mobile Control server are not restricted by this setting.
For information on creating app groups, see
(page 166).
66
administrator help
12.11.3 Knox Premium restrictions configuration (Android device profile)
With the Knox Premium restrictions configuration you define restrictions for Samsung Knox devices. These restrictions apply to the device, not to the Knox container.
Option
Allow firmware auto update options
Enable ODE Trusted Boot verification
Description
The device automatically checks for firmware updates. Users cannot change this in the device settings.
The device decrypts the data partition on boot only if the binary and the kernel are official, i.e. if the device is not rooted.
If the check box is cleared, the device always decrypts the data partition on boot.
Prevent installation of another administrator app
The installation of apps that require device administrator privileges is prevented. This does not affect apps that are installed by Sophos Mobile
Control.
Prevent activation of another administration app
The activation of device administrator privileges for apps is prevented.
Allow Common Criteria mode
The Common Criteria mode (CC mode) of the device is turned on, ensuring that the device meets the security requirements stated by the Mobile Device
Fundamentals Protection Profile (MDFPP).
Note: CC mode is only used if the following requirements are met:
Device encryption is turned on.
Fast encryption is turned off.
External storage encryption is turned on.
A maximum number of failed login attempts until device wipe is set.
Certificate revocation is turned on.
Password history is turned off.
12.11.4 App Protection configuration (Android device profile)
With the App Protection configuration you define password requirements for protecting apps.
With App Protection in use, users must define a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.
67
Sophos Mobile Control (in Sophos Central)
If App Protection is active on a device, the command Reset App Protection password is available in the Actions menu of the Show device page. The user can also reset the App Protection password in the Self Service Portal.
Setting/Field
Password complexity
Grace period in minutes
App group
Description
The minimum complexity requirements for the password to be defined by users, for example 6 char
password.
After the grace period has expired, protected apps can only be unlocked by entering a password.
Select the app group containing the apps that are password protected.
For creating app groups, see
12.11.5 App Control configuration (Android device profile)
With the App Control configuration you define apps that users are not allowed to start. For example, you can use this to block apps that have been pre-installed by the device manufacturer and cannot be uninstalled.
Setting/Field
App group
Description
Select the app group containing the blocked apps.
For information on creating app groups, see App groups (page 166).
12.11.6 Exchange ActiveSync configuration (Android device profile)
With the Exchange ActiveSync configuration you define user settings for your Microsoft Exchange
Server.
Setting/Field
Account name
Exchange ActiveSync host
Description
The account name.
The address of the Microsoft Exchange Server.
Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.
68
Setting/Field
Domain
User
Email address
Sender
Password
Synchronization period
Synchronization interval
SSL
Default account
Allow all certificates
Client certificate
Allow forwarding emails
Allow use of HTML format
Maximum attachment size in MB
administrator help
Description
The domain for this account.
The user for this account.
If you enter the variable
%_USERNAME_%
, the server replaces it with the actual user name.
The email address of the account.
If you enter the variable
%_EMAILADDRESS_%
, the server replaces it with the actual email address.
A sender name for this account.
If you enter the variable
%_EMAILADDRESS_%
, the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The time period emails are synchronized for.
If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.
The interval between email synchronization processes.
All communication is sent through SSL (Secure Socket
Layer).
We recommend that you select this check box.
The account is used as the default email account.
Allow all certificates in transfer processes from the email server.
The client certificate for the connection to ActiveSync.
Allow forwarding of emails.
Allow the use of HTML format in emails.
The maximum size of a single email message (1, 3,
5, 10, Unlimited).
69
Sophos Mobile Control (in Sophos Central)
Setting/Field
Synchronize content types
Description
The content types to be synchronized.
Note:
For Sony devices with Enterprise API version 6.x or below, it is important that the Exchange
ActiveSync account information matches the user that is assigned to the device.
On these devices, the SMC client is not able to send the ActiveSync ID to the SMC server. When a device contacts the SMC EAS proxy for the first time, the ActiveSync ID that the email client sends is not known to Sophos Mobile Control. To verify the account details, the SMC EAS proxy searches for a device with an unknown ActiveSync ID and an assigned user that matches the user information supplied by the email client. If such a device is found, the ActiveSync ID is assigned to that device and the email request is passed on to the Exchange server. Otherwise, the request is rejected.
For details, see Sophos knowledgebase article 121360 .
12.11.7 Wi-Fi configuration (Android device profile)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
Setting/Field
SSID
Security type
Description
The ID of the Wi-Fi network.
The security type of the Wi-Fi network:
None
WEP
WPA/WPA2
EAP/PEAP
EAP/TLS
EAP/TTLS
If you select WEP or WPA/WPA2, a Password field is displayed. Enter the relevant password.
If you select one of the EAP settings, the fields
Identity, Anonymous Identity and Password are displayed. Enter the required EAP information.
If you select EAP/PEAP or EAP/TTLS, the field
Phase 2 authorization is displayed in addition.
Select the type of authorization:
PAP
CHAP
70
administrator help
Setting/Field Description
MSCHAP
MSCHAPv2
12.11.8 VPN configuration (Android device profile)
With the VPN configuration you define VPN settings for network connections.
Setting/Field
Connection name
Server
Connection type
Description
The name of the connection shown on the device.
The host name or the IP address of the server.
The type of the VPN connection:
L2TP/IPsec (PSK)
If you select this type, the fields User, Password and L2TP/IPsec (PSK) are displayed. Enter the user and password. In the L2TP/IPsec (PSK) field, enter the pre-shared key for authentication.
L2TP/IPsec (Certificate)
If you select this type, the fields Client certificate, Root certificate, User and
Password are displayed. In the fields Client certificate and Root certificate, select the relevant certificates. In addition, enter the User and the relevant
Password.
12.11.9 Root certificate configuration (Android device profile)
With the Root certificate configuration you upload a root certificate to devices.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
12.11.10 Client certificate configuration (Android device profile)
With the Client certificate configuration you install a client certificate onto Android devices.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.
71
Sophos Mobile Control (in Sophos Central)
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
12.11.11 SCEP configuration (Android device profile)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).
Note: You must first add a Root certificate configuration to upload the CA certificate of the
SCEP server before you can add a SCEP configuration.
Setting/Field
URL
Alias name
Subject
Type of Subject Alternative Name
Value of Subject Alternative Name
NT user login name
Description
The web address of the Certificate Authority server.
Use the variable
%_SCEPPROXYURL_%
to refer to the server URL that is configured on the SCEP tab of the System setup page.
The name under which the certificate will appear in selection dialogs.
This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the
CN=
prefix.
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.
For example:
Enter
CN=%_USERNAME_%
to specify a user.
Enter
CN=%_DEVPROP(serial_number)_%
to specify a device.
For information on available placeholders, see
Placeholders in profiles and policies (page 55).
Optionally, configure a Subject Alternative Name
(SAN). Select one of the available SAN types.
If you have selected a SAN type, enter the SAN value.
72
administrator help
Setting/Field
Challenge
Root certificate
Key size
Use as digital signature
Use for encryption
Description
The web address to obtain a challenge password from the SCEP server.
Use the variable
%_CACHALLENGE_%
to refer to the challenge URL that is configured on the SCEP tab of the System setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root
certificate configurations of the current profile.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
If you select this check box, the public key can be used as a digital signature.
If you select this check box, the public key can be used for data encryption.
12.11.12 Access Point Name configuration (Android device profile)
With the Access Point Name configuration you specify an Access Point Name (APN) configuration for mobile devices. APN configurations define how devices connect to a mobile network.
Important: We recommend that you ask your carrier for the required settings. If you select Use
as default APN and the settings are not correct, the device cannot access data through cellular networks.
Note: With the exception of the APN field, all settings are optional and should only be specified if required by your mobile network carrier.
Setting/Field
APN
User-friendly name
Description
The APN that the device quotes when it opens a connection with the carrier.
This must match an APN that the carrier accepts.
Otherwise, the connection cannot be established.
An optional name that is displayed on the device in addition to the APN.
73
Sophos Mobile Control (in Sophos Central)
Setting/Field
Proxy server and port
User name, User password
Server
MMSC
MMS proxy server and port
Mobile Country Code (MCC), Mobile Network
Code (MNC)
Description
The address and port of the HTTP server that is used for web traffic.
A user name and password for connecting to the
APN.
The WAP Gateway Server.
The Multimedia Messaging Service Center (MMSC).
The address and port of a HTTP server that is used for communication with the MMSC.
MCC and MNC for specifying the carrier.
The APN is only used for this carrier.
Authentication type
APN type
Bearer
Protocol
Roaming protocol
Use as default APN
The authentication method for PPP connections.
The types of data connection that this APN is used for.
To use the APN for all data types, enter
*
or leave the field empty.
The Radio Access Technology (RAT) that the carrier uses.
The network protocol that is supported by the carrier.
The network protocol that is supported by the carrier when in roaming mode.
If selected, devices will use this APN as default.
An error is raised when you try to select this option in more than one Access Point Name configuration.
12.11.13 Kiosk mode configuration (Android device profile)
With the Kiosk mode configuration you define restrictions for devices to put them into a kiosk mode.
Click Select source and then do one of the following to specify an app that is started when the profile is transferred to a device:
■
Select Custom and enter an app identifier.
74
administrator help
■
■
Select App list and then select an app from the App identifier list. The list contains all apps
that you have configured on the Apps page. See Add app
(page 157).
Select None to configure kiosk mode without specifying an app. The kiosk mode restrictions are applied to the device, but no app is started.
Under Options, deselect hardware and software features you want to disable in kiosk mode.
When the profile is transferred to a device, the app that you specified is started. However, if you have not turn off any of the available hardware or software features, the user will be able to leave the app and use the device as normal. To set the device into a true kiosk mode, you must clear at least the Allow Home button and Allow task manager checkboxes.
Note:
■
■
■
The app that you specify must be installed on the device. If it is not, the transfer tasks will remain in state Incomplete until the app is installed. To install the app, create a task bundle with an Install app task, for example, and transfer it to your devices.
If you want to specify an app for Samsung Knox devices, make sure it is a launcher app. This type of app provides an alternative desktop for Android.
For Sony devices with Enterprise API version 9 or above, if you clear any of the Allow volume
up, Allow volume down or Allow volume mute checkboxes, all volume buttons of the device are disabled.
12.12 Configurations for Android for Work policies
With an Android for Work policy you configure settings that are related to the work profile of a device.
For information on how to create an Android for Work policy, see
Create profile or policy (page
52).
12.12.1 Password policies configuration (Android for Work policy)
With the Password policies configuration you define password rules for the work profile.
Note: The settings supported may depend on the version of the operating system or on other device features. The scope is indicated by a blue label in Sophos Mobile Control.
Password type
When you select the Password policies configuration, the Password type list is displayed. In this list, select the type of password you want to define:
Setting/Field
Any
Description
Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock. No additional restrictions are imposed.
75
Sophos Mobile Control (in Sophos Central)
Setting/Field
Alphabetic
PIN
Alphanumeric
Complex
Description
Users must set a Passwordscreen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.
Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.
Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length. See the following table.
Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.
If you select Alphabetic, PIN, Alphanumeric or Complex, the following fields are displayed:
Setting/Field Description
Minimum password length
Idle time before password prompt
Maximum password age in days
The minimum number of characters a password must contain.
The time (in seconds) after the device will be locked if it has not been used. The device can be unlocked by entering the password.
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
Maximum number of failed attempts until device wipe
The maximum number of failed attempts to enter the correct password before the device is wiped.
Minimum history length
The number of old passwords that are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password. Value range: 1 to 5 or none.
If you select Complex, the following additional fields are displayed:
76
administrator help
Setting/Field Description
Minimum number of letters
Minimum number of lowercase letters
Minimum number of uppercase letters
The minimum number of letters a password must contain.
The minimum number of lowercase letters a password must contain.
The minimum number of uppercase letters a password must contain.
Minimum number of non-alphabetic characters
The minimum number of non-alphabetic characters
(for example & or !) a password must contain.
Minimum number of numerals
The minimum number of numerals a password must contain.
Minimum number of special characters
The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.
12.12.2 Restrictions configuration (Android for Work policy)
With the Restrictions configuration you configure restrictions and related settings for Android for
Work.
Security
Setting/Field Description
Allow screen capture
Allow user to configure credentials
Users can capture the screen content of work apps.
Users can install or remove certificates in the work profile.
Allow work clipboard in personal apps
Users can copy text from a work app and paste it into a personal app.
Pasting clipboard text from a personal app into a work app is always possible.
Allow Smart Lock
Users can turn on the Android Smart Lock feature that automatically unlocks the device in certain situations.
77
Sophos Mobile Control (in Sophos Central)
Setting/Field
Allow location sharing
Description
Work apps can access the device’s location features.
If the check box is cleared, work apps cannot access the device’s location features, even if the user has turned location sharing on.
Allow opening web links in personal apps
Web links that the user taps in a work app can be opened by a personal browser app.
Allow debugging
Allow unlocking device by fingerprint
Users can turn on the debugging features in the Android developer options.
Users can use the fingerprint sensor to unlock the device.
Accounts
Setting/Field
Allow managing accounts
Description
Users can add or remove accounts from the work profile, for example app accounts.
Users cannot remove the Google account from the work profile.
Network and communication
Setting/Field
Allow Android Beam
Allow VPN
Description
Users can send data from work apps through Android Beam
(data transfer through NFC).
Users can use VPN connections for work apps.
78
administrator help
Hardware
Setting/Field
Allow camera
Applications
Description
Work apps can access the camera.
Setting/Field
Allow app uninstall
Allow installing apps from unknown sources
Allow managing apps
Short message
Long message
Description
Users can uninstall work apps.
If the check box is cleared, users can only install work apps from the Google Play Store, not from unknown sources or through Android Debug Bridge (ADB).
If the check box is cleared, users cannot perform the following tasks for work apps:
Uninstall apps
Disable apps
Stop apps
Clear app cache
Clear app data
Clear setting Open by default
A company-specific support message that is displayed to the user when functionality has been turned off.
Note: If you enter more than 200 characters, the message may be truncated.
Additional text to complement the short message. The text is displayed when the user taps More details in screens that display the short message.
Note: This text is also displayed on the Android Device
administrator screen for the Sophos Mobile Control app.
79
Sophos Mobile Control (in Sophos Central)
12.12.3 App Protection configuration (Android for Work policy)
With the App Protection configuration you define password requirements for protecting work apps, i.e. the apps that are installed in the work profile.
With App Protection in use, users must define a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.
If App Protection is active on a device, the command Reset App Protection password is available in the Actions menu of the Show device page. The user can also reset the App Protection password in the Self Service Portal.
Setting/Field
Password complexity
Grace period in minutes
App group
Description
The minimum complexity requirements for the password to be defined by users, for example 6 char
password.
After the grace period has expired, protected apps can only be unlocked by entering a password.
Select the app group containing the apps that are password protected.
For creating app groups, see
12.12.4 App Control configuration (Android for Work policy)
With the App Control configuration you define work apps that users are not allowed to start.
Setting/Field
App group
Description
Select the app group containing the blocked apps.
For information on creating app groups, see App groups (page 166).
80
administrator help
12.12.5 App permissions configuration (Android for Work policy)
With the App permissions configuration you configure what happens when a work app requests a permission at runtime.
Setting/Field
Default permission handling
App-specific runtime permissions
Description
The default response for future runtime permission requests of work apps:
Prompt: Apps prompt the user to grant a permission.
Auto-accept: All runtime permission requests are automatically granted.
Auto-deny: All runtime permission requests are automatically denied.
The user cannot change the permissions later.
You can grant or deny certain runtime permissions for individual apps. Click Add and then configure the settings for an app:
In the App identifier field, enter the internal identifier of the app.
For each runtime permission, select the desired grant state:
Selectable: The user can grant or deny the permission.
Granted: Permission is granted and cannot be denied by the user.
Denied: Permission is denied and cannot be granted by the user.
12.12.6 Exchange ActiveSync configuration (Android for Work policy)
Setting/Field
Account name
Exchange ActiveSync host
Domain
Description
The account name.
The address of the Microsoft Exchange Server.
Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.
The domain for this account.
81
Sophos Mobile Control (in Sophos Central)
Setting/Field
User
Email address
Sender
Password
Synchronization period
SSL
Allow all certificates
Client certificate
Description
The user for this account.
If you enter the variable
%_USERNAME_%
, the server replaces it with the actual user name.
The email address of the account.
If you enter the variable
%_EMAILADDRESS_%
, the server replaces it with the actual email address.
A sender name for this account.
If you enter the variable
%_EMAILADDRESS_%
, the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The time period emails are synchronized for.
If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.
All communication is sent through SSL (Secure Socket
Layer).
We recommend that you select this check box.
Allow all certificates in transfer processes from the email server.
The client certificate for the connection to ActiveSync.
12.12.7 Root certificate configuration (Android for Work policy)
With the Root certificate configuration you install a root certificate onto devices. This certificate will be available to work apps, i.e. to apps that are installed in the work profile.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
82
administrator help
12.12.8 Client certificate configuration (Android for Work policy)
With the Client certificate configuration you install a client certificate onto Android devices. This certificate will be available to work apps, i.e. to apps that are installed in the work profile.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
12.12.9 SCEP configuration (Android for Work policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP). These certificates will be available to work apps, i.e. to apps that are installed in the work profile.
Note: You must first add a Root certificate configuration to upload the CA certificate of the
SCEP server before you can add a SCEP configuration.
Setting/Field
URL
Alias name
Subject
Description
The web address of the Certificate Authority server.
Use the variable
%_SCEPPROXYURL_%
to refer to the server URL that is configured on the SCEP tab of the System setup page.
The name under which the certificate will appear in selection dialogs.
This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the
CN=
prefix.
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.
For example:
Enter
CN=%_USERNAME_%
to specify a user.
Enter
CN=%_DEVPROP(serial_number)_%
to specify a device.
For information on available placeholders, see
Placeholders in profiles and policies (page 55).
83
Sophos Mobile Control (in Sophos Central)
Setting/Field
Type of Subject Alternative Name
Value of Subject Alternative Name
NT user login name
Challenge
Description
Optionally, configure a Subject Alternative Name
(SAN). Select one of the available SAN types.
If you have selected a SAN type, enter the SAN value.
Root certificate
Key size
Use as digital signature
Use for encryption
The web address to obtain a challenge password from the SCEP server.
Use the variable
%_CACHALLENGE_%
to refer to the challenge URL that is configured on the SCEP tab of the System setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root
certificate configurations of the current profile.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
If you select this check box, the public key can be used as a digital signature.
If you select this check box, the public key can be used for data encryption.
12.13 Configurations for Sophos container policies for Android
With a Sophos container policy you configure settings that are related to the Sophos container apps Sophos Secure Email and Sophos Secure Workspace.
For information on how to create a Sophos container policy, see
Create profile or policy (page
52).
84
administrator help
12.13.1 General configuration (Android Sophos container policy)
With the General configuration you define settings that apply to all Sophos container apps, if applicable.
Setting/Field
Enable Sophos container password
Password complexity
Password age in days
Failed logins until lock
Allow fingerprint
Grace period in minutes
Description
Users must enter an additional password to be able to start a Sophos container app. The password has to be defined when the first container app is started after the configuration has been applied. This password applies to all container apps.
The required minimum complexity of the Sophos container password. More secure passwords are always allowed. Passwords (a mix of numeric and alphanumeric characters) are always seen as more secure than PINs (numeric characters only).
Any: Sophos container passwords do not have restrictions.
4 digit PIN
6 digit PIN
4 char password
6 char password
8 char password
10 char password
The number of days that a password can be used before users are prompted to change it.
The number of failed login attempts that are tolerated before the container apps are locked. Once they are locked an administrator needs to unlock the apps or, if allowed, users can use the Self Service Portal to do so.
Users can use their fingerprint to unlock the app.
The period of time within which no Sophos container password must be entered when a container app comes to the foreground again.
The grace period applies to all container apps. You can switch between the apps during the grace period without entering a password.
You can select 1, 2, 5, 10, 15 minutes.
85
Sophos Mobile Control (in Sophos Central)
Setting/Field
Lock on device lock
Last server connect
Offline starts without server connection
Description
When the device is locked, the Sophos container is locked as well.
If the check box is cleared, the container is locked only after the grace period has expired.
The period of time within users can use a Sophos container app without a connection to the Sophos
Mobile Control server.
When a Sophos container app becomes active and does not have contact with the server within the defined period of time, a lock screen will be displayed. Users can only unlock the app by tapping
Retry on the lock screen. The app will then try to connect to the server. If the connection can be established, the app will be unlocked. If not, access will be denied.
On access: Server connection is always required and the app is locked when the server cannot be reached.
1 hour: Server connection is required when the app becomes active one hour or more after the last successful server connection.
3 hours
6 hours
12 hours
1 day
3 days
1 week
none: No regular contact is required.
In this field you define how often users can start one of the Sophos container apps without a server connection.
Note: This setting requires the Sophos container password feature to be turned on.
A counter is incremented whenever users enter the
Sophos container password. If the counter exceeds the defined number, the same lock screen as for the
Last server connect setting will be displayed. The counter will be reset if a connection to the Sophos
Mobile Control server is established.
Unlimited: No server connection is required.
0: Starting the app without a server connection is not possible.
86
administrator help
Setting/Field Description
5
10
20
1: After one start of the app, a successful server connection is necessary.
3
Root allowed
Container apps are allowed to run on rooted devices.
App usage constraints
Here you can define constraints on using the Sophos container apps. Click Add to enter constraints.
Geo-fencing
Time-fencing
Wi-Fi fencing
Lets you add latitude and longitude and a radius within which the Sophos container apps can be used.
Lets you specify a start and end time within which the Sophos container apps can be used. Days of the week on which the apps can be used can be specified as well.
Lets you specify Wi-Fi networks to which the device must be connected in order to use the Sophos container apps.
The device must actually be connected to one of the listed networks. Being able to see a particular network in the list of available networks is not enough.
Important: We recommend that you do not rely on
Wi-Fi fencing as the only security mechanism because Wi-Fi names can be spoofed very easily.
87
Sophos Mobile Control (in Sophos Central)
12.13.2 Corporate Email configuration (Android Sophos container policy)
With the Corporate Email configuration you define user settings for your Microsoft Exchange
Server. These settings are applied to the Sophos Secure Email app if it is installed in the Sophos container.
Setting/Field
Exchange ActiveSync host
User
Email address
Domain
Support contact email
Export contacts to device
Show notification settings
Description
The address of the Microsoft Exchange Server.
Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.
The user for this account.
If you enter the variable
%_USERNAME_%
, the server replaces it with the actual user name.
The email address of the account.
If you enter the variable
%_EMAILADDRESS_%
, the server replaces it with the actual email address.
The domain for this account.
The email address that will be used as the "Contact
Support" email address.
Users are allowed to export the exchange contacts with a phone number to the local device contacts.
Sophos Secure Email will keep them synchronized.
Only name and telephone number will be exported to enable the user to identify company contacts in an incoming call. Note that even after a remote reset of the Sophos Secure Email app, the information will still be available in the local storage of the device.
This setting controls the display of email notifications and event reminders in Sophos Secure Email.
When you select the check box:
The user can turn email notifications on or off.
Event reminders are turned on.
When you clear the check box:
Email notifications and event reminders are turned off.
88
administrator help
Setting/Field
Open attachments
Add
Description
Note: If you think notifications displayed on a lost or stolen device is a security risk, you may want to clear this check box.
If you select the check box, Save and View buttons are displayed below the attachment. Save passes the attachment on to Sophos Secure Workspace,
View opens the file in Sophos Secure Email. If
Sophos Secure Email cannot open the file, users can select where to pass the file on to.
If you clear the check box, attachment cannot be opened or passed on to other apps.
Click Add to configure settings that a future version of the Sophos Secure Email app might require.
Important: Only configure these settings if instructed by the Sophos support team.
12.13.3 Corporate Documents configuration (Android Sophos container policy)
With the Corporate Documents configuration you define settings for the Corporate Documents feature of the Sophos Secure Workspace app.
Configure storage providers
For each storage provider you can define the following settings separately:
Setting/Field
Enable
Offline
Open in (encrypted)
Open in (unencrypted)
Clipboard
Description
The storage provider is available in the app.
Users are allowed to add files from the storage provider to the app's Favorites list for offline use.
Users can share encrypted files with other apps via
Open In.
Users can share unencrypted files with other apps via Open In.
Users can copy parts of a document and paste them into other apps.
89
Sophos Mobile Control (in Sophos Central)
Enterprise provider settings
For WebDAV provider, also referred to as enterprise provider, you can centrally define server settings and login credentials. These cannot be changed by users.
Credential settings that you do not define centrally can be chosen by the users in the app's provider credential screens.
For example you can centrally define the server and user account to be used but you can leave the password field undefined. Users then would have to know the password when accessing the storage provider.
Setting/Field
Name
Server
User name
Password
Upload folder
Description
The name of the provider that is displayed in the
Sophos Secure Workspace app.
In this field, enter:
The URL of the root folder on the Corporate
Documents WebDAV server.
The URL of the root folder on the WebDAV server.
Use the following format: https://server.company.com
Only the https
protocol is supported.
The user name for the relevant server. You can also use the
%_USERNAME_%
variable.
The password for the relevant account.
The upload folder for the relevant account.
Other settings
Setting/Field
Enable Documents
Description
This turns on the Documents feature to securely distribute company documents.
90
administrator help
Setting/Field
Passphrase complexity
Description
The required minimum complexity of passphrases for encryption keys. More secure passphrases are always allowed.
You can select the following settings:
4 char password
6 char password
8 char password
10 char password
12.13.4 Corporate Browser configuration (Android Sophos container policy)
With the Corporate Browser configuration you define settings for the Corporate Browser feature of the Sophos Secure Workspace app.
The Corporate Browser allows you to securely access corporate intranet pages and other allowed pages. You can define domains and bookmarks within a domain.
Every bookmarks belongs to a certain domain. When you use Add bookmark to define a bookmark, the domain entry is created automatically if it does not exist.
Domain settings
Setting/Field
URL
Allow copy/paste
Allow open with
Allow save password
Description
The domain that you want to allow.
Users can copy and paste text from the Corporate
Browser to other apps.
Users can download attachments or pass them on to other apps.
Users can save their passwords in the Corporate
Browser.
91
Sophos Mobile Control (in Sophos Central)
Bookmark settings
Setting/Field
Name
URL
Description
The name for the bookmark.
The web address for the bookmark.
12.13.5 Client certificate configuration (Android Sophos container policy)
With the Client certificate configuration you install a client certificate onto devices. This certificate will be available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the Sophos container.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
12.13.6 Root certificate configuration (Android Sophos container policy)
With the Root certificate configuration you upload a root certificate to devices. This certificate will be available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the Sophos container.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
12.13.7 SCEP configuration (Android Sophos container policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP). These certificates are available to the
Sophos Secure Workspace app if it is installed in the Sophos container.
Note: You must first add a Root certificate configuration to upload the CA certificate of the
SCEP server before you can add a SCEP configuration.
92
Setting/Field
URL
Alias name
Subject
Type of Subject Alternative Name
Value of Subject Alternative Name
NT user login name
Challenge
Root certificate
administrator help
Description
The web address of the Certificate Authority server.
Use the variable
%_SCEPPROXYURL_%
to refer to the server URL that is configured on the SCEP tab of the System setup page.
The name under which the certificate will appear in selection dialogs.
This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the
CN=
prefix.
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.
For example:
Enter
CN=%_USERNAME_%
to specify a user.
Enter
CN=%_DEVPROP(serial_number)_%
to specify a device.
For information on available placeholders, see
Placeholders in profiles and policies (page 55).
Optionally, configure a Subject Alternative Name
(SAN). Select one of the available SAN types.
If you have selected a SAN type, enter the SAN value.
The web address to obtain a challenge password from the SCEP server.
Use the variable
%_CACHALLENGE_%
to refer to the challenge URL that is configured on the SCEP tab of the System setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root
certificate configurations of the current profile.
93
Sophos Mobile Control (in Sophos Central)
Setting/Field
Key size
Use as digital signature
Use for encryption
Description
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
If you select this check box, the public key can be used as a digital signature.
If you select this check box, the public key can be used for data encryption.
12.14 Configurations for Mobile Security policies
With a Mobile Security policy you configure settings that are related to the Sophos Mobile Security app.
For detailed information on Mobile Security policies, see these sections:
Configure antivirus settings for Sophos Mobile Security
(page 194)
Configure web filtering settings for Sophos Mobile Security
(page 196)
12.15 Configurations for Knox container profiles
With a Knox container profile you configure settings that are related to the Knox container of
Samsung devices.
For information on how to create a Knox container profile, see Create profile or policy (page 52).
12.15.1 Password policies configuration (Knox container profile)
Password type
When you select the Password policies configuration, the Password type list is displayed. In this list, select the type of password you want to define:
Setting/Field
Any
Description
Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock. No additional restrictions are imposed.
94
administrator help
Setting/Field
Alphabetic
PIN
Alphanumeric
Complex
Description
Users must set a Passwordscreen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.
Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.
Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length. See the following table.
Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.
If you select Alphabetic, PIN, Alphanumeric or Complex, the following fields are displayed:
Setting/Field Description
Minimum password length
Idle time before password prompt
Maximum password age in days
The minimum number of characters a password must contain.
The time (in seconds) after the device will be locked if it has not been used. The device can be unlocked by entering the password.
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
Maximum number of failed attempts until device wipe
The maximum number of failed attempts to enter the correct password before the device is wiped.
Minimum history length
The number of old passwords that are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password. Value range: 1 to 5 or none.
If you select Complex, the following additional fields are displayed:
95
Sophos Mobile Control (in Sophos Central)
Setting/Field Description
Minimum number of letters
Minimum number of lowercase letters
Minimum number of uppercase letters
The minimum number of letters a password must contain.
The minimum number of lowercase letters a password must contain.
The minimum number of uppercase letters a password must contain.
Minimum number of non-alphabetic characters
The minimum number of non-alphabetic characters
(for example & or !) a password must contain.
Minimum number of numerals
The minimum number of numerals a password must contain.
Minimum number of special characters
The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.
Biometric authentication
Setting/Field
Allow fingerprint authentication
Allow iris authentication
12.15.2 Restrictions configuration (Knox container profile)
Setting/Field
Allow screen capture
Allow camera
Description
Users can capture the screen content of apps inside the
Samsung Knox container.
Apps inside the Samsung Knox container can access the camera.
96
Description
If supported by the device, the user can use fingerprint authentication to unlock the Knox container.
If supported by the device, the user can use iris authentication to unlock the Knox container.
administrator help
Setting/Field
Allow clipboard
Allow "Share via"
Allow microphone
Enforce the use of the secure keypad
Allow addition of new email accounts
Allow data export
Allow copying files into the container
Allowed apps / Forbidden apps
Description
Users can copy any contents to the clipboard.
The Share via feature that certain apps use is turned on.
Apps inside the Samsung Knox container can access the microphone.
Users must use the secure keypad.
Users can add email accounts beyond the accounts that are configured by a Sophos Mobile Control profile.
Private apps can access data from within the Samsung Knox container.
Private files can be copied or moved into the Samsung Knox container.
You can configure either Allowed apps or Forbidden apps.
Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.
App installations initiated by the Sophos Mobile Control server are not restricted by this setting.
For information on creating app groups, see
(page 166).
12.15.3 Exchange ActiveSync configuration (Knox container profile)
Setting/Field
Account name
Exchange ActiveSync host
Domain
Description
The account name.
The address of the Microsoft Exchange Server.
Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.
The domain for this account.
97
Sophos Mobile Control (in Sophos Central)
Setting/Field
User
Email address
Sender
Password
Synchronization period
Synchronization interval
SSL
Default account
Allow all certificates
Allow forwarding emails
Allow use of HTML format
Maximum attachment size in MB
Synchronize content types
98
Description
The user for this account.
If you enter the variable
%_USERNAME_%
, the server replaces it with the actual user name.
The email address of the account.
If you enter the variable
%_EMAILADDRESS_%
, the server replaces it with the actual email address.
A sender name for this account.
If you enter the variable
%_EMAILADDRESS_%
, the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The time period emails are synchronized for.
If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.
The interval between email synchronization processes.
All communication is sent through SSL (Secure Socket
Layer).
We recommend that you select this check box.
The account is used as the default email account.
Allow all certificates in transfer processes from the email server.
Allow forwarding of emails.
Allow the use of HTML format in emails.
The maximum size of a single email message (1, 3,
5, 10, Unlimited).
The content types to be synchronized.
administrator help
12.16 Configurations for iOS device profiles
With an iOS device profile you configure various aspects of iOS devices, like password policies, restrictions or Wi-Fi settings.
For information on how to create a device profile, see
Create profile or policy (page 52).
12.16.1 Password policies configuration (iOS device profile)
With the Password policies configuration you define password rules for devices.
Setting/Field
Allow simple value
Require alphanumeric value
Minimum password length
Minimum number of complex characters
Maximum password age in days
Maximum Auto-Lock (in minutes)
Password history
Maximum grace period for device lock
Description
Users are allowed to use sequential or repeated characters in their password, for example
1111
or
abcde
.
Passwords must contain at least one letter or number.
Specifies the minimum number of characters a password must contain.
Specifies the minimum number of non-alphanumeric characters (for example & or !) a password must contain.
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
In this field, you can specify the maximum value the user is allowed to configure on the device. Auto-Lock specifies how soon (in minutes) the device will be locked if it has not been used.
In this field, you can specify how many old passwords are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password. Value range: 1 to 50 or 0 (no password history).
In this field, you can specify the maximum value the user is allowed to configure on the device. The grace period for device lock specifies for how long the device can be unlocked after a lock without a password prompt. If you select None, the user can select any of the intervals available. If you select
99
Sophos Mobile Control (in Sophos Central)
Setting/Field Description
Immediately, users must enter a password every time they unlock their devices.
Maximum number of failed attempts until device wipe
In this field, you can specify the maximum number of failed attempts to enter the correct password before the device is wiped. After six failed attempts, a time delay is imposed before a password can be entered again. The delay increases with each failed attempt. After the final failed attempt, all data and settings are securely removed from the device. The time delay starts after the sixth attempt. So if you set this value to 6 or lower, no delay is imposed and the device is wiped when the attempt limit is exceeded.
12.16.2 Restrictions configuration (iOS device profile)
With the Restrictions configuration you define restrictions for devices.
Device
Setting/Field
Allow app installation
Allow app installation from device UI
Allow use of camera
Allow FaceTime
Allow screen capture
Allow automatic sync while roaming
Description
If the check box is cleared, the App Store is unavailable and its icon is removed from the Home screen. Users cannot install or update apps from the App Store, iTunes or Apple
Configurator.
If the check box is cleared, the App Store is unavailable and its icon is removed from the Home screen. Users can still install or update apps from iTunes or Apple Configurator.
If the check box is cleared, the camera is unavailable and the Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.
Users can place or receive FaceTime video calls.
Users can take a screenshot of the display.
If the check box is cleared, devices that are roaming will only sync when the user accesses an account.
100
administrator help
Setting/Field Description
Allow Siri
If the check box is cleared, users cannot use Siri, voice commands, or dictation.
Allow Siri while device is locked
If the check box is cleared, users must unlock their devices by entering their password before they use Siri.
Allow Siri querying content from the web
If the check box is cleared, Siri does not query content from the web.
Force Siri explicit language filter
If the check box is cleared, the Siri filter for explicit language is not enforced on the device.
Allow voice dialing while device is locked
If the check box is cleared, users cannot dial by using voice commands when the device is locked by a password.
Note: If the user has not configured a device password, voice dialing is always allowed.
Allow Passbook while device is locked
Passbook notifications are displayed when the device is locked.
Users can make in-app purchases.
Allow in-app purchase
Force user to enter store password for all purchases
Users must enter their Apple ID password to make any purchase.
If the check box is cleared, there is a brief grace period during which users can make subsequent purchases without having to enter their password again.
Allow multiplayer gaming
Allow Game Center
Allow adding Game Center friends
Allow find my friends modification
Allow host pairing
Users can play multi-player games in Game Center.
If the check box is cleared, Game Center is unavailable.
Users can add friends in Game Center.
If the check box is cleared, modifications to the Find my
Friends app are unavailable.
If the check box is cleared, host pairing is turned off with the exception of the supervision host. If no supervision host certificate is configured, all pairing is turned off.
101
Sophos Mobile Control (in Sophos Central)
Setting/Field Description
Allow pairing with Apple Watch
Allow AirDrop
Allow Control Center on lock screen
If the check box is cleared, users cannot pair the device with an Apple Watch. Any currently paired Apple Watch is unpaired.
Content sharing with AirDrop is turned on.
If the check box is cleared, the Control Center is unavailable when the device screen is locked.
Allow Notification Center on lock screen
If the check box is cleared, the Notification Center is unavailable when the device screen is locked.
Allow Today view on lock screen
If the check box is cleared, the Today view is unavailable when the device screen is locked.
Allow News
Allow over-the-air PKI updates
The News app is available.
Over-the-air PKI updates are possible.
Allow iBooks Store
Allow explicit sexual content in iBooks
Store
Users can purchase books in iBooks.
If the check box is cleared, explicit sexual content through iBooks Store is blocked.
Allow user to install configuration profiles
Users can install configuration profiles.
Allow iMessage
Users can use iMessage to send or receive text messages.
Allow app removal
Allow erase all contents and settings
Users can remove apps from the device.
If the check box is cleared, the Erase all Content And
Settings option in the Reset UI is unavailable.
Allow internet search result for Spotlight
If the check box is cleared, Spotlight does not return internet search results.
Allow enabling of restrictions option
If the check box is cleared, the Enable Restrictions option in the Reset UI is unavailable.
Allow Handoff
Allow device name modification
Users can use the Apple Continuity feature Handoff. With
Handoff, users can start to work on a document, email or message on one device and continue from another device.
Users can change the device name.
102
administrator help
Setting/Field Description
Allow wallpaper modification
Allow keyboard shortcuts
Allow automatic app download
Users can change the wallpaper.
Users can use keyboard shortcuts.
If the check box is cleared, the automatic downloading of apps purchased on other devices is turned off. This does not affect updates to existing apps.
Allow Apple Music
Allow Apple Music Radio
Users can access the Apple Music library.
Users can access Apple Music Radio.
Allow modification of Bluetooth settings
Users can modify the Bluetooth settings.
Company data
Setting/Field Description
Allow documents to be shared only within managed apps/accounts
With this setting you define a restriction on opening documents with apps or accounts (for example a company email account) managed by Sophos Mobile Control.
If users have an email account managed by Sophos Mobile
Control and apps managed by Sophos Mobile Control on their devices, attachments from the managed email account can only be opened with managed apps. In this way you can prevent corporate documents from being opened in unmanaged apps.
Allow documents to be shared only within unmanaged apps/accounts
With this setting you define a restriction on opening documents with apps/accounts (for example a private email account) not managed by Sophos Mobile Control.
If users have an email account and apps not managed by
Sophos Mobile Control on their devices, attachments from the unmanaged email account can only be opened with unmanaged apps. In this way you can prevent personal documents from being opened in managed apps.
Force AirDrop documents to be used as unmanaged documents
AirDrop is considered an unmanaged drop target.
Allow managed apps to sync with iCloud
Managed apps can use iCloud synchronization.
103
Sophos Mobile Control (in Sophos Central)
Setting/Field
Allow backup for enterprise books
Allow enterprise books notes and highlights sync
Applications
Description
Enterprise books are backed up.
Enterprise books notes and highlights are synchronized.
Setting/Field
Allow use of the iTunes Store
Allow use of Safari
Enable auto-fill
Block pop-ups
Allow JavaScript in browser
Accept cookies
Description
If the check box is cleared, the iTunes Store is unavailable and its icon is removed from the Home screen. Users cannot preview, purchase or download content.
If the check box is cleared, the Safari web browser is unavailable and its icon is removed from the Home screen.
This also prevents users from opening web clips.
If the check box is cleared, Safari does not auto-fill web forms with previously entered information.
The Safari pop-up blocker is turned on.
Web pages can execute JavaScript code on the device.
In this field, you specify if cookies will be accepted:
Always
Never
From visited sites
Allow modification of cellular data usage per app
Users can change the cellular data usage per app.
Allowed apps / Forbidden apps You can specify either Allowed apps or Forbidden apps.
Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list. For information on creating app groups, see
104
administrator help
iCloud
Setting/Field
Allow backup
Allow document sync
Allow Photo Stream
Allow iCloud Photo Library
Allow shared photo streams
Allow keychain sync
Description
Users can back up their devices to iCloud.
Users can store documents in iCloud.
If the check box is cleared, users cannot turn on Photo
Stream.
Note: If you install a configuration profile that restricts the use of Photo Stream, Photo Stream photos are removed from the device. Photos are not sent from the Camera Roll to Photo Stream. If there are no further copies of these photos, they are lost.
Users can use the iCloud Photo Library.
Users can invite others to view their photo streams and can view photo streams shared by others.
The Keychain feature of iCloud for synchronizing passwords across different iOS and OS X devices is available.
Security and privacy
Setting/Field Description
Allow diagnostic data to be sent to Apple
If the check box is cleared, iOS diagnostic information is not sent to Apple.
Allow user to accept untrusted TLS certificates
If the check box is cleared, users are not asked if they want to trust certificates that cannot be verified. This setting applies to Safari and to Mail Contacts and Calendar accounts.
Trust enterprise apps
Allow password modification
Enterprise apps are trusted.
Users can add, change or remove the device password.
105
Sophos Mobile Control (in Sophos Central)
Setting/Field
Allow account modification
Allow Touch ID to unlock device
Force limit ad-tracking
Force encrypted backups
Content ratings
Description
If the check box is cleared, users cannot modify accounts.
The Accounts menu is unavailable.
If the check box is cleared, the device cannot be unlocked by Touch ID.
Anonymous user data apps used for targeting ads are no longer provided.
Users must encrypt backups in iTunes.
Setting/Field
Allow explicit music and podcasts
Description
If the check box is cleared, explicit music or video content is hidden in the iTunes Store. Explicit content is flagged by content providers, for example record labels, when listed on the iTunes Store.
12.16.3 Roaming/Hotspot settings configuration (iOS device profile)
With the Roaming/Hotspot settings configuration you define settings for roaming and personal hotspots.
Note: Users can change these settings on their devices anytime.
Setting/Field
Enable voice roaming
Enable data roaming
Enable personal hotspot
Description
Voice roaming is available.
Data roaming is available.
The user can configure the device to serve as a personal hotspot.
106
administrator help
12.16.4 Exchange ActiveSync configuration (iOS device profile)
With the Exchange ActiveSync configuration you define user settings for your Microsoft Exchange
Server.
Setting/Field
Account name
Exchange ActiveSync host
Domain
User
Email address
Password
Synchronization period
SSL
Allow move
Allow recent address syncing
Description
The account name.
The address of the Microsoft Exchange Server.
Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.
The domain for this account.
The user for this account.
If you enter the variable
%_USERNAME_%
, the server replaces it with the actual user name.
The email address of the account.
If you enter the variable
%_EMAILADDRESS_%
, the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The time period emails are synchronized for.
If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.
All communication is sent through SSL (Secure Socket
Layer).
We recommend that you select this check box.
The user can move emails from this account to another. This also allows users to use a different account when replying to or forwarding a message from this account.
The account is included in the syncing of recently used addresses with other devices using iCloud.
107
Sophos Mobile Control (in Sophos Central)
Setting/Field
Use in Mail only
Identity certificate
12.16.5 Wi-Fi configuration (iOS device profile)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
Setting/Field
SSID
Connect automatically
Hidden network
Security type
Description
The ID of the Wi-Fi network.
Automatically connect to the target network.
The target network is not open or visible.
The security type of the Wi-Fi network:
None
WEP
WPA/WPA2
Any (personal)
Corporate WEP
Corporate WPA/WPA2
Any (company)
If you select WEP, WPA/WPA2 or Any (personal), a
Password field is displayed. Enter the relevant password.
If you select Corporate WEP, Corporate WPA/WPA2 or
Any (company), the tabs Protocols, Authentication and Trust are displayed.
In the Protocols tab configure the following:
Under Accepted EAP types, specify the EAP methods to be used for authentication. Depending on the types selected here, the values in the Internal
identity field in this tab become available for selection.
108
Description
The account can only be used to send messages from the Mail app. It cannot be selected as a sending account for messages created with other apps, for example Photos or Safari.
Select the identity certificate for the connection to
ActiveSync.
The list includes all certificates from Client certificate configurations of the current profile.
administrator help
Setting/Field
Proxy
Description
Under EAP-FAST, configure the EAP-FAST Protected
Access credential settings.
In the Authentication tab, configure client authentication settings:
In the User field, enter the user name for the connection to the Wi-Fi network.
Select Require password on each connect, if the password is to be queried for each connection and transferred with the authentication.
In the Password field, enter the relevant password.
In the Identity certificate list, select the certificate for the connection to the Wi-Fi network.
Note: The certificate to be used has to be specified in a Client certificate configuration.
In the External identity field, enter the externally visible ID (for TTLS, PEAP and EAP-FAST).
In the Trust tab, configure server authentication settings:
Select the trusted certificates from the list.
Note: You must specify the certificates in a Root
certificate configuration.
In this list, select the proxy settings for the Wi-Fi connection:
None
Manually
Automatic
If you select Manually, the fields Server and port,
Authentication and Password are displayed. Enter the required proxy information. If you select Automatic, the field Proxy server URL is displayed. Enter the URL of the proxy server.
12.16.6 VPN configuration (iOS device profile)
With the VPN configuration you define VPN settings for network connections.
Setting/Field
Connection name
Description
The name of the connection shown on the device.
109
Sophos Mobile Control (in Sophos Central)
Setting/Field
Connection type
Description
The type of the VPN connection:
Cisco AnyConnect
IPSec (Cisco)
F5
Check Point
Custom SSL
Different entry fields are shown on the VPN page depending on the connection type you select here.
Identifier (reverse DNS format) (connection type
Custom SSL)
The custom identifier in reverse DNS format.
The host name or the IP address of the server.
Server (all connection types)
Account (all connection types)
Custom data (connection type Custom SSL)
The user account for the authentication of the connection.
If your vendor has specified custom connection properties, you can enter them in this field.
To enter a property, click Add and then enter Key and Value of the property in the dialog box.
Send all traffic through VPN
Group (connection type Cisco AnyConnect)
User authentication (connection types Cisco
AnyConnect, F5, Custom SSL)
All traffic is sent through VPN.
The group that may be required for the authentication of the connection.
Select the type of user authentication for the connection:
If you select Password, a Password field is shown below the User Authentication field. Enter the password for authentication.
If you select Certificate, a Certificate field is shown below the User authentication field.
Select a certificate.
Device authentication (connection type IPSec
(Cisco))
The type of device authentication:
Keys (Shared Secret)/Group name
If you select this option, the fields Group name,
Keys (Shared Secret), Use hybrid
authentication and Request password are displayed below the Device authentication field.
Enter the required authentication information in
110
Setting/Field
Proxy (all connection types) administrator help
Description the Group name and Keys (Shared Secret) fields. Select Use hybrid authentication and
Request password as required.
Certificate
If you select this option, the fields Certificate and
Including user PIN are displayed below the
Device authentication field. In the Certificate list, select the required certificate. Select
Including user PIN to include the user PIN in device authentication.
The proxy settings for the connection:
None
Manually
If you select this option, the fields Server and
port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the
Password field, enter the password for the connection to the proxy server.
Automatic
If you select this option, the Proxy server URL field is displayed. Enter the URL of the server with the proxy setting in this field.
12.16.7 Per app VPN configuration (iOS device profile)
With the Per app VPN configuration you define VPN settings to support the iOS feature Per app
VPN.
You can configure apps to automatically connect to VPN when they are started. So you can, for example, ensure that data transmitted by managed apps travels through VPN.
After you have set up per app VPN configurations, you can select a configuration on the Edit
package page of an application. See
Configure per app VPN and settings for iOS apps (page
165).
Setting/Field
Connection name
Description
The name of the connection shown on the device.
111
Sophos Mobile Control (in Sophos Central)
Setting/Field
Connection type
Description
The type of the VPN connection:
Cisco AnyConnect
F5
Check Point
Custom SSL
Different entry fields are shown on the VPN page depending on the connection type you select here.
Identifier (reverse DNS format) (connection type
Custom SSL)
The custom identifier in reverse DNS format.
Server (all connection types)
Account (all connection types)
The host name or the IP address of the server.
The user account for the authentication of the connection.
Custom data (connection type Custom SSL)
If your vendor has specified custom connection properties, you can enter them in this field.
To enter a property, click Add and then enter Key and Value of the property in the dialog box.
Group (connection type Cisco AnyConnect)
Send all traffic through VPN
User authentication (connection type Cisco
AnyConnect, F5, Custom SSL)
In this field, enter the group that may be required for the authentication of the connection.
All traffic is sent through VPN.
In this list, select the type of user authentication for the connection:
Password
If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.
Certificate
If you select this option, the Certificate field is shown below the User authentication field.
Select a certificate.
Device authentication (connection type IPSec
(Cisco))
In this list, select the type of device authentication:
Keys (Shared Secret)/Group name
If you select this option, the fields Group name,
Keys (Shared Secret), Use hybrid
112
Setting/Field
Proxy (all connection types)
Provider type
Safari domains
administrator help
Description
authentication and Request password are displayed below the Device authentication field.
Enter the required authentication information in the Group name and Keys (Shared Secret) fields. Select Use hybrid authentication and
Request password as required.
Certificate
If you select this option, the fields Certificate and
Including user PIN are displayed below the
Device authentication field. In the Certificate list, select the required certificate. Select
Including user PIN to include the user PIN in device authentication.
In this list, select the proxy settings for the connection:
None
Manually
If you select this option, the fields Server and
port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the
Password field, enter the password for the connection to the proxy server.
Automatic
If you select this option, the Proxy server URL field is displayed. Enter the URL of the server with the proxy setting in this field.
The VPN connection type.
App proxy: Network traffic is sent through a VPN tunnel at the application layer.
Packet tunnel: Network traffic is sent through a
VPN tunnel at the network layer.
In this field, you can enter a list of domain strings.
When a domain that matches one of the domain strings is opened in Safari or another browser app, the VPN connection is triggered.
Use a new line for each domain string.
113
Sophos Mobile Control (in Sophos Central)
Setting/Field Description
The rule matching behavior is as follows:
Leading and trailing dots are ignored. For example, the string
.example.com
matches the same domains as the string
example.com
.
Each string component must match a whole domain component. For example, the string
example.com
matches the domain www.example.com
, but not www.myexample.com
.
Strings with a single component only match that specific domain. For example, the string
example
matches the domain example
, but not www.example.com
.
12.16.8 Single sign-on configuration (iOS device profile)
With the Single sign-on configuration you define settings for a single sign-on for third-party apps.
Setting/Field
Name
Kerberos principal name
Realm
Description
A human-readable name for the account.
The Kerberos principal name.
If you do not enter a value, the user must enter the name during profile installation.
The Kerberos realm name.
You must enter the name in upper-case letters.
114
administrator help
12.16.9 Single app mode configuration (iOS device profile)
With the Single app mode configuration you define settings for the single mode that locks devices into a single app and prevents users from changing to other apps.
Setting/Field
Select source
App identifier
Disable touchscreen
Disable rotation
Disable volume buttons
Disable ringer switch
Disable sleep wake button
Disable Auto-Lock
Enable VoiceOver
Enable Zoom
Enable Invert Colors
Enable AssistiveTouch
Enable Speak Selection
Enable Mono Audio
VoiceOver
Zoom
Description
Select how you want to specify the app for the single app mode:
App list: Select the app from a list of all available iOS apps for the customer.
Custom: Manually enter the bundle ID of the app.
The app for the single app mode.
Either select an app from the list or enter a bundle ID.
Touch gestures are unavailable.
The screen does not rotate.
Volume buttons are unavailable.
The ringer switch is unavailable.
The wake button is unavailable.
The Auto-Lock feature that puts the device into sleep after an idle period is turned off.
VoiceOver is available.
The Zoom feature is available.
The Invert Colors feature is available.
AssistiveTouch is available.
The Speak Selection feature is available.
The Mono Audio feature is available.
VoiceOver adjustments are available.
Zoom adjustment are available.
115
Sophos Mobile Control (in Sophos Central)
Setting/Field
Invert Colors
AssistiveTouch
Description
Invert Colors adjustment are available.
AssistiveTouch adjustment are available.
12.16.10 Web clip configuration (iOS device profile)
With the Web clip configuration you define web clips to be added to the Home screen of user devices. Web clips provide fast access to favorite web pages. But you can also add a web clip with a support phone number for example, to provide a quick way to dial the helpdesk.
Setting/Field
Description
URL
Can be removed
Full screen
Description
A description for the web clip.
The web address of the web clip.
If the check box is cleared, the user cannot remove the web clip. It cannot be deleted from the device unless the user removes the profile that installed it.
The web clip is opened full screen on the device. A full screen web clip opens the URL as a web app.
12.16.11 Access Point Name configuration (iOS device profile)
With the Access Point Name configuration you specify an Access Point Name (APN) configuration for iOS devices. APN configurations define how devices connect to a mobile network.
Note: The Access Point Name configuration is deprecated in favor of the Cellular configuration.
See Cellular configuration (iOS device profile)
(page 120)
Important: If these settings are not correct, the device cannot access data using the cellular network. To undo settings changes, the profile must be removed from the device.
Setting/Field
APN
Description
The APN that the device quotes when it opens a
GPRS connection with the carrier.
This must match an APN that the carrier accepts.
Otherwise, the connection cannot be established.
116
administrator help
Setting/Field
User name for access point
Password for access point
Proxy server and port
Description
The user name for the access point.
Note: iOS supports APN user names of up to 64 characters.
The password for the access point.
Note: iOS supports APN passwords of up to 64 characters.
The address and the port of the proxy server.
12.16.12 Web content filter configuration (iOS device profile)
With the Web content filter configuration you define forbidden URLs and allowed URLs with bookmarks.
Setting/Field
Forbidden URLs
Allowed URLs with bookmarks
Description
If you select the check box, you can define a list of blocked URLs that may not be accessed on the devices.
Click Next to display the Select web content filter
type page. On this page, you can add individual
URLs.
Use a new line for each URL.
If you select the check box, you can define allowed
URLs with bookmarks to be added to the Safari browser on the devices. All other sites are blocked.
Click Next to display the Web content filter page.
Click Add to add individual URLs as bookmarks.
117
Sophos Mobile Control (in Sophos Central)
12.16.13 Global HTTP proxy configuration (iOS device profile)
With the Global HTTP proxy configuration you define a corporate proxy server.
Setting/Field
Global HTTP proxy
Description
Select the proxy settings for the connection:
Manually
If you select this option, the fields Server and
port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the
Password field, enter the password for the connection to the proxy server.
Automatic
If you select this option, the Proxy server URL field is displayed. Enter the URL of the server with the proxy setting in this field.
12.16.14 Root certificate configuration (iOS device profile)
With the Root certificate configuration you install a root certificate onto devices.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
12.16.15 Client Certificate configuration (iOS device profile)
With the Client certificate configuration you install a client certificate onto iOS devices.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
118
administrator help
12.16.16 SCEP configuration (iOS device profile)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).
Setting/Field
URL
CA name
Subject
Type of Subject Alternative Name
Value of Subject Alternative Name
NT user login name
Challenge
Description
The web address of the Certificate Authority server.
Use the variable
%_SCEPPROXYURL_%
to refer to the server URL that is configured on the SCEP tab of the
System setup page.
A name that is understood by the Certificate Authority.
The name can, for example, be used to distinguish between instances.
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.
For example:
Enter
CN=%_USERNAME_%
to specify a user.
Enter
CN=%_DEVPROP(serial_number)_%
to specify a device.
For information on available placeholders, see
Placeholders in profiles and policies (page 55).
Optionally, configure a Subject Alternative Name
(SAN). Select one of the available SAN types.
If you have selected a SAN type, enter the SAN value.
Retries
The web address to obtain a challenge password from the SCEP server.
Use the variable
%_CACHALLENGE_%
to refer to the challenge URL that is configured on the SCEP tab of the System setup page.
The number of retries if the server sends a response of type pending.
119
Sophos Mobile Control (in Sophos Central)
Setting/Field
Retry delay
Key size
Use as digital signature
Use for encryption
Description
The number of seconds between retries.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
If you select this check box, the public key can be used as a digital signature.
If you select this check box, the public key can be used for data encryption.
12.16.17 Managed domains configuration (iOS device profile)
With the Managed domains configuration you define managed domains for iOS devices.
When domains are managed, files downloaded from specific websites in Safari can only be opened using apps that were pushed to the device using MDM.
You can enter managed Email domains and Web domains. Enter one domain per line.
Note: If a managed web domain entry contains a port number, only addresses that specify that port number will be considered managed. Otherwise, only the standard ports will be considered managed (port 80 for http and 443 for https).
12.16.18 Cellular configuration (iOS device profile)
With the Cellular configuration you define cellular network settings for iOS devices.
Note: A cellular configuration cannot be installed onto a device if an APN configuration is already installed.
Setting/Field
Authentication
APN
Description
PAP
CHAP
The APN that the device quotes when it opens a
GPRS connection with the carrier.
This must match an APN that the carrier accepts.
Otherwise, the connection cannot be established.
120
administrator help
Setting/Field
User name for access point
Password for access point
Proxy server and port
Description
The user name for the access point.
Note: iOS supports APN user names of up to 64 characters.
The password for the access point.
Note: iOS supports APN passwords of up to 64 characters.
The address and the port of the proxy server.
12.16.19 CalDAV configuration (iOS device profile)
With the CalDAV configuration you configure the synchronization of calendar data with a CalDAV server. For example, this can be used to sync Google Calendar with an iOS device.
Setting/Field
Account name
Account host and port
Principal URL
User name, Password
Description
The display name of the CalDAV account on the device.
The host name or IP address and optionally the port number of the CalDAV server.
For example, for Google Calendar enter:
calendar.google.com:443
If required by the CalDAV server, enter the principal URL of the calendar resource.
For example, to sync with a calendar other than the primary calendar in a Google account, enter:
https://apidata.googleusercontent.com/caldav/
v2/calendar_id/user where calendar_id is the ID of the calendar you want to sync with. In the Google Calendar web application, the calendar ID is displayed in the calendar settings. See the Google Calendar help for details.
The login credentials for the CalDAV account.
For example, for Google Calendar enter the credentials of the
Google account.
121
Sophos Mobile Control (in Sophos Central)
12.16.20 CardDAV configuration (iOS device profile)
With the CardDAV configuration you configure the synchronization of contact data with a CardDAV server. For example, this can be used to sync Google Contacts with an iOS device.
Setting/Field
Account name
Account host and port
Principal URL
User name, Password
Description
The display name of the CardDAV account on the device.
The host name or IP address and optionally the port number of the CardDAV server.
For example, for Google Contacts enter:
google.com
If required by the CardDAV server, enter the principal URL of the contacts resource.
For example, the Google CardDAV API supports the following principal URL:
https://www.googleapis.com/carddav/
v1/principals/account_name@gmail.com where account_name is the Google account name.
The login credentials for the CardDAV account.
For example, for Google Contacts enter the credentials of the
Google account.
12.16.21 IMAP/POP configuration (iOS device profile)
With the IMAP/POP configuration you add an IMAP or POP email account to the iOS device.
Setting/Field
Account name
Account type
User display name
Description
The display name of the email account on the device.
The type of the email server for incoming email.
Can be either IMAP or POP.
The display name of the user for outgoing email.
You can use the variable
%_USERNAME_%
and the server will replace it with the actual user name.
122
administrator help
Setting/Field
Email address
Description
The email address of the account.
You can use the variable
%_EMAILADDRESS_%
and the server will replace it with the actual email address.
Allow move
Allow recent address syncing
Use in Mail only
Allow Mail Drop
Enable S/MIME
Signing certificate
Encryption certificate
The user can move emails from this account to another. This also allows users to use a different account when replying to or forwarding a message from this account.
The account is included in the syncing for the list of recent addresses.
The account can only be used to send messages from the Mail app. It cannot be selected as a sending account for messages created with other apps, for example Photos or Safari.
Allow Apple Mail Drop for this account.
Support the S/MIME encryption standard.
The certificates that are used for email signing and encryption.
To select a certificate, you must first upload it in a Client
certificate configuration of the current profile.
Allow user to send unencrypted emails
For each outgoing email, the user can choose to encrypt it or not.
Incoming email
Email server and port
The host name or IP address and the port number of the server for incoming email (inbound server).
The user name for connecting to the inbound server.
User name
Authentication type
The authentication method for connecting to the inbound server.
Password
SSL
Outgoing email
Email server and port
The password for connecting to the inbound server (if required).
Use Secure Sockets Layer for incoming email transfer.
User name
The host name or IP address and the port number of the server for outgoing email (outbound server).
The user name for connecting to the outbound server.
123
Sophos Mobile Control (in Sophos Central)
Setting/Field Description
Authentication type
The authentication method for connecting to the outbound server.
The password for connecting to the outbound server (if required).
Password
Use same password as for incoming email
Use the password that is specified for incoming email.
SSL
Use Secure Sockets Layer for outgoing email transfer.
12.16.22 Network usage rules configuration (iOS device profile)
With the Network usage rules configuration you specify how managed apps are allowed to use cellular data networks.
General rules
Under Rules for all managed apps, specify the settings for managed apps in general.
Setting/Field
Allow cellular data
Allow data roaming
Description
Managed apps are allowed to use data communication over cellular networks.
Managed apps are allowed to use data communication while the device is roaming on a foreign cellular network.
Exceptions
Exceptions override the general rules. Use Add exception to define rules that are specific to an app group.
Setting/Field
App group
Allow cellular data
Description
Select an app group that contains the managed apps to which the exception applies.
Managed apps from the selected app group are allowed to use data communication over cellular networks.
124
administrator help
Setting/Field
Allow data roaming
Description
Managed apps from the selected app group are allowed to use data communication while the device is roaming on a foreign cellular network.
Note: You cannot define multiple exceptions for the same app group.
12.17 Configurations for Sophos container policies for iOS
With a Sophos container policy you configure settings that are related to the Sophos container apps Sophos Secure Email and Sophos Secure Workspace.
For information on how to create a Sophos container policy, see
Create profile or policy (page
52).
12.17.1 General configuration (iOS Sophos container policy)
With the General configuration you define settings that apply to all Sophos container apps, if applicable.
Setting/Field
Enable Sophos container password
Password complexity
Description
Users must enter an additional password to be able to start a Sophos container app. The password has to be defined when the first container app is started after the configuration has been applied. This password applies to all container apps.
The required minimum complexity of the Sophos container password. More secure passwords are always allowed. Passwords (a mix of numeric and alphanumeric characters) are always seen as more secure than PINs (numeric characters only).
Any: Sophos container passwords do not have restrictions.
4 digit PIN
6 digit PIN
4 char password
6 char password
8 char password
10 char password
125
Sophos Mobile Control (in Sophos Central)
Setting/Field
Password age in days
Failed logins until lock
Allow fingerprint
Grace period in minutes
Lock on device lock
Last server connect
Description
The number of days that a password can be used before users are prompted to change it.
The number of failed login attempts that are tolerated before the container apps are locked. Once they are locked an administrator needs to unlock the apps or, if allowed, users can use the Self Service Portal to do so.
Users can use their fingerprint to unlock the app.
The period of time within which no Sophos container password must be entered when a container app comes to the foreground again.
The grace period applies to all container apps. You can switch between the apps during the grace period without entering a password.
You can select 1, 2, 5, 10, 15 minutes.
When the device is locked, the Sophos container is locked as well.
If the check box is cleared, the container is locked only after the grace period has expired.
The period of time within users can use a Sophos container app without a connection to the Sophos
Mobile Control server.
When a Sophos container app becomes active and does not have contact with the server within the defined period of time, a lock screen will be displayed. Users can only unlock the app by tapping
Retry on the lock screen. The app will then try to connect to the server. If the connection can be established, the app will be unlocked. If not, access will be denied.
On access: Server connection is always required and the app is locked when the server cannot be reached.
1 hour: Server connection is required when the app becomes active one hour or more after the last successful server connection.
3 hours
6 hours
12 hours
1 day
126
administrator help
Setting/Field Description
3 days
1 week
none: No regular contact is required.
Offline starts without server connection
In this field you define how often users can start one of the Sophos container apps without a server connection.
Note: This setting requires the Sophos container password feature to be turned on.
A counter is incremented whenever users enter the
Sophos container password. If the counter exceeds the defined number, the same lock screen as for the
Last server connect setting will be displayed. The counter will be reset if a connection to the Sophos
Mobile Control server is established.
Unlimited: No server connection is required.
0: Starting the app without a server connection is not possible.
3
5
1: After one start of the app, a successful server connection is necessary.
10
20
Jailbreak allowed
Container apps are allowed to run on jailbroken devices.
App usage constraints
Here you can define constraints on using the Sophos container apps. Click Add to enter constraints.
Geo-fencing
Time-fencing
Lets you add latitude and longitude and a radius within which the Sophos container apps can be used.
Lets you specify a start and end time within which the Sophos container apps can be used. Days of the week on which the apps can be used can be specified as well.
127
Sophos Mobile Control (in Sophos Central)
Setting/Field
Wi-Fi fencing
Description
Lets you specify Wi-Fi networks to which the device must be connected in order to use the Sophos container apps.
The device must actually be connected to one of the listed networks. Being able to see a particular network in the list of available networks is not enough.
Important: We recommend that you do not rely on
Wi-Fi fencing as the only security mechanism because Wi-Fi names can be spoofed very easily.
12.17.2 Corporate Email configuration (iOS Sophos container policy)
With the Corporate Email configuration you define user settings for your Microsoft Exchange
Server. These settings are applied to the Sophos Secure Email app if it is installed in the Sophos container.
Setting/Field
Exchange ActiveSync host
User
Email address
Domain
Support contact email
Use secure text fields
Description
The address of the Microsoft Exchange Server.
Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.
The user for this account.
If you enter the variable
%_USERNAME_%
, the server replaces it with the actual user name.
The email address of the account.
If you enter the variable
%_EMAILADDRESS_%
, the server replaces it with the actual email address.
The domain for this account.
The email address that will be used as the "Contact
Support" email address.
The content of input fields is secured. Auto-complete and auto-correction are disabled within the Sophos
Secure Email app to prevent sensitive words to be saved in the memory of the device.
128
Setting/Field
Export contacts to device
Show notification details
Deny copy to clipboard
Allow external viewers
Maximum email size
Open attachments
administrator help
Description
Users are allowed to export the exchange contacts with a phone number to the local device contacts.
Sophos Secure Email will keep them synchronized.
Only name and telephone number will be exported to enable the user to identify company contacts in an incoming call. Note that even after a remote reset of the Sophos Secure Email app, the information will still be available in the local storage of the device.
This option controls the display of email notifications and event reminders in the Sophos Secure Email app.
When you select the option:
Email notifications are displayed with sender and subject.
Event reminders are displayed with time, location and title.
When you deselect the option:
Email notifications are disabled.
Event reminders are displayed with time only.
Note: If you think notifications displayed on a lost or stolen device is a security risk, you may want to disable notification details.
Users cannot copy or cut texts from the Sophos
Secure Email app.
The user can save attachments or open them in other apps.
If required, select the maximum email size for Sophos
Secure Email app from the list.
If you select this option, Save and View buttons are displayed under the attachment. Save passes the attachment on to Sophos Secure Workspace, View opens the file in Sophos Secure Email. If Sophos
Secure Email cannot open the file, users can select where to pass the file on to.
If you deselect this option, attachment cannot be opened or passed on to other apps.
129
Sophos Mobile Control (in Sophos Central)
Setting/Field
Add
Description
Click Add to configure settings that a future version of the Sophos Secure Email app might require.
Important: Only configure these settings if instructed by the Sophos support team.
12.17.3 Corporate Documents configuration (iOS Sophos container policy)
Configure storage providers
For each storage provider you can define the following settings separately:
Setting/Field
Enable
Offline
Open in (encrypted)
Open in (unencrypted)
Clipboard
Description
The storage provider is available in the app.
Users are allowed to add files from the storage provider to the app's Favorites list for offline use.
Users can share encrypted files with other apps via
Open In.
Users can share unencrypted files with other apps via Open In.
Users can copy parts of a document and paste them into other apps.
Enterprise provider settings
For Egnyte and WebDAV provider, also referred to as enterprise provider, you can centrally define server settings and login credentials. These cannot be changed by users.
Credential settings that you do not define centrally can be chosen by the users in the app's provider credential screens.
For example you can centrally define the server and user account to be used but you can leave the password field undefined. Users then would have to know the password when accessing the storage provider.
130
Setting/Field
Name
Server
User name
Password
Upload folder
Other settings
Setting/Field
Enable Documents
Passphrase complexity
administrator help
Description
The name of the provider that is displayed in the
Sophos Secure Workspace app.
In this field, enter:
The URL of the root folder on the Corporate
Documents WebDAV server.
The URL of the root folder on the Egnyte server.
The URL of the root folder on the WebDAV server.
Use the following format:
https://server.company.com
In this field, enter the user name for the relevant server.
In this field, enter the password for the relevant account.
In this field, enter the upload folder for the relevant account.
Description
This turns on the Documents feature to securely distribute company documents.
The required minimum complexity of passphrases for encryption keys. More secure passphrases are always allowed.
You can select the following settings:
4 char password
6 char password
8 char password
10 char password
131
Sophos Mobile Control (in Sophos Central)
12.17.4 Corporate Browser configuration (iOS Sophos container policy)
With the Corporate Browser configuration you define settings for the Corporate Browser feature of the Sophos Secure Workspace app.
The Corporate Browser allows you to securely access corporate intranet pages and other allowed pages. You can define domains and bookmarks within a domain.
Every bookmarks belongs to a certain domain. When you use Add bookmark to define a bookmark, the domain entry is created automatically if it does not exist.
Domain settings
Setting/Field
URL
Allow copy/paste
Allow open with
Allow save password
Description
The domain that you want to allow.
Users can copy and paste text from the Corporate
Browser to other apps.
Users can download attachments or pass them on to other apps.
Users can save their passwords in the Corporate
Browser.
Bookmark settings
Setting/Field
Name
URL
Description
The name for the bookmark.
The web address for the bookmark.
12.17.5 Client certificate configuration (iOS Sophos container policy)
With the Client certificate configuration you install a client certificate onto devices. This certificate will be available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the Sophos container.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.
132
administrator help
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
12.17.6 Root certificate configuration (iOS Sophos container policy)
With the Root certificate configuration you upload a root certificate to devices. This certificate will be available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the Sophos container.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
12.17.7 SCEP configuration (iOS Sophos container policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP). These certificates are available to the
Sophos Secure Workspace app if it is installed in the Sophos container.
Note: You must first add a Root certificate configuration to upload the CA certificate of the
SCEP server before you can add a SCEP configuration.
Setting/Field
URL
Alias name
Subject
Description
The web address of the Certificate Authority server.
Use the variable
%_SCEPPROXYURL_%
to refer to the server URL that is configured on the SCEP tab of the System setup page.
The name under which the certificate will appear in selection dialogs.
This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the
CN=
prefix.
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.
For example:
Enter
CN=%_USERNAME_%
to specify a user.
Enter
CN=%_DEVPROP(serial_number)_%
to specify a device.
133
Sophos Mobile Control (in Sophos Central)
Setting/Field
Type of Subject Alternative Name
Value of Subject Alternative Name
NT user login name
Challenge
Description
For information on available placeholders, see
Placeholders in profiles and policies (page 55).
Optionally, configure a Subject Alternative Name
(SAN). Select one of the available SAN types.
If you have selected a SAN type, enter the SAN value.
Root certificate
Key size
Use as digital signature
Use for encryption
The web address to obtain a challenge password from the SCEP server.
Use the variable
%_CACHALLENGE_%
to refer to the challenge URL that is configured on the SCEP tab of the System setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root
certificate configurations of the current profile.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
If you select this check box, the public key can be used as a digital signature.
If you select this check box, the public key can be used for data encryption.
12.18 Configurations for Windows Mobile policies
With a Windows Mobile policy you configure various aspects of Windows Mobile devices, like password policies, restrictions or Wi-Fi settings.
For information on how to create a Windows Mobile policy, see
(page 52).
134
administrator help
12.18.1 Password policies configuration (Windows Mobile policy)
With the Password policies configuration you define password rules for devices.
Setting/Field
Password type
Description
Select the type of password you want to define:
Alphanumeric
Alphanumeric or numeric
Allow simple password
Minimum password length
Maximum number of failed attempts
Time in minutes until the device is locked
Password history
Passwords can contain sequential or repeated characters, for example
abcde
or
1111
.
The minimum number of characters a password must contain.
The maximum number of failed login attempts to enter the correct password before the device is wiped.
Enter a value between
1
and
999
, or
0
for no restriction.
The time period (in minutes) after which the device is locked if it has not been used. The user can unlock the device.
Enter a value between
1
and
999
, or
0
for no restriction.
The number of old passwords that are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password.
Enter a value between
1
and
999
, or
0
for no restriction.
Maximum password age in days
The number of days after which users must change their password.
Enter a value between
1
and
730
, or
0
for no restriction.
Minimum number of different character groups
The minimum number of non-alphanumeric characters (for example & or !) a password must contain.
Allow the password grace period to be set
Users are allowed to set the password grace period.
135
Sophos Mobile Control (in Sophos Central)
12.18.2 Restrictions configuration (Windows Mobile policy)
With the Restrictions configuration you define restrictions for devices.
Device
Setting/Field
Forbid SD card
Forbid unencrypted device
Description
Users cannot access the storage card. This does not prevent apps from accessing the storage card.
Internal storage encryption is turned on.
Important: After internal storage encryption has been turned on on a device, you cannot turn it off again through a policy.
Note: You must enable BitLocker on the device before applying the policy.
Forbid action center notifications above lock screen
No Action Center notifications are displayed above the device lock screen.
Forbid manual addition of non-Microsoft email accounts
Forbids adding all types of email accounts, as well as Exchange, Office 365 and Outlook.com accounts.
Forbid Microsoft account connection
The Microsoft account is the system account used for synchronization, backup and the Store.
Forbid developer mode
Forbid Windows Store
Forbid native browser
Forbid camera
Telemetry
The Windows developer mode is turned off.
The app store is unavailable.
The Microsoft Edge browser is unavailable.
The Privacy setting Let apps use my camera is turned off.
Select if the device can send diagnostic and usage telemetry data:
Allowed
Allowed, except for secondary data requests
Not allowed
136
administrator help
Various
Setting/Field
Forbid copy and paste
Forbid Cortana
Forbid "Save as" for Office files
Forbid screen capture
Forbid sharing of Office files
Forbid "Sync my settings"
Forbid voice recording
Wi-Fi
Description
The clipboard is unavailable.
Cortana is turned off.
Users cannot save a file on the device as an Office file.
Screen captures are turned off.
Users cannot share Office files.
Device settings cannot be synchronized to and from other Windows devices.
Voice recording is turned off.
Setting/Field
Forbid Wi-Fi
Forbid internet sharing
Forbid Wi-Fi Sense (hotspot auto-connect)
Forbid hotspot reporting
Forbid manual configuration
Description
Wi-Fi connections are turned off.
Internet Connection Sharing (ICS) is turned off.
The device does not automatically connect to Wi-Fi hotspots.
The device does not send information about Wi-Fi connections.
Users cannot configure Wi-Fi connections beyond the connections that are configured by Sophos Mobile
Control.
137
Sophos Mobile Control (in Sophos Central)
Connectivity
Setting/Field
Forbid NFC
Forbid Bluetooth
Forbid USB connection
Description
Near Field Communication (NFC) is turned off.
Bluetooth is turned off.
USB connection between the device and a computer to sync files or to use developer tools to deploy or debug applications is forbidden. This does not affect
USB charging.
Roaming and costs
Setting/Field
Forbid cellular data roaming
Forbid VPN over cellular
Forbid VPN roaming over cellular
Description
Data connections over foreign cellular networks are turned off.
VPN connections over cellular networks are turned off.
VPN connections over foreign cellular networks are turned off.
Security and privacy
Setting/Field Description
Forbid Bing Vision to store images from Bing
Vision search
Bing Vision does not store the contents of the images captured when performing Bing Vision search.
Forbid use of location when searching
Forbid manual installation of root certificates
The search cannot utilize location information.
Users cannot manually install root and intermediate
CA certificates.
138
administrator help
Setting/Field
Forbid locating
SafeSearch permission
Description
All location privacy settings on the device are turned off. No apps can use the location service. This also forbids Sophos Mobile Control to locate the device.
The level of search result filtering that is enforced on the device:
Moderate: Moderate filtering against adult content. Valid search results are not filtered.
Strict: Highest filtering against adult content.
Unenrollment
Setting/Field
Forbid user to reset the phone
Forbid manual MDM unenrollment
Description
Users cannot factory reset the device through the control panel or hardware key combinations.
Users cannot delete the workplace account.
12.18.3 Exchange ActiveSync configuration (Windows Mobile policy)
With the Exchange ActiveSync configuration you define user settings for your Microsoft Exchange
Server.
Setting/Field
Account name
Exchange ActiveSync host
Domain
User
Description
The account name.
The address of the Microsoft Exchange Server.
Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.
The domain for this account.
The user for this account.
If you enter the variable
%_USERNAME_%
, the server replaces it with the actual user name.
139
Sophos Mobile Control (in Sophos Central)
Setting/Field
Email address
Password
Synchronization period
Synchronization interval
SSL
Synchronize content types
Description
The email address of the account.
If you enter the variable
%_EMAILADDRESS_%
, the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The time period emails are synchronized for.
If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.
The interval between email synchronization processes.
All communication is sent through SSL (Secure Socket
Layer).
We recommend that you select this check box.
The content types to be synchronized.
12.18.4 Wi-Fi configuration (Windows Mobile policy)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
Setting/Field
SSID
Connect automatically
Hidden network
Security type
Proxy
Description
In this field, enter the ID of the Wi-Fi network.
The connection will be established automatically.
The target network is not open or visible.
Select the Security type from the list. If you select either WPA-PSK or WPA2-PSK you must specify the password.
If you select Manually from the list, you must specify
Server and port.
140
administrator help
12.18.5 App restrictions configuration (Windows Mobile policy)
With the App restrictions configuration you specifically allow or block apps on the devices.
Setting/Field
Allowed apps
Forbidden apps
App group
Description
Contains a set of individual apps that users are allowed to install and use on the device. Users will be unable to install or use any apps that are not explicitly listed.
Use Allowed apps when you know the list of apps that you want to allow and want to block all other apps.
Contains a set of individual apps that users are prevented from installing on the device. Users will be able to install any apps that are not explicitly listed.
Use Forbidden apps when you know the list of apps that you want to block and want to allow all other apps.
Select the App group that contains the list of apps you want to allow or block.
Note: The app group has to be created beforehand.
See
12.18.6 Root certificate configuration (Windows Mobile policy)
With the Root certificate configuration you install a root certificate onto devices.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
12.18.7 SCEP configuration (Windows Mobile policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).
Setting/Field
Description
Description
A description for the configuration.
141
Sophos Mobile Control (in Sophos Central)
Setting/Field
URL
Subject
Subject Alternative Name
Challenge
Root certificate
Retries
Retry delay
Key size
Description
The web address of the Certificate Authority server.
Use the variable
%_SCEPPROXYURL_%
to refer to the server URL that is configured on the SCEP tab of the
System setup page.
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.
For example:
Enter
CN=%_USERNAME_%
to specify a user.
Enter
CN=%_DEVPROP(serial_number)_%
to specify a device.
For information on available placeholders, see
Placeholders in profiles and policies (page 55).
Optionally, configure one or more Subject Alternative
Name (SAN) values.
Click Add and then enter a SAN type and a SAN value.
The web address to obtain a challenge password from the SCEP server.
Use the variable
%_CACHALLENGE_%
to refer to the challenge URL that is configured on the SCEP tab of the System setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current profile.
The number of retries if the server sends a response of type pending.
The number of seconds between retries.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
142
administrator help
Setting/Field
Use as digital signature
Use for encryption
Hash algorithm
Description
If you select this check box, the public key can be used as a digital signature.
If you select this check box, the public key can be used for data encryption.
Select one or more hash algorithms that are supported by the SCEP server.
12.19 Configurations for Windows Desktop policies
With a Windows Desktop policy you configure various aspects of Windows Desktop devices, like password policies, restrictions or Wi-Fi settings.
For information on how to create a Windows Desktop policy, see Create profile or policy
(page
52).
12.19.1 Password policies configuration (Windows Desktop policy)
With the Password policies configuration you define password rules for devices.
Note: Password complexity rules (for example length, number of uppercase and lowercase letters) for Windows Desktop devices are fixed and cannot be set by a Sophos Mobile Control policy. For details see
Windows Desktop password complexity rules (page 54).
Note: Password policies cannot be assigned to a Windows Desktop device, if there are other local users configured on the device (in addition to the user that is enrolled with Sophos Mobile
Control), and at least one of them is not allowed to change their password.
Setting/Field
Maximum number of failed attempts
Time in minutes until the device is locked
Description
The maximum number of failed login attempts to enter the correct password before the device is wiped.
Enter a value between
1
and
999
, or
0
for no restriction.
The time period (in minutes) after which the device is locked if it has not been used. The user can unlock the device.
Enter a value between
1
and
999
, or
0
for no restriction.
143
Sophos Mobile Control (in Sophos Central)
Setting/Field
Password history
Maximum password age in days
Description
The number of old passwords that are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password.
Enter a value between
1
and
999
, or
0
for no restriction.
The number of days after which users must change their password.
Enter a value between
1
and
730
, or
0
for no restriction.
12.19.2 Restrictions configuration (Windows Desktop policy)
With the Restrictions configuration you define restrictions for devices.
Device
Setting/Field Description
Forbid SD card
Users cannot access the storage card. This does not prevent apps from accessing the storage card.
Forbid manual addition of non-Microsoft email accounts
Forbids adding all types of email accounts, as well as Exchange, Office 365 and Outlook.com accounts.
Forbid developer mode
Forbid camera
Disable Edge autofill
The Windows developer mode is turned off.
The Privacy setting Let apps use my camera is turned off.
The Save form entries setting in the Edge web browser is turned off and cannot be turned on by the user.
If the check box is cleared, the setting is turned on and cannot be turned off by the user.
Disable Edge F12 Developer Tools
The F12 Developer Tools of the Edge web browser are unavailable.
144
Setting/Field
Disable Edge pop-up blocker
Disable AutoPlay settings
Disable Date & Time settings
Disable Language settings
Disable Power & Sleep settings
Disable Region settings
Disable Sign-in settings
Disable VPN settings
Disable Workplace settings
Disable Account settings
Telemetry
administrator help
Description
The Block pop-ups setting in the Edge web browser is turned off and cannot be turned on by the user.
If the check box is cleared, the setting is turned on and cannot be turned off by the user.
The relevant sections of the Windows Control Panel are unavailable. The user cannot change any of these settings after the policy has been assigned to the device.
Note: Disable AutoPlay settings does not affect connected devices, like for example mobile phones.
Select if the device can send diagnostic and usage telemetry data:
Allowed
Allowed, except for secondary data requests
Not allowed
Various
Setting/Field
Forbid Cortana
Forbid "Sync my settings"
Description
Cortana is turned off.
Device settings cannot be synchronized to and from other Windows devices.
145
Sophos Mobile Control (in Sophos Central)
Setting/Field
Disable Windows tips
Description
The Windows notification setting Show me tips
about Windows is cleared and unavailable.
Wi-Fi
Setting/Field
Forbid internet sharing
Forbid Wi-Fi Sense (hotspot auto-connect)
Description
Internet Connection Sharing (ICS) is turned off.
The device does not automatically connect to Wi-Fi hotspots.
Connectivity
Description
Bluetooth is turned off.
Setting/Field
Forbid Bluetooth
Security and privacy
Setting/Field
Forbid use of location when searching
Unenrollment
Setting/Field
Forbid manual MDM unenrollment
Description
The search cannot utilize location information.
Description
Users cannot delete the workplace account.
146
administrator help
12.19.3 Exchange ActiveSync configuration (Windows Desktop policy)
With the Exchange ActiveSync configuration you define user settings for your Microsoft Exchange
Server.
Important: If you use multiple configurations to set up Exchange ActiveSync accounts, the devices might only be able to retrieve mail for one account. This typically happens when the accounts are located on different Exchange ActiveSync servers and there are different mailbox policies defined on these servers. Because the Windows Desktop devices can only enforce a single mailbox policy, they will fail to connect to the accounts that use a different policy.
Setting/Field
Account name
Exchange ActiveSync host
Domain
User
Email address
Password
Synchronization period
Synchronization interval
SSL
Description
The account name.
The address of the Microsoft Exchange Server.
Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.
The domain for this account.
The user for this account.
If you enter the variable
%_USERNAME_%
, the server replaces it with the actual user name.
The email address of the account.
If you enter the variable
%_EMAILADDRESS_%
, the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The time period emails are synchronized for.
If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.
The interval between email synchronization processes.
All communication is sent through SSL (Secure Socket
Layer).
We recommend that you select this check box.
147
Sophos Mobile Control (in Sophos Central)
Setting/Field
Synchronize content types
Description
The content types to be synchronized.
12.19.4 Wi-Fi configuration (Windows Desktop policy)
Setting/Field
SSID
Connect automatically
Hidden network
Description
In this field, enter the ID of the Wi-Fi network.
The connection will be established automatically.
The target network is not open or visible.
12.19.5 Root certificate configuration (Windows Desktop policy)
With the Root certificate configuration you install a root certificate onto devices.
In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
148
administrator help
13 Task bundles
By using task bundles you can bundle several tasks in one transaction. So you can bundle all tasks necessary to have a device enrolled and configured:
■
■
Enroll the device.
Apply required policies.
■
■
Install required applications (for example managed apps for iOS devices).
Apply required profiles.
You can also include wipe commands in task bundles to automatically wipe non-compliant (for example jailbroken or rooted) devices. For further information, see
(page 26).
13.1 Create task bundle
1. On the menu sidebar, under CONFIGURE, click Task bundles and select Android or Apple
iOS.
2. On the Task bundles page, click Create task bundle.
The Edit task bundle page is displayed.
3. Enter a name and, optionally, a version and a description for the new task bundle in the relevant fields.
4. When you select the Selectable for compliance actions option, the task bundle can be
transferred onto a device when the device breaks a compliance rule. See Compliance rules
(page 26).
Note: This option will be disabled when you edit an existing task bundle and the task bundle is already used as a compliance action.
5. On the menu sidebar, under CONFIGURE, click Task bundles and select Android or Apple
iOS.
6. Click Create task.
7. Select the task type and click Next.
The next view depends on the task type you have selected. In each view you can specify your own meaningful task names. These task names are shown during installation on the Self
Service Portal.
8. Follow the wizard steps to add the required task and click Apply to create the task.
For a description of the available task types, see
(page 150) and
(page 153).
9. Optional: Add further tasks to the task bundle.
Tip: You can change the installation order of the tasks by using the sort arrows on the right-hand side of the tasks list.
149
Sophos Mobile Control (in Sophos Central)
10. After you have added all required tasks to the task bundle, click Save on the Edit task bundle page.
The task bundle is available for transfer. It is displayed on the Task bundles page.
Note: When you edit an existing task bundle which is used as Initial package in the Self Service
Portal settings, the enrollment task cannot be deleted. See Configure Self Service Portal settings
(page 16).
13.2 Available Android task types
The following task types are available for Android task bundles:
Enroll
When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.
When the task is transferred to a device that is already enrolled, no enrollment email is sent.
Install profile or assign policy
Select a profile or policy from the list of available profiles and policies. For information on how to
add profiles or policies to this list, see Profiles and policies (page 52).
When the task is transferred to devices, the profile is silently installed or the policy is silently assigned.
You can add more than one task of this type to a task bundle.
Remove profile
In Select source, select Profiles and then select a profile from the list.
In addition to the profiles that are available on the Sophos Mobile Control server, the list includes profiles that are in use on the managed devices.
You can also remove a profile that is not contained in the list. Select Identifier and then enter the identifier of the profile you want to remove from devices.
When the task is transferred to devices, the profile is silently removed.
You can add more than one task of this type to a task bundle.
Note: You cannot directly remove a Sophos container policy or a Mobile Security policy from devices. Instead, use the device action Unenroll Sophos container or Unenroll SMSec. This will also remove the related policies from the device.
150
administrator help
Install app
Select an app from the list of all available apps. For information on how to add apps to this list, see
When the task is transferred to devices, users receive a notification on their devices that Sophos
Mobile Control wants to install the app. Users can tap OK to start the process, or Not now to be notified again after a short period of time.
If users tap OK but then tap Cancel in the subsequent Android dialog, the task fails.
If the app is already installed on a device that receives the task, it is updated.
You can add more than one task of this type to a task bundle.
Install Android for Work app
This task type is available if you have configured Android for Work for the customer.
Select an app from list of all available work apps. For information how to add apps to this list, see
The installation task is sent to a Google service. Google then manages the installation of the app onto the device. On the Task view page, the state of the task is successful when it has been sent to Google.
You can add more than one task of this type to a task bundle.
For information how to uninstall a work app from devices, see Uninstall work app (page 181).
Remove app
In Select source, select Apps to select an app for removal from the list of available apps.
In addition to the apps that are available on the Sophos Mobile Control server, the list includes apps that are in use on the managed devices - with the exception of Android system apps and apps that have been pre-installed by the device manufacturer.
You can also remove an app that is not contained in the list. Select Identifier and then enter the package name of the app you want to remove from devices. If you select Knox container app, the app will be removed from the Samsung Knox container.
When the task is transferred to devices, users receive a notification on their devices that Sophos
Mobile Control wants to remove the app. Users can tap OK to start the process, or Not now to be notified again after a short period of time.
If users tap OK but then tap Cancel in the subsequent Android dialog, the task fails.
If the app is not installed on a device that receives the task, no notification is displayed.
You can add more than one task of this type to a task bundle.
151
Sophos Mobile Control (in Sophos Central)
Send message
Enter a plain text to be displayed on the devices.
When the task is transferred to devices, the message text is displayed in a notification window.
Users can display past messages on the Messages page of the Sophos Mobile Control app.
You can add more than one task of this type to a task bundle.
Unenroll
When the task is transferred to devices, they are unenrolled from Sophos Mobile Control. See
Unenroll devices (page 38). Device users do not need to confirm the operation.
You cannot add an Unenroll and a Wipe task to the same task bundle.
Wipe
When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.
Important: Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.
Note: When a Wipe task is transferred to a device that is enrolled with Android for Work, only the work profile and all work apps are removed.
You cannot add an Unenroll and a Wipe task to the same task bundle.
Knox container: lock
When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container is locked.
If the task is transferred to a device that does not support Samsung Knox, the task fails.
Knox container: unlock
When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container is unlocked.
If the task is transferred to a device that does not support Samsung Knox, the task fails.
Knox container: reset password
When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container password is reset. Users must set a new password to unlock the Knox container.
If the task is transferred to a device that does not support Samsung Knox, the task fails.
152
administrator help
Knox container: remove
When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container
(including any container-related configuration) is removed.
If the task is transferred to a device that does not support Samsung Knox, the task fails.
Trigger SMSec scan
When the task is transferred to devices, the Sophos Mobile Security app is silently triggered to perform a scan against malware and potentially unwanted apps (PUAs).
This task requires that Sophos Mobile Security is managed from Sophos Mobile Control, that is,
a Mobile Security policy is assigned to the device. See Manage Sophos Mobile Security (page
194).
If Sophos Mobile Security is not managed by Sophos Mobile Control on a device that receives the task (that is, if a Mobile Security policy is not assigned to the device), the task remains in the state Will be retried.
13.3 Available iOS task types
The following task types are available for iOS task bundles:
Enroll
When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.
When the task is transferred to a device that is already enrolled, no enrollment email is sent.
Install profile or assign policy
Select a profile or policy from the list of available profiles and policies. For information on how to
add profiles or policies to this list, see Profiles and policies (page 52).
When the task is transferred to devices, the profile is silently installed or the policy is silently assigned.
You can add more than one task of this type to a task bundle.
Remove profile
In Select source, select Profiles and then select a profile from the list.
In addition to the profiles that are available on the Sophos Mobile Control server, the list includes profiles that are in use on the managed devices.
153
Sophos Mobile Control (in Sophos Central)
You can also remove a profile that is not contained in the list. Select Identifier and then enter the identifier of the profile you want to remove from devices.
When the task is transferred to devices, the profile is silently removed.
You can add more than one task of this type to a task bundle.
Note: You cannot directly remove a Sophos container policy from devices. Instead, use the device action Unenroll Sophos container. This will also remove the related policy from the device.
Install provisioning profile
Select an app provisioning profile from the list of available profiles. For information on how to add
profiles to this list, see Import provisioning profiles for iOS apps (page 54).
When the task is transferred to devices, the provisioning profile is silently installed.
Remove provisioning profile
In Select source, select Profiles and then select a provisioning profile from the list.
In addition to the profiles that are available on the Sophos Mobile Control server, the list includes profiles that are in use on the managed devices.
You can also remove a provisioning profile that is not contained in the list. Select Identifier and then enter the identifier of the profile you want to remove from devices.
When the task is transferred to devices, the provisioning profile is silently removed.
Install app
Select an app from the list of all available apps. For information on how to add apps to this list, see
When the task is transferred to devices, users receive a notification on their devices that Sophos
Mobile Control wants to install the app. Users can tap Install to start the process, or Cancel to reject the installation.
If users reject the installation, the task fails.
If the app is already installed on a device that receives the task, it is updated.
You can add more than one task of this type to a task bundle.
Remove app
In Select source, select Apps to select an app for removal from the list of available apps.
In addition to the apps that are available on the Sophos Mobile Control server, the list includes apps that are in use on the managed devices - with the exception of iOS system apps.
You can also remove an app that is not contained in the list. Select Identifier and then enter the bundle ID of the app you want to remove from devices.
154
administrator help
When the task is transferred to devices, the app is removed silently.
You can add more than one task of this type to a task bundle.
Send message
Enter a plain text to be displayed on the devices.
When the task is transferred to devices, the message text is displayed in a notification window.
Users can display past messages on the Messages page of the Sophos Mobile Control app.
You can add more than one task of this type to a task bundle.
Unenroll
When the task is transferred to devices, they are unenrolled from Sophos Mobile Control. See
Unenroll devices (page 38). Device users do not need to confirm the operation.
You cannot add an Unenroll and a Wipe task to the same task bundle.
Wipe
When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.
Important: Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.
You cannot add an Unenroll and a Wipe task to the same task bundle.
13.4 Duplicate task bundles
Since creating a task bundle can be time-consuming, you can duplicate finished task bundles.
This function is helpful if several extensive task bundles with similar tasks are required. Then only a few tasks need to be deleted or added.
Note: You can only duplicate task bundles if they are not edited at the same time. Copies are named “Copy of” plus the name of the original. You can rename the bundles according to your requirements.
1. On the menu sidebar, under CONFIGURE, click Task bundles and select Android or Apple
iOS.
The Task bundles page is displayed.
2. Click the blue triangle next to the task bundle you want to duplicate and then click Duplicate.
The task bundle is duplicated and shown on the Task bundles page. You can now edit the duplicated task bundle as required. To edit the task bundle, click the blue triangle next to it and then click Edit.
155
Sophos Mobile Control (in Sophos Central)
13.5 Transfer task bundles to individual devices or to device groups
1. On the menu sidebar, under CONFIGURE, click Task bundles and select Android or Apple
iOS.
The Task bundles page is displayed.
2. Click the blue triangle next to the required task and then click Transfer.
The Select devices page is displayed.
3. On this page, you can:
■
■
Select individual devices you want to transfer the task bundle to.
Click Select device groups, to open the Select device groups page and select one or several device groups for transferring the task bundle.
4. After you have made your selection, click Next.
The Set execution date page is displayed.
5. Under Scheduled date, select Now or specify a Date and Time for the execution of this task.
6. Click Finish.
The Task view is shown.
The task bundle is transferred to the selected devices at the specified date and time.
156
administrator help
14 Apps
You configure apps in Sophos Mobile Control to make them available for installation through the
Sophos Mobile Control console (administrator-initiated) or through the Sophos Mobile Control app (user-initiated).
To make an app available in Sophos Mobile Control, you can do one of the following:
■
You upload the app package to the Sophos Mobile Control server. This option is not available for Windows Mobile apps.
■
You provide a link to the app in the relevant app store.
For both options, see section
To install an app on a device, create a task bundle that contains an Install app task. For Android and iOS devices, you can create such task bundles directly from the Apps page. See
(page 159).
Note:
To be able to install app packages that are stored on the Sophos Mobile Control server (in contrast to the installation from the app store), the following conditions must be met:
■
■
For Android, the Android security setting Unknown sources must be enabled on the devices.
When you try to install an APK file when Unknown sources is disabled, the Sophos Mobile
Control app will direct the users to the page where they can enable the setting. This restriction does not apply to devices with LG GATE, Samsung Knox or Sony Enterprise API.
For iOS, the installation of apps from IPA files is only possible for self-developed apps. When the app is ready for distribution, you must create a provisioning profile for the app and make it available on the devices, either installed separately beforehand or included in the app's IPA file. You can use Sophos Mobile Control to distribute provisioning profiles to your iOS devices.
See
Import provisioning profiles for iOS apps
(page 54). For details on provisioning profiles, see the iOS Developer Library.
14.1 Add app
You make an app available for installation either by uploading the app package or by linking to the app in the relevant app store.
1. On the menu sidebar, under CONFIGURE, click Apps and then select the platform for which you want to add the app.
2. On the Apps page, click Add app and then select:
■
■
Android package or iOS package to add the app by uploading the APK file (for Android apps) or IPA file (for iOS apps).
Android link, iOS link or Windows Mobile link to add the app by linking to it in the relevant app store.
On the next page, you configure the app details.
157
Sophos Mobile Control (in Sophos Central)
Note: For iOS links, you can click Search in iTunes to search for the app in the iTunes database.
When you select an app in the search results list, the relevant fields on the Edit iOS link page will be populated from the corresponding iTunes values.
3. Enter a Name for the new app.
4. Optional: For app packages, enter a Version that is displayed in the Enterprise App Store.
For app links, the version is displayed as
Google Play Store
or
App Store
. In the
Enterprise App Store this is replaced by the actual version from the app store.
5. Optional: In the App identifier field, enter the internal identifier of the app.
Leave this field empty if you do not know the exact identifier. In most cases, Sophos Mobile
Control can read the value from the app itself and then fills in this field automatically.
6. Optional: In the App category field, enter a category name, for example
Recommended
.
When you make the app available in the Enterprise App Store as described in the next step, the app will be listed in a section with that name.
7. You can make the app available in the Enterprise App Store so that it's installation can be initiated by the user. Click Show next to Available to device groups and select one or more device groups for which the app will be listed in the Enterprise App Store.
8. For iOS devices, when you select SMC managed installation, the app will be installed as a managed app.
Certain device profile settings are only available for managed apps.
Note: The SMC managed installation setting only affects apps that are installed by the user from the Enterprise App Store. Apps that you install from the Sophos Central Admin console are always managed.
For information on managed apps, see
Managed apps for iOS (page 160).
9. Optional: In the Description text field, enter a description that is displayed in the Enterprise
App Store.
Note: You may use the placeholder
%_appstoretext_%
anywhere in your description text.
In the Enterprise App Store, this is replaced by the actual app description from Google Play or the App Store.
10. Click Show next to Operating systems and select the operating system versions the app applies to.
11. For Samsung Knox devices, when you select Install in Knox container, the app will be installed inside the Knox container.
This option is only available when a Samsung Knox Premium license key is configured on the
System setup page.
12. Configure the app source.
■
For app links, enter the URL of the app in the relevant app store in the Link field.
To determine the URL, click the link below the Link field to open the app store in a new browser tab and navigate to the app page. Then copy the URL from the tab's address bar and paste it into the Link field.
158
administrator help
■
For app packages, click Upload a file to upload the app to the Sophos Mobile Control server. Navigate to the APK file (for Android apps) or IPA file (for iOS apps) and click Open.
Note:
The package file size must not exceed a certain limit.
13. When you have configured the app details, click Save to save the app settings and to return to the Apps page.
The app is available for installation. It is displayed on the Apps page. If you have configured the
Available to device groups field, the app is also displayed in the Enterprise App Store of the
Sophos Mobile Control app from where users can install it. The installation process runs unattended or with very little user interaction.
14.2 Install app
Note: This section only applies to Android and iOS devices.
When you have added an app to Sophos Mobile Control as described in Add app
(page 157), you can manually install it on selected devices or device groups.
1. On the menu sidebar, under CONFIGURE, click Apps and then click Android or Apple iOS.
2. On the Apps page, click the blue triangle next to the required app and then click Install.
3. Select the devices on which you want to install the app. Do one of the following:
■
■
Select individual devices.
Click Select device groups and then select one or more device groups.
When you are ready, click Next.
4. On the Set execution date page, specify the date when the app will be installed:
■
■
Select Now for an immediate execution.
Select Date and then enter a date and a time for a scheduled execution.
5. Click Finish.
The selected app is installed onto the selected devices at the specified date.
On supervised iOS devices and on Android devices with the Sophos Samsung Plugin app installed, apps are installed silently, that is without user interaction.
14.3 Uninstall app
Note: This section only applies to Android and iOS devices.
When you have added an app to Sophos Mobile Control as described in Add app
(page 157), you can manually uninstall it from selected devices or device groups.
1. On the menu sidebar, under CONFIGURE, click Apps and then click Android or Apple iOS.
2. On the Apps page, click Uninstall.
3. Select the devices from which you want to uninstall an app. Do one of the following:
■
Select individual devices.
159
Sophos Mobile Control (in Sophos Central)
■
Click Select device groups and then select one or more device groups.
When you are ready, click Next.
4. On the Select app page, select the required app.
5. On the Set execution date page, specify the date when the app will be uninstalled:
■
■
Select Now for an immediate execution.
Select Date and then enter a date and a time for a scheduled execution.
6. Click Finish.
The selected app is uninstalled from the selected devices at the specified date.
Managed apps on supervised iOS devices are uninstalled silently, that is without user interaction.
Tip: Alternatively, you can use the following procedure to uninstall an app from a single device:
Open the device's Show device page, go to the Installed apps tab and then click the trash can icon next to the app name.
14.4 Managed apps for iOS
For iOS apps that you add to Sophos Mobile Control, you can choose to have the app installed as managed or unmanaged on the users’ devices.
Managed apps have the following characteristics:
■
When users select a managed app in the Enterprise App Store, an installation task is created and processed in Sophos Mobile Control. In contrast, when users select an unmanaged app, they are redirected to the Apple App Store to install the app from there.
■
■
■
You can uninstall managed apps through the Sophos Mobile Control console. This is not possible for unmanaged apps.
On supervised iOS devices, managed apps are installed and uninstalled silently, that is without user interaction.
Certain settings in iOS device profiles are only available for managed apps.
■
When an iOS device is unenrolled from Sophos Mobile Control, all managed apps are automatically removed from the device. Unmanaged apps will remain on the device.
The following rules determine if an app is installed managed or unmanaged:
■
Apps that you install from the Sophos Central Admin console are always managed.
■
■
Apps that the user installs from the App Store are always unmanaged.
Apps that the user installs from the Enterprise App Store are managed if you have activated the SMC managed installation setting in the app properties, as described in
157).
To check the app status on a device, open the Show device page for that device and go to the
Installed apps tab. See The Show device page
(page 39).
Tip: If a user has installed an unmanaged app you can convert it into a managed app. To do this, configure the app in Sophos Mobile Control as managed, and then create an installation task for it. Because the app is already installed, it is not installed again, but its status changes from
unmanaged to managed.
160
administrator help
14.5 Manage apps purchased through Apple VPP
With the Apple Volume Purchase Program (VPP), you can buy iOS apps in volume for distribution within your company.
After an order placed with Apple VPP has been completed, you can download an sToken (service token) that contains the licenses for the apps purchased.
In Sophos Mobile Control, you can provide the licenses included in the sToken to users by inviting them to become authorized Apple VPP users. After users have accepted their invitation, they become authorized VPP users and you can assign VPP apps to them. Users can install assigned
VPP apps onto their devices using iTunes.
You can also assign VPP apps to devices with iOS 9 or higher. You do not need to invite devices to VPP. You install an assigned VPP app on a device through Sophos Mobile Control.
For detailed information on how to enroll and use Apple VPP, see http://www.apple.com/business/vpp/ .
For detailed information on how to assign VPP apps to users or devices, see
VPP apps (page 163) and Manually assign VPP apps (page 163).
14.5.1 Set up a VPP sToken
To provide licenses for apps purchased through the Apple Volume Purchase Program (VPP) in
Sophos Mobile Control, you need to set up an sToken (service token).
1. On the menu sidebar, under SETTINGS, click Setup > System setup.
2. On the System setup page, click the Apple VPP tab.
3. Click the Apple iTunes VPP Portal link.
This opens the Apple VPP web portal in a new browser window.
4. On that page, select Business.
5. In the Business Store Sign In dialog, enter your Apple ID and your password.
6. Go to the Account Summary page and click Download Token.
The sToken is generated and saved to your local computer in a text file with extension
.vpptoken
, using the download settings of your web browser.
7. Optional: Move the sToken file to a location that you can access from the Sophos Mobile
Control console.
8. Go back to the Apple VPP tab of the Sophos Mobile Control console, click Upload a file, select the sToken file and then click Open.
Sophos Mobile Control reads in the file and populates the Organization and Expiry date fields from the sToken details.
9. In the Automatically assign VPP apps on installation list, you can configure the automatic
assignment of VPP apps. See Automatically assign VPP apps (page 163).
10. Optional: Fill in the remaining fields of the Apple VPP tab.
In the Country field, enter your two-letter country code, for example
US
for the United States.
161
Sophos Mobile Control (in Sophos Central)
11. Click Save.
Note: To notify when the sToken is about to expire, Sophos Mobile Control sends several email reminders to all administrators of the relevant customer, starting 30 days prior to the expiry date.
14.5.2 Invite users to Apple VPP
You need to set up an sToken before you can invite users to the Apple Volume Purchase Program
(VPP). See
(page 161).
1. On the menu sidebar, under MANAGE, click Users.
2. On the Show users page, you can invite all users or individual users to Apple VPP:
■
To invite all users:
1. Click Invite users to Apple VPP at the top of the Show users page.
2. Click Yes in the confirmation dialog box.
■
To invite a single user:
1. Click the required user name.
2. On the Show user page, click Invite user to VPP.
3. Click Yes in the confirmation dialog box.
■
1. Click Search and invite a user to Apple VPP at the top of the Show users page.
2. In the Search user dialog, search for the user either by name or by email address.
3. In the search result list, select the user that you want to invite to Apple VPP.
4. Click Apply.
Sophos Mobile Control sends an invitation email to all relevant users.
Users must follow the link in their invitation email to connect their Apple iTunes account with Apple
VPP. Afterward, they can install and use the apps that are licensed by your company.
14.5.3 Manage Apple VPP users
When you have set up an Apple VPP sToken as described in Set up a VPP sToken (page 161),
the Show user page of each user includes an Apple Volume Purchase Program (VPP) section.
In this section, you can perform the following tasks to view or edit the Apple VPP status of the user:
■
View the Apple VPP user status. This can be:
■
Not registered: The user has not been invited to Apple VPP.
■
■
Registered: The user has been invited to Apple VPP, but has not connected their Apple iTunes account with Apple VPP.
Associated: The user has connected their Apple iTunes account with Apple VPP and can install VPP apps.
■
■
View the Apple VPP apps that the user has installed.
Invite the user to Apple VPP by clicking Invite user to VPP.
162
administrator help
In most cases, an email with an invitation link is sent to the user. If the user account does not contain an email address, an invitation link will be displayed in a message box.
■
■
Send another invitation email if the user did not receive or lost the initial email, by clicking
Re-send invitation email.
Deregister the user from Apple VPP by clicking Delete VPP registration.
14.5.4 Automatically assign VPP apps
By default, apps that you purchased through the Apple Volume Purchase Program (VPP) are automatically assigned to the device on which the app is installed. If the device does not support the assignment of VPP apps, the app is assigned to the user that is assigned to the device.
Note: To support the assignment of VPP apps, the device must have the status managed and use iOS 9 or higher.
You can invert the order of precedence and favor user assignment over device assignment, or you can disable automatic assignment and instead assign VPP apps manually, as described in
(page 163).
The automatic assignment of VPP apps is configured per customer.
1. On the menu sidebar, under SETTINGS, click Setup > System setup.
2. On the System setup page, click the Apple VPP tab.
3. In the list Automatically assign VPP apps on installation, select the desired option:
■
■
■
Preferably to device: If the device supports it, the VPP app is assigned to the device.
Otherwise, the VPP is assigned to the user that is assigned to the device.
Preferably to user: The VPP app is assigned to the user that is assigned to the device.
Disabled: VPP apps are not assigned automatically. If you select this option, VPP apps must be assigned manually.
14.5.5 Manually assign VPP apps
This section describes the manual assignment of individual VPP apps. By default, apps that you purchased through the Apple Volume Purchase Program (VPP) are automatically assigned to the device on which the app is installed. See
Automatically assign VPP apps (page 163).
You can assign apps that you purchased through the Apple Volume Purchase Program (VPP) to users or to devices. After you assign a VPP app to users that are associated with Apple VPP, they can install it on all iOS devices that are associated with their Apple ID. After you assign a
VPP app to devices, you can push it to the devices through Sophos Mobile Control.
To assign a VPP app to users or devices:
1. On the menu sidebar, under CONFIGURE, click Apps > Apple iOS.
This opens the Apps page that displays a list of all apps that you have added to Sophos Mobile
Control.
2. To add apps you purchased through Apple VPP to the app list, click Import VPP apps.
This retrieves the app information from the Apple VPP server and creates app entries in Sophos
Mobile Control, if required.
163
Sophos Mobile Control (in Sophos Central)
3. Click the blue triangle next to the VPP app you want to assign to users or devices and then click Edit.
4. On the Edit iOS link page, click Show next to the VPP licenses option.
This opens the VPP licenses dialog.
5. To assign the app to one or more users, click VPP users and then select the required users.
The list contains all users that are registered for or associated with Apple VPP.
6. To assign the app to one or more devices, click Devices and then select the required devices.
The list contains all devices with iOS 9 or higher and status Managed.
7. Click Apply to confirm the changes and to close the VPP licenses dialog.
8. Click Save to save the changes and to synchronize the app assignment with the Apple VPP server.
Tip: To discard assignment changes that you made in the VPP licenses dialog, click Apply to close the dialog box and then click Back to leave the Edit iOS link page without saving the changes to the database.
To install the assigned app on a device:
■
After the app is assigned to users, it is listed in the Purchased view of the iTunes app on their devices. The users can install it from there.
■
After the app is assigned to devices, you can install it through Sophos Mobile Control. See
(page 159).
To deassign an app:
■
Open the VPP licenses dialog box as described before and then clear the selection of the required users or devices.
Note: Because the status of VPP apps is managed by the Apple VPP server, it may take some time until changes that you make in Sophos Mobile Control are visible on the devices.
14.5.6 Synchronize VPP license information
For performance reasons, Sophos Mobile Control keeps a local copy of VPP license information.
You can trigger Sophos Mobile Control to synchronize its VPP data with the Apple VPP server.
Note: You only need to synchronize the VPP data if the displayed license information for an app is incorrect.
1. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the Apple
VPP tab.
2. Click Clear VPP cache.
Sophos Mobile Control discards its local VPP information for the customer and synchronizes the data with the Apple VPP server.
Note: For information how to display the license information for a VPP app, see Manually assign
(page 163).
164
administrator help
14.6 Configure per app VPN and settings for iOS apps
For iOS apps, you can select a per app VPN to support the iOS feature Per app VPN. With this feature, apps can be configured to automatically connect to VPN when they are started. You can also configure settings for the app that will be deployed on the device during the app installation.
Prerequisites:
■
■
To be able to select a per app VPN, you need to define a Per app VPN configuration in an iOS configuration profile. See
Per app VPN configuration (iOS device profile)
(page 111).
To define settings, you need to know the required parameter and the parameter type.
1. On the menu sidebar, under CONFIGURE, click Apps and then click Apple iOS.
2. On the Apps page, click the blue triangle next to the required app and then click Edit.
3. On the Edit iOS link or Edit iOS package page, click Show next to the Settings and VPN field.
4. On the Edit settings and VPN page, select the required configuration from the Per app VPN list to define the VPN the app is supposed to connect to.
5. To add managed settings, click Create parameter.
6. In the Configuration parameter dialog, configure the following: a) In the Parameter field, enter the required parameter, for example, SMC_URL.
b) In the Value field, enter the parameter value, for example,
smc.sophos.com
.
c) In the Type list, select the parameter type: String, Bool, Integer or Real.
d) Click Apply.
The set of managed settings is displayed on the Edit Settings and VPN page.
7. On the Edit settings and VPN page, click Apply.
8. Click Save.
The selected per app VPN will be used when the app connects to VPN. The settings will be provided to the devices during the app installation.
165
Sophos Mobile Control (in Sophos Central)
15 App groups
In Sophos Mobile Control you create app groups to define list of apps for profiles, policies and compliance rules.
App groups are used in the following settings:
■
In the App Protection configuration of Android device profiles.
■
■
■
■
In the App Control configuration of Android device profiles.
In the Restrictions configuration of Android device profiles, iOS device profiles and Knox container profiles.
In the App restrictions configuration of Windows Mobile policies.
In compliance rules to specify lists of allowed, forbidden and mandatory apps.
15.1 Create app group
1. On the menu sidebar, under SETTINGS, click App groups and then select the platform for which you want to create the group.
2. On the App group page, click Create app group.
3. On the Edit app group page, enter a Name for the new app group and then click Add app.
4. In the Edit app dialog box you can either select an app from a list or enter custom app data.
■
■
To select an app from a list, click App list and then select an app from the list of all apps that are currently installed on the managed devices for the platform you selected.
To enter custom app data for an Android app, click Custom and then configure the following information:
■
App name: An arbitrary name that is used to identify the app.
■
Identifier: The package name of the app. The package name can be retrieved from the app's URL in Google Play. For example for the Sophos Mobile Control Android app, the
Google Play URL is https://play.google.com/store/apps/details?id=com.sophos.mobilecontrol.client.android
and the package name is
com.sophos.mobilecontrol.client.android
.
■
To enter custom app data for an iOS app, click Custom and then configure the following information:
■
App name: An arbitrary name that is used to identify the app.
■
Identifier: The bundle ID of the app.
166
administrator help
■
To enter custom app data for a Windows Mobile app, click Custom and then configure the following information:
■
App name: An arbitrary name that is used to identify the app.
■
Link: The URL of the app in the Windows Store. For example, the Windows Store URL of the Sophos Mobile Control Windows app is https://www.microsoft.com/en-us/store/apps/mobile-control/9nblggh0g04v.
■
GUID: If you know the GUID of the app, you can enter it instead of the link. Otherwise, leave this field empty.
5. After you have selected an app from the list or entered custom app data, click Add to add it to the app group.
6. Optional: Add more apps to the app group.
7. When you are ready, click Save to save the app group.
15.2 Import app group
You can create an app group by importing a UTF-8 encoded comma-separated values (CSV) file with up to 10,000 apps.
Note: Use a text editor for editing the CSV file. If you use Microsoft Excel, values entered may not be resolved correctly. Make sure that you save the file with extension
.csv
.
Tip: A sample file with the correct column names and column order is available for download from the Import apps page.
To import apps from a CSV file and add them to an app group:
1. On the menu sidebar, under SETTINGS, click App groups and then select the platform for which you want to create the group.
2. On the App group page, click Create app group.
3. On the Edit app group page, enter a Name for the new app group and then click Import
apps.
4. On the Import apps page, click Upload a file and then navigate to the CSV file that you have prepared.
The entries are read in from the file and are displayed.
5. If the data is not formatted correctly or is inconsistent, the file as a whole cannot be imported.
In this case, follow the error messages that are displayed next to the relevant entries, correct the content of the CSV file accordingly and upload it again.
6. Click Finish to add the apps to the app group.
7. On the Edit app group page, click Save.
167
Sophos Mobile Control (in Sophos Central)
16 Corporate documents
Note: This feature requires a Mobile Advanced license.
In Sophos Mobile Control, you can upload files for distribution to the devices of your users.
■
■
Documents managed in Sophos Mobile Control are automatically added to the Corporate
Documents store of Sophos Secure Workspace.
In the Corporate Documents store on the device, the Category that can be defined for each document is shown as folder.
■
■
If Sophos Secure Workspace is not managed by Sophos Mobile Control, the Corporate
Documents store is not visible.
Documents in Corporate Documents are read only. They cannot be edited in Sophos Secure
Workspace and then uploaded again.
To distribute corporate documents:
1. Install the Sophos Secure Workspace app onto the devices. See Apps (page 157).
2. Assign a Sophos container policy with a Corporate Documents configuration.
3. Upload documents to Sophos Mobile Control.
16.1 Add corporate documents
Prerequisite: You have activated a Mobile Advanced license.
To distribute documents to devices:
1. On the menu sidebar, under CONFIGURE, click Documents.
The Documents page is displayed.
2. Click Add document.
The Edit document page is displayed.
3. Enter a category for the document.
■
The Category is the name of the folder in which the document is displayed in the Corporate
Documents store on the device.
■
■
Multiple files can have the same Category.
If you leave this field blank, the file will be shown in the root folder of Corporate Documents.
168
administrator help
4. Define settings for the document:
■
Select Copy to clipboard to allow users to copy the document to the clipboard.
■
■
Select Share document to allow users to share the document.
Select Use document offline to allow users to create a Favorite for the document.
When a plain document from Corporate Documents is marked as Favorite, it will be stored encrypted in the Sophos Secure Workspace app. When sharing the document is allowed, the encrypted favorite file will be decrypted automatically before it is forwarded to other apps. If you clear the Use document offline check box and users already have offline copies, the file stored in Sophos Secure Workspace Favorites on the managed devices will be removed automatically as part of the next synchronization.
5. Click Show next to Assigned groups and select the group that should have access to the document.
6. Add a description for the document.
7. Click Upload a file and navigate to the document. Select it and click Open.
The document file size must not exceed a certain limit.
8. Repeat this step for each document you want to distribute.
The document is added to the documents list. It is distributed to the users, who can view it in the
Sophos Secure Workspace app.
169
Sophos Mobile Control (in Sophos Central)
17 Android for Work
Android for Work is a Google program to separate personal and corporate data on an Android device.
If you have registered your company with Android for Work, you can set up Sophos Mobile Control as a third-party EMM (Enterprise Mobility Management) provider for your Android for Work domain.
Android for Work supports different deployment scenarios. Sophos Mobile Control uses the BYOD
(bring your own device) scenario:
■
Users have to create a work profile on their devices.
■
■
■
■
■
The work profile will be attached to the primary device profile, that is the personal profile, so that its content is available to the personal profile.
Sophos Mobile Control manages the content of the work profile. It registers itself as the profile
owner.
When a device is enrolled with Android for Work, all the apps in the work profile, including the
Sophos Mobile Control app, are marked with a briefcase badge.
Users use the badged version of the Google Play Store app to install work apps from Google
Play for Work.
You can configure the content and layout of Google Play for Work using Sophos Mobile Control.
Related Links
Android for Work Help Center (external link)
17.1 Set up Android for Work
You must initially set up Android for Work for a customer to enable the Android for Work features.
1. Register an Android for Work domain with Google.
2. Create an enterprise service account and configure the APIs that are required to communicate with the Google services.
3. Bind Sophos Mobile Control to your Android for Work domain.
170
administrator help
17.1.1 Register domain with Google
In the first stage of the setup procedure for Android for Work, you register a domain with Google
(Managed Google Domain), create a domain administrator (Managed Google Account) and verify your domain ownership.
Note: If you already have a Managed Google Domain, for example because you have signed up for G Suite (formerly Google Apps), you can skip this section. Instead, enable Android for Work for your domain from the Google Admin console.
1. Click the following link https://www.google.com/a/signup/?enterprise_product=ANDROID_WORK to sign up for Android for Work.
2. Fill the web form with the required information.
■
Under About your business, enter the domain that will be used as the Managed Google
Domain in Business domain address. For example, you could use the domain of your
Sophos Mobile Control server.
Note: If you want to configure Android for Work for more than one customer in Sophos
Mobile Control, you need a separate domain for each customer.
■
Under Your Google admin account, enter the credentials for a new domain administrator.
Note: Make a note of the credentials as you will need them later in the setup procedure.
3. Click the button to create the domain administrator account.
This opens the setup page for Android for Work in the Google Admin console.
Tip: You can also access the setup page manually: Open the following web address https://admin.google.com
and log in with the credentials of the domain administrator you’ve created.
4. In the Google Admin console, start the procedure to verify your domain ownership.
Follow the instructions provided by Google to verify your domain.
After your domain ownership is verified, you receive a token to connect your Android for Work domain with your third-party EMM provider, that is, with Sophos Mobile Control.
Next, you must create a Google service account and configure the relevant APIs for Android for
Work. See
Configure Google service account
(page 171).
17.1.2 Configure Google service account
In the second stage of the setup procedure for Android for Work, you create and configure a
Google service account.
Prerequisite: You have a domain administrator account for your Android for Work domain.
A Google service account is a special type of Google account for an application. This account is used by Sophos Mobile Control to communicate with the Google Android for Work API.
Create a project:
1. Click the following link https://console.developers.google.com/apis/library to open the Google
API console. Log in with the credentials of your domain administrator account.
171
Sophos Mobile Control (in Sophos Central)
2. In the header bar of the Google API console, click Project > Create project.
If you already have a project, the header bar shows the project name instead of the word
Project.
3. In the New project dialog, enter a project name, for example
Android for Work
, and then click Create.
Enable the required APIs:
4. On the menu sidebar, click Library, and then enter the string
admin sdk
in the search field.
5. In the search result list, click Admin SDK.
6. At the top of the Admin SDK page, click Enable.
7. Click Library again and repeat the previous three steps for the Google Play EMM API.
This time, use
emm
as a search string.
Create a service account:
8. On the Google Play EMM API page, click Create credentials.
9. In step one of the Add credentials to your project page, click the service account link.
10. On the Service Accounts page, click Create Service Account.
11. In the Create service account dialog box, enter the following settings: a) In Name, enter a name to identify the service account, for example
Android for Work
.
b) Select Furnish a new private key and then select JSON.
c) Select Enable G Suite Domain-wide Delegation.
d) In Product name for the consent screen, enter for example
Android for Work
.
When you click Create, the private key for your service account is generated and saved to your computer in a JSON file.
Note: Store the JSON file in a secure location. You need it to bind Sophos Mobile Control to your Android for Work domain.
Configure API access:
12. Click the following link https://admin.google.com
to open the Google Admin console and log in with the credentials of your domain administrator account.
13. Click Security and then click Advanced settings.
Tip: You may need to click Show more to display Advanced settings.
14. Click Manage API client access.
15. Open the JSON file in a text editor and copy the client_id
value into the Client Name field.
For example, if your JSON file contains a line
"client_id": "123456789", then enter
123456789
in the Client Name field.
172
administrator help
16. In the One or more API Scopes field, enter the following two URLs, separated by a comma: https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/androidenterprise
17. Click Authorize.
You can now bind Sophos Mobile Control to your Android for Work domain. See Bind Sophos
(page 173).
17.1.3 Bind Sophos Mobile Control to your domain
In the third stage of the setup procedure for Android for Work, you bind Sophos Mobile Control to your Android for Work domain.
Prerequisites:
■
You have a domain administrator account for your Android for Work domain.
■
■
You have verified your domain ownership.
You have enabled the Android for Work APIs.
■
You have created a service account for Android for Work.
1. Log in to the Sophos Mobile Control console. Use an administrator account for the customer for which you want to set up Android for Work.
2. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Android tab.
3. Under Android for Work, click Configure.
4. In the dialog box that opens, configure the following settings:
Business domain
Domain administrator
EMM token
Your Android for Work domain that has been verified by Google.
The name of your domain administrator account.
This is the administrator that you created when you registered your Android for Work domain with
Google.
The token that you received from Google after you verified your domain ownership.
You can view the token when you log in to the
Google admin console ( https://admin.google.com
) with your domain administrator credentials and navigate to Security > Android for Work settings.
5. Click Upload a file and then navigate to the JSON file that you downloaded from Google when creating the service account for Android for Work.
6. Click Bind.
7. On the Android tab, click Save.
173
Sophos Mobile Control (in Sophos Central)
Sophos Mobile Control contacts the Google web service to bind itself as an EMM provider to your
Android for Work domain.
In the final stage of the setup procedure for Android for Work, you must configure the Google
EMM settings. See
Configure EMM settings (page 174).
17.1.4 Configure EMM settings
In the final stage of the setup procedure for Android for Work, you configure the Google EMM settings.
Prerequisite: You have bound Sophos Mobile Control to your Android for Work domain.
1. Click the following link https://admin.google.com
to open the Google Admin console and log in with the credentials of your domain administrator account.
2. Click Security and then click Manage EMM provider for Android.
Tip: You may need to click Show more to display Manage EMM provider for Android.
3. Under General Settings, select Enforce EMM policies on Android devices.
This completes the setup procedure for Android for Work.
17.2 Configure Android for Work
To enable your users to enroll their devices with Android for Work, you must complete the following configuration tasks:
1. Create an Android for Work policy and configure at least one Restrictions configuration. See
Configurations for Android for Work policies
(page 75).
2. Create a task bundle that is transferred to a device when a user enrolls with Android for Work on the Self Service Portal. The task bundle must contain at least an Enroll task and an Install
profile or assign policy task for an Android for Work policy. You may use different task bundles for corporate and private devices. See
Create task bundle (page 149).
3. In the Self Service Portal setup, decide whether enrollment with Android for Work is optional or mandatory when users enroll a device with Sophos Mobile Control. See
Configure Android for Work device enrollment
(page 174).
17.2.1 Configure Android for Work device enrollment
Your users enroll their devices with Android for Work through the Self Service Portal. In Sophos
Mobile Control, you configure whether enrollment with Android for Work is optional or mandatory, and which task bundles are transferred to the devices.
Prerequisites
■
You have configured Android for Work for the customer.
■
You have created a task bundle for the Android for Work device enrollment. The task bundle must contain at least an Enroll task and an Install profile or assign policy task for an Android for Work policy. You may use different task bundles for corporate and private devices.
1. On the menu sidebar, under SETTINGS, click Setup > Self Service Portal, and then click the Group settings tab.
174
administrator help
2. Click the blue triangle next to the Self Service Portal group for which you want to configure the Android for Work device enrollment, and then click Edit. Or create a new group.
The Self Service Portal group must be configured for the Android platform.
For details on the Self Service Portal configuration, see Configure Self Service Portal settings
(page 16).
3. In at least one of the columns Initial package - corporate devices and Initial package -
personal devices, you must select a task bundle to be executed on corporate and personal devices.
4. Set whether enrollment is required or not in Android for Work - corporate devices and
Android for Work - personal devices.
■
■
Optional: Users can choose to enroll with Android for Work when they enroll their devices with Sophos Mobile Control.
Required: Enrollment with Android for Work is mandatory.
5. Click Apply.
6. In the Group settings tab, click Save.
17.3 Manage Android for Work users
A user must have a Managed Google Account to enroll a device with Android for Work. This
Android for Work account is connected to the domain that you registered with Google.
Android for Work account names are formed like an email addresses, for example user@your_android_for_work_domain
.
When a user enrolls a device with Android for Work on the Self Service Portal, Sophos Mobile
Control checks if an Android for Work account for the user already exists on the Google server.
For this, the left part of the user’s email address in Sophos Mobile Control is combined with your
Android for Work domain. If an account with that name does not exist, Sophos Mobile Control creates it.
Example: If the user’s email address in Sophos Mobile Control is user@your_company.com
and your Android for Work domain is your_android_for_work_domain
, Sophos Mobile
Control checks the Google server for an account user@your_android_for_work_domain
.
Other than creating an Android for Work account during enrollment, Sophos Mobile Control does not manage the account lifecycle. If you delete the user account in Sophos Mobile Control, the user’s Android for Work account remains.
You can manage the Android for Work accounts for your domain from the Google Admin console.
If required, you can create Android for Work accounts from your LDAP directory, using Google
Apps Directory Sync (GADS).
Related Links
Google Admin console (external link)
About Google Apps Directory Sync (external link)
175
Sophos Mobile Control (in Sophos Central)
17.4 Enroll devices with Android for Work
Your users enroll their devices with Android for Work during the enrollment with Sophos Mobile
Control through the Sophos Central Self Service portal. Enrollment with Android for Work through the Sophos Central Admin console is not possible.
However, you can unenroll a user’s device from Android for Work through the Sophos Central
Admin console, for example to delete corporate data from the device in case of lost or theft.
Note: Sophos Mobile Control supports the enrollment with Android for Work for devices with
Android 6 or higher.
17.5 Lock work profile
For devices that are enrolled with Android for Work, you can lock or unlock the work profile. When the work profile is locked, all work apps are unavailable and no notifications are displayed for work apps.
Tip: Users can lock the work profile from the Quick Settings panel on their device, for example when they are on leave.
1. On the menu sidebar, under MANAGE, click Devices.
2. Click the blue triangle next to the device for which you want to lock or unlock the work profile and then click Show.
3. Click Actions > Set container access.
4. Select the access permissions.
■
■
■
Deny: The work profile is locked. Users can no longer access apps or data within the work profile.
Allow: The work profile is unlocked.
Auto mode: The work profile is locked if the device violates a compliance rule that contains a Lock container action. This is the default behavior if you have not set an access permission.
5. Click Yes.
The device is synchronized with the Sophos Mobile Control server. Once this is complete the setting is applied to the device.
17.6 Remove work profile from device
For devices that are enrolled with Android for Work, you can remove the work profile. For example to delete corporate data from the device in case of lost or theft.
When you remove the work profile from the device, all work apps, including the Sophos Mobile
Control app, are also removed. In the Sophos Mobile Control console, the device is displayed with status Unenrolled.
1. On the menu sidebar, under MANAGE, click Devices.
2. Click the blue triangle next to the device from which you want to remove the work profile and then click Show.
176
administrator help
3. Click Actions > Wipe Android for Work.
A task to remove the work profile is created and transferred to the device. You can display the task status on the Task view page.
Note: If the user has already removed the work profile manually, the task fails as the device cannot receive it anymore.
To re-enroll the device with Android for Work, the user must repeat the enrollment procedure on the Self Service Portal.
17.7 User-initiated work profile removal
Users can remove the work profile from their device, either accidentally or intentionally. Sophos
Mobile Control is unable to detect this type of removal. It continues to display the device status as Managed (Android for Work).
After the user has removed the work profile, the device cannot synchronize with the Sophos
Mobile Control server.
Tip: You can use the Devices not synchronized in last 7 days report to identify potentially affected devices.
If the work profile was removed accidentally, you can re-enroll the device with Android for Work:
1. You delete the device from Sophos Mobile Control.
2. The user repeats the enrollment procedure through the Self Service Portal.
17.8 Work apps
Work apps are apps that are compatible with Android for Work.
You use Google Play for Work to select the work apps that are available to your Android for Work users. Your users install these apps through the Google Play Store app in their work profile.
You must perform the following tasks in Google Play for Work and in Sophos Mobile Control to make work apps available to your users:
1. In Google Play for Work, you select the apps for your Android for Work domain. To do this:
■
Approve the app.
■
Purchase app licenses.
■
Accept the app permissions.
See
(page 178).
2. In Sophos Mobile Control, you configure the app. To do this:
■
Define the location of the app in the Google Play Store app on the users’ devices.
■
For apps that support it, configure custom app settings.
■
For paid apps, assign users a license for the app.
See
177
Sophos Mobile Control (in Sophos Central)
17.8.1 Approve work app
1. Open the Google Play for Work Store ( https://play.google.com/work ) and log in with your
Google administrator account.
2. In the Google Play for Work Store, select the app you want to make available to your users.
3. Either click Approve (for free apps) or Buy (for paid apps).
Note: Paid apps for Android for Work are currently only available in the United States and in
Canada.
4. If the app requires permissions, accept these on behalf of your company.
When your users install that app, they are not asked to grant permissions.
5. For paid apps, enter the number of licenses and the payment method.
Note: If you receive an error when trying to buy an app, check in the Google Admin console that Google payment services are enabled for your domain or your account.
At this stage, the app is approved for your domain but users are not able to install it yet. You must complete the allocation process in Sophos Mobile Control. See
Note: If an update to your work app includes additional app permissions, you must accept these before your users can install the update. In the Google Play for Work menu, click Update to view and approve pending updates.
Related Links
Google Play for Work (external link)
Google Admin console (external link)
Google Play for Work Help Center (external link)
17.8.2 Edit work app
After you have approved an app in the Google Play for Work Store, you must configure the app in Sophos Mobile Control to make it available to your Android for Work users.
1. On the menu sidebar, under CONFIGURE, click Apps and then click Android.
2. On the Apps page, click Android for Work apps.
This opens the Android for Work apps page that displays a list of all work apps that you have approved in the Google Play for Work Store.
3. Click Retrieve app list from Google to synchronize the changes you made in the Google
Play for Work Store. After synchronization, users can install the apps through the Google Play
Store app in their work profile.
4. Click the blue triangle next to the required app and then click Edit.
5. Use the Page and App category fields to define the location of the app in the Google Play
Store app on the users’ devices: a) In the Page list, select the page in which the app will appear. The page items are pre-configured by Sophos Mobile Control and cannot be changed.
b) In the App category field, enter the name of a category in which the app will appear.
178
administrator help
When you start to type in the App category field, a list of matching categories is displayed.
If you enter a category that is not available, it is created.
6. For paid apps, the Edit Android for Work app page contains a Licenses field. Click Show next to the Licenses field to view or edit the license information for the app.
It may take a few seconds before Sophos Mobile Control retrieves the license information from
Google.
a) In the Licenses dialog, you can see the number of used and remaining licenses for the app, and the Android for Work users that have a license assigned.
b) Select users to assign them a license for the app, or deselect users to remove their license.
Click Apply to close the Licenses dialog.
7. If the app offers managed configuration, the Edit Android for Work app page contains an
App settings button. Click that button to view or edit the available app settings.
For information on the available settings, see the documentation that is provided by the app developer.
8. On the Edit Android for Work app page, click Save to save your changes.
9. On the Android for Work apps page, click Send configuration to Google to send the updated layout information and app configuration to Google.
Note: If you skip this last step, the app configuration is only stored locally in Sophos Mobile
Control. It is not transferred to the Google server and is not available to your users.
After the data is synchronized to the Google server, the work app is available through the Google
Play Store app in the work profile. Free apps are available to all of your users, while paid apps are only available to users that have a license assigned.
17.8.3 Work app settings
Setting/Field
Title
Product ID
Pricing
Distribution type
Description
The external app name as displayed in the Google
Play for Work Store.
The internal app name.
The pricing type:
Free
Free with in-app purchases
Paid
Public (Google-hosted): The app is available to the general public in Google Play for Work.
179
Sophos Mobile Control (in Sophos Central)
Setting/Field Description
Private (Google-hosted): The app is developed by you and only available to users within your
Android for Work domain. The APK file was uploaded to Google Play for Work.
Private (self-hosted): Like Private
(Google-hosted), but the APK file is installed from your local server. Google Play for Work is only used to manage the distribution.
Google Play for Work URL, Google Play URL The web address of the app in Google Play for Work and Google Play.
Click the link to open that page in a new browser window.
Page
App category
Licenses
App settings
The page on which the app will appear in the users’
Google Play Store app.
The values are pre-configured by Sophos Mobile
Control and cannot be changed.
The name of a category under which the app will appear in the users’ Google Play Store app.
Click Show next to Licenses to view or edit the license information for the app.
This setting is only available for paid apps.
Click App settings to view or edit app-specific settings.
For information on the available settings, see the documentation provided by the app developer.
This setting is only available if the app offers managed configuration.
17.8.4 Install work app
After you have approved a work app in Google Play for Work and have assigned app licenses to your users, you can install the app to selected devices or device groups.
Note: Users can install approved apps through the Google Play Store app in their work profile.
1. On the menu sidebar, under CONFIGURE, click Apps and then click Android.
2. On the Apps page, click Android for Work apps.
3. Click the blue triangle next to the required app and then click Install.
180
administrator help
4. Select the devices on which you want to install the app. Do one of the following:
■
■
Select individual devices.
Click Select device groups and then select one or more device groups.
When you are ready, click Next.
5. On the Set execution date page, specify the date when the app will be installed:
■
■
Select Now for an immediate execution.
Select Date and then enter a date and a time for a scheduled execution.
6. Click Finish.
The installation task is sent to a Google service. Google then manages the installation of the app onto the device. On the Task view page, the state of the task is successful when it has been sent to Google.
17.8.5 Uninstall work app
You can uninstall a work app from selected devices or device groups.
1. On the menu sidebar, under CONFIGURE, click Apps and then click Android.
2. On the Apps page, click Android for Work apps.
3. On the Android for Work apps page, click Uninstall.
4. Select the devices from which you want to uninstall an app. Do one of the following:
■
■
Select individual devices.
Click Select device groups and then select one or more device groups.
When you are ready, click Next.
5. On the Select app page, select the required app.
6. On the Set execution date page, specify the date when the app will be uninstalled:
■
■
Select Now for an immediate execution.
Select Date and then enter a date and a time for a scheduled execution.
7. Click Finish.
A task to uninstall the app is sent to a Google service. Google then manages the removal of the app from the device. On the Task view page, the state of the task is successful when it has been sent to Google.
Tip: Alternatively, you can use the following procedure to uninstall an app from a single device:
Open the device's Show device page, go to the Installed apps tab and then click the trash can icon next to the app name.
17.8.6 Licenses for work apps
By assigning licenses for paid work apps to users, you define which apps are available to a user.
You only assign licenses for paid work apps to users. Free apps that you have approved in Google
Play for Work are automatically available to all of your users after you synchronize the app list from Google to Sophos Mobile Control.
181
Sophos Mobile Control (in Sophos Central)
Tip: You do not need to assign a license for administrator-initiated app installations. When you install a work app as described in
Install work app (page 180), a license from your pool of purchased
licenses will automatically be assign to the relevant users.
17.8.7 Layout of Google Play for Work
You can define the location of each work app in the Google Play Store app on the users’ devices.
The configurable layout elements are Pages and Categories.
■
■
■
■
Pages are named, vertically scrollable views. Pages and their names are pre-defined by
Sophos Mobile Control.
Categories are named, horizontally scrollable subsections of a page that you define. In the
Google documentation, categories are also called clusters.
Each category is specific to a certain page, and each app appears within a certain category.
Pages that do not contain any apps are not displayed.
■
You can configure up to 30 categories per page and up to 100 apps per category.
For each app, you define the page and, optionally, the category in which the app is displayed in the Google Play Store app on the users’ devices. By default, apps are placed on a page named
Other.
You configure the store layout on the Edit Android for Work app page. See
178).
17.8.8 Configurable work apps
A work app can offer a managed configuration. This feature is included by the app developer and allows you to configure custom settings for the app.
If an app supports managed configuration, a note This app offers managed configuration is displayed on the app’s page in Google Play for Work.
You configure the app settings on the Edit Android for Work app page. See Edit work app
(page
178).
17.8.9 Private and self-hosted work apps
All work apps that you want to make available to your users must be distributed through Google
Play for Work.
■
Public work apps are apps that are available to all users with an Google Play for Work account.
■
■
Private work apps are apps developed by you that are only available to users inside your domain.
Self-hosted work apps are private apps for which the application package (that is the APK file) is located on a server belonging to your organization instead of the Google server. However,
182
administrator help the app store metadata for self-hosted apps must be uploaded to Google so that the app can be distributed through Google Play for Work.
For information on private work apps, see the Android for Work Developer web pages (external link).
183
Sophos Mobile Control (in Sophos Central)
18 Send message to devices
You can send a custom message to managed devices.
Note: You cannot send messages to Windows Desktop devices.
1. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed.
2. Select one or more devices, click Actions and then click Send message.
3. In the Enter message dialog, enter the message you want to send.
The message can contain up to 500 characters. Below the text field, the number of remaining characters is displayed.
4. Click Finish.
184
administrator help
19 Standalone EAS proxy
You can set up an EAS proxy to control the access of your managed devices to an email server.
Email traffic of your managed devices is routed through that proxy. You can block email access for devices, for example a device that violates a compliance rule.
The devices must be configured to use the EAS proxy as email server for incoming and outgoing emails. The EAS proxy will only forward traffic to the actual email server if the device is known in
Sophos Mobile Control and matches the required policies. This guarantees higher security as the email server does not need to be accessible from the Internet and only devices that are authorized
(correctly configured, for example with passcode guidelines) can access it. Also, you can configure the EAS proxy to block access from specific devices.
The standalone EAS proxy is downloaded and installed separately from Sophos Mobile Control.
It communicates with the Sophos Mobile Control server through an HTTPS web interface.
Note: For performance reasons, we recommend you use the standalone EAS proxy server instead of the internal version when email traffic for more than 500 client devices must be managed.
Features
■
■
■
■
Support for multiple Microsoft Exchange or IBM Notes Traveler email servers. You can set up one EAS proxy instance per email server.
Load balancer support.You can set up standalone EAS proxy instances on several computers and then use a load balancer to distribute the client requests among them.
Support for certificate-based client authentication.You can select a certificate from a certification authority (CA), from which the client certificates must be derived.
Support for email access control through PowerShell. In this scenario, the EAS proxy service communicates with the email server through PowerShell to control the email access of your managed devices. Email traffic happens directly from the devices to the email server and is
not routed through a proxy. See Set up email access control through PowerShell
(page 189).
Note: For non-iOS devices, filtering abilities of the standalone EAS proxy are limited due the specifics of the IBM Notes Traveler protocol. Traveler clients on non-iOS devices do not send the device ID with every request. Requests without a device ID are still forwarded to the Traveler server, even though the EAS proxy is not able to verify that the device is authorized.
19.1 Usage scenarios for the standalone EAS proxy
A standalone EAS proxy server should be used for the following scenarios.
185
Sophos Mobile Control (in Sophos Central)
You use IBM Notes Traveler (formerly IBM Lotus Notes Traveler) for non-iOS devices
Microsoft Exchange and IBM Notes Traveler for iOS devices use the ActiveSync protocol for the communication between email server and client, while IBM Notes Traveler for non-iOS devices
(for example, Android) uses a different protocol. The standalone EAS proxy supports that protocol.
For non-iOS devices, dedicated Traveler client software is required. This software is available through
<traveler-server>/servlet/traveler
or the Traveler file system. The Install App and Uninstall App features of Sophos Mobile Control can be used to install and uninstall the
Traveler client software. Configuration has to be performed manually.
You want to support multiple backend servers
With the standalone EAS proxy you can set up multiple instances of backend email systems.
Each instance needs an incoming TCP port. Each port can connect to a different backend. You need one URL per EAS proxy instance.
You want to set up load balancing for EAS
You can set up standalone EAS proxy instances on several computers and then use a load balancer to distribute the client requests among them.
For this scenario an existing load balancer for HTTP is required.
You want to use client certificate based authentication
For this scenario an existing PKI is required and the public part of the CA certificate has to be set in the EAS proxy.
You need to manage more than 500 devices
For performance reasons, we recommend you use the standalone EAS proxy server instead of the internal version when email traffic for more than 500 client devices must be managed.
19.2 Download the EAS proxy installer
1. Log in to the Sophos Central Admin console.
2. On the menu sidebar, under My Products, click Mobile.
3. On the menu sidebar of the Mobile view, under SETTINGS, click Setup > System setup and then click the EAS proxy tab.
4. Under External, click the link to download the EAS proxy installer.
The installer file is saved to your local computer.
186
administrator help
19.3 Install the standalone EAS proxy
Prerequisite:
■
■
All required email servers are accessible. The EAS proxy installer will not configure connections to servers that are not available.
You are an administrator on the computer where you install the EAS proxy.
1. Run
Sophos Mobile Control EAS Proxy Setup.exe
to start the Sophos Mobile
Control EAS Proxy - Setup Wizard.
2. On the Choose Install Location page, choose the destination folder and click Install to start installation.
After the installation has been completed, the Sophos Mobile Control EAS Proxy -
Configuration Wizard is started automatically and guides you through the configuration steps.
3. In the SMC Server configuration dialog, enter the URL of the SMC server that the EAS proxy will connect with.
You should also select Use SSL for incoming connections (Clients to EAS Proxy) to secure the communication between clients and the EAS proxy.
Optionally, select Use client certificates for authentication if you want the clients to use a certificate in addition to the EAS proxy credentials for authentication. This adds an additional layer of security to the connection.
Select Allow all certificates if your Sophos Mobile Control server presents varying certificates to the EAS proxy, for example because there are several server instances behind a load balancer, and each instance uses a different certificate. When this option is selected, the EAS proxy will accept any certificate from the Sophos Mobile Control server.
Important: Because the Allow all certificates option reduces the security level of the server communication, we strongly recommend that you select it only if required by your network environment.
4. If you selected Use SSL for incoming connections (Clients to EAS Proxy) before, the
Configure server certificate page is displayed. On this page you create or import a certificate for the secure (HTTPS) access to the EAS proxy.
Note:
You can download an SSL Certificate Wizard from MySophos that you can use to request your SSL certificate for the Sophos Mobile Control EAS proxy.
For general information about how to download Sophos software, see Sophos knowledgebase article 111195 .
■
If you do not have a trusted certificate yet, select Create self-signed certificate.
■
If you have a trusted certificate, click Import a certificate from a trusted issuer and select one of the following options from the list:
■
■
PKCS12 with certificate, private key and certificate chain (intermediate and CA)
Separate files for certificate, private key, intermediate and CA certificate
187
Sophos Mobile Control (in Sophos Central)
5. On the next page, enter the relevant certificate information, depending on the type of certificate that you selected.
Note: For a self-signed certificate, you need to specify a server that is accessible from the client devices.
6. If you selected Use client certificates for authentication before, the SMC client
authentication configuration page is displayed. On this page, you select a certificate from a certification authority (CA), from which the client certificates must be derived.
When a client tries to connect, the EAS proxy will check if the certificate that the client provides is derived from the CA that you specify here.
7. On the EAS Proxy instance setup page, configure one or more EAS proxy instances.
■
■
■
■
■
■
■
Instance type: Select EAS proxy.
Instance name: A name to identify the instance.
Server port: The port of the EAS proxy for incoming email traffic. If you set up more than one proxy instance, each of these must use a different port.
Require client certificate authentication: Email clients must authenticate themselves when connecting to the EAS proxy.
ActiveSync server: The name or IP address of the server with which the proxy instance will connect.
SSL: Communication between the proxy instance and the ActiveSync server is secured by SSL.
Allow EWS subscription requests from Secure Email: Select this to allow the Sophos
Secure Email app on iOS to subscribe to push notifications through Exchange Web Services
(EWS). Push notifications inform the device when there are messages for Secure Email, even if the app is closed.
Note: By default, the EAS proxy blocks all requests to the Exchange server’s EWS interface for security reasons. If you select this checkbox, subscription requests are allowed. Other requests remain blocked.
■
Enable Traveler client access: Only select this checkbox if you need to allow access by
IBM Notes Traveler clients on non-iOS devices.
8. After entering the instance information, click Add to add the instance to the Instances list.
For every proxy instance, the installer creates a certificate that you need to upload to the
Sophos Mobile Control server. After you have clicked Add, a message window opens, explaining how to upload the certificate.
9. In the message window, click OK.
This will open a dialog, showing the folder in which the certificate has been created.
Note: You can also open the dialog by selecting the relevant instance and clicking the Export
config and upload to SMC link on the EAS Proxy instance setup page.
10. Make a note of the certificate folder. You need this information when you upload the certificate to Sophos Mobile Control.
11. Optional: Click Add again to configure additional EAS proxy instances.
12. When you have configured all required EAS proxy instances, click Next.
The server ports that you entered are tested and inbound rules for the Windows Firewall are configured.
188
administrator help
13. On the Allowed mail user agents page, you can specify mail user agents (i.e. email client applications) that are allowed to connect to the EAS proxy. When a client connects to the EAS proxy using an email application that is not specified, the request will be rejected.
■
■
Select Allow all mail user agents to configure no restriction.
Select Only allow the specified mail user agents and then select a mail user agent from the list. Click Add to add the entry to the list of allowed agents. Repeat this for all mail user agents that are allowed to connect to the EAS proxy.
14. On the Sophos Mobile Control EAS Proxy - Configuration Wizard finished page, click
Finish to close the Configuration Wizard and return to the Setup Wizard.
15. In the Setup Wizard, make sure that Start Sophos Mobile Control EAS Proxy server now is selected, then click Finish to complete the configuration and to start the Sophos Mobile
Control EAS proxy for the first time.
To complete the EAS proxy configuration, upload the certificates that were created for every proxy instance to Sophos Mobile Control:
16. Log in to the Sophos Central Admin console.
17. On the menu sidebar, under My Products, click Mobile.
18. On the menu sidebar of the Mobile view, under SETTINGS, click Setup > System setup and then click the EAS proxy tab.
19. Under External, click Upload a file and upload the certificate that the Sophos Mobile Control
EAS Proxy - Setup Wizard has created for the PowerShell connection.
If you have set up more than one instance, repeat this for all instance certificates.
20. Click Save.
21. In Windows, open the Services dialog and restart the EASProxy service.
This completes the initial setup of the standalone EAS proxy.
Note: Every day, the EAS proxy log entries are moved to a new file, using the naming pattern
EASProxy.log.yyyy-mm-dd
. These daily log files are not deleted automatically and thus may cause disk space issues over time. We recommend that you set up a process to move the log files to a backup location.
19.4 Set up email access control through PowerShell
You can set up a PowerShell connection to an Exchange or an Office 365 server. This means that the EAS proxy service communicates with the email server through PowerShell to control the email access for your managed devices. Email traffic is routed directly from the devices to the email server. It is not routed through a proxy.
The PowerShell scenario has these advantages:
■
Devices communicate directly with the Exchange server.
■
You do not need to open a port on your server for incoming email traffic from your managed devices.
Supported email servers are:
■
Exchange Server 2010
■
Exchange Server 2013
189
Sophos Mobile Control (in Sophos Central)
■
■
Exchange Server 2016
Office 365 with an Exchange Online plan
To set up PowerShell:
1. Configure PowerShell.
2. Create a service account on the Exchange server or in Office 365. This account is used by
Sophos Mobile Control to execute PowerShell commands.
3. Set up one or more PowerShell connection instances to Exchange or Office 365.
4. Upload the instance certificates to Sophos Mobile Control.
Configure PowerShell
1. On the computer on which you are going to install the EAS proxy, open Windows PowerShell, as an administrator, and enter:
PS C:\Windows\system32> Set-ExecutionPolicy RemoteSigned
Note: If PowerShell is not available, install it as described in the Microsoft article Installing
Windows PowerShell (external link) .
2. If you want to connect to a local Exchange server, open Windows PowerShell as administrator on that computer and enter the same command as before:
PS C:\Windows\system32> Set-ExecutionPolicy RemoteSigned
Note: This step is not required for Office 365.
Create a service account
3. Log in to the relevant admin console:
■
■
■
For Exchange Server 2010: Exchange Management Console
For Exchange Server 2013/2016: Exchange Admin Center
For Office 365: Office 365 Admin Center
4. Create a user account. This account is used as a service account by Sophos Mobile Control to execute PowerShell commands.
■
■
■
Use a user name like
smc_powershell
that identifies the account purpose.
Turn off the setting to make the user change their password the next time they log in.
Remove any Office 365 license that was automatically assigned to the new account. Service accounts don’t require a license.
5. Create a new role group and assign it the required permissions.
■
Use a role group name like
smc_powershell
.
■
■
Add the Mail Recipients and Organization Client Access roles.
Add the service account as a member.
Set up PowerShell connections
190
administrator help
6. Use the Sophos Mobile Control EAS Proxy - Setup Wizard as if you would set up a standalone EAS Proxy. In wizard step EAS Proxy instance setup, configure the following settings:
■
■
■
■
■
Instance type: Select PowerShell Exchange/Office 365.
Instance name: A name to identify the instance.
Exchange server: The name or IP address of the Exchange server (for a local Exchange server installation) or
outlook.office365.com
(for Office 365). Don’t include a prefix
https://
or a suffix
/powershell
. These are added automatically.
Allow all certificates: The certificate that the Exchange server presents is not verified.
Use this for example if you have a self-signed certificate installed on your Exchange server.
Because the Allow all certificates option reduces the security level of the server communication, we strongly recommend that you select it only if required by your network environment.
Allow EWS subscription requests from Secure Email: Select this to allow the Sophos
Secure Email app on iOS to subscribe to push notifications through Exchange Web Services
(EWS). Push notifications inform the device when there are messages for Secure Email, even if the app is closed.
Note: By default, the EAS proxy blocks all requests to the Exchange server’s EWS interface for security reasons. If you select this checkbox, subscription requests are allowed. Other requests remain blocked.
■
■
Service account: The name of the user account you created in the Exchange or Office
365 admin console.
Password: The password of the user account.
7. Click Add to add the instance to the Instances list.
8. Optional: Repeat the previous steps to set up PowerShell connections to other Exchange or
Office 365 servers.
Upload certificates
10. Log in to the Sophos Central Admin console.
11. On the menu sidebar, under My Products, click Mobile.
12. On the menu sidebar of the Mobile view, under SETTINGS, click Setup > System setup and then click the EAS proxy tab.
13. Under External, click Upload a file. Upload the certificate that the Sophos Mobile Control
EAS Proxy - Setup Wizard created for the PowerShell connection.
If you have set up more than one instance, repeat this for all instance certificates.
14. Click Save.
15. In Windows, open the Services dialog and restart the EASProxy service.
This completes the initial setup of PowerShell connections. Email traffic between a managed device and the Exchange or Office 365 servers is blocked if the device violates a compliance rule.
You can block an individual device by setting the email access mode for that device to Deny.
Note: Depending on the configuration of your Exchange server, devices receive a notification when their email access is blocked.
191
Sophos Mobile Control (in Sophos Central)
19.5 Configure a connection to the internal EAS proxy server
1. On the menu sidebar, under SETTINGS, click Setup > System setup.
2. On the System setup page, click the EAS proxy tab.
3. In the Internal section, enter the Exchange or groupware server URL in the
Exchange/groupware server URL text field.
4. Select Use SSL to use a secure connection.
5. Select Allow EWS subscription requests from Secure Email to allow the Sophos Secure
Email app on iOS to subscribe to push notifications through Exchange Web Services (EWS).
Push notifications inform the device when there are messages for Secure Email, even if the app is closed.
By default, the EAS proxy blocks all requests to the Exchange server’s EWS interface for security reasons. If you select this checkbox, subscription requests are allowed. Other requests remain blocked.
6. Click Check connection to test the connection.
A message will be displayed if the server can be accessed.
7. Click Save.
19.6 Configure a connection to the external EAS proxy server
To configure the connection between Sophos Mobile Control and the standalone EAS proxy, you upload the certificate of the EAS proxy server to Sophos Mobile Control. The certificate was generated when you configured the EAS proxy instance.
For information on the installation and configuration of the standalone EAS proxy, see Standalone
Important: If the EAS proxy service is started before you have uploaded the certificate, Sophos
Mobile Control rejects the connection to the server and the service fails to start.
To upload the certificate of the external EAS proxy:
1. On the menu sidebar, under SETTINGS, click Setup > System setup, and then click the EAS
proxy tab.
2. In the External section, click Upload a file and navigate to the certificate file.
If you have set up more than one EAS proxy instance, repeat this for all instances.
3. Click Save.
4. In Windows, open the Services dialog and restart the EASProxy service.
192
administrator help
20 Advanced license
When you activate a Mobile Advanced license, you can manage the Sophos Secure Workspace app and the Sophos Secure Email app using Sophos Mobile Control. See
Manage Sophos container apps (page 199).
After you have received your license key you need to activate the license.
Activate a Mobile Advanced license
In the Sophos Central Admin console, click your account name (upper right of the user interface), select Licensing and then enter your license key in the Apply Activation Code field.
193
Sophos Mobile Control (in Sophos Central)
21 Manage Sophos Mobile Security
Note: This feature requires a Mobile Security license or a Mobile Advanced license.
Sophos Mobile Security is a security app for Android devices that protects devices from malicious apps and assists users in detecting app permissions that could be a security risk. Its web filtering capability allows you to filter websites by category and lets you block inappropriate content.
You can manage the Sophos Mobile Security app on devices that are enrolled with Sophos Mobile
Control as follows:
■
You can configure settings for the Sophos Mobile Security app on all managed devices remotely and centrally through the Sophos Mobile Control console.
■
■
■
You can make sure that the Sophos Mobile Security app is installed on the devices and runs scans at defined intervals. You can define this as a compliance rule.
You can trigger scans for specific devices.
You can view scan results for devices in the Sophos Mobile Control console.
For further information on Sophos Mobile Security, see the Sophos Mobile Security help.
21.1 Configure antivirus settings for Sophos Mobile Security
Prerequisite: You have activated a Mobile Security license.
1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click Android.
The Profiles and policies page is displayed.
2. Click Create and select Mobile Security policy.
The Edit policy page is displayed.
3. Enter a Name and a Version for the new profile.
4. In the Description field, enter a description for the profile.
5. Click Add configuration.
The Available configurations page is displayed.
6. Select Antivirus and click Next.
The settings view of the configuration is displayed.
7. Go to the Antivirus tab.
8. Under General, you can specify the following: a) In the Cloud scan mode field, define when Sophos Mobile Security should scan for the latest malware information. Select one of the following options to define when the app should use a cloud lookup:
■
Always
■
Not while roaming
194
administrator help
■
Wi-Fi only
With this setting you can control the data traffic of the app. If you set Cloud scan mode to
Wi-Fi only, the cloud lookup will only be performed when the device has a Wi-Fi connection.
If you set Cloud scan mode to Not while roaming, a cloud lookup will never be performed while the device is roaming on a foreign network.
b) In the Scheduled scan interval list, select how often scans are carried out.
9. Under Targets, you can select the following: a) Select Scan system apps to include system apps in scans.
System apps are not scanned by default as they are protected by the Android OS and cannot be removed by the user. But you can activate the scanning of system apps here.
b) Select Scan SD Card, USB to scan all files on SD cards, USB and other external storage devices in addition to the default scanning of all installed apps.
10. Under PUAs, you can do as follows: a) Select Detect PUAs to scan for Potentially Unwanted Applications.
Potentially Unwanted Applications (PUAs) are apps that, while not malicious, are generally considered unsuitable for business networks. PUAs include adware, dialers, system monitors, remote administration tools, and hacking tools. However, certain apps that can fall into the PUA category might be considered useful by some users.
If you select this option, Sophos Mobile Security will detect PUAs during scans and notify the device user accordingly.
b) Select Enable user to allow PUAs to enable users to allow apps although they have been identified as PUAs. The user can mark them as ignored. In subsequent scans, these apps will not be shown as PUAs.
11. Under Apps with low reputation, you can specify how to deal with these apps. Classification of apps is based on Sophos Live Protection data. Under Mode, you can do as follows: a) Select Allow to turn off scanning for low reputation apps.
b) Select Warn to display a warning on the device when a low reputation app is detected.
Users can then choose how to deal with the app. They can add it to a list of allowed apps so that no further warning is displayed if this app is detected.
c) Select Block in order to prevent low reputation apps from being started. A warning will be displayed but the user cannot start the app.
12. Under Live protection, you can do as follows: a) Make sure that Scan notification is selected to receive scan notifications.
b) Select Monitor SD card to monitor the SD card for any changes. If new files are stored on the card, they are scanned.
13. If your scan results include apps that should be allowed to start, you can add them to the list of allowed apps. Apps on this list will always be allowed to start. The apps will not be reported.
To identify such an app, you can use the scan results of Sophos Mobile Security. See View
Sophos Mobile Security scan results (page 197). Before you can allow these apps to start on
the devices, you must add them to an App group, as described in App groups (page 166).
195
Sophos Mobile Control (in Sophos Central)
14. To add allowed apps, select the App group containing the allowed apps.
15. Click Apply.
21.2 Configure web filtering settings for Sophos Mobile
Security
Prerequisite: You have activated a Mobile Security license.
The Sophos Mobile Security app protects you from browsing sites with malicious, undesirable or illegal content.
Note: Web filtering only works with the Android web browser or with Google Chrome.
1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click Android.
The Profiles and policies page is displayed.
2. Click Create and select Mobile Security policy.
The Edit policy page is displayed.
3. Enter a Name and a Version for the new profile.
4. In the Description field, enter a description for the profile.
5. Click Add configuration.
The Available configurations page is displayed.
6. Select Web filtering and click Next.
The Web filtering page is displayed.
7. In the Filter malicious websites field, specify whether you want to Allow access to malicious websites, Warn the user against malicious websites, or Block these sites.
8. Under Filter websites by category, specify for each category whether you want to Allow access to websites of this category, Warn the user against potential malicious, undesirable or illegal content, or Block websites of this category.
Websites are categorized based on data from SophosLabs. The data is updated constantly.
9. Under Website exceptions, you can define: a) Allowed domains: add domains or IP addresses that are allowed, even though the category they belong to is blocked.
b) Blocked domains: add domains or IP addresses that are blocked, even though the category they belong to is allowed.
You can insert domain names or IP addresses. Examples: www.company.com, *.company.com,
10.2.0.1, 10.2.0.1/24
10. Click Apply.
Users cannot change the settings that you specified in the Sophos Mobile Control.
196
administrator help
21.3 Define Sophos Mobile Security compliance rules
Prerequisite: You have activated a Mobile Security license.
You can configure compliance rules that relate to Sophos Mobile Security.
1. Add a new compliance rule or open an existing set for editing. For further information, see
2. Go to the Android tab.
3. In the Max. SMSec scan interval field, you can specify the maximum scan interval for malware scans performed by the Sophos Mobile Security app.
4. In the Denial of SMSec permissions allowed list, select whether a denial of the required permissions results in a compliance violation.
5. In the Malware apps allowed list, select whether detected malware apps are allowed.
6. In the Suspicious apps allowed list, select whether detected suspicious apps are allowed.
7. In the PUAs allowed list, select whether detected PUAs (Potentially Unwanted Apps) are allowed.
8. After you have configured all required settings, click Save.
21.4 View Sophos Mobile Security scan results
Prerequisite: You have activated a Mobile Security license.
1. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed with all devices enrolled with Sophos Mobile Control for this customer.
2. Click the blue triangle next to the required device and then click Edit or click its name.
The Show device or the Edit device page is displayed.
3. Go to the Scan results tab.
The tab shows the Sophos Mobile Security scan results. The non-clean packages, for example,
Potentially Unwanted Apps, are shown in a table. Under Threat name, you can click the links to display further information from Sophos Labs about the relevant threat.
4. Go to the Compliance violations tab to view the compliance violations related to the scan results. The violations shown depend on the Sophos Mobile Security compliance rules.
197
Sophos Mobile Control (in Sophos Central)
21.4.1 Create a list of allowed PUAs and apps with low reputation
You can use the scan results to create a list of allowed apps. This list will be valid for all Android devices with the Sophos Mobile Security app installed for the customer you are logged on to.
1. Go to the Scan results tab of one of your scanned devices.
The non-clean packages are shown in a table. The Threat name column indicates whether the displayed package is a low reputation app, a PUA or malware. You can click the links to display further information on the relevant threat from SophosLabs.
Detected low reputation apps and PUAs have a blue check mark icon to the left of the package name. Only these apps can be added to the allowed apps list.
2. Click the blue check mark icon to add the app to the allowed apps list.
3. In the dialog box, click Yes to confirm the operation.
The app is added to the allowed apps list.
4. Repeat this step for all apps you want to add.
5. To view the list, go to Settings and click General.
6. Click Show allow list.
All apps you added are displayed. Apps on this list will be allowed to start on all managed devices. The apps are not reported anymore.
When you click Clear allow list, all entries in the list are deleted.
198
administrator help
22 Manage Sophos container apps
Note: This feature requires a Mobile Advanced license.
For better data separation on the managed devices, Sophos Mobile Control provides the Sophos container apps Sophos Secure Email and Sophos Secure Workspace:
■
■
Sophos Secure Email is an app for Android and iOS devices that provides a secure container for managing your email, calendar and contacts.
Sophos Secure Workspace is an app for Android and iOS devices that allows users to access encrypted files stored in the cloud. Files can be decrypted and viewed in a seamless way.
Encrypted files can be handed over by other apps and uploaded to one of the supported cloud storage providers. Alternatively, the documents can be stored locally within the app.
With Sophos Secure Workspace, you can read files encrypted by SafeGuard Cloud Storage or SafeGuard Data Exchange. Both are modules of SafeGuard Enterprise or one of its different editions. They allow you to encrypt files using a local key. These local keys are derived from a passphrase that is entered by a user. You can only decrypt a file when you know the passphrase that was used to encrypt the file.
The Sophos container provides:
■
Centrally defined password rules
■
■
Password rules for all container apps
Single-Sign-On for all container apps
■
■
■
Sophos Secure Workspace document settings
Sophos Secure Workspace browser settings
■
Sophos Secure Email settings
You can manage the Sophos apps with Sophos Mobile Control as follows:
You can configure settings for the Sophos container apps on all managed devices remotely and centrally in Sophos Mobile Control. See
Configurations for Sophos container policies for
(page 84) and Configurations for Sophos container policies for iOS (page 125).
■
■
You can make sure that the Sophos container apps are installed on the devices. You can define this as a compliance rule.
You can enable secure distribution of documents using the Corporate Documents storage
provider. See Corporate documents (page 168).
Note: In order to manage the Sophos container apps, they must be distributed using Sophos
Mobile Control. If users already have an unmanaged version of Sophos Secure Workspace installed on their devices, they must uninstall it first and then install the managed version.
For further information on Sophos Secure Workspace, see the Sophos Secure Workspace help.
199
Sophos Mobile Control (in Sophos Central)
22.1 Reset Sophos container password
Prerequisite: You have activated a Mobile Advanced license.
Note: This section applies to devices that have an assigned Sophos container policy.
You can reset the Sophos container password. This is useful, for example, when users forget their password. If you reset a Sophos container password, users will be asked to define a new container password.
1. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed.
2. Click the device for which you want to reset the Sophos container password.
The Show device page is displayed.
3. Click Actions.
The Actions menu is displayed.
4. Click Reset Sophos container password.
5. In the dialog box, click Yes to confirm the operation.
The Sophos container password is reset. The user has to enter a new Sophos container password.
22.2 Lock and unlock the Sophos container
Prerequisite: You have activated a Mobile Advanced license.
Note: This section applies to devices that have an assigned Sophos container policy.
You can lock or unlock the Sophos container, that is, set the access permissions for the Sophos container apps and for data within the Sophos container.
1. On the menu sidebar, under MANAGE, click Devices.
2. On the Devices page, click the blue triangle next to the device for which you want to lock or unlock the Sophos container and then click Show.
3. On the Show device page, click Actions > Set Sophos container access.
4. In the dialog box for setting the access permissions, select one of the following:
■
■
■
Deny: The Sophos container is locked. Users can no longer use it.
Allow: The Sophos container is unlocked.
Auto mode: The Sophos container is locked as long as the device violates a compliance rule for which Lock container is activated. This is the default behavior if you have not set an access permission.
5. Click Yes.
The device is triggered to synchronize with the Sophos Mobile Control server. On synchronization, the setting is applied to the device.
200
administrator help
23 Glossary
device
The device to be managed (for example smartphone, tablet or
Windows 10 device).
The registration of a device with Sophos Mobile Control.
enrollment
Enterprise App Store
An app repository that is hosted on the Sophos Mobile Control server.
The administrator can use the Sophos Central Admin console to add apps to the Enterprise App Store. Users can then use the Sophos
Mobile Control app to install these apps onto their devices.
Mobile Advanced license
With a license of type Mobile Advanced you can manage the Sophos
Mobile Security, Sophos Secure Workspace and Sophos Secure
Email apps through Sophos Mobile Control.
provisioning
SMSec
The process of installing the Sophos Mobile Control app on a device.
Abbreviation for Sophos Mobile Security.
Sophos Central Admin console
The web interface that you use to manage devices.
Sophos Central Self
Service portal
The web interface that allows users to enroll their own devices and carry out other tasks without having to contact the helpdesk.
Sophos Mobile Control client
The Sophos Mobile Control app that is installed onto the managed device.
Sophos Mobile Security
A security app for Android devices. You can manage this app with
Sophos Mobile Control, provided that a license of type Mobile
Advanced is activated.
Sophos Secure Email
Sophos Secure
Workspace
An app for Android and iOS devices that provides a secure container for managing your email, calendar and contacts. You can manage this app with Sophos Mobile Control, provided that a license of type
Mobile Advanced is activated.
An app for Android and iOS devices that provides a secure workspace where you can browse, manage, edit, share, encrypt and decrypt documents from various storage providers or distributed by your company. You can manage this app with Sophos Mobile Control, provided that a license of type Mobile Advanced is activated.
201
Sophos Mobile Control (in Sophos Central)
task bundle
You create a package to bundle several tasks into one transaction.
You can bundle all tasks necessary to have a device fully enrolled and running.
202
administrator help
24 Technical support
You can find technical support for Sophos products in any of these ways:
■
Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.
■
■
■
Visit the Sophos support knowledgebase at www.sophos.com/en-us/support.aspx
.
Download the product documentation at www.sophos.com/en-us/support/documentation.aspx
.
Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/support-query.aspx
.
203
Sophos Mobile Control (in Sophos Central)
25 Legal notices
Copyright
©
2011-2017 Sophos Limited. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos is a registered trademark of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.
Last update: 20170405
204
ดาวน์โหลด
ลิงก์สาธารณะได้รับการอัปเดตแล้ว
ลิงก์สาธารณะไปยังแชทของคุณได้รับการอัปเดตแล้ว You may view and manage your chat links after registration here.
ลิงก์สาธารณะของเอกสาร
โฆษณา