Sophos Mobile Control Administrator help

Sophos Mobile Control administrator help

Product version: 7

2

Contents

1 About this help..........................................................................................................................6

2 About Sophos Mobile Control...................................................................................................7

3 About the Sophos Mobile Control console...............................................................................9

3.1 User interface.............................................................................................................9

3.2 Table views...............................................................................................................10

3.3 Prerequisites.............................................................................................................10

3.4 User roles.................................................................................................................10

3.5 Login to the Sophos Mobile Control console............................................................11

3.6 Log out from the Sophos Mobile Control console.....................................................12

3.7 Change your password.............................................................................................12

3.8 Password recovery...................................................................................................12

4 Key steps for managing devices with Sophos Mobile Control................................................13

5 Dashboard..............................................................................................................................14

6 Reports...................................................................................................................................15

7 Tasks.......................................................................................................................................16

7.1 Monitor tasks............................................................................................................16

8 General settings.....................................................................................................................19

8.1 Configure personal settings......................................................................................19

8.2 Configure password policies.....................................................................................20

8.3 Configure SMC app settings.....................................................................................20

8.4 Enable Baidu Cloud Push service............................................................................21

8.5 Configure iOS settings..............................................................................................21

8.6 Configure polling interval for Windows devices.........................................................22

8.7 Configure Email........................................................................................................22

8.8 Configure technical support contact details..............................................................22

8.9 Define customer properties......................................................................................22

9 Configure Self Service Portal.................................................................................................24

9.1 Create Self Service Portal groups with internal user management..........................24

9.2 Configure Self Service Portal settings......................................................................25

9.3 Available Self Service Portal settings.......................................................................26

9.4 Manage Self Service Portal users............................................................................28

10 System setup........................................................................................................................34

10.1 Check your licenses................................................................................................34

10.2 Apple Push Notification service certificates............................................................34

10.3 Configure iOS AirPlay destinations.........................................................................38

10.4 Samsung Knox license...........................................................................................39

10.5 Configure SCEP.....................................................................................................39

10.6 Configure user setup..............................................................................................40

11 Compliance rules..................................................................................................................41

11.1 Create compliance rules.........................................................................................41

11.2 Available compliance rules.....................................................................................43

11.3 Assign compliance rules to device groups..............................................................47

11.4 Check devices for compliance................................................................................47

12 Devices.................................................................................................................................48

12.1 Add devices............................................................................................................48

12.2 Enroll devices.........................................................................................................50

12.3 Unenroll devices.....................................................................................................54

12.4 Manage devices......................................................................................................55

12.5 Apple DEP..............................................................................................................60

13 Device groups.......................................................................................................................68

13.1 Create device group...............................................................................................68

13.2 Delete device groups..............................................................................................68

14 Profiles and policies..............................................................................................................69

14.1 Create profile or policy............................................................................................69

14.2 Import iOS device profiles created with Apple Configurator...................................70

14.3 Import provisioning profiles for iOS apps................................................................71

14.4 Windows Desktop password complexity rules........................................................71

14.5 Samsung Knox support..........................................................................................72

14.6 Placeholders in profiles and policies.......................................................................72

14.7 Install a profile onto devices...................................................................................73

14.8 Assign a policy to devices.......................................................................................73

14.9 Remove profile........................................................................................................74

14.10 Download profiles and policies.............................................................................74

14.11 Configurations for Android device profiles............................................................75

14.12 Configurations for Android for Work policies.........................................................92

14.13 Configurations for Sophos container policies for Android...................................101

14.14 Configurations for Mobile Security policies.........................................................111

14.15 Configurations for Knox container profiles..........................................................111

3

4

14.16 Configurations for iOS device profiles.................................................................116

14.17 Configurations for Sophos container policies for iOS.........................................142

14.18 Configurations for Windows Mobile policies.......................................................151

14.19 Configurations for Windows Desktop policies.....................................................160

15 Task bundles.......................................................................................................................166

15.1 Create task bundle................................................................................................166

15.2 Available Android task types.................................................................................167

15.3 Available iOS task types.......................................................................................170

15.4 Duplicate task bundles..........................................................................................172

15.5 Transfer task bundles to individual devices or to device groups...........................173

16 Apps...................................................................................................................................174

16.1 Add app................................................................................................................174

16.2 Install app.............................................................................................................176

16.3 Uninstall app.........................................................................................................176

16.4 Managed apps for iOS..........................................................................................177

16.5 Manage apps purchased through Apple VPP.......................................................178

16.6 Configure per app VPN and settings for iOS apps...............................................182

17 App groups.........................................................................................................................184

17.1 Create app group..................................................................................................184

17.2 Import app group..................................................................................................185

18 Corporate documents.........................................................................................................186

18.1 Add corporate documents....................................................................................186

19 Android for Work.................................................................................................................188

19.1 Set up Android for Work........................................................................................188

19.2 Configure Android for Work..................................................................................192

19.3 Manage Android for Work users...........................................................................193

19.4 Enroll devices with Android for Work....................................................................194

19.5 Lock work profile...................................................................................................194

19.6 Remove work profile from device..........................................................................194

19.7 User-initiated work profile removal.......................................................................195

19.8 Work apps.............................................................................................................195

20 Create administrators.........................................................................................................202

21 Send message to devices..................................................................................................203

22 Advanced license...............................................................................................................204

23 Manage Sophos Mobile Security........................................................................................205

23.1 Configure antivirus settings for Sophos Mobile Security......................................205

23.2 Configure web filtering settings for Sophos Mobile Security.................................207

23.3 Define Sophos Mobile Security compliance rules................................................208

23.4 View Sophos Mobile Security scan results...........................................................208

24 Manage Sophos container apps.........................................................................................210

24.1 Reset Sophos container password.......................................................................211

24.2 Lock and unlock the Sophos container.................................................................211

24.3 Corporate keyring synchronization.......................................................................212

25 Glossary.............................................................................................................................213

26 Technical support................................................................................................................215

27 Legal notices......................................................................................................................216

5

6

Sophos Mobile Control

1 About this help

This help describes how to use the Sophos Mobile Control console.

Further information is available in the following documents:

■

■

■

■

For a description of Sophos Mobile Control installation, see the Sophos Mobile Control installation guide . This guide is not relevant for Sophos Mobile Control as a Service.

For information on how to use the Sophos Mobile Control console as a super administrator for customer management, see the Sophos Mobile Control super administrator guide . This guide is not relevant for Sophos Mobile Control as a Service.

For a description of the key steps for initial configuration, see the Sophos Mobile Control startup guide and the Sophos Mobile Control as a Service startup guide .

For information on the Sophos Mobile Control Self Service Portal, see the Sophos Mobile

Control user help .

Document conventions

The following conventions are used in this help:

■

Unless otherwise noted, Windows Mobile refers to Windows 10 Mobile and Mobile Enterprise editions and to Windows Phone 8.1.

■

■

Unless otherwise noted, Windows Desktop or Windows 10 Desktop refers to Windows 10 Pro,

Enterprise, Education, and Home editions.

Unless otherwise noted, all procedures assume that you are logged in to the Sophos Mobile

Control console using an administrator account.

administrator help

2 About Sophos Mobile Control

Sophos Mobile Control

Sophos Mobile Control is a management tool for mobile devices like smartphones and tablets, and also for Windows 10 desktop devices. It helps to keep corporate data safe by managing apps and security.

The Sophos Mobile Control system consists of a server and a client component.

The server is the core component of the Sophos Mobile Control product. It provides a web interface to administer Sophos Mobile Control and to manage the enrolled devices.

The client is an app to be installed onto the devices. It supports over-the-air setup and configuration through the web interface of the Sophos Mobile Control server.

With the Sophos Mobile Control Self Service Portal for your users, you can reduce IT effort by allowing users to enroll devices on their own and to carry out other tasks without contacting the helpdesk.

Sophos Mobile Control can also be used to manage the Sophos Mobile Security, Sophos Secure

Workspace and Sophos Secure Email mobile apps. This requires an SMC Advanced license.

Sophos Mobile Security

Sophos Mobile Security is a security app for Android devices. Using up-to-the-minute intelligence from SophosLabs, your apps will be automatically scanned as you install them. This antivirus functionality protects you from malicious software which can lead to data loss and unexpected costs.

Sophos Secure Workspace

Sophos Secure Workspace is an app for Android and iOS devices that provides a secure workspace where you can browse, manage, edit, share, encrypt and decrypt documents from various storage providers or distributed by your company. It is designed to prevent any data loss even when your device is lost or stolen or when you send a document to an unintended destination.

Files can be decrypted and viewed in a seamless way. Files that are handed over by other apps can be encrypted and either uploaded to one of the supported cloud storage providers or stored locally within Sophos Secure Workspace.

With Sophos Secure Workspace you can read files encrypted by SafeGuard Cloud Storage or

SafeGuard Data Exchange. Both are modules of SafeGuard Enterprise or one of its different editions.

Sophos Secure Workspace also includes Corporate Browser, a web browser that lets you securely access corporate intranet pages and other allowed pages, as defined by a Sophos Mobile Control policy.

7

Sophos Mobile Control

Sophos Secure Email

Sophos Secure Email is an app for Android and iOS devices that provides a secure container for managing your email, calendar and contacts. All data is encrypted and is protected from third-party access.

8

administrator help

3 About the Sophos Mobile Control console

The Sophos Mobile Control console is the central instrument for managing devices with Sophos

Mobile Control. It is the web interface of the server used for device management. With the web portal you can implement a corporate policy for the use of devices and apply it to the devices that are enrolled with Sophos Mobile Control.

In the Sophos Mobile Control console you can:

■

Configure the system, for example personal settings or platform-specific settings.

■

Configure compliance rules and define actions to be taken if devices no longer comply with

the rules specified. See Compliance rules

(page 41).

■

■

■

■

Enroll devices with Sophos Mobile Control. See

Add devices

(page 48).

Provision new devices. See Enroll devices

(page 50).

Install application packages on enrolled devices. See

Apps

(page 174).

Define profiles and security policies for devices. See Profiles and policies

(page 69).

■

■

■

■

Create task bundles to bundle several tasks and transfer them to the devices in one transaction.

See

Task bundles (page 166).

Configure settings for the Self Service Portal. See Configure Self Service Portal (page 24).

Carry out administrative tasks on devices, for example reset the password of devices, lock or wipe devices if they are lost or stolen, unenroll devices. See

Manage devices

(page 55).

Create and view reports. See Reports (page 15).

3.1 User interface

The user interface of the Sophos Mobile Control console is divided into a header, a main menu, and the main frame. The main frame displays the different pages of the Sophos Mobile Control console, based on the selected menu.

■

Header

The page header has these links on the right side:

■

■

■

Your account name and the customer name.

The Help button that opens online help in a separate browser window.

The Logout button that logs you off from the Sophos Mobile Control console.

■

Main menu

The main menu on the left lets you access the main functions of Sophos Mobile Control.

Note: Your assigned administrator role affects what you can do. See

User roles

(page 10).

9

Sophos Mobile Control

3.2 Table views

Many pages of the Sophos Mobile Control console display information in a tabular form.

These tables have common controls that you can interact with.

Above the table:

■

Use the Show or hide columns icon to configure which table columns are visible.

■

Enter text in the Search all fields field to only display data rows that contain that text in any column. Note that date columns are searched by their internal format yyyy-mm-dd

.

In the table:

■

Click a column header to sort the table rows by that property. Click again to revert the sort order.

■

■

Click the blue triangle next to an entry name to perform actions on that entry, like Show, Edit,

Delete.

Below the table:

■

Use the navigation buttons to display a specific table page.

Use the Export icon to export either the whole table or the current page to a Microsoft Excel file or a comma-separated values (CSV) file. If you have configured a row filter, only the currently visible rows are exported.

3.3 Prerequisites

Before using the Sophos Mobile Control console:

■

You need a computer connected to the internet and equipped with a web browser. For information on supported browsers and the relevant versions, see the Sophos Mobile Control

release notes.

■

The super administrator must have created a customer (a tenant whose devices are managed in Sophos Mobile Control). For further information, see the Sophos Mobile Control super administrator guide .

Note: For Sophos Mobile Control as a Service, a customer is predefined. Super administrators are not supported for Sophos Mobile Control as a Service.

■

You need a Sophos Mobile Control user account and the relevant credentials for logging in to the Sophos Mobile Control console. The credentials consist of customer, user and password.

For further information, see

Login to the Sophos Mobile Control console

(page 11).

3.4 User roles

Users of Sophos Mobile Control have different roles. You assign these roles when you create

new administrators. See Create administrators

(page 202).

The available modules and functions in the Sophos Mobile Control console depend on the role.

10

administrator help

You can assign the following roles:

Role

Administrator

Limited Administrator

Reporting

Content admin

Helpdesk

App Group Administrator

Description

This role has the rights to perform all available actions.

This role is allowed to perform all actions required for enrolling and managing a device, but cannot specify essential settings and cannot manage other administrators.

This role can view the list of devices and is able to create reports. For example, an auditor or an employee who needs to document the settings in Sophos Mobile Control.

This role is intended for employees responsible for uploading, updating or removing documents distributed via the Documents feature. Usually this role is assigned to a person outside the IT department. The permissions are set to limit visibility and access only the content in the

Documents menu.

This role is intended for support purposes. It has only limited rights (for example installation of software packages). This role does not have access to critical functions, such as defining settings and creating, deleting or editing devices/device groups, packages and profiles.

This role can manage app groups. A typical user is an administrator that accesses the Sophos Mobile Control web service interface to create, update or read app groups.

If you require further roles, please contact the Sophos support team.

3.5 Login to the Sophos Mobile Control console

1. Open the web address of the Sophos Mobile Control console in your web browser.

2. In the login dialog, enter your customer name and your user credentials (name and password), then click Login.

The customer’s Dashboard is displayed.

Note: When you log in to the Sophos Mobile Control console for the first time, you are prompted to change your password.

Note: The administrator can display messages in the login dialog, for example regarding upcoming upgrades or outage times. Click the message to display its entire content.

11

Sophos Mobile Control

3.6 Log out from the Sophos Mobile Control console

To log out from the Sophos Mobile Control console, click Logout in the page header.

3.7 Change your password

You can change your password any time after you have logged in to the Sophos Mobile Control console:

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Change

password tab.

2. Enter your old password, a new one and confirm it.

3. Click Save.

3.8 Password recovery

If you have forgotten your password for the Sophos Mobile Control console, you can reset it.

1. In the Login dialog box of the Sophos Mobile Control console, click Forgot password?

The Reset password dialog box is displayed.

2. Enter your Customer and User information and click Reset password.

You receive an email with a link for resetting your password.

3. Click the link.

The Change password dialog box is displayed.

4. Enter a new password, confirm it and click Change password.

Your password has been changed and you are logged in to the Sophos Mobile Control console.

12

administrator help

4 Key steps for managing devices with

Sophos Mobile Control

Sophos Mobile Control offers a wide range of Mobile Device Management functions depending on device types, corporate security policies and specific requirements in your company.

The key steps for managing devices with Sophos Mobile Control are:

■

Configure compliance rules for devices. See

Compliance rules (page 41).

■

Create device groups. See

Create device group

(page 68).

Device groups are used to categorize devices. We recommend that you put devices into groups. This helps you to manage them efficiently as you can carry out tasks on a group rather than on individual devices.

■

Enroll and provision devices. See

Add devices

(page 48) and

Enroll devices (page 50).

Devices can either be enrolled and provisioned by administrators through the Sophos Mobile

Control console or by device users through the Self Service Portal.

■

■

■

■

Set up profiles and security settings for devices. See

Profiles and policies

(page 69).

Create task bundles. See Task bundles

(page 166).

Configure the available features of the Self Service Portal. See Configure Self Service Portal

(page 24).

Apply new or updated profiles and security settings to enrolled devices.

13

Sophos Mobile Control

5 Dashboard

Note: This section applies to the Dashboard of regular administrators. For the super administrator, the Dashboard is used to manage customers. See the Sophos Mobile Control super administrator guide .

The customizable Dashboard is the regular start page of Sophos Mobile Control and provides access to the most important information at a quick glance. It consists of several widgets providing information about:

■

■

■

■

Devices, all or per group

Compliance status by platform or for all devices

Managed status by platform or for all devices

The SSP registration status

■

The platform versions in use

There also is a special widget Add device to start the device enrollment wizard. See

Use the device enrollment wizard to assign and enroll new devices

(page 51).

The following options are available to customize the Dashboard:

■

To add a widget to the page, click Add widget.

■

■

■

To remove a widget from the page, click the Close button in its header.

To reset the page to its default layout, click Restore default layout.

To rearrange the widgets on the page, drag a widget header.

14

administrator help

6 Reports

With Sophos Mobile Control you can create various reports from the following areas:

■

Devices

■

■

Apps and documents

Compliance violations

■

Malware

To create a report:

1. On the menu sidebar, under INFORM, click Reports, and then click the name of the required report.

2. In the Choose format dialog, click one of the available icons to select the output format:

■

■

Click to export the report to a Microsoft Excel file.

Click to export the report to a comma-separated values (CSV) file.

The report file is saved to your local computer, using the download settings of your web browser.

15

Sophos Mobile Control

7 Tasks

The Task view page gives you an overview of all tasks you created and started and displays their current state.

You can monitor all your tasks and intervene in case of problems. For example, you can delete a task that obviously cannot be completed but blocks the device.

To delete a task, click the Delete icon next to it.

You can filter tasks according to Type and State and sort them by device name, package name, creator and scheduled date.

7.1 Monitor tasks

In the Sophos Mobile Control console, you can monitor all existing tasks for devices.

■

The Tasks page shows all unfinished and failed tasks as well as the finished tasks of the last few days. The Task view page is refreshed automatically, so you can watch the states of the tasks evolve.

■

■

The Task details page shows general information about a task from the Tasks page or the

Task archive page.

The Task archive page shows all tasks.

7.1.1 View unfinished, failed and latest finished tasks

1. On the menu sidebar, under INFORM, click Tasks.

2. On the Task view page, the State column shows the task status, for example, Completely

failed.

3. In the Refresh interval (in sec.) field, you can select how often the Task view page is to be refreshed.

4. To view further details about a task, click the Show magnifier icon next to the required task.

The Task details page is displayed. Besides general information on the task (for example, device name, package name and creator) it shows the states a specific task went through, including timestamps and error codes. If there are commands to be executed by the device, an additional Details button is available on the Task details page.

5. If available, click Details to view the commands to be executed by the device.

The commands sent to the device are part of the task. They are executed by the SMC app or by the MDM client. Results indicating the success or failure are transferred back to the server.

If there was no error, the error code is “0”. If a command has failed, the error code is displayed.

In most cases there is also a description of what may have caused the command to fail.

6. To return to the Task details page, click Back.

16

administrator help

7.1.2 View task archive

1. On the menu sidebar, under INFORM, click Tasks.

2. On the Task view page, click Task archive.

The Task archive page is displayed. It shows all finished and failed tasks in the system.

3. On this page, you can:

■

■

■

Click Reload to refresh the Task archive page.

Delete a task from the archive by clicking the Delete icon next to the relevant task.

Select several tasks and click Delete selected to delete them from the archive.

To go back to the Task view page, click Tasks on the menu sidebar.

7.1.3 Task states

The following table provides an overview of the task states shown on the Task view and on the

Task archive pages.

Every state is associated with a color code that indicates the state category.

Color code State

Accepted

Will be retried

Description

Task has been created.

Task will be retried later.

Started

In progress

Task bundle in progress

Notified

Task has been started.

Execution of the task is being prepared.

Execution of the task bundle is being prepared.

SMC app was notified.

Commands sent

Result evaluation started

Result incomplete

Waiting for user interaction

SMC app has received the package and/or the commands.

SMC app has answered and the evaluation of the result has been started.

Result evaluation showed that not all commands’ results have been received by now.

There is a pending user action on the device.

17

Sophos Mobile Control

Color code State

Device is locked

Successful

Installed

Result evaluation failed

Task partly failed

Delayed

Failed (retry queued)

Task failed

Completely failed

Not started

Session requested

Unknown

Description

Task waits for the device to become unlocked (iOS only).

Package has been installed or the commands have been successfully executed.

Note: For the initial provisioning of the Sophos Mobile

Control app the task must finish with the state Installed.

The Sophos Mobile Control app has been installed successfully. The device is provisioned now.

Result evaluation could not be executed.

Not all commands of the task could be executed successfully.

Task will be restarted later.

Task has failed and will be retried later.

Task has failed and no further retries are queued.

Task has failed, and it is not possible to retry it.

Task is part of a task bundle and was not processed yet.

An AirPlay session was requested (iOS only).

The server has no information about the task status.

Color code Category

Open

In progress

Success

Failure

Other

18

administrator help

8 General settings

On the General settings page you can configure some basic settings of Sophos Mobile Control.

8.1 Configure personal settings

To use the Sophos Mobile Control console more efficiently, you can customize the user interface to show only the platforms you work with.

Note: By configuring the platforms you only change the view of the user who is currently logged in. You cannot deactivate any functions here.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Personal tab.

2. Configure the following settings:

Option Description

Language

Timezone

Unit system

Select the language for the Sophos Mobile Control console.

Select the timezone in which dates are shown.

Select the unit system for length values (Metric or Imperial).

Lines per page in tables

Show extended device details

Select this check box to show all available information about the device. The Custom properties and Internal properties tabs will be added to the Show device page.

Activated platforms

Select the maximum number of table lines you want to display per page.

Select the platforms you want to manage for the customer:

Android iOS

Windows Mobile (includes Windows Phone 8.1 and Windows 10

Mobile operating systems)

Windows Desktop

Based on your platform selection, the user interface of the Sophos

Mobile Control console is adjusted. Only views and features that are relevant for the selected platforms are shown.

Note: The list of available platforms depends on your platform settings from the super administrator configuration. For further information, see the Sophos Mobile Control super administrator guide .

19

Sophos Mobile Control

3. Click Save.

8.2 Configure password policies

To enforce password security, configure password policies for users of the Sophos Mobile Control console and the Self Service Portal.

Note: The password policies do not apply to users from an external LDAP directory. For information on external user management, see the Sophos Mobile Control super administrator guide .

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Password

policies tab.

2. Under Rules, you can define password requirements, like a minimum number of lower-case, upper-case or numerical characters that a password must contain to be valid.

3. Under Settings, configure the following settings: a) Password change interval (days): Enter the number of days until a password expires

(between

1

and

730

), or leave the field empty to disable password expiration.

b) Number of previous passwords which must not be reused: Select a value between

1

and

10

, or select

---

to disable this restriction.

c) Maximum number of failed login attempts: Select the number of failed login attempts until the account gets locked (between

1

and

10

), or select

---

to allow an unlimited number of failed login attempts.

4. Click Save.

8.3 Configure SMC app settings

On the SMC app tab of the General settings page, you configure settings for the Sophos Mobile

Control app on Android, iOS and Windows Mobile devices.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the SMC app tab.

2. Configure the following settings:

Option Description

Disable unenrollment through app

Remove the Unenroll button from the Sophos Mobile Control app to prevent users from unenrolling their device through the app.

Note: To completely prevent user-initiated unenrollment, also disable the Unenroll device option in the Self Service Portal settings. See

Configure Self Service Portal settings (page 25).

3. Click Save.

20

administrator help

8.4 Enable Baidu Cloud Push service

Sophos Mobile Control uses the Google Cloud Messaging (GCM) service to send push notifications to Android devices, to trigger them to contact the Sophos Mobile Control server. In China, GCM will likely not work. Therefore, Sophos Mobile Control can also use Baidu Cloud Push, which is a Chinese push notification service.

If you manage Android devices that are located in China, enable the Baidu Cloud Push service as follows:

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Android tab.

2. In the Baidu Cloud Push service section, select Enable Baidu Cloud Push service.

3. Click Save.

When Baidu Cloud Push is enabled, Sophos Mobile Control sends all push notifications through

GCM and through Baidu Cloud Push.

8.5 Configure iOS settings

On the iOS tab of the General settings page, you configure settings that are specific to iOS devices.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the iOS tab.

2. Configure the following settings:

Option

Activation Lock bypass

Description

Select Enable to be able to clear the Activation Lock on supervised devices.

When this option is selected, Sophos Mobile Control retrieves a bypass code when syncing with a supervised device that has

Activation Lock enabled. If required, you can perform the Activation

Lock bypass action from the device's Show device page to clear

Activation Lock when the device needs to be erased and re-deployed.

Activation Lock is an iOS security feature to prevent the reactivation of lost or stolen devices. Normally, you need the correct Apple ID and password to clear Activation Lock. With the Activation Lock bypass feature, you can clear Activation Lock by providing the bypass code only.

Synchronize device name

Select Enable to manage iOS devices under the name that is configured on the device.

When this option is selected, the device name that Sophos Mobile

Control uses is set every time the device synchronizes with Sophos

Mobile Control.

When this option is deselected, you set the device name during device enrollment.

21

Sophos Mobile Control

3. Click Save.

8.6 Configure polling interval for Windows devices

For Windows devices, you can configure the polling interval at which the Windows MDM client contacts the Sophos Mobile Control server. Usually, the server contacts the client using push notifications. Polling is used as a safety measure when the push notification service is not available.

Note: The default values are sufficient in most cases. Using shorter intervals impacts battery life and data consumption and causes higher server load.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Windows tab.

2. Select polling intervals for the different Windows operating systems.You can configure individual settings for:

■

■

Windows 10 Mobile and Windows Phone 8.1 devices

Windows 10 Desktop devices

3. Click Save.

8.7 Configure Email

On the Email configuration tab, you can configure settings for emails that are sent by Sophos

Mobile Control to the users.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Email

configuration tab.

2. In the Language list, select the email language.

3. In the Originator name field, enter the name that will appear as email originator.

4. Click Save.

8.8 Configure technical support contact details

To support users who have questions or problems, you can provide them with details of how to contact technical support. The information that you enter here is displayed in the Sophos Mobile

Control app and on the Self Service Portal.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Technical

contact tab.

2. Enter the required information for the technical contact.

3. Click Save.

8.9 Define customer properties

You can define customer-level properties.

22

administrator help

When you define a property with name my property

, you can refer to the value of the property in profiles and policies by using the placeholder

%_CUSTPROP(my property)_%

. For example, you can use this to refer to a domain that is specific to the customer.

For details on profile and policy placeholders, see

Placeholders in profiles and policies

(page 72).

To define a customer property:

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Customer

properties tab.

2. Click Add customer property.

3. Enter a Name and a Value for the new property.

4. Click Apply to add the property.

5. Click Save to save the changes to the customer settings.

23

Sophos Mobile Control

9 Configure Self Service Portal

With the Self Service Portal you can reduce IT efforts by allowing users to enroll devices on their own and carry out other tasks without having to contact the helpdesk.

On the menu sidebar, you can configure settings for the use of the Self Service Portal, for example:

■

The platforms for which devices can be enrolled.

■

■

The available functions.

The users that are allowed to access the Self Service Portal.

9.1 Create Self Service Portal groups with internal user management

Self Service Portal configurations are applied to groups of Self Service Portal users. With internal user management, you can create Self Service Portal groups and assign users to them. For

further information on user management, see Manage Self Service Portal users

(page 28).

Note: Internal user management is only available for a customer if it has been activated by the super administrator. For further information, see the Sophos Mobile Control super administrator guide . This does not apply to Sophos Mobile Control as a Service. Super administrators are not supported in Sophos Mobile Control as a Service. For information on how to define the user

management methods for Sophos Mobile Control as a Service, see Configure Self Service Portal user management

(page 29).

To create a Self Service Portal group:

1. On the menu sidebar, under MANAGE, click Users.

The Show users page is displayed.

2. Click Show user groups.

The Show user groups page is displayed.

3. Click Create group.

The Edit group page is displayed.

4. In the Name field, enter a name for the new Self Service Portal user group.

5. Click Save.

The new Self Service Portal user group is displayed on the Show user groups page. When you create new users, you can assign them to the group. When you define Self Service Portal settings, you can select the group to assign the settings to it.

24

administrator help

9.2 Configure Self Service Portal settings

1. On the menu sidebar, under SETTINGS, click Setup, and then click Self Service Portal.

The Self Service Portal page is displayed.

2. On the Configuration tab, configure the following settings: a) In the Maximum number of devices list, select the maximum number of devices a user can enroll through the Self Service Portal. This ensures that the number of available licenses is not exceeded.

b) In the Device owner preselection list, select if new devices are classified as corporate or personal devices, and if the users are able to change this classification when they enroll their devices through the Self Service Portal. You can select one of the following settings:

■

no preselection: The owner field in the Self Service Portal is left blank. Users can select the device type.

■

corporate preselected: On the Self Service Portal, Corporate device is preselected.

Users can change the setting to Personal device.

■

corporate fixed: Device type cannot be selected. Company is listed as owner.

■

personal preselected: On the Self Service Portal, Personal device is preselected.

Users can change the setting to Corporate device.

■

personal fixed: Device type cannot be selected. Employee is listed as owner.

c) Under Available functionality, select the functions that should be available for users of the Self Service Portal. The functions supported vary according to the device platform. See

Available Self Service Portal settings

(page 26).

3. On the Terms of use tab, you configure a mobile policy, disclaimer or agreement text that is displayed as a first step when users enroll their devices. Users must accept the text to be able to continue.

HTML formatting tags are supported for the text. The text will be displayed in the relevant browser accordingly.

4. On the Post-install text tab, you configure text to be displayed on the Self Service Portal after automatic installation. This text can tell the user what must be done next, for example configuring the server in the iOS app or configuring the Android mail client.

HTML formatting tags are supported for the text. The text will be displayed in your chosen browser accordingly.

5. On the Group settings tab, you configure the group settings, for example, the device groups enrolled devices will be added to and the task bundle that will be transferred to the devices.

Important: Because of the complexity of the group settings configuration, we recommend that you test device enrollment for different user groups before you roll out the settings to your actual users.

a) Click Add.

25

Sophos Mobile Control

The Edit group settings page is displayed.

b) Enter a Name for the Self Service Portal configuration group.

c) In the Directory group field, enter the Self Service Portal Group you have defined in the internal user management or the external user management group with the full LDAP path or with wildcards. You can use an asterisk (*) as the first, the last or the only character in this field to specify several groups. For example: Enter

Dev*

to specify all group names that start with the string

Dev

. Enter

*

to specify all available groups.

d) Select if the texts that are configured in the Terms of use and Post-install text tabs will be displayed.

e) In columns Initial package - corporate device and Initial package - personal device, select the task bundle (for Android and iOS) or policy (for Windows Mobile and Windows

Desktop) to be executed on corporate and personal devices.

f) In column Active, select the platforms that should be available on the Self Service Portal.

You must select an initial package before you can select a platform.

g) In column Add to device group, select the group the device should be added to.

Note: On the menu sidebar, a Default device group is available. If you have not defined your own device groups yet, you can add devices to this group. For further information,

see Device groups (page 68).

h) Click Apply.

6. The Self Service Portal page is displayed. Click Save.

Note: As a super administrator, you can also define the default customer for the login of users at the Self Service Portal. For further information, see the Sophos Mobile Control super administrator guide . Note that this does not apply to Sophos Mobile Control as a Service. Super administrators are not supported in Sophos Mobile Control as a Service.

9.3 Available Self Service Portal settings

The following table shows the functions of the Self Service Portal that you can enable or disable as described in

Configure Self Service Portal settings (page 25), and the device platforms for

which a function is supported.

Setting

Locate device

Lock device

Description

With this function users can locate devices if they are lost or stolen.

With this function users can lock their devices if they are lost or stolen.

Android iOS Windows

Mobile

Windows

Desktop

26

administrator help

Setting Description

Reconfigure device

Show compliance violations

With this function users can reconfigure their devices if

Sophos Mobile Control has been removed from the device, but the device is still enrolled.

With this function users can view the compliance violations for their devices.

Refresh data

With this function users can manually synchronize their devices with the Sophos

Mobile Control Server. This is useful, for example, if the device has been switched off for a long period of time and therefore has not been synchronized with the server.

In this case, the device may be non-compliant (depending on the compliance rules configured) and needs to be synchronized with the server to make it compliant again.

Reset password

Wipe

With this function users can reset their unlock screen password. For Android and iOS devices, a temporary password is displayed on the

Self Service portal. The device can only be unlocked with this password. After unlocking their devices, users can set a new password. For iOS, the password is completely deleted. The user has to set a new password within 60 minutes.

With this function users can reset their enrolled devices to their factory settings if devices are lost or stolen. All data on the device is deleted.

For devices that are enrolled with Android for Work, only the

Android iOS Windows

Mobile

Windows

Desktop

27

Sophos Mobile Control

28

Setting Description work profile is removed. The device itself is not reset.

Unenroll device

With this function users can decommission devices that they no longer use. This is useful, for example, if the number of devices users can enroll through the Self Service

Portal is limited or users get new devices.

Delete unmanaged device

With this function users can delete decommissioned devices.

Reset App Protection password

With this function users can reset their App Protection password on Android devices.

The App Protection password protects defined apps and has to be entered each time users start these apps. The password will be deleted and they have to set a new one.

Reset Sophos container password

With this function users can reset their Sophos container password. The Sophos container password has to be entered each time users start one of the container apps. The password will be deleted and they have to set a new one.

Reconfigure the SMC app

With this function users can reconfigure an already installed Sophos Mobile

Control app.

Android iOS Windows

Mobile

Windows

Desktop

9.4 Manage Self Service Portal users

Sophos Mobile Control offers different methods for managing Self Service Portal users:

■

Internal user management: With internal user management you can create users by adding them manually to Sophos Mobile Control or by importing them from a comma-separated values

(CSV) file.

administrator help

■

External user management: With external user management you can assign devices to groups and profiles based on external directory membership.

The user management method is customer-specific. For on-premise installations of Sophos Mobile

Control, it is defined by the super administrator when a customer is created. For Sophos Mobile

Control as a Service, you must define it before adding users. See

Configure Self Service Portal user management

(page 29).

9.4.1 Configure Self Service Portal user management

Note: For on-premise installations of Sophos Mobile Control, user management for the Self

Service Portal is configured by the super administrator when a customer is created. See the

Sophos Mobile Control super administrator guide.

1. On the menu sidebar, under SETTINGS, click Setup, and then click System setup.

The System setup page is displayed.

2. Go to the User setup tab. In this tab, select the data source for the Self Service Portal (SSP) users to be managed by Sophos Mobile Control:

■

■

■

None. No SSP, user-specific profiles, or LDAP administrators available.

Select Internal directory to use internal user management for users of the Sophos Mobile

Control Self Service Portal.

Select External LDAP directory to use external user management for users of the Sophos

Mobile Control Self Service Portal.

Click Configure external LDAP to specify the server details. See Configure external directory connection (page 29).

3. Click Save.

If you have selected Internal directory or External LDAP directory, the selected option and the option None. No SSP, user-specific profiles, or LDAP administrators available. are displayed on the User setup tab. If you want to change your selection afterward, select None.

No SSP, user-specific profiles, or LDAP administrators available first to make all options available.

Note: The user management configuration cannot be changed as long as there are any devices linked to the directory. If you try to change the configuration while devices are still connected, an error message is displayed.

9.4.1.1 Configure external directory connection

When you use an external LDAP directory for managing user accounts for the Sophos Mobile

Control console and the Self Service Portal, you must configure the directory connection so that

Sophos Mobile Control can retrieve the user data from the LDAP server. For on-premise installations of Sophos Mobile Control, this is done by the super administrator when the customer is created.

Note: There is no synchronization between the LDAP directory and Sophos Mobile Control.

Sophos Mobile Control only accesses the LDAP directory to look up user information. Changes

29

Sophos Mobile Control to an LDAP user account are not implemented on the Sophos Mobile Control database, and vice versa.

1. On the menu sidebar, under SETTINGS, click Setup > System setup, and then click the User

setup tab.

2. Select External LDAP directory.

3. Click Configure external LDAP to specify the server details.

4. On the Server details page, configure the following settings: a) Select the LDAP type. Sophos Mobile Control supports:

■

Active Directory

■

IBM Domino

■

NetIQ eDirectory

■

Red Hat Directory Server

■

Zimbra

b) In the Primary URL field, enter the URL of the primary directory server. You can enter the server IP or the server name. Select SSL to use SSL for the server connection. For Sophos

Mobile Control as a Service, SSL cannot be deselected.

c) Optional: In the Secondary URL field, enter the URL of a directory server that is used as fallback in case the primary server cannot be reached. You can enter the server IP or the server name. Select SSL to use SSL for the server connection. For Sophos Mobile Control as a Service, SSL cannot be deselected.

d) In the User field, enter an account for lookup operations on the directory server. Sophos

Mobile Control uses the account credentials when it connects to the directory server.

For Active Directory, you also need to enter the relevant domain. Supported formats are:

■

<domain>\<user name>

■ <user name>@<domain>.<domain code>

Note: For security reasons, we recommend you specify a user that only has read permissions for the directory server and not write permissions.

e) In the Password field, enter the password for the user.

Click Next.

5. On the Search base page, enter the Distinguished Name (DN) of the search base object.

The search base object defines the location in the external directory from which the search for a user or user group begins.

30

administrator help

6. On the Search fields page, define which directory fields are to be used for resolving the

%_USERNAME_% and %_EMAILADDRESS_% placeholders in profiles and policies. Type the required field names or select them from the User name and Email lists.

Note: The lists only contain fields that are configured for the user that is currently connected

to the LDAP directory, specified in step 4.d

earlier in this description. If, for example, an email

field was not configured for that user, you need to manually enter the required value in the

Email field.

In the case of Active Directory, these field mappings apply:

■

User name:

sAMAccountName

■

■

■

First name:

givenName

Last name:

sn

Email:

mail

7. On the SSP configuration page, specify the users that are allowed to log in to the Self Service

Portal. Enter the relevant information in the SSP group field, using one of the following options:

■

■

■

If you enter an asterisk

*

, all authenticated directory users are allowed to log in to the Self

Service Portal.

If you enter the name of a group that is defined on the directory server, all members of that group are allowed to log in to the Self Service Portal. After you have entered the group name, click Resolve group to resolve the group name into a Distinguished Name (DN).

If you leave the field empty, no users from the directory server are allowed to log in to the

Self Service Portal. Use this option if you want to enable external user management for the Sophos Mobile Control console but not for the Self Service Portal.

Note:

The group you specify here is not related to the directory group you define on the Group

settings tab of the Self Service Portal page. With those settings, you define task bundles,

Sophos Mobile Control group membership and available device platforms for each directory group.

8. Click Apply.

9. On the User setup tab, click Save.

9.4.2 Create Self Service Portal users with internal user management

Prerequisite: Internal user management has been enabled for the customer you are logged in to. For on-premise installations this is done in customer management by the super administrator.

For further information, see the Sophos Mobile Control super administrator guide .

This does not apply to Sophos Mobile Control as a Service. Super administrators are not supported in Sophos Mobile Control as a Service. For information on how to define the user management methods for Sophos Mobile Control as a Service, see

Configure Self Service Portal user management

(page 29).

1. On the menu sidebar, under MANAGE, click Users.

The Show users page is displayed.

31

Sophos Mobile Control

2. Click Create user.

The Edit user page is displayed.

3. Select the Send welcome email check box.

4. Enter the following information: a) User name b) First name c) Last name d) Email address e) Groups (optional)

Click Show, to display all available user groups and select one.

5. Click Save.

The new Self Service Portal user is displayed on the Show users page. A welcome email is sent to the new user.

If you click the blue triangle next to the required user, you can view the user details (Show), Edit or Delete the user.

Note: If you click a user name, the Show user page is displayed. This page contains the Resend

welcome email button, which you can use to send the email again if the user did not receive or lost the initial email.

9.4.3 Import Self Service Portal users with internal user management

Prerequisite: Internal user management has been enabled for the customer you are logged in to.

■

For on-premise installations of Sophos Mobile Control, see the Sophos Mobile Control super administrator guide .

■

For Sophos Mobile Control as a Service, see

Configure Self Service Portal user management

(page 29).

With internal user management, you can add new Self Service Portal users by importing a UTF-8 encoded comma-separated values (CSV) file with up to 500 users.

Note: Use a text editor for editing the CSV file. If you use Microsoft Excel, values entered may not be resolved correctly. Make sure that you save the file with extension

.csv

.

Tip: A sample file with the correct column names and column order is available for download from the Import users page.

To import users from a CSV file:

1. On the menu sidebar, under MANAGE, click Users, and then click Import users.

2. On the Import users page, select Send welcome emails.

3. Click Upload a file and then navigate to the CSV file that you have prepared.

The entries are read in from the file and are displayed.

32

administrator help

4. If the data is not formatted correctly or is inconsistent, the file as a whole cannot be imported.

In this case, follow the error messages that are displayed next to the relevant entries, correct the content of the CSV file accordingly and upload it again.

5. Click Finish to create the user accounts.

The users are imported and displayed on the Show users page. They will receive emails with their login credentials for the Self Service Portal.

33

Sophos Mobile Control

34

10 System setup

10.1 Check your licenses

Sophos Mobile Control uses a user-based license scheme. One user license is valid for all devices assigned to that user. Devices that are not assigned to a user require one license each.

To check your available licenses:

1. On the menu sidebar, under SETTINGS, click Setup > System setup.

2. On the System setup page, click the License tab.

The following information is displayed:

■

Maximum number of licenses: Maximum number of device users (and unassigned devices) that can be managed.

If the super administrator did not set a quota for the customer, the number of licenses is limited by the overall number for the Sophos Mobile Control server.

■

Used licenses: Number of licenses in use.

■

Valid until: The license expiry date.

If you have any questions or concerns regarding the displayed license information, contact your

Sophos sales representative.

Note: To notify when the license is about to expire, Sophos Mobile Control sends several email reminders to all administrators, starting 30 days prior to the expiry date.

10.2 Apple Push Notification service certificates

To use the built-in Mobile Device Management (MDM) protocol of iOS devices, Sophos Mobile

Control must use the Apple Push Notification service (APNs) to trigger the devices.

APNs certificates have a validity period of one year. To notify when the certificate is about to expire, Sophos Mobile Control sends several email reminders to the administrators, starting 30 days prior to the expiry date.

The following sections describe the requirements that must be fulfilled and the steps you must take to get access to the APNs servers with your own client certificate.

10.2.1 Requirements

For communication with the Apple Push Notification Service (APNs), TCP traffic to and from the following ports must be allowed:

■

The Sophos Mobile Control server needs to connect to gateway.push.apple.com:2195

TCP (17.0.0.0/8)

administrator help

■

Each iOS device with Wi-Fi only access needs to connect to

*.push.apple.com:5223

TCP (17.0.0.0/8)

10.2.2 Create an APNs certificate

This procedure assumes that you have not uploaded a certificate for the Apple Push Notification service (APNs) to Sophos Mobile Control yet.

To renew an existing certificate, see

Renew an APNs certificate (page 35).

Tip: You can use the same certificate for several customers. See

Copy an APNs certificate to another customer

(page 37).

1. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS

APNs tab.

The description on that tab guides you through the steps you have to perform to request a certificate from Apple and to upload it to Sophos Mobile Control.

2. In the Download certificate signing request step, click Download certificate signing

request.

This saves the certificate signing request file apple.csr

to your local computer. The signing request file is specific to the current customer.

3. You need an Apple ID. Even if you already have an ID, we recommend that you create a new one for use with Sophos Mobile Control. In the Create Apple ID step, click Create a new

Apple ID.

This opens an Apple web page where you can create an Apple ID for your company.

Note: Store the credentials in a safe place where your colleagues can access them. Your company will need these credentials to renew the certificate each year.

4. For your reference, enter your new Apple ID in the Apple ID field on the top of the iOS APNs tab.

When you renew the certificate each year, you must always use that same Apple ID.

5. In the Create or renew APNs certificate step, click Apple Push Certificates Portal.

This opens the Apple Push Certificates Portal.

6. Log in with your Apple ID and upload the certificate signing request file apple.csr

.

7. Download the

.pem

APNs certificate file and save it to your computer.

8. In the Upload APNs certificate step, click Upload certificate and then browse for the

.pem

file that you received from the Apple Push Certificates Portal.

9. Click Save to add the APNs certificate to Sophos Mobile Control.

Sophos Mobile Controls reads the certificate and displays the certificate details on the iOS APNs tab.

10.2.3 Renew an APNs certificate

This procedure assumes that you already have uploaded a certificate for the Apple Push Notification service (APNs) to Sophos Mobile Control that is about to be expire and needs to be renewed.

To create and upload a new certificate, see

Create an APNs certificate

(page 35).

35

Sophos Mobile Control

Important: On the Apple portal, it is important that you select the correct APNs certificate for renewal. If you renew the wrong certificate, you might need to re-enroll all iOS devices.

1. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS

APNs tab.

2. In the Download certificate signing request step, click Download certificate signing

request.

This saves the certificate signing request file apple.csr

to your local computer.

3. Skip the step Create Apple ID. This step is only required if you are creating an APNs certificate for Sophos Mobile Control for the first time.

4. In the Create or renew APNs certificate step, click Apple Push Certificates Portal.

This opens the Apple Push Certificates Portal.

5. Log in with your Apple ID. This must be the same ID that you used for the creation of the initial

APNs certificate.

6. On the Apple Push Certificates Portal, click Renew next to your Sophos Mobile Control APNs certificate.

7. Upload the certificate signing request file apple.csr

you prepared before.

8. Download the

.pem

APNs certificate file and save it to your computer.

9. In the Upload APNs certificate step, click Upload certificate and then browse for the

.pem

file that you received from the Apple Push Certificates Portal.

10. Click Save.

11. When you are logged in as super administrator, there is an additional dialog that lists all customers that currently use the same APNs certificate as the super administrator customer, that is a certificate with the same Topic attribute.

■

■

Click Save for all customers concerned to renew the APNs certificate for all of these customers.

Click Save only for super administrator customer to renew the APNs certificate only for the super administrator customer.

Important:

If the following message is shown, you are not renewing the correct certificate:

"The topic of the new certificate does not correspond to the old one.

If devices have been

set up with the previous certificate, they have to be set up again. Do you really want to save

your changes?"

This message indicates that you are about to create a new APNs certificate with a different identifier. If you confirm the message, all existing iOS devices are not manageable any more and you have to re-enroll them.

For information how to select the correct certificate, see

Identify the correct APNs certificate for renewal (page 37).

36

administrator help

10.2.4 Copy an APNs certificate to another customer

You can copy a certificate for the Apple Push Notification service (APNs) to another customer within the same or a different installation of Sophos Mobile Control.

Important: If there already exists an APNs certificate at the target location, it is important that the Topic property of the certificate that you want to copy is identical to the Topic of the existing certificate. If you copy the wrong certificate, you might need to re-enroll all iOS devices of the customer.

Download the certificate from the source location:

1. Log in to the Sophos Mobile Control console as an administrator of the customer whose APNs certificate you want to copy.

2. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS

APNs tab.

3. Make a note of the Topic value that is displayed in the certificate details.

4. Click Download certificate as PKCS #12 file.

5. In the confirmation dialog, the password for the certificate file is displayed. Make a note of that password and then click Download.

This saves the certificate file apns_cert.p12

to your local computer.

Upload the certificate to the target location:

6. Log in to the Sophos Mobile Control console as an administrator of the customer to whom you want to upload the certificate.

7. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS

APNs tab.

8. If there already exists an APNs certificate, verify that the Topic value is identical to the value of the certificate you are about to copy.

9. In the Upload APNs certificate step, click Upload certificate and then browse for the apns_cert.p12

file that you downloaded before.

10. Enter the password and then click Apply.

11. Click Save.

10.2.5 Identify the correct APNs certificate for renewal

When you renew your Apple Push Notification service (APNs) certificate for the Sophos Mobile

Control server as described in Renew an APNs certificate (page 35), it is important that on the

Apple portal you select the correct APNs certificate for renewal.

This section describes how to identify the APNs certificate that is currently uploaded to the Sophos

Mobile Control server.

Retrieve the certificate identifier:

1. Log in to the Sophos Mobile Control console with an administrator account for the customer whose APNs certificate needs to be renewed.

2. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS

APNs tab.

37

Sophos Mobile Control

3. In section Content of the Apple Push Notification keystore, the properties of the uploaded

APNs certificate are displayed.

4. Make a note of the value that is displayed for Topic.

This is the identifier of your APNs certificate.

Identify the certificate:

5. Use your web browser to open the URL of the Apple Push Certificates Portal, https://identity.apple.com/pushcert/ .

If you are experiencing issues with certain features of the Apple portal when using Microsoft

Internet Explorer, we recommend that you use the latest version of the Firefox, Opera, Chrome or Safari browser instead.

6. Log in with the Apple ID that you used for the creation of the initial APNs certificate.

7. In the list of APNs certificates, click the Certificate Info icon next to a certificate entry.

This displays the certificate details.

8. In field Subject DN, locate the value that follows the string

UID=

. If this matches the identifier that you determined in the Sophos Mobile Control console, you have identified the correct certificate.

10.2.6 Check APNs connectivity of devices

Users of the Sophos Mobile Control app for iOS can check if their devices are able to connect to the Apple Push Notification service (APNs) server.

1. In the Sophos Mobile Control app, tap the Information icon to open the About screen.

2. Tap Check APNs.

The app tries to connect to the Apple APNs server. The expected server response time is 5 seconds or less.

If the app notifies you that the APNs server could be reached, the device is able to receive commands from Sophos Mobile Control server through APNs.

If the app notifies you that the APNs server could not be reached, your network does not allow

APNs communication and thus Sophos Mobile Control is not able to manage iOS devices. To

correct this, make sure that the requirements described in Requirements

(page 34) are met.

10.3 Configure iOS AirPlay destinations

With Sophos Mobile Control you can remotely trigger AirPlay mirroring between an iOS device and predefined AirPlay destinations (for example AppleTV).

Note: AirPlay only works for devices within the same network.

You can define destinations for AirPlay mirroring.

1. On the menu sidebar, under SETTINGS, click Setup and then System setup, and go to the

iOS AirPlay tab.

2. In the AirPlay destinations section, click Create AirPlay destination.

The AirPlay destination page is displayed.

38

administrator help

3. Enter the Device name (required) and the MAC address (optional). If necessary, enter the

Password for the AirPlay destination device.

4. Click Apply.

The device is shown under AirPlay destinations in the iOS AirPlay tab of the System setup page.

5. Click Save.

You can trigger AirPlay mirroring between an iOS device and this destination by clicking Request

AirPlay mirroring from the Actions menu on the Show device page for the relevant device.

10.4 Samsung Knox license

If your company has purchased a Samsung Knox Premium license, you have to enter your license key, the number of licenses and the expiry date on the Samsung Knox license tab in order to manage the Knox container on your Samsung Knox devices with Sophos Mobile Control.

10.5 Configure SCEP

You can configure Simple Certificate Enrollment Protocol (SCEP) to provide certificates. This allows devices to obtain certificates from a Certificate Authority by using SCEP.

You can configure all the settings required to access a Certificate Authority server with SCEP in the Sophos Mobile Control console.

You can define the settings required for devices in an SCEP Device profile for Android and iOS or a policy for Windows Mobile.

10.5.1 Prerequisites

In order to use the Simple Certificate Enrollment Protocol, the following prerequisites must be fulfilled:

■

■

An SCEP-enabled Windows CA exists in the environment.

Login credentials for a user who can create a challenge code are available.

■

The Sophos Mobile Control server has http or https access to the following sites:

■ https://YOUR-SCEP-SERVER/CertSrv/MSCEP_ADMIN

■ https://YOUR-SCEP-SERVER/CertSrv/MSCEP

10.5.2 Configure SCEP

1. On the menu sidebar, under SETTINGS, click Setup and then System setup, and go to the

SCEP tab.

39

Sophos Mobile Control

2. Specify the following: a) In the SCEP server URL field, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP.

b) In the Challenge URL field, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP_ADMIN.

Note: If you use a Windows 2003 server as the SCEP server, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP.

c) In the User and Password fields, enter the user credentials of the user who can create a challenge code.

Note: In the User field, enter a user who has the necessary rights to enroll certificates.

Use the logon format: username@domain d) In the Challenge characters field, select the character types that are used for the challenge password.

e) In the Challenge length field, accept the default length.

f) Optional: Clear the Use HTTP proxy option if you want Sophos Mobile Control to bypass the HTTP proxy when connecting to the SCEP server. This option is only available if the

HTTP proxy is enabled.

For on-premise installation, the super administrator can configure an HTTP proxy that

Sophos Mobile Control uses for outbound HTTP and SSL connections. See the Sophos

Mobile Control super administrator guide .

For Sophos Mobile Control as a Service, the HTTP proxy is always enabled.

3. Click Save.

Sophos Mobile Control tests the connection to your SCEP server.

To deploy a profile using SCEP, you must add a SCEP configuration to an Android or iOS device profile or to a Windows Mobile policy.

10.6 Configure user setup

On the User setup tab you can change the user management settings. For further information,

see Manage Self Service Portal users

(page 28) and the Sophos Mobile Control super administrator guide.

40

administrator help

11 Compliance rules

With compliance rules you can:

■

Allow, forbid or enforce certain features of a device.

■

Define actions that are executed when a compliance rule is violated.

You can create various sets of compliance rules and assign them to device groups. This allows you to apply different levels of security to your managed devices.

Tip: If you are planning to manage both corporate and private devices, we recommend that you define separate sets of compliance rules for at least these two device types.

Note: There are two predefined compliance rules available. These are based on the HIPAA and the PCI DSS security standards.

11.1 Create compliance rules

To create compliance rules:

1. On the menu sidebar, under CONFIGURE, click Compliance rules.

2. On the Compliance rules page, click Create compliance rules.

3. Enter a Name and an optional Description for the new set of compliance rules.

The Compliance rules page contains individual tabs for the device platforms that are activated for the customer. Repeat the following steps for all required platforms.

4. Make sure that the Enable platform check box on each tab is selected.

If this check box is not selected, devices of that platform are not checked for compliance.

5. Under Rule, configure the compliance rules for the particular platform.

Each compliance rule has a fixed severity level (high, medium, low) that is depicted by a blue icon. The severity helps you to assess the importance of each rule and the actions you should implement when it is violated.

If you have defined app groups, you can assign these to the compliance rules Allowed apps,

Forbidden apps and Mandatory apps.

41

Sophos Mobile Control

6. Under If rule is violated, define the actions that will be taken when a rule is violated:

Option

Deny email

Description

Forbid email access.

This action can only be taken if the super administrator has configured a connection to the internal or to the standalone EAS

Proxy. See the Sophos Mobile Control super administrator guide .

Lock container

Deny network

Notify admin

Transfer task bundle

Disable the Sophos Secure Workspace and Secure Email apps. This affects document, email and web access that is managed by these apps.

This action can only be taken when you have activated an SMC

Advanced license.

This option is only relevant for Android and iOS devices.

Forbid network access.

This action can only be taken if the super administrator has configured Network Access Control. See the Sophos Mobile Control super administrator guide .

Send compliance emails to selected recipients.

The list of recipients and the time schedule is specified collectively for all sets of compliance rules that you create. See the instructions later in this section.

Transfer a specific task bundle to the device.

Select a task bundle from the list, or select None to transfer no task bundle when the compliance rule is violated.

Important: When used incorrectly, task bundles may misconfigure or even wipe devices. To assign the correct task bundles to compliance rules, an in-depth knowledge of the system is required.

7. When you have made the settings for all required platforms, click Save to save the set of compliance rules under the name that you specified.

The new set is displayed on the Compliance rules page.

8. If you have selected the Notify admin action for one of the compliance rules, click Compliance

email settings to specify the recipients that will receive compliance emails and the times when compliance emails are sent.

You can specify the recipients either by entering the name of an administrator or by entering a valid email address.

Note: These are common settings that apply to all compliance rules that have a Notify admin action.

42

administrator help

9. Click Save to save the compliance email settings.

11.2 Available compliance rules

The following table shows the compliance rules you can select for the individual platforms under

Rule in the relevant Compliance rules tabs.

Windows

Mobile

Windows

Desktop

Setting Description

Managed required

Minimum SMC app version

Define the action that will be executed when a device is no longer managed.

Enter the minimum Sophos

Mobile Control app version that has to be installed onto the device.

Root rights allowed

Select whether devices with root rights are allowed.

Note: For Sony devices with

Enterprise API version 4 or above and for Samsung devices with Knox version 5.5

or below, this includes all devices that are classified

insecure by the MDM API, for example because the bootloader is unlocked.

Apps from unknown sources allowed

Select whether apps from unknown sources are allowed.

Android Debug Bridge

(ADB) allowed

Select whether ADB (Android

Debug Bridge) is allowed.

Allow jailbreak

Select whether jailbroken devices are allowed.

Password required

Select whether a device password or other screen lock mechanism (like pattern or

PIN) is required.

For Android, this includes the display lock types Pattern, PIN and Password, but not Swipe.

Android iOS

43

Sophos Mobile Control

Setting Description

Min. OS version

Max. OS version

Select the earliest operating system version required.

Select the latest operating system version allowed.

Max. synchronization gap

Specify the maximum interval between synchronization processes for devices.

Maximum SMC app synchronization interval

Max. SMSec scan interval

Specify the maximum interval between iOS app synchronization processes for devices.

This field is only displayed if

Sophos Mobile Security is available for this customer. For further information, see

Manage Sophos Mobile

Security

(page 205). In this field, you can specify the maximum scan interval for malware scans performed by the Sophos Mobile Security app on the device.

Denial of SMSec permissions allowed

Sophos Mobile Security needs permissions on the device to work properly. The user has to grant these permissions when the app is installed.

Select whether a denial of the required permissions results in a compliance violation.

Malware apps allowed

This field is only displayed if

Sophos Mobile Security is available for this customer.

Select whether detected malware apps are allowed.

Android iOS Windows

Mobile

Windows

Desktop

44

administrator help

Setting Description

Suspicious apps allowed

PUAs allowed

This field is only displayed if

Sophos Mobile Security is available for this customer.

Select whether detected suspicious apps are allowed.

This field is only displayed if

Sophos Mobile Security is available for this customer.

Select whether detected PUAs

(Potentially Unwanted Apps) are allowed on devices.

Encryption required

Select whether encryption is required for devices.

On devices with Android 5 or higher, users must additionally enable the Require PIN to

start device or Require

Password to start device

setting when they set a screen lock. See Sophos knowledgebase article

123947 .

Data roaming allowed

Select whether data roaming is allowed for devices.

Locate permission required

This setting refers to the

Locate function. Select whether the user has to allow the Sophos Mobile Control app at installation time to retrieve location data in order to be compliant.

Denial of SMC permissions allowed

The Sophos Mobile Control app needs permissions on the device to work properly. The user has to grant these permissions when the app is installed.

Select whether a denial of the required permissions results in a compliance violation.

Android iOS Windows

Mobile

Windows

Desktop

45

Sophos Mobile Control

Setting Description

App is able to locate

Location services must be turned on and the Sophos

Mobile Control app must be allowed to use them.

For Windows Mobile, this rule only affects Windows Phone

8.1 devices.

Process control permission required

Sophos Mobile Security needs usage access to ensure that blocked apps cannot be opened and protected apps will ask for a password.

Select whether a denial of usage access results in a compliance violation.

Allowed apps /

Forbidden apps

Mandatory apps

You can specify either

Allowed apps or Forbidden

apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list. For information on creating app

groups, see App groups (page

184).

If you specify Allowed apps, only the listed apps are allowed. If other apps are detected the device will no longer be compliant.

Note: Android system apps are automatically allowed.

If you specify Forbidden

apps, the device will no longer be compliant if these apps are detected.

Specify apps that must be installed. Select the app group containing the mandatory apps from the list. For information on creating app groups, see

App groups

(page 184).

Android iOS Windows

Mobile

Windows

Desktop

46

administrator help

Setting Description

Windows Defender must be turned on

Clean status from

Windows Defender required

The Windows Defender setting

real-time protection must be turned on.

Device is not compliant when

Windows Defender shows alerts.

Up-to-date Windows

Defender definitions required

Windows Defender must use the latest spyware definitions.

Android iOS Windows

Mobile

Windows

Desktop

11.3 Assign compliance rules to device groups

1. On the menu sidebar, under MANAGE, click Device groups.

The Device groups page is displayed.

2. Click the blue triangle next to the device group you want to assign a set of compliance rules to and then click Edit.

There is always a Default device group available. For information on how to create your own

device groups, see Create device group (page 68).

3. Under Compliance rules in the fields Corporate devices and Personal devices, select the compliance rules you want to apply.

4. Click Save.

The selected compliance rules are shown on the Device groups page for the relevant device group under Compliance rules (corporate) and Compliance rules (personal).

11.4 Check devices for compliance

After you have configured compliance rules, you can check if enrolled devices comply with the rules defined.

1. On the menu sidebar, under CONFIGURE, click Compliance rules.

The Compliance rules page is displayed.

2. Click Check now.

All enrolled devices are checked for compliance according to the rules defined in Compliance

rules. The specified actions are carried out. The pie chart on the Dashboard is updated accordingly.

47

Sophos Mobile Control

12 Devices

12.1 Add devices

Devices can be added to Sophos Mobile Control in the following ways:

■

Add devices manually. See

Add device (page 48).

■

■

Import devices from a comma-separated values (CSV) file. See

Import devices

(page 49).

Use the device enrollment wizard to add a device to Sophos Mobile Control, assign it to a

user, enroll it, and transfer an enrollment task bundle. See Use the device enrollment wizard to assign and enroll new devices (page 51).

■

Enable users to enroll devices on their own through the Self Service Portal. See Configure

Self Service Portal (page 24). This portal reduces IT effort by allowing users to carry out tasks

without contacting the helpdesk. The devices are provisioned by executing defined task bundles.

See

Task bundles (page 166).

We recommend that you use device groups to group devices for easier administration. See

Device groups

(page 68).

12.1.1 Add device

We recommend that you create one or more device groups before adding your first device to

Sophos Mobile Control. You can then assign each device to a device group, to simplify device

management. See Create device group (page 68).

To add a new device to Sophos Mobile Control:

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed.

2. Click Add and then select the platform from the Add device manually menu section.

The Edit device page is displayed.

3. On the Edit device page, specify the following device details: a) In the Name field, enter a unique name for the new device.

b) In the Description field, enter a description for the new device.

c) Under Owner, select Company or Employee.

d) In the Email address field enter an email address.

e) In the Phone number field, enter the phone number of the new device. Enter the phone number in international format, for example

+491701234567

.

f) Under Device group, select the device group the device is to be assigned to.

48

administrator help

Note: A Default device group is available. If you have not defined your own device groups yet, you can add devices to this group. For information on how to create your own device

groups, see Create device group (page 68).

4. To assign a user to the device, click the Edit user assignment icon next to the User field and then click Assign user to device. For further information, see

Assign a user to a device

(page 58).

5. To add custom properties to the device, go to the Custom properties tab and click Add

custom property. For further information, see

Define custom properties for devices (page

58).

6. After you have specified all relevant device details, click Save.

The new device is added to Sophos Mobile Control and displayed on the Devices page under

MANAGE. You can now provision and manage the device.

Note: For iOS devices, when you have configured Sophos Mobile Control to synchronize the device name with the device as described in

Configure iOS settings (page 21), the name you

entered in the Name field is replaced by the name set during synchronization.

12.1.2 Duplicate a device

You can create new devices in Sophos Mobile Control by duplicating existing devices.

Note: You can only duplicate devices that are not being edited. The duplicate is named "Copy of" plus the name of the original. You can rename the devices according to your requirements.

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed.

2. Click the device you want to duplicate.

The Show device page is displayed.

3. Click Actions and then click Duplicate this device.

The device is duplicated and shown on the Devices page.You can now edit the duplicated device as required. To edit the device, click the blue triangle next to it and click Edit.

12.1.3 Import devices

You can add new devices by importing a UTF-8 encoded comma-separated values (CSV) file with up to 500 devices.

Note: Use a text editor for editing the CSV file. If you use Microsoft Excel, values entered may not be resolved correctly. Make sure that you save the file with extension

.csv

.

Note: The users that are specified in your CSV file must already be available in Sophos Mobile

Control.

Tip: A sample file with the correct column names and column order is available for download from the Import devices page.

To import devices from a CSV file:

1. On the menu sidebar, under MANAGE, click Devices.

49

Sophos Mobile Control

2. On the Devices page, click Add > Import devices.

3. On the Import devices page, click Upload a file and then navigate to the CSV file that you have prepared.

The entries are read in from the file and are displayed.

4. If the data is not formatted correctly or is inconsistent, the file as a whole cannot be imported.

In this case, follow the error messages that are displayed next to the relevant entries, correct the content of the CSV file accordingly and upload it again.

5. Click Finish to create the devices.

The devices listed in the CSV file are imported and displayed on the Devices page. You can now enroll and configure the devices.

12.2 Enroll devices

After you have added new devices in the Sophos Mobile Control console, they must be enrolled with Sophos Mobile Control. You have the following options:

■

You can enroll individual, unmanaged devices using the Devices function. For further information, see

Enroll individual devices

(page 50).

■

You can use the device enrollment wizard to add a device to Sophos Mobile Control, assign

it to a user, enroll it, and transfer an enrollment task bundle. See Use the device enrollment wizard to assign and enroll new devices

(page 51).

Note: If required, you can use the device enrollment wizard or the auto-enrollment method to enroll iOS devices without Apple ID. This can be useful, for example to preconfigure the

device before handing it over to a user. See Enroll iOS devices without Apple ID

(page 53).

To enroll and configure multiple devices efficiently, the following methods are recommended:

■

You can bundle the tasks that are necessary to enroll devices, apply required policies and install required applications (for example, managed apps for iOS devices). For further information, see

Task bundles (page 166).

■

You can enable users to enroll devices through the Self Service Portal. To do so, include a task bundle for enrollment when configuring the settings for Self Service Portal use. For further information on how to create the task bundles required for enrollment, see the Sophos Mobile

Control startup guide or the Sophos Mobile Control as a Service startup guide . For further

information on how to select the task bundle in the Self Service Portal settings, see Configure

Self Service Portal settings

(page 25).

12.2.1 Enroll individual devices

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed.

2. Select the desired device, click Actions and then click Enroll.

Note: It is possible to select several devices for enrollment.

3. Click Yes, when you are asked if you want to enroll the selected devices.

50

administrator help

The enrollment task is started and displayed on the Task view page. An email with enrollment instructions is sent to the user.

12.2.2 Use the device enrollment wizard to assign and enroll new devices

You can easily enroll new devices with the device enrollment wizard. It provides a workflow that combines the following tasks:

■

■

Add a new device to Sophos Mobile Control.

Optional: Assign a user to the device.

■

■

Enroll the device.

Optional: Transfer a task bundle to the device.

To start the device enrollment wizard:

1. On the menu sidebar, under MANAGE, click Devices, and then click Add > Enrollment

wizard.

Tip: Alternatively, you can start the wizard from the Dashboard page by clicking the Add

device widget.

2. On the Enter user search parameters wizard page, you can either enter search criteria to look up a user the device will be assigned to, or select Skip user assignment to enroll a device that will not be assigned to a user yet.

Click Next to continue.

3. When you have entered search criteria, the wizard displays a list of matching users.

Select the required user and click Next.

51

Sophos Mobile Control

4. On the Device details wizard page, configure the following settings:

Option

Platform

Name

Description

Phone number

Email address

Owner

Device group

Description

The device platform. You can only select a platform that is enabled for the customer that you logged in to.

A unique name under which the device will be managed by Sophos

Mobile Control.

An optional description of the device.

An optional phone number. Enter the number in international format, for example

+491701234567

.

The email address to which the enrollment instructions will be sent.

Select the device owner: either Company or Employee.

Select the device group the device will be assigned to. If you have not created a device group yet, you can select the device group

Default, which is always available.

When you are ready, click Next.

5. On the Bundle selection wizard page, select a task bundle that will be transferred to the device after it has been enrolled, or select Only enroll device to enroll the device without transferring a task bundle.

Note: Only task bundles that contain an Enroll task are displayed.

When you are ready, click Next. The device is added to Sophos Mobile Control.

6. On the Enrollment wizard page, follow the instructions to install the Sophos Mobile Control app onto the device and to complete the enrollment and provisioning.

7. When enrollment has been completed successfully, click Finish to close the device enrollment wizard.

Note:

■

When you have made all the selections, you can close the wizard without having to wait for the Finish button to appear. An enrollment task is created and processed in the background.

■

■

If you have selected a task bundle to be transferred to the device after enrollment, you can

monitor the task status on the Task view page. See View unfinished, failed and latest finished tasks (page 16).

For iOS devices, when you have configured Sophos Mobile Control to synchronize the device

name with the device as described in Configure iOS settings (page 21), the name you entered

in the Name field is ignored and the name that is configured on the device is used instead.

52

administrator help

12.2.3 Auto-enroll iOS devices

You can configure iOS devices to auto-enroll with Sophos Mobile Control during device activation.

To do so, you use Apple Configurator 2 to assign devices to the Sophos Mobile Control MDM server. When the users switch on their devices for the first time, the iOS setup assistant starts.

During setup, the devices are automatically enrolled with Sophos Mobile Control.

Note: For a detailed description of Apple Configurator 2, see the Apple Configurator 2 online help .

To configure auto-enrollment of iOS devices with Sophos Mobile Control:

1. As a one-time step to prepare auto-enrollment, create a device group that will be assigned to devices during auto-enrollment with Sophos Mobile Control. In the device group properties, select the Enable iOS auto-enrollment option. See

Create device group

(page 68).

2. Make a note of the URL that is displayed in the Auto-enrollment URL field of the device group.

You need this URL when you configure devices with Apple Configurator 2.

3. Connect the iOS device you want to auto-enroll to an USB port of a Mac with Apple

Configurator 2 installed.

4. In Apple Configurator 2, use the Prepare Assistant to set up the device configuration.

5. Select Manual Enrollment and then enter the auto-enrollment URL of the device group.

6. Follow the further steps of the Prepare Assistant. You can optionally configure the following aspects of the device activation:

■

■

■

■

Enable device supervision mode.

Configure host computers to which the device is allowed to connect with, using USB ports.

For supervised devices, generate or choose a "supervision identity".

Disable configuration steps of the iOS setup assistant.

After you have completed the configuration, hand over the device to the user. When the user switches on the device for the first time, the iOS setup and the enrollment with Sophos Mobile

Control are performed as configured.

Tip: By default, Sophos Mobile Control manages auto-enrolled devices under a name that is composed from the device ID and the device type. Alternatively, Sophos Mobile Control can use

the name that is configured on the device. See the Synchronize device name option in Configure iOS settings

(page 21).

12.2.4 Enroll iOS devices without Apple ID

You can enroll an iOS device with Sophos Mobile Control without having to associate the device with an Apple ID first. This can be useful for example to preconfigure the device before handing it over to a user.

The standard enrollment method includes the installation of the Sophos Mobile Control app onto the device. Because the app is installed from the App Store and an Apple ID is required to access the App Store, you need to associate the device with the ID before starting the enrollment.

53

Sophos Mobile Control

Alternatively, you can enroll an iOS device without installing the Sophos Mobile Control app, so there is no need to associate the device with an Apple ID. This is provided by:

■

The auto-enrollment method. See

Auto-enroll iOS devices

(page 53).

■

The device enrollment wizard. See Use the device enrollment wizard to assign and enroll new devices

(page 51).

In the Device enrollment wizard, do as follows:

1. On the Enrollment page, select the Enrollment without Apple ID tab.

2. Use the device's web browser to open the enrollment URL. This opens a Sophos Mobile

Control enrollment form.

3. In that form, enter the token and then click Enroll.

4. Follow the instructions on the device to install the enrollment task bundle.

12.3 Unenroll devices

You can unenroll devices that will no longer be used, for example, if a user gets a new device.

This is useful, for example, if you have limited the number of devices a user can enroll through the Self Service Portal.

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed with all devices enrolled with Sophos Mobile Control for this customer.

2. Select the desired device, click Actions and then click Unenroll.

A message is displayed prompting you to confirm that you want to unenroll the device.

Note: It is possible to select several devices for unenrollment.

3. Click Yes.

The device is unenrolled. This results in the following:

Android devices:

■

The Sophos Mobile Control Client device administrator is disabled.

■

■

The server login data and all other data received are removed.

The container apps (Sophos Secure Workspace and Sophos Secure Email) and the Sophos

Mobile Security app are reset.

iOS devices:

■

All profiles are removed.

■

All managed apps are removed.

■

All certificates received through Mobile Device Management are removed.

■

The container apps (Sophos Secure Workspace and Sophos Secure Email) are reset.

54

administrator help

12.4 Manage devices

On the menu sidebar, under MANAGE > Devices and Device groups, you can keep track of devices and device groups and carry out a number of administrative tasks. After adding devices to Sophos Mobile Control you can, for example:

■

■

View and edit device details.

Allow or forbid email access for devices.

■

■

■

■

■

Lock or unlock devices remotely.

Reset device passwords.

Wipe the device remotely in case of loss or theft.

Decommission devices (Android and iOS).

Delete devices.

12.4.1 View devices

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed, showing all devices enrolled with Sophos Mobile Control for this customer.

2. Go to the required device and click its name.

The Show device page is displayed for the selected device.

Tip:

On the Devices page you can display additional information by pointing to certain elements:

■

■

Point to the "Not managed" icon of a device to display the actual status like Unenrolled or

Checked out.

Point to the "Not compliant" icon of a device to display the severity level (high, medium, low).

12.4.1.1 The Show device page

On the Show device page, all relevant information for an individual device is displayed.

In the upper part of the page, you can see the most important device information at a glance.

In the lower part of the page, detailed device information is displayed on several tabs. The tabs and information shown depend on the device platform.

■

Profiles (Android, iOS)

Shows the profiles (including provisioning profiles) installed on the device.

The tab also contains commands to install profiles onto the device or to remove them.

■

Policies

Shows the policies assigned to the device.

55

Sophos Mobile Control

On this tab, the Assign policy button is available to assign a policy to the device.

■

Device properties

Shows device properties, for example, properties for model, model name, OS version. For

Android devices, rooted smartphones are detected and the relevant property is shown. For iOS devices, jailbroken smartphones are detected and the relevant property is shown.

■

Custom properties

Shows custom device properties. These are the properties that you can create yourself. Custom device properties can, for example, be used in placeholders if no Active Directory connection is available. When you edit a device, you can also add user-specific information here.

■

Internal properties

Shows internal device properties, for example, ActiveSync traffic allowed, IMEI.

■

Compliance violations

This tab is only displayed for non-compliant devices. It shows the compliance violations of the device and the actions taken because of the violation.

These actions are defined during the compliance rule configuration. See Create compliance rules (page 41).

■

Installed apps (Android, iOS)

Shows the software installed onto the device.

For iOS devices, the Managed column on the Installed apps tab indicates managed apps.

With Sophos Mobile Control you can push such apps to iOS devices and also silently remove them.

For Android devices, Sophos Mobile Control differentiates between system apps and apps that the user has installed onto the device.

The Size column shows the disk space usage of an app itself. The Data column shows the additional disk space that an app uses for user data, configurations, and so on.

With the Install app button, you can install software onto the device. You can also remove managed apps from iOS devices by clicking the Delete icon next to the relevant app.

■

System apps (Android)

Shows Android system apps on the device.

Note: System apps cannot be removed from the device.

■

Knox apps (Android)

This tab shows the apps that the user has installed in the Samsung Knox container.

■

Knox system apps (Android)

This tab shows the system apps that are installed in the Samsung Knox container.

■

Scan results (Android)

56

administrator help

This tab is only available if the Sophos Mobile Security functionality is available for the customer you are logged in to. It shows the results of the last Sophos Mobile Security scan performed on the device. Sophos Mobile Security is a security app for Android devices that protects devices from malicious apps and assists users in detecting app permissions that could be a security risk. The app can be managed by Sophos Mobile Control. For further information, see

Manage Sophos Mobile Security (page 205).

■

Certificates

Shows the certificates in use on the device.

■

Tasks

This tab shows all unfinished and failed tasks for the device as well as the finished tasks of the last few days. You can also view these tasks, together with the tasks for all other devices, on the Task view page. See

Monitor tasks (page 16).

From the Show device page, you can directly switch to the Edit device page. To edit the device you are viewing, click Edit.

12.4.1.2 Use the extended device filter

With the extended device filter, you can filter the device lists according to your needs.

To use the device filter:

1. On the Devices page, click the Extended filter button (magnifier icon) in the header bar.

The Device filter: Filter is not active. dialog box is displayed.

2. Define your filter criteria.

3. After you have selected the required criteria, click Filter.

The filter is activated and the list of devices is reloaded. The magnifier icon in the header bar changes its color from blue to green to indicate that the filter is active. To reset the filter, click

Extended filter again and click Reset in the filter dialog.

Note: Remember to reset filters manually when they are no longer needed. Otherwise, lists or reports may not include the results you expect.

12.4.2 Edit devices

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed with all devices enrolled with Sophos Mobile Control for this customer.

2. Click the blue triangle next to the required device and then click Edit.

The Edit device page is displayed for the selected device.

3. Make the necessary changes (for example, install or remove software on the Installed apps tab) and click Save.

Your changes are applied to the edited device.

57

Sophos Mobile Control

Note: Property changes only become valid after you have clicked Save. If you do not save the changes you have made, they do not have any effect.

12.4.2.1 Assign a user to a device

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the required device and then click Edit.

3. On the Edit device page, click the Edit user assignment icon next to the User field and then click the relevant entry from the selection list:

■

■

To assign a user to a device that has no user assigned to it yet, click Assign user to

device.

To assign a different user to a device that already has a user assigned to it, click Reassign

user to device.

4. In the Enter user search parameters step of the assignment dialog, enter search parameter in one or more fields to filter the user list that will be displayed in the next step. For example, enter the user name or part of it.

5. In the Select user step, select the required user and then click Apply.

6. On the Edit device page, click Save.

12.4.2.2 Deassign a user from a device

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the required device and then click Edit.

3. On the Edit device page, click the Edit user assignment icon next to the User field and then click Deassign user from device.

4. In the confirmation dialog, click Yes.

5. Click Save.

12.4.2.3 Define custom properties for devices

You can define custom properties for individual devices.

When you define a property with name my property

, you can refer to the value of the property in profiles and policies by using the placeholder

%_DEVPROP(my property)_%

. For example, you can use this to refer to the user that is assigned to a device.

For details on profile and policy placeholders, see

Placeholders in profiles and policies

(page 72).

Note:

■

■

■

You cannot create a custom device property with the same name as a standard device property.

When you duplicate a device as described in Duplicate a device

(page 49), the new device receives the custom properties of the source device.

As well as the device-level custom properties described here, you can also define customer-level custom properties. See

Define customer properties

(page 22).

58

administrator help

To define a custom device property:

1. On the menu sidebar, under SETTINGS, click Setup > General. On the Personal tab, make sure that the Show extended device details option is selected.

2. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed with all devices enrolled with Sophos Mobile Control for this customer.

3. Click the blue triangle next to the required device and then click Edit.

4. On the Edit device page, go to the Custom properties tab and click Add custom property.

5. Enter a Name and a Value for the new custom device property.

6. Click Apply to add the property.

7. Click Save to save the changes to the device.

12.4.2.4 Configure network access

Before you can configure network access for a device, Network Access Control (NAC) must be enabled in Sophos Mobile Control.

For on-premise installation, NAC is enabled by the super administrator. See the Sophos Mobile

Control super administrator guide .

For Sophos Mobile Control as a Service, NAC is always enabled.

There are two options to configure network access for a device:

1. Allow or deny network access unconditionally.

2. Disable network access when the device violates a compliance rule, enable network access otherwise.

Note: Sophos Mobile Control does not control the network access by itself. Instead, it provides a Deny network status that can be used by external NAC software like Sophos UTM to block network communication.

To configure network access for a device:

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, select the devices for which you want to set the network access mode.

3. Click Actions, and then click Set network access.

4. Select the network access mode:

■

■

■

Allow: Network access for the selected devices is allowed.

Deny: Network access for the selected devices is denied.

Auto mode: Network access for the selected devices is based on the compliance status of the devices.

5. Click Yes to save the changes.

For information on how to configure network access in compliance rules, see Create compliance rules

(page 41).

59

Sophos Mobile Control

12.4.3 Lock device

You can lock a device that is managed by Sophos Mobile Control. This activates the screen lock.

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device that you want to lock or unlock and then click Show.

3. On the Show device page, click Actions > Lock.

A task to activate the lock screen is created and transferred to the device. Users must enter their device password (or their PIN or pattern, if configured) to unlock the device.

You can display the task status on the Task view page.

12.5 Apple DEP

With the Apple Device Enrollment Program (DEP), you can purchase iOS (and OS X) devices in volume for distribution within your company. DEP simplifies the deployment of mobile devices by providing the following features:

■

■

Configurable activation process.

Wireless enabling of supervision mode.

■

■

Over-the-air configuration.

Automatic enrollment of iOS devices with Sophos Mobile Control during device activation.

Tip: For detailed information on DEP, visit the Apple DEP website at http://www.apple.com/business/dep/ .

Preparation steps

To prepare the management of DEP devices with Sophos Mobile Control, perform the following one-time steps:

1. On the Apple DEP web portal, create a virtual MDM server and link it to Sophos Mobile Control.

See

Set up a virtual MDM server

(page 61).

2. In Sophos Mobile Control, create one or more DEP profiles that control various device attributes specific to DEP. With the DEP profile, you can also customize the iOS setup assistant that starts when a device is switched on for the first time. See

Create DEP profile (page 62).

Deployment steps

When you purchase DEP devices, the typical deployment process includes the following steps:

1. Purchase the devices from Apple or an approved DEP vendor.

2. On the Apple DEP web portal, assign the devices to the Sophos Mobile Control MDM server.

For this and the next step, see Deploy DEP devices

(page 65).

3. In the Sophos Mobile Control console, assign a DEP profile to the devices.

4. Distribute the devices to your users.

60

administrator help

5. When the users switch on their devices for the first time, the customized iOS setup assistant starts. During setup, the devices are enrolled with Sophos Mobile Control and the user is assigned to the device.

6. If required, you can transfer additional task bundles to the devices to complete the provisioning.

12.5.1 Set up a virtual MDM server

Prerequisite: This procedure assumes that you have already enrolled in the Apple Device

Enrollment Program (DEP) and set up an administrator account for the Apple DEP web portal.

Note: For detailed information on enrolling in DEP, visit the Apple DEP website at http://www.apple.com/business/dep/ or see the Apple Deployment Programs online help .

Tip: If you have already enrolled in the Apple Volume Purchase Program (VPP), you can use the same Apple ID for DEP.

To use Apple DEP with Sophos Mobile Control, you need to create a virtual MDM server on the

Apple DEP web portal and link it to the Sophos Mobile Control server. This includes a verification process to establish a secure connection between Sophos Mobile Control and the Apple DEP web service.

To set up a virtual MDM server for Sophos Mobile Control:

1. Log in to the Sophos Mobile Control console with an administrator account for the customer for which you want to manage the DEP devices.

2. On the menu sidebar, under SETTINGS, click Setup > System setup, and then click the

Apple DEP tab.

3. Click Download public key to download the Sophos Mobile Control public key file for Apple

DEP.

The file is saved to your local computer, using the download settings of your web browser.

4. Open the Apple DEP web portal at https://deploy.apple.com

in a new browser window.

You can do this by clicking the Apple DEP web portal link in Sophos Mobile Control.

5. Log in to the Apple DEP web portal with your company Apple ID.

6. On the portal, go to Device Enrollment Program > Manage Servers, and then click Add

MDM Server.

7. Enter a name for MDM server, for example

Sophos Mobile Control

.

8. In the next step, upload the public key file that you downloaded from Sophos Mobile Control.

9. In the next step, download the server token.

At this point, you may log out from the Apple DEP web portal.

10. On the Apple DEP tab of Sophos Mobile Control, click Upload a file and select the server token that you downloaded from the Apple DEP web portal.

The details of your virtual MDM server are displayed.

11. Click Save to save your changes.

The DEP server token is valid for one year. To notify when the token is about to expire, Sophos

Mobile Control sends several email reminders to all administrators of the relevant customer, starting 30 days prior to the expiry date.

Important: When you create a new server token on the Apple DEP web portal, you must use the same Apple ID that you used for the creation of the initial token.

61

Sophos Mobile Control

12.5.2 Create DEP profile

You need to set up the Apple Device Enrollment Program (DEP) before you can create DEP profiles. See

Set up a virtual MDM server (page 61).

A DEP profile is assigned to a DEP device and provides information to the Apple server when the device is activated. This information includes:

■

■

The MDM server (that is Sophos Mobile Control) assigned to manage the device.

Configuration options for the enrollment with Sophos Mobile Control.

■

■

A list of hosts that the device is allowed to pair with.

Customization options for the iOS setup assistant that starts when the device is switched on for the first time.

If required, you can create several DEP profiles to use different setup and enrollment settings for your DEP devices.

To create a DEP profile:

1. On the menu sidebar, under SETTINGS, click Setup > System setup, and then click the

Apple DEP profiles tab.

2. Click Add.

3. In the Edit DEP profile dialog, enter a name and optionally a description for the DEP profile.

4. Optional: In the Device group list, select a device group that will be assigned to devices when they are enrolled with Sophos Mobile Control.

For information on device groups, see Device groups (page 68).

Note: To simplify device management, we recommend that you use a separate device group for DEP devices.

5. Optional: In the Task bundle list, select a task bundle that will be transferred onto the devices when they are enrolled with Sophos Mobile Control.

The list includes all iOS task bundles that contain no enrollment task.

For information on task bundles, see

Task bundles (page 166).

62

administrator help

6. On the Enrollment tab, you can configure the following settings:

Option Description

Supervise device

Supervision mode is enabled.

User can remove MDM profile

The user is able to remove the Sophos Mobile Control enrollment profile through the iOS user interface.

This option can only be deselected for supervised devices.

Install SMC app

User can skip MDM profile assignment

Assign user to device

Install the Sophos Mobile Control app onto the device.

If you enable this option, you must also disable the Skip Apple ID option on the iOS setup tab to make sure that Sophos Mobile Control can install the app from the App Store.

Note: Alternatively, if you are enrolled in the Apple Volume Purchase

Program (VPP), the Sophos Mobile Control app can be installed as a VPP app, even if the device is not associated with an Apple ID.

Devices must be in status managed and must use iOS 9 or higher.

See

Automatically assign VPP apps

(page 181).

The user is able to skip the setup step that applies the Sophos Mobile

Control enrollment profile.

During the enrollment process with Sophos Mobile Control, users are asked for their Self Service Portal credentials and then assigned to the device.

Use this option to auto-assign a user to the device.

63

Sophos Mobile Control

7. On the iOS setup tab, you can disable configuration steps of the iOS setup assistant that starts when the device is switched on for the first time.

Note: These settings only affect the iOS setup. If you disable a configuration step, the user is still able to enable the relevant option later. To completely disable a feature, use a

Restrictions configuration. See

Restrictions configuration (iOS device profile)

(page 117).

Option

Skip Apps & Data

Description

The page Apps & Data is not displayed. The user cannot restore data from an iCloud or iTunes backup, or transfer data from an

Android device.

Disable "Move Data from

Android"

On the Apps & Data page, the option Move Data from Android is not available. The user cannot transfer data from an Android device.

This can only be enabled when Skip Apps & Data is also enabled.

Skip Diagnostics

Skip Location Services

Skip Siri

Skip Display Zoom

Skip Apple ID

Skip Apple Pay

Skip Touch ID

Skip Passcode

Skip Terms and Conditions

The page Diagnostics is not displayed. Sending diagnostic and usage data to Apple is disabled.

The page Location Services is not displayed. The user cannot enable location services.

The page Siri is not displayed. The user cannot set up Siri.

The page Display Zoom is not displayed. The user cannot change the display view.

The page Apple ID is not displayed. The user cannot log in with their

Apple ID to access Apple services.

The page Apple Pay is not displayed. The user cannot add credit or debit card information for paying in stores or within apps using

Apple Pay.

The page Touch ID to is not displayed. The user cannot set up a fingerprint in place of a passcode.

The page Create a Passcode is not displayed. The user cannot set up a passcode to unlock the device.

The page Terms and Conditions is not displayed.

64

administrator help

8. On the Support information tab, you can configure the following settings:

Option

Department

Description

The department or location name associated with the profile.

This name is included in the information that the user can access by clicking About Configuration during device setup.

Phone number

Email

The support phone number for your company.

This field is pre-populated with the phone number from the technical support contact details. See

Configure technical support contact details (page 22).

Note: The phone number is stored internally in the DEP profile but is not available to the device user.

The support email address for your company.

This field is pre-populated with the email address from the technical support contact details. See

Configure technical support contact details (page 22).

Note: The email address is stored internally in the DEP profile but is not available to the device user.

9. On the USB pairing tab, you configure host computers to which the device is allowed to connect with, using USB ports.

This can be used to sync the device with iTunes or to manage it with Apple Configurator.

■

■

To allow USB connection with all hosts, select Allow USB pairing with all hosts.

To forbid USB connection or to restrict it to certain hosts, deselect Allow USB pairing with

all hosts and then upload a certificate file for each host to which the device is allowed to connect with.

10. When you have configured all tabs of the Edit DEP profile dialog, click Apply to save the

DEP profile.

11. To assign the profile to all new DEP devices to which no profile has been manually assigned to, select it in the Default DEP profile assigned to new devices list.

When you select None, you have to manually assign a DEP profile to new DEP devices as

described in Deploy DEP devices (page 65). Otherwise, DEP devices will not be enrolled with

Sophos Mobile Control when they are activated.

12. Click Save to save your changes.

12.5.3 Deploy DEP devices

Perform this procedure to connect your devices to Apple DEP and to enroll them with Sophos

Mobile Control.

65

Sophos Mobile Control

You can manage devices that you have purchased from Apple or from an approved DEP vendor.

Before you can connect devices to Apple DEP, you need to configure the device vendor on the

Apple DEP portal.

Note: In a typical DEP workflow, you perform this procedure before handing over the devices to your users for activation and usage.

Note: For a detailed description of the Apple DEP portal, see the Apple Deployment Programs online help .

To assign your devices to Sophos Mobile Control and to assign a DEP profile to them:

1. Open the web portal for the Apple deployment programs at https://deploy.apple.com

in your web browser and then log in with your company Apple ID.

2. On the portal, go to Device Enrollment Program > Manage Devices.

3. Under Choose Devices By, select your new devices by serial number, by order number, or upload a CSV file containing the serial numbers of your devices.

Note: If you have purchased your devices from a reseller, they are available on the DEP portal within 24 hours after the reseller posts your order to Apple.

4. Under Choose Action, select Assign to Server and then select the virtual MDM server that you have set up for Sophos Mobile Control as described in

Set up a virtual MDM server

(page

61).

5. Click OK to perform the assignment.

At this point, you may log out from the Apple DEP web portal.

You may skip the remaining steps if you have configured a default DEP profile as described in

Create DEP profile (page 62).

6. Log in to the Sophos Mobile Control console with an administrator account for the customer for which you want to manage the DEP devices.

7. On the menu sidebar, under MANAGE, click Devices and then click Apple DEP.

The Apple DEP devices page lists all devices that you have assigned to Sophos Mobile

Control on the Apple DEP web portal.

8. If the devices that you just assigned to Sophos Mobile Control do not appear in the list, click

Synchronize with Apple DEP portal.

Note: To limit the load on the Apple DEP server, repeated synchronization is possible only after a short queue time.

9. Select the new devices and then click Actions > Assign profile.

10. In the confirmation dialog, select the DEP profile you want to assign to the devices and then click OK.

When the purchased devices arrive at your company, you can hand them over to your users. No further configuration is required. When the users switch on their devices for the first time, the iOS setup and the enrollment with Sophos Mobile Control are performed as configured in the assigned

DEP profile.

When you have selected the Assign user to device profile option as described in Create DEP profile

(page 62), the users are automatically assigned to their device.

66

administrator help

12.5.4 Manage DEP devices

DEP devices are managed in Sophos Mobile Control just as non-DEP devices are. See

Manage devices (page 55).

Specifically to DEP, you can assign a DEP profile to a device. The DEP profile provides information to the Apple server when the device is activated. See

Create DEP profile (page 62).

Note: Because a DEP profile is only used for device activation, changing the assigned DEP profile has no effect on the device until it is reset and then activated again.

To change the DEP profile of a device:

1. On the menu sidebar, under MANAGE, click Devices and then click Apple DEP.

The Apple DEP devices page lists all devices that you have assigned to Sophos Mobile

Control on the Apple DEP web portal.

2. Click Synchronize with Apple DEP portal to update the DEP information.

Note: To limit the load on the Apple DEP server, the Synchronize with Apple DEP portal option is disabled after a synchronization and becomes available again after a few minutes.

3. Select the devices to which you want to assign a different DEP profile.

4. Click Actions > Assign profile.

5. In the confirmation dialog, select the DEP profile you want to assign to the devices and then click OK.

67

Sophos Mobile Control

13 Device groups

Device groups are used to categorize devices. They help you to manage devices efficiently as you can carry out tasks on a group rather than on individual devices.

A device always belongs to exactly one device group. You assign a device to a device group when you add it to Sophos Mobile Control.

Tip: Only group devices with the same operating system. This makes it easier to use groups for installations and other operating system specific tasks.

13.1 Create device group

1. On the menu sidebar, under MANAGE, click Device groups, and then click Create device

group.

2. On the Edit device group page, enter a Name and a Description for the new device group.

3. In the Compliance rules section, use the Corporate devices and Personal devices lists to select the compliance rules you want to apply.

4. Click Save.

Note: The device group settings contain the Enable iOS auto-enrollment option. This option

allows you to enroll iOS devices with the Apple Configurator. See Auto-enroll iOS devices

(page 53)

The new device group is created and shown on the Device groups page.

13.2 Delete device groups

1. On the menu sidebar, under MANAGE, click Device groups.

2. On the Device groups page, click the blue triangle next to the device group that you want to delete, and then click Delete.

3. In the confirmation dialog, select one of the remaining device groups to which devices from the current device group will be re-assigned.

This selection is not available when there are no devices assigned to the current device group.

4. Click Yes to delete the device group.

Note: When there is only one device group left and there are devices assigned to it, you cannot delete this device group.

68

administrator help

14 Profiles and policies

Profiles

Profiles are settings that you define and then install onto a device or device group.

To install a profile on one or more devices, Sophos Mobile Control creates a task and executes it at the specified time. When you update a profile, you must install it again for the changed configurations to take effect on the device.

The following profile types are available:

Configurations for Android device profiles

(page 75)

Configurations for Android for Work policies

(page 92)

Configurations for Knox container profiles (page 111)

Configurations for iOS device profiles

(page 116)

Policies

Policies are settings that you define and then assign to a device or device group. You can only assign one policy of each type to one device.

If you assign a policy to a device, a sync is triggered and the settings take effect immediately.

Assigned policies are updated on the device each time a device connects to the Sophos Mobile

Control server. So when you update a policy, you do not have to explicitly re-apply it to the device.

The following policy types are available:

Configurations for Sophos container policies for Android (page 101)

Configurations for Mobile Security policies (page 111)

Configurations for Sophos container policies for iOS

(page 142)

Configurations for Windows Mobile policies

(page 151)

Configurations for Windows Desktop policies

(page 160)

14.1 Create profile or policy

Profiles and policies are made up of one or more configurations. By adding configurations, you define the scope of the profile or policy, that is, the areas that are managed on the devices.

1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click the platform for which you want to create the profile or policy.

2. On the Profiles and policies page, click Create. If there is more than one profile or policy type available for a platform, Create opens a menu from which you can select the required type.

For a list of available profile and policy types, see Profiles and policies (page 69).

69

Sophos Mobile Control

3. Enter a name, a version and a description.

Required fields are marked with a red asterisk.

4. For Sophos container policies, a General configuration is mandatory and is automatically added to the policy. On the Edit policy page, click General to open the configuration and make the required changes.

5. For Android for Work policies, a Restrictions configuration is mandatory and is automatically added to the policy. On the Edit policy page, click Restrictions to open the configuration and make the required changes.

6. To add more configurations to the profile or policy, click Add configuration and then select the configuration you want to add.

Note: The configurations supported may depend on the version of the operating system or on other device features. The requirements are indicated by a blue label.

7. In the settings page of the configuration, specify the required settings.

8. Optional: Repeat the previous steps to add more configurations.

9. After you have added all required configurations, click Save.

The profile or policy is created. For information on how to apply it to devices, see

Install a profile onto devices (page 73) or Assign a policy to devices (page 73).

14.2 Import iOS device profiles created with Apple

Configurator

You can import profiles created with Apple Configurator into Sophos Mobile Control.

Apple Configurator can be downloaded from the App Store.

Note: You import device profiles with the same procedure as provisioning profiles for your self-developed iOS apps. When you upload a profile file, Sophos Mobile Control analyzes its content in order to distinguish between the two profile types.

1. After you have created a profile in Apple Configurator, export it (unencrypted and unsigned) and save it on your computer.

2. On the menu sidebar, under CONFIGURE, click Profiles, policies > Apple iOS.

3. On the Profiles and policies page, click Create > Import profile.

The Edit profile page is displayed.

4. Enter a name, a description and, optionally, a version for the new profile in the relevant fields.

5. Click Upload a file and navigate to the file you have saved on your computer, select it and click Open.

6. Click Save.

The profile is created. It can be installed onto devices. See

Install a profile onto devices

(page

73).

70

administrator help

14.3 Import provisioning profiles for iOS apps

When you develop your own iOS apps, you create provisioning profiles so that your apps can be installed from an IPA file instead of the App Store. You can upload these provisioning profiles to the Sophos Mobile Control server to subsequently distribute them to your devices.

For details on provisioning profiles, see the iOS Developer Library.

Note: You import provisioning profiles with the same procedure as device profiles created with

Apple Configurator. When you upload a profile file, Sophos Mobile Control analyzes its content in order to distinguish between the two profile types.

1. After you have generated a provisioning profile in your iOS development environment, save it on your computer.

2. On the menu sidebar, under CONFIGURE, click Profiles, policies > Apple iOS.

3. On the Profiles and policies page, click Create > Import profile.

The Edit profile page is displayed.

4. Enter a name, a description and, optionally, a version for the new profile in the relevant fields.

5. Click Upload a file and navigate to the file you have saved on your computer, select it and click Open.

6. Click Save.

The profile is created. It can be installed onto devices. See

Install a profile onto devices

(page

73).

14.4 Windows Desktop password complexity rules

Password complexity rules (for example length, number of uppercase and lowercase letters) for

Windows Desktop devices are fixed and cannot be set by a Sophos Mobile Control policy. Different rules apply for local and for Microsoft accounts.

Local accounts

■

■

■

Password must not contain the user's account name or more than two consecutive characters from the user's full name.

Password must be six or more characters long.

Password must contain characters from three of the following four categories:

■

■

■

■

Uppercase characters A-Z (Latin alphabet)

Lowercase characters a-z (Latin alphabet)

Digits 0-9

Special characters (!, $, #, %, etc.)

71

Sophos Mobile Control

Microsoft accounts

■

■

Password must be eight or more characters long.

Password must contain characters from two of the following four categories:

■

■

Uppercase characters A-Z (Latin alphabet)

Lowercase characters a-z (Latin alphabet)

■

■

Digits 0-9

Special characters (!, $, #, %, etc.)

14.5 Samsung Knox support

You can manage your Samsung Knox devices with Sophos Mobile Control.

Note: In order to manage Samsung Knox devices, a Samsung Knox Premium license key needs to have been entered in the Sophos Mobile Control System setup.

To configure the Knox container of Samsung devices, see Configurations for Knox container profiles (page 111).

To install apps in a Samsung Knox container, see Add app (page 174).

To manage your Samsung Knox devices you can create task bundles for the following actions:

■

■

■

■

Knox container: lock

Knox container: unlock

Knox container: reset password

Knox container: remove (removes the container and all related configuration from the device)

To create a task bundle for a Samsung Knox device, see

Create task bundle (page 166).

14.6 Placeholders in profiles and policies

Profiles and policies may contain placeholders which are replaced by actual data at the time of task execution. The following placeholders can be used in profiles:

■

Placeholders for user data:

■ %_EMAILADDRESS_%

■

%_USERNAME_%

■

Placeholders for device properties:

■

%_DEVPROP(property name)_%

property name

can be either a standard property or a custom property of the device.

See

Define custom properties for devices

(page 58).

72

administrator help

■

Placeholders for customer properties:

■ %_CUSTPROP(property name)_%

See

Define customer properties (page 22).

14.7 Install a profile onto devices

1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click one of the device platforms that support profiles:

■

■

Android

Apple iOS

The Profiles and policies page for the selected platform is displayed.

2. Click the blue triangle next to the profile to be installed and then click Install.

The Select devices page is displayed.

3. On this page, you can:

■

■

Select individual devices onto which you want to install the profile.

Click Select device groups and select one or several device groups.

4. After you have made your selection, click Next.

The Set execution date page is displayed.

5. Under Scheduled date, select Now or specify a Date and Time for the execution of the task.

6. Click Finish.

The Task view is shown.

The profile is installed onto the selected devices at the specified date and time.

Note: You can also install a profile by using one of the following options:

■

■

Create a task bundle with an Install profile or assign policy task and transfer it to the required devices or device groups.

On the device's Show device page, select the Profiles tab and click Install profile.

14.8 Assign a policy to devices

1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click one of the device platforms that support policies:

■

■

■

■

Android

Apple iOS

Windows Mobile

Windows Desktop

The Profiles and policies page for the selected platform is displayed.

73

Sophos Mobile Control

2. Click the blue triangle next to the policy to be assigned and then click Assign.

The Select devices page is displayed.

3. On this page, you can:

■

■

Select individual devices you want to assign the policy to.

Click Select device groups and select one or several device groups for assigning the policy.

4. After you have made your selection, click Finish.

The policy is assigned to the selected devices and a synchronization process for the selected devices is triggered.

Note: You can also assign a policy by using one of the following options:

■

■

Create a task bundle with an Install profile or assign policy task and transfer it to the required devices or device groups.

On a device's Show device page, select the Policies tab and click Assign policy.

Note: Policies cannot be removed from a device. To disable a policy, you must assign a different policy to that device.

14.9 Remove profile

Use one of the following procedures to remove a profile from devices:

■

On a device's Show device page select the Profiles tab. Click the blue triangle next to profile you want to remove and then click Remove.

■

Create a task bundle with a Remove profile task and transfer it to the required devices or device groups.

14.10 Download profiles and policies

You can download profiles and policies that you have configured in the Sophos Mobile Control console. This is useful, for example, if you need to pass the defined settings on to Sophos Support.

1. On the menu sidebar, go to Profiles, policies and click a device platform.

The Profiles and policies page for the selected platform is displayed.

2. Click the name of the required profile or policy.

The Show profile or Show policy page is displayed.

3. Click Download.

The profile or policy is saved to your local computer as follows:

■ iOS profiles are saved as XML Plist files with extension

.mobileconfig

.

■

Android profiles are saved as XML files with extension

.smcprofile

.

■

Android and iOS policies are saved as JSON files.

74

administrator help

■

Windows Mobile policies are saved as XML files with extension

.windowsphoneconfig

.

■

Windows Desktop policies are saved as XML files with extension

.windowsdesktopconfig

.

14.11 Configurations for Android device profiles

With an Android device profile you configure various aspects of Android devices, like password policies, restrictions or Wi-Fi settings.

For information on how to create a device profile, see

Create profile or policy (page 69).

14.11.1 Password policies configuration (Android device profile)

With the Password policies configuration you define password rules for devices.

Note: The settings supported may depend on the version of the operating system or on other device features. The scope is indicated by a blue label in Sophos Mobile Control.

Password type

When you select the Password policies configuration, the Password type list is displayed. In this list, select the type of password you want to define:

Setting/Field

Any

Alphabetic

PIN

Alphanumeric

Complex

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock. No additional restrictions are imposed.

Users must set a Passwordscreen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length. See the following table.

Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.

75

Sophos Mobile Control

If you select Alphabetic, PIN, Alphanumeric or Complex, the following fields are displayed:

Setting/Field Description

Minimum password length

Idle time before password prompt

The minimum number of characters a password must contain.

The time (in seconds) after the device will be locked if it has not been used. The device can be unlocked by entering the password.

Maximum password age in days

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

Maximum number of failed attempts until device wipe

The maximum number of failed attempts to enter the correct password before the device is wiped.

Minimum history length

The number of old passwords that are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password. Value range: 1 to 5 or none.

If you select Complex, the following additional fields are displayed:

Setting/Field Description

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

Minimum number of non-alphabetic characters

The minimum number of non-alphabetic characters

(for example & or !) a password must contain.

Minimum number of numerals

The minimum number of numerals a password must contain.

76

administrator help

Setting/Field

Minimum number of special characters

Description

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

14.11.2 Restrictions configuration (Android device profile)

With the Restrictions configuration you define restrictions for devices.

Security

Setting/Field

Force encryption

Force SD card encryption

Allow fast encryption

Allow factory reset

Allow developer options

Allow safe mode

Allow USB debugging

Allow firmware recovery

Description

Users must encrypt their devices.

When the profile is installed onto a device, the user must encrypt the SD card.

Note: For some device types, users can choose to cancel the encryption. They will be reminded again on the next SD card mount.

If the check box is cleared, the fast encryption options in the device settings are unavailable.

If the check box is cleared, users cannot reset their devices to factory state.

If the check box is cleared, users cannot change the developer options.

If the check box is cleared, users cannot boot the device in safe mode.

If the check box is cleared, USB debugging is turned off.

Note: For Sony devices with Enterprise API version 9 or above, clearing the Allow USB debugging checkbox makes all developer options unavailable.

If the check box is cleared, all types of firmware updates

(like over-the-air, download etc.) are turned off.

77

Sophos Mobile Control

Setting/Field

Allow backup

Allow settings changes

Allow clipboard

Enable shared clipboard

Allow screen capture

Allow mock GPS locations

Allow over-the-air firmware updates

Allow audio recording

Allow video recording

Allow Activation Lock

Allow S Beam

Allow S Voice

Description

If the check box is cleared, users cannot create system backups. Google backup is turned off. Other backup methods (for example Sophos Mobile Control backups) remain available.

If the check box is cleared, users cannot change device settings. Depending on individual devices the settings icon is removed.

If the check box is cleared, users cannot copy any contents to the clipboard.

Note: This setting applies to devices with Android 4.2.2 or higher.

Allows users to copy clipboard content between apps.

If the check box is cleared, each app has an individual clipboard.

This setting is only available if you select Allow clipboard.

If the check box is cleared, users cannot take a screenshot of the display.

If the check box is cleared, users cannot select a mock location app in the Android developer options.

If the check box is cleared, over-the-air firmware updates are turned off.

If the check box is cleared, users cannot perform audio recording.

If the check box is cleared, users cannot record videos. They can take pictures and stream videos.

If the check box is cleared, the Activation Lock options in the device settings are unavailable.

If the check box is cleared, the Samsung S Beam app is unavailable.

If the check box is cleared, the Samsung S Voice app is unavailable.

78

administrator help

Setting/Field

Allow “Share via”

Description

If the check box is cleared, the Share via feature is turned off.

Accounts

Setting/Field

Allow multiple user accounts

Allow addition of new email accounts

Description

If the check box is cleared, multi-user support is turned off.

Users or other apps cannot create additional user accounts.

If the check box is cleared, users cannot add email accounts.

This does not affect the account creation through a device profile.

Allow removal of the Google account

Allow auto-sync for Google accounts

If the check box is cleared, users cannot remove the Google account from the device.

If the check box is cleared, Google accounts are not synchronized automatically. Users are still able to perform a manual sync from inside some apps like Gmail.

Network and communication

Setting/Field

Allow airplane mode

Allow sync while roaming

Allow emergency calls only

Force manual sync during roaming

Description

If the check box is cleared, users cannot enable airplane mode.

If the check box is cleared, synchronization while roaming is turned off.

Only emergency calls are allowed. All other calls will be blocked.

Automatic data synchronization is turned off when the device is roaming. This affects all configured accounts, such as

Google or Exchange.

79

Sophos Mobile Control

Setting/Field

Force mobile data connection

Allow SMS

Allow mobile data connection while roaming

Allow voice calls while roaming

Allow user mobile data limit

Allow VPN

Allow Wi-Fi Direct

Allow Android Beam

Allow Miracast policy

Allow Bluetooth

Allow NFC

Allow Wi-Fi

Description

Users cannot turn off cellular data.

If the check box is cleared, users cannot send text messages.

If the check box is cleared, mobile data connections while roaming are turned off.

If the check box is cleared, voice calls while roaming are turned off.

If the check box is cleared, users cannot set a mobile data limit.

If the check box is cleared, users cannot use VPN connections.

If the check box is cleared, data transfer through Wi-Fi Direct is turned off.

If the check box is cleared, data transfer through Android

Beam is turned off. This includes the Samsung S Beam app.

If the check box is cleared, data transfer through Miracast is turned off.

If the check box is cleared, Bluetooth is turned off.

If the check box is cleared, NFC (near field communication) is turned off.

If the check box is cleared, Wi-Fi is turned off.

80

administrator help

Tethering

Setting/Field

Allow tethering

Allow Wi-Fi tethering

Allow USB tethering

Allow Bluetooth tethering

Allow configuring Wi-Fi tethering

Hardware

Setting/Field

Allow camera

Force GPS for location queries

Allow SD card

Allow moving apps to the SD card

Allow writing to the SD card

Allow microphone

Allow USB

Description

If the check box is cleared, all tethering is turned off. This includes tethering over Wi-Fi, USB and Bluetooth.

Note: If the check box is cleared, the settings Allow Wi-Fi

tethering, Allow USB tethering and Allow Bluetooth

tethering have no effect.

If the check box is cleared, Wi-Fi tethering (Wi-Fi hotspot) is turned off.

If the check box is cleared, USB tethering is turned off.

If the check box is cleared, Bluetooth tethering is turned off.

The user can configure the settings of the Wi-Fi hotspot.

Description

If the check box is cleared, the camera is unavailable.

GPS information is used for device location.

If the check box is cleared, SD cards cannot be used in devices.

If the check box is cleared, users cannot move apps from the internal storage to the SD card.

If the check box is cleared, it is not possible to write to unencrypted SD cards.

If the check box is cleared, the microphone is unavailable.

The USB mass storage mode and the USB media player are available on the device.

81

Sophos Mobile Control

Setting/Field

Allow USB media player

Description

If the check box is cleared, the Media Transfer Protocol

(MTP) is unavailable. Because Android uses MTP for USB file transfer, any file transfer over USB is blocked.

Applications

Setting/Field

Allow app install

Allow app uninstall

Allow unsigned app install

Allow Play Store

Allow apps from unknown sources

Allow native browser

Allow app crash reports

Allow wallpaper change

Allow camera on lock screen

Allow widgets on lock screen

Description

If the check box is cleared, users cannot install apps.

If the check box is cleared, users cannot uninstall apps.

If the check box is cleared, users can only install signed

APK files.

If the check box is cleared, the Google Play Store app is unavailable.

Note: This setting applies to devices with Android 4.2.2 or higher.

If the check box is cleared, users can only install apps through the Google Play Store app.

If the check box is cleared, the native browser is unavailable.

Third-party browser apps are not affected.

If the check box is cleared, apps cannot send crash reports.

If the check box is cleared, users cannot change the wallpaper.

If the check box is cleared, the camera is unavailable when the screen is locked.

If the check box is cleared, widgets are unavailable when the screen is locked.

82

administrator help

Setting/Field Description

Allow Knox contact info for personal calls

By default, a Samsung Knox device displays contact information when the user receives a call from a Knox contact while in personal mode.

If the check box is cleared, Knox contact information is not displayed in personal mode.

Allow autofill in browser

Allow cookies in browser

Allow JavaScript in browser

Allow pop-ups in browser

The user can enable autofill in the settings of the native

Android browser. If enabled, web pages can provide suggestions when the user is filling in form data.

If the check box is cleared, autofill is turned off and the browser setting is unavailable.

The user can enable cookies in the settings of the native

Android browser. If enabled, web pages can store cookies on the device.

If the check box is cleared, cookies are turned off and the browser setting is unavailable.

The user can enable JavaScript in the settings of the native

Android browser. If enabled, web pages can execute

JavaScript code on the device.

If the check box is cleared, JavaScript is turned off and the browser setting is unavailable.

The user can enable pop-ups in the settings of the native

Android browser. If enabled, web pages can open new browser windows.

If the check box is cleared, pop-ups are turned off and the browser setting is unavailable.

Allow changing date and time settings

Allowed apps / Forbidden apps

The user can change the date and time settings.

You can configure either Allowed apps or Forbidden apps.

Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.

App installations initiated by the Sophos Mobile Control server are not restricted by this setting.

For information on creating app groups, see

App groups

(page 184).

83

Sophos Mobile Control

14.11.3 Knox Premium restrictions configuration (Android device profile)

With the Knox Premium restrictions configuration you define restrictions for Samsung Knox devices. These restrictions apply to the device, not to the Knox container.

Option

Allow firmware auto update options

Enable ODE Trusted Boot verification

Description

The device automatically checks for firmware updates. Users cannot change this in the device settings.

The device decrypts the data partition on boot only if the binary and the kernel are official, i.e. if the device is not rooted.

If the check box is cleared, the device always decrypts the data partition on boot.

Prevent installation of another administrator app

The installation of apps that require device administrator privileges is prevented. This does not affect apps that are installed by Sophos Mobile

Control.

Prevent activation of another administration app

The activation of device administrator privileges for apps is prevented.

Allow Common Criteria mode

The Common Criteria mode (CC mode) of the device is turned on, ensuring that the device meets the security requirements stated by the Mobile Device

Fundamentals Protection Profile (MDFPP).

Note: CC mode is only used if the following requirements are met:

Device encryption is turned on.

Fast encryption is turned off.

External storage encryption is turned on.

A maximum number of failed login attempts until device wipe is set.

Certificate revocation is turned on.

Password history is turned off.

14.11.4 App Protection configuration (Android device profile)

With the App Protection configuration you define password requirements for protecting apps.

With App Protection in use, users must define a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.

84

administrator help

If App Protection is active on a device, the command Reset App Protection password is available in the Actions menu of the Show device page. The user can also reset the App Protection password in the Self Service Portal.

Setting/Field

Password complexity

Grace period in minutes

App group

Description

The minimum complexity requirements for the password to be defined by users, for example 6 char

password.

After the grace period has expired, protected apps can only be unlocked by entering a password.

Select the app group containing the apps that are password protected.

For creating app groups, see

App groups (page 184).

14.11.5 App Control configuration (Android device profile)

With the App Control configuration you define apps that users are not allowed to start. For example, you can use this to block apps that have been pre-installed by the device manufacturer and cannot be uninstalled.

Setting/Field

App group

Description

Select the app group containing the blocked apps.

For information on creating app groups, see App groups (page 184).

14.11.6 Exchange ActiveSync configuration (Android device profile)

With the Exchange ActiveSync configuration you define user settings for your Microsoft Exchange

Server.

Setting/Field

Account name

Exchange ActiveSync host

Description

The account name.

The address of the Microsoft Exchange Server.

Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.

85

Sophos Mobile Control

Setting/Field

Domain

User

Email address

Sender

Password

Synchronization period

Synchronization interval

SSL

Default account

Allow all certificates

Client certificate

Allow forwarding emails

Allow use of HTML format

Maximum attachment size in MB

86

Description

The domain for this account.

The user for this account.

If you enter the variable

%_USERNAME_%

, the server replaces it with the actual user name.

The email address of the account.

If you enter the variable

%_EMAILADDRESS_%

, the server replaces it with the actual email address.

A sender name for this account.

If you enter the variable

%_EMAILADDRESS_%

, the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period emails are synchronized for.

If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

All communication is sent through SSL (Secure Socket

Layer).

We recommend that you select this check box.

The account is used as the default email account.

Allow all certificates in transfer processes from the email server.

The client certificate for the connection to ActiveSync.

Allow forwarding of emails.

Allow the use of HTML format in emails.

The maximum size of a single email message (1, 3,

5, 10, Unlimited).

administrator help

Setting/Field

Synchronize content types

Description

The content types to be synchronized.

Note:

For Sony devices with Enterprise API version 6.x or below, it is important that the Exchange

ActiveSync account information matches the user that is assigned to the device.

On these devices, the SMC client is not able to send the ActiveSync ID to the SMC server. When a device contacts the SMC EAS proxy for the first time, the ActiveSync ID that the email client sends is not known to Sophos Mobile Control. To verify the account details, the SMC EAS proxy searches for a device with an unknown ActiveSync ID and an assigned user that matches the user information supplied by the email client. If such a device is found, the ActiveSync ID is assigned to that device and the email request is passed on to the Exchange server. Otherwise, the request is rejected.

For details, see Sophos knowledgebase article 121360 .

14.11.7 Wi-Fi configuration (Android device profile)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Security type

Description

The ID of the Wi-Fi network.

The security type of the Wi-Fi network:

None

WEP

WPA/WPA2

EAP/PEAP

EAP/TLS

EAP/TTLS

If you select WEP or WPA/WPA2, a Password field is displayed. Enter the relevant password.

If you select one of the EAP settings, the fields

Identity, Anonymous Identity and Password are displayed. Enter the required EAP information.

If you select EAP/PEAP or EAP/TTLS, the field

Phase 2 authorization is displayed in addition.

Select the type of authorization:

PAP

CHAP

87

Sophos Mobile Control

Setting/Field Description

MSCHAP

MSCHAPv2

14.11.8 VPN configuration (Android device profile)

With the VPN configuration you define VPN settings for network connections.

Setting/Field

Connection name

Server

Connection type

Description

The name of the connection shown on the device.

The host name or the IP address of the server.

The type of the VPN connection:

L2TP/IPsec (PSK)

If you select this type, the fields User, Password and L2TP/IPsec (PSK) are displayed. Enter the user and password. In the L2TP/IPsec (PSK) field, enter the pre-shared key for authentication.

L2TP/IPsec (Certificate)

If you select this type, the fields Client certificate, Root certificate, User and

Password are displayed. In the fields Client certificate and Root certificate, select the relevant certificates. In addition, enter the User and the relevant

Password.

14.11.9 Root certificate configuration (Android device profile)

With the Root certificate configuration you upload a root certificate to devices.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

14.11.10 Client certificate configuration (Android device profile)

With the Client certificate configuration you install a client certificate onto Android devices.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.

88

administrator help

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

14.11.11 SCEP configuration (Android device profile)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Note: You must first add a Root certificate configuration to upload the CA certificate of the

SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Alias name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

NT user login name

Description

The web address of the Certificate Authority server.

Use the variable

%_SCEPPROXYURL_%

to refer to the server URL that is configured on the SCEP tab of the System setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the

CN=

prefix.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.

For example:

Enter

CN=%_USERNAME_%

to specify a user.

Enter

CN=%_DEVPROP(serial_number)_%

to specify a device.

For information on available placeholders, see

Placeholders in profiles and policies (page 72).

Optionally, configure a Subject Alternative Name

(SAN). Select one of the available SAN types.

If you have selected a SAN type, enter the SAN value.

89

Sophos Mobile Control

Setting/Field

Challenge

Root certificate

Key size

Use as digital signature

Use for encryption

Description

The web address to obtain a challenge password from the SCEP server.

Use the variable

%_CACHALLENGE_%

to refer to the challenge URL that is configured on the SCEP tab of the System setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root

certificate configurations of the current profile.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

14.11.12 Access Point Name configuration (Android device profile)

With the Access Point Name configuration you specify an Access Point Name (APN) configuration for mobile devices. APN configurations define how devices connect to a mobile network.

Important: We recommend that you ask your carrier for the required settings. If you select Use

as default APN and the settings are not correct, the device cannot access data through cellular networks.

Note: With the exception of the APN field, all settings are optional and should only be specified if required by your mobile network carrier.

Setting/Field

APN

User-friendly name

Description

The APN that the device quotes when it opens a connection with the carrier.

This must match an APN that the carrier accepts.

Otherwise, the connection cannot be established.

An optional name that is displayed on the device in addition to the APN.

90

administrator help

Setting/Field

Proxy server and port

User name, User password

Server

MMSC

MMS proxy server and port

Mobile Country Code (MCC), Mobile Network

Code (MNC)

Description

The address and port of the HTTP server that is used for web traffic.

A user name and password for connecting to the

APN.

The WAP Gateway Server.

The Multimedia Messaging Service Center (MMSC).

The address and port of a HTTP server that is used for communication with the MMSC.

MCC and MNC for specifying the carrier.

The APN is only used for this carrier.

Authentication type

APN type

Bearer

Protocol

Roaming protocol

Use as default APN

The authentication method for PPP connections.

The types of data connection that this APN is used for.

To use the APN for all data types, enter

*

or leave the field empty.

The Radio Access Technology (RAT) that the carrier uses.

The network protocol that is supported by the carrier.

The network protocol that is supported by the carrier when in roaming mode.

If selected, devices will use this APN as default.

An error is raised when you try to select this option in more than one Access Point Name configuration.

14.11.13 Kiosk mode configuration (Android device profile)

With the Kiosk mode configuration you define restrictions for devices to put them into a kiosk mode.

Click Select source and then do one of the following to specify an app that is started when the profile is transferred to a device:

■

Select Custom and enter an app identifier.

91

Sophos Mobile Control

■

■

Select App list and then select an app from the App identifier list. The list contains all apps

that you have configured on the Apps page. See Add app

(page 174).

Select None to configure kiosk mode without specifying an app. The kiosk mode restrictions are applied to the device, but no app is started.

Under Options, deselect hardware and software features you want to disable in kiosk mode.

When the profile is transferred to a device, the app that you specified is started. However, if you have not turn off any of the available hardware or software features, the user will be able to leave the app and use the device as normal. To set the device into a true kiosk mode, you must clear at least the Allow Home button and Allow task manager checkboxes.

Note:

■

■

■

The app that you specify must be installed on the device. If it is not, the transfer tasks will remain in state Incomplete until the app is installed. To install the app, create a task bundle with an Install app task, for example, and transfer it to your devices.

If you want to specify an app for Samsung Knox devices, make sure it is a launcher app. This type of app provides an alternative desktop for Android.

For Sony devices with Enterprise API version 9 or above, if you clear any of the Allow volume

up, Allow volume down or Allow volume mute checkboxes, all volume buttons of the device are disabled.

14.12 Configurations for Android for Work policies

With an Android for Work policy you configure settings that are related to the work profile of a device.

For information on how to create an Android for Work policy, see

Create profile or policy (page

69).

14.12.1 Password policies configuration (Android for Work policy)

With the Password policies configuration you define password rules for the work profile.

Note: The settings supported may depend on the version of the operating system or on other device features. The scope is indicated by a blue label in Sophos Mobile Control.

Password type

When you select the Password policies configuration, the Password type list is displayed. In this list, select the type of password you want to define:

Setting/Field

Any

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock. No additional restrictions are imposed.

92

administrator help

Setting/Field

Alphabetic

PIN

Alphanumeric

Complex

Description

Users must set a Passwordscreen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length. See the following table.

Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.

If you select Alphabetic, PIN, Alphanumeric or Complex, the following fields are displayed:

Setting/Field Description

Minimum password length

Idle time before password prompt

Maximum password age in days

The minimum number of characters a password must contain.

The time (in seconds) after the device will be locked if it has not been used. The device can be unlocked by entering the password.

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

Maximum number of failed attempts until device wipe

The maximum number of failed attempts to enter the correct password before the device is wiped.

Minimum history length

The number of old passwords that are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password. Value range: 1 to 5 or none.

If you select Complex, the following additional fields are displayed:

93

Sophos Mobile Control

Setting/Field Description

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

Minimum number of non-alphabetic characters

The minimum number of non-alphabetic characters

(for example & or !) a password must contain.

Minimum number of numerals

The minimum number of numerals a password must contain.

Minimum number of special characters

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

14.12.2 Restrictions configuration (Android for Work policy)

With the Restrictions configuration you configure restrictions and related settings for Android for

Work.

Security

Setting/Field Description

Allow screen capture

Allow user to configure credentials

Users can capture the screen content of work apps.

Users can install or remove certificates in the work profile.

Allow work clipboard in personal apps

Users can copy text from a work app and paste it into a personal app.

Pasting clipboard text from a personal app into a work app is always possible.

Allow Smart Lock

Users can turn on the Android Smart Lock feature that automatically unlocks the device in certain situations.

94

administrator help

Setting/Field

Allow location sharing

Description

Work apps can access the device’s location features.

If the check box is cleared, work apps cannot access the device’s location features, even if the user has turned location sharing on.

Allow opening web links in personal apps

Web links that the user taps in a work app can be opened by a personal browser app.

Allow debugging

Allow unlocking device by fingerprint

Users can turn on the debugging features in the Android developer options.

Users can use the fingerprint sensor to unlock the device.

Accounts

Setting/Field

Allow managing accounts

Description

Users can add or remove accounts from the work profile, for example app accounts.

Users cannot remove the Google account from the work profile.

Network and communication

Setting/Field

Allow Android Beam

Allow VPN

Description

Users can send data from work apps through Android Beam

(data transfer through NFC).

Users can use VPN connections for work apps.

95

Sophos Mobile Control

Hardware

Setting/Field

Allow camera

Applications

Description

Work apps can access the camera.

Setting/Field

Allow app uninstall

Allow installing apps from unknown sources

Allow managing apps

Short message

Long message

Description

Users can uninstall work apps.

If the check box is cleared, users can only install work apps from the Google Play Store, not from unknown sources or through Android Debug Bridge (ADB).

If the check box is cleared, users cannot perform the following tasks for work apps:

Uninstall apps

Disable apps

Stop apps

Clear app cache

Clear app data

Clear setting Open by default

A company-specific support message that is displayed to the user when functionality has been turned off.

Note: If you enter more than 200 characters, the message may be truncated.

Additional text to complement the short message. The text is displayed when the user taps More details in screens that display the short message.

Note: This text is also displayed on the Android Device

administrator screen for the Sophos Mobile Control app.

96

administrator help

14.12.3 App Protection configuration (Android for Work policy)

With the App Protection configuration you define password requirements for protecting work apps, i.e. the apps that are installed in the work profile.

With App Protection in use, users must define a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.

If App Protection is active on a device, the command Reset App Protection password is available in the Actions menu of the Show device page. The user can also reset the App Protection password in the Self Service Portal.

Setting/Field

Password complexity

Grace period in minutes

App group

Description

The minimum complexity requirements for the password to be defined by users, for example 6 char

password.

After the grace period has expired, protected apps can only be unlocked by entering a password.

Select the app group containing the apps that are password protected.

For creating app groups, see

App groups (page 184).

14.12.4 App Control configuration (Android for Work policy)

With the App Control configuration you define work apps that users are not allowed to start.

Setting/Field

App group

Description

Select the app group containing the blocked apps.

For information on creating app groups, see App groups (page 184).

97

Sophos Mobile Control

14.12.5 App permissions configuration (Android for Work policy)

With the App permissions configuration you configure what happens when a work app requests a permission at runtime.

Setting/Field

Default permission handling

App-specific runtime permissions

Description

The default response for future runtime permission requests of work apps:

Prompt: Apps prompt the user to grant a permission.

Auto-accept: All runtime permission requests are automatically granted.

Auto-deny: All runtime permission requests are automatically denied.

The user cannot change the permissions later.

You can grant or deny certain runtime permissions for individual apps. Click Add and then configure the settings for an app:

In the App identifier field, enter the internal identifier of the app.

For each runtime permission, select the desired grant state:

Selectable: The user can grant or deny the permission.

Granted: Permission is granted and cannot be denied by the user.

Denied: Permission is denied and cannot be granted by the user.

14.12.6 Exchange ActiveSync configuration (Android for Work policy)

With the Exchange ActiveSync configuration you define user settings for your Microsoft Exchange

Server. These settings are applied to the Gmail app in the work profile.

Setting/Field

Account name

Exchange ActiveSync host

Description

The account name.

The address of the Microsoft Exchange Server.

Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.

98

administrator help

Setting/Field

Domain

User

Email address

Sender

Password

Synchronization period

SSL

Allow all certificates

Client certificate

Description

The domain for this account.

The user for this account.

If you enter the variable

%_USERNAME_%

, the server replaces it with the actual user name.

The email address of the account.

If you enter the variable

%_EMAILADDRESS_%

, the server replaces it with the actual email address.

A sender name for this account.

If you enter the variable

%_EMAILADDRESS_%

, the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period emails are synchronized for.

If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.

All communication is sent through SSL (Secure Socket

Layer).

We recommend that you select this check box.

Allow all certificates in transfer processes from the email server.

The client certificate for the connection to ActiveSync.

14.12.7 Root certificate configuration (Android for Work policy)

With the Root certificate configuration you install a root certificate onto devices. This certificate will be available to work apps, i.e. to apps that are installed in the work profile.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

99

Sophos Mobile Control

14.12.8 Client certificate configuration (Android for Work policy)

With the Client certificate configuration you install a client certificate onto Android devices. This certificate will be available to work apps, i.e. to apps that are installed in the work profile.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

14.12.9 SCEP configuration (Android for Work policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP). These certificates will be available to work apps, i.e. to apps that are installed in the work profile.

Note: You must first add a Root certificate configuration to upload the CA certificate of the

SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Alias name

Subject

Description

The web address of the Certificate Authority server.

Use the variable

%_SCEPPROXYURL_%

to refer to the server URL that is configured on the SCEP tab of the System setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the

CN=

prefix.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.

For example:

Enter

CN=%_USERNAME_%

to specify a user.

Enter

CN=%_DEVPROP(serial_number)_%

to specify a device.

For information on available placeholders, see

Placeholders in profiles and policies (page 72).

100

administrator help

Setting/Field

Type of Subject Alternative Name

Value of Subject Alternative Name

NT user login name

Challenge

Description

Optionally, configure a Subject Alternative Name

(SAN). Select one of the available SAN types.

If you have selected a SAN type, enter the SAN value.

Root certificate

Key size

Use as digital signature

Use for encryption

The web address to obtain a challenge password from the SCEP server.

Use the variable

%_CACHALLENGE_%

to refer to the challenge URL that is configured on the SCEP tab of the System setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root

certificate configurations of the current profile.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

14.13 Configurations for Sophos container policies for Android

With a Sophos container policy you configure settings that are related to the Sophos container apps Sophos Secure Email and Sophos Secure Workspace.

For information on how to create a Sophos container policy, see

Create profile or policy (page

69).

101

Sophos Mobile Control

14.13.1 General configuration (Android Sophos container policy)

With the General configuration you define settings that apply to all Sophos container apps, if applicable.

Setting/Field

Enable Sophos container password

Password complexity

Password age in days

Failed logins until lock

Allow fingerprint

Grace period in minutes

Description

Users must enter an additional password to be able to start a Sophos container app. The password has to be defined when the first container app is started after the configuration has been applied. This password applies to all container apps.

The required minimum complexity of the Sophos container password. More secure passwords are always allowed. Passwords (a mix of numeric and alphanumeric characters) are always seen as more secure than PINs (numeric characters only).

Any: Sophos container passwords do not have restrictions.

4 digit PIN

6 digit PIN

4 char password

6 char password

8 char password

10 char password

The number of days that a password can be used before users are prompted to change it.

The number of failed login attempts that are tolerated before the container apps are locked. Once they are locked an administrator needs to unlock the apps or, if allowed, users can use the Self Service Portal to do so.

Users can use their fingerprint to unlock the app.

The period of time within which no Sophos container password must be entered when a container app comes to the foreground again.

The grace period applies to all container apps. You can switch between the apps during the grace period without entering a password.

You can select 1, 2, 5, 10, 15 minutes.

102

administrator help

Setting/Field

Lock on device lock

Last server connect

Offline starts without server connection

Description

When the device is locked, the Sophos container is locked as well.

If the check box is cleared, the container is locked only after the grace period has expired.

The period of time within users can use a Sophos container app without a connection to the Sophos

Mobile Control server.

When a Sophos container app becomes active and does not have contact with the server within the defined period of time, a lock screen will be displayed. Users can only unlock the app by tapping

Retry on the lock screen. The app will then try to connect to the server. If the connection can be established, the app will be unlocked. If not, access will be denied.

On access: Server connection is always required and the app is locked when the server cannot be reached.

1 hour: Server connection is required when the app becomes active one hour or more after the last successful server connection.

3 hours

6 hours

12 hours

1 day

3 days

1 week

none: No regular contact is required.

In this field you define how often users can start one of the Sophos container apps without a server connection.

Note: This setting requires the Sophos container password feature to be turned on.

A counter is incremented whenever users enter the

Sophos container password. If the counter exceeds the defined number, the same lock screen as for the

Last server connect setting will be displayed. The counter will be reset if a connection to the Sophos

Mobile Control server is established.

Unlimited: No server connection is required.

0: Starting the app without a server connection is not possible.

103

Sophos Mobile Control

Setting/Field Description

5

10

20

1: After one start of the app, a successful server connection is necessary.

3

Root allowed

Container apps are allowed to run on rooted devices.

App usage constraints

Here you can define constraints on using the Sophos container apps. Click Add to enter constraints.

Geo-fencing

Time-fencing

Wi-Fi fencing

Lets you add latitude and longitude and a radius within which the Sophos container apps can be used.

Lets you specify a start and end time within which the Sophos container apps can be used. Days of the week on which the apps can be used can be specified as well.

Lets you specify Wi-Fi networks to which the device must be connected in order to use the Sophos container apps.

The device must actually be connected to one of the listed networks. Being able to see a particular network in the list of available networks is not enough.

Important: We recommend that you do not rely on

Wi-Fi fencing as the only security mechanism because Wi-Fi names can be spoofed very easily.

104

administrator help

14.13.2 Corporate Email configuration (Android Sophos container policy)

With the Corporate Email configuration you define user settings for your Microsoft Exchange

Server. These settings are applied to the Sophos Secure Email app if it is installed in the Sophos container.

Setting/Field

Exchange ActiveSync host

User

Email address

Domain

Support contact email

Export contacts to device

Show notification settings

Description

The address of the Microsoft Exchange Server.

Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.

The user for this account.

If you enter the variable

%_USERNAME_%

, the server replaces it with the actual user name.

The email address of the account.

If you enter the variable

%_EMAILADDRESS_%

, the server replaces it with the actual email address.

The domain for this account.

The email address that will be used as the "Contact

Support" email address.

Users are allowed to export the exchange contacts with a phone number to the local device contacts.

Sophos Secure Email will keep them synchronized.

Only name and telephone number will be exported to enable the user to identify company contacts in an incoming call. Note that even after a remote reset of the Sophos Secure Email app, the information will still be available in the local storage of the device.

This setting controls the display of email notifications and event reminders in Sophos Secure Email.

When you select the check box:

The user can turn email notifications on or off.

Event reminders are turned on.

When you clear the check box:

Email notifications and event reminders are turned off.

105

Sophos Mobile Control

Setting/Field

Open attachments

Add

Description

Note: If you think notifications displayed on a lost or stolen device is a security risk, you may want to clear this check box.

If you select the check box, Save and View buttons are displayed below the attachment. Save passes the attachment on to Sophos Secure Workspace,

View opens the file in Sophos Secure Email. If

Sophos Secure Email cannot open the file, users can select where to pass the file on to.

If you clear the check box, attachment cannot be opened or passed on to other apps.

Click Add to configure settings that a future version of the Sophos Secure Email app might require.

Important: Only configure these settings if instructed by the Sophos support team.

14.13.3 Corporate Documents configuration (Android Sophos container policy)

With the Corporate Documents configuration you define settings for the Corporate Documents feature of the Sophos Secure Workspace app.

Configure storage providers

For each storage provider you can define the following settings separately:

Setting/Field

Enable

Offline

Open in (encrypted)

Open in (unencrypted)

Clipboard

Description

The storage provider is available in the app.

Users are allowed to add files from the storage provider to the app's Favorites list for offline use.

Users can share encrypted files with other apps via

Open In.

Users can share unencrypted files with other apps via Open In.

Users can copy parts of a document and paste them into other apps.

106

administrator help

Enterprise provider settings

For WebDAV provider, also referred to as enterprise provider, you can centrally define server settings and login credentials. These cannot be changed by users.

Credential settings that you do not define centrally can be chosen by the users in the app's provider credential screens.

For example you can centrally define the server and user account to be used but you can leave the password field undefined. Users then would have to know the password when accessing the storage provider.

Setting/Field

Name

Server

User name

Password

Upload folder

Description

The name of the provider that is displayed in the

Sophos Secure Workspace app.

In this field, enter:

The URL of the root folder on the Corporate

Documents WebDAV server.

The URL of the root folder on the WebDAV server.

Use the following format: https://server.company.com

Only the https

protocol is supported.

The user name for the relevant server. You can also use the

%_USERNAME_%

variable.

The password for the relevant account.

The upload folder for the relevant account.

Other settings

Setting/Field

Enable Documents

Description

This turns on the Documents feature to securely distribute company documents.

107

Sophos Mobile Control

Setting/Field

Passphrase complexity

Description

The required minimum complexity of passphrases for encryption keys. More secure passphrases are always allowed.

You can select the following settings:

4 char password

6 char password

8 char password

10 char password

14.13.4 Corporate Browser configuration (Android Sophos container policy)

With the Corporate Browser configuration you define settings for the Corporate Browser feature of the Sophos Secure Workspace app.

The Corporate Browser allows you to securely access corporate intranet pages and other allowed pages. You can define domains and bookmarks within a domain.

Every bookmarks belongs to a certain domain. When you use Add bookmark to define a bookmark, the domain entry is created automatically if it does not exist.

Domain settings

Setting/Field

URL

Allow copy/paste

Allow open with

Allow save password

Description

The domain that you want to allow.

Users can copy and paste text from the Corporate

Browser to other apps.

Users can download attachments or pass them on to other apps.

Users can save their passwords in the Corporate

Browser.

108

administrator help

Bookmark settings

Setting/Field

Name

URL

Description

The name for the bookmark.

The web address for the bookmark.

14.13.5 Client certificate configuration (Android Sophos container policy)

With the Client certificate configuration you install a client certificate onto devices. This certificate will be available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the Sophos container.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

14.13.6 Root certificate configuration (Android Sophos container policy)

With the Root certificate configuration you upload a root certificate to devices. This certificate will be available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the Sophos container.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

14.13.7 SCEP configuration (Android Sophos container policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP). These certificates are available to the

Sophos Secure Workspace app if it is installed in the Sophos container.

Note: You must first add a Root certificate configuration to upload the CA certificate of the

SCEP server before you can add a SCEP configuration.

109

Sophos Mobile Control

Setting/Field

URL

Alias name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

NT user login name

Challenge

Root certificate

Description

The web address of the Certificate Authority server.

Use the variable

%_SCEPPROXYURL_%

to refer to the server URL that is configured on the SCEP tab of the System setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the

CN=

prefix.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.

For example:

Enter

CN=%_USERNAME_%

to specify a user.

Enter

CN=%_DEVPROP(serial_number)_%

to specify a device.

For information on available placeholders, see

Placeholders in profiles and policies (page 72).

Optionally, configure a Subject Alternative Name

(SAN). Select one of the available SAN types.

If you have selected a SAN type, enter the SAN value.

The web address to obtain a challenge password from the SCEP server.

Use the variable

%_CACHALLENGE_%

to refer to the challenge URL that is configured on the SCEP tab of the System setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root

certificate configurations of the current profile.

110

administrator help

Setting/Field

Key size

Use as digital signature

Use for encryption

Description

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

14.14 Configurations for Mobile Security policies

With a Mobile Security policy you configure settings that are related to the Sophos Mobile Security app.

For detailed information on Mobile Security policies, see these sections:

Configure antivirus settings for Sophos Mobile Security

(page 205)

Configure web filtering settings for Sophos Mobile Security

(page 207)

14.15 Configurations for Knox container profiles

With a Knox container profile you configure settings that are related to the Knox container of

Samsung devices.

For information on how to create a Knox container profile, see Create profile or policy (page 69).

14.15.1 Password policies configuration (Knox container profile)

Password type

When you select the Password policies configuration, the Password type list is displayed. In this list, select the type of password you want to define:

Setting/Field

Any

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock. No additional restrictions are imposed.

111

Sophos Mobile Control

Setting/Field

Alphabetic

PIN

Alphanumeric

Complex

Description

Users must set a Passwordscreen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length. See the following table.

Users must set a Passwordscreen lock. The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.

If you select Alphabetic, PIN, Alphanumeric or Complex, the following fields are displayed:

Setting/Field Description

Minimum password length

Idle time before password prompt

Maximum password age in days

The minimum number of characters a password must contain.

The time (in seconds) after the device will be locked if it has not been used. The device can be unlocked by entering the password.

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

Maximum number of failed attempts until device wipe

The maximum number of failed attempts to enter the correct password before the device is wiped.

Minimum history length

The number of old passwords that are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password. Value range: 1 to 5 or none.

If you select Complex, the following additional fields are displayed:

112

administrator help

Setting/Field Description

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

Minimum number of non-alphabetic characters

The minimum number of non-alphabetic characters

(for example & or !) a password must contain.

Minimum number of numerals

The minimum number of numerals a password must contain.

Minimum number of special characters

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

Biometric authentication

Setting/Field

Allow fingerprint authentication

Allow iris authentication

Description

If supported by the device, the user can use fingerprint authentication to unlock the Knox container.

If supported by the device, the user can use iris authentication to unlock the Knox container.

14.15.2 Restrictions configuration (Knox container profile)

Setting/Field

Allow screen capture

Allow camera

Description

Users can capture the screen content of apps inside the

Samsung Knox container.

Apps inside the Samsung Knox container can access the camera.

113

Sophos Mobile Control

Setting/Field

Allow clipboard

Allow "Share via"

Allow microphone

Enforce the use of the secure keypad

Allow addition of new email accounts

Allow data export

Allow copying files into the container

Allowed apps / Forbidden apps

Description

Users can copy any contents to the clipboard.

The Share via feature that certain apps use is turned on.

Apps inside the Samsung Knox container can access the microphone.

Users must use the secure keypad.

Users can add email accounts beyond the accounts that are configured by a Sophos Mobile Control profile.

Private apps can access data from within the Samsung Knox container.

Private files can be copied or moved into the Samsung Knox container.

You can configure either Allowed apps or Forbidden apps.

Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.

App installations initiated by the Sophos Mobile Control server are not restricted by this setting.

For information on creating app groups, see

App groups

(page 184).

14.15.3 Exchange ActiveSync configuration (Knox container profile)

Setting/Field

Account name

Exchange ActiveSync host

Domain

Description

The account name.

The address of the Microsoft Exchange Server.

Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.

The domain for this account.

114

Setting/Field

User

Email address

Sender

Password

Synchronization period

Synchronization interval

SSL

Default account

Allow all certificates

Allow forwarding emails

Allow use of HTML format

Maximum attachment size in MB

Synchronize content types

administrator help

Description

The user for this account.

If you enter the variable

%_USERNAME_%

, the server replaces it with the actual user name.

The email address of the account.

If you enter the variable

%_EMAILADDRESS_%

, the server replaces it with the actual email address.

A sender name for this account.

If you enter the variable

%_EMAILADDRESS_%

, the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period emails are synchronized for.

If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

All communication is sent through SSL (Secure Socket

Layer).

We recommend that you select this check box.

The account is used as the default email account.

Allow all certificates in transfer processes from the email server.

Allow forwarding of emails.

Allow the use of HTML format in emails.

The maximum size of a single email message (1, 3,

5, 10, Unlimited).

The content types to be synchronized.

115

Sophos Mobile Control

14.16 Configurations for iOS device profiles

With an iOS device profile you configure various aspects of iOS devices, like password policies, restrictions or Wi-Fi settings.

For information on how to create a device profile, see

Create profile or policy (page 69).

14.16.1 Password policies configuration (iOS device profile)

With the Password policies configuration you define password rules for devices.

Setting/Field

Allow simple value

Require alphanumeric value

Minimum password length

Minimum number of complex characters

Maximum password age in days

Maximum Auto-Lock (in minutes)

Password history

Maximum grace period for device lock

Description

Users are allowed to use sequential or repeated characters in their password, for example

1111

or

abcde

.

Passwords must contain at least one letter or number.

Specifies the minimum number of characters a password must contain.

Specifies the minimum number of non-alphanumeric characters (for example & or !) a password must contain.

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

In this field, you can specify the maximum value the user is allowed to configure on the device. Auto-Lock specifies how soon (in minutes) the device will be locked if it has not been used.

In this field, you can specify how many old passwords are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password. Value range: 1 to 50 or 0 (no password history).

In this field, you can specify the maximum value the user is allowed to configure on the device. The grace period for device lock specifies for how long the device can be unlocked after a lock without a password prompt. If you select None, the user can select any of the intervals available. If you select

116

administrator help

Setting/Field Description

Immediately, users must enter a password every time they unlock their devices.

Maximum number of failed attempts until device wipe

In this field, you can specify the maximum number of failed attempts to enter the correct password before the device is wiped. After six failed attempts, a time delay is imposed before a password can be entered again. The delay increases with each failed attempt. After the final failed attempt, all data and settings are securely removed from the device. The time delay starts after the sixth attempt. So if you set this value to 6 or lower, no delay is imposed and the device is wiped when the attempt limit is exceeded.

14.16.2 Restrictions configuration (iOS device profile)

With the Restrictions configuration you define restrictions for devices.

Device

Setting/Field

Allow app installation

Allow app installation from device UI

Allow use of camera

Allow FaceTime

Allow screen capture

Allow automatic sync while roaming

Description

If the check box is cleared, the App Store is unavailable and its icon is removed from the Home screen. Users cannot install or update apps from the App Store, iTunes or Apple

Configurator.

If the check box is cleared, the App Store is unavailable and its icon is removed from the Home screen. Users can still install or update apps from iTunes or Apple Configurator.

If the check box is cleared, the camera is unavailable and the Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.

Users can place or receive FaceTime video calls.

Users can take a screenshot of the display.

If the check box is cleared, devices that are roaming will only sync when the user accesses an account.

117

Sophos Mobile Control

Setting/Field Description

Allow Siri

If the check box is cleared, users cannot use Siri, voice commands, or dictation.

Allow Siri while device is locked

If the check box is cleared, users must unlock their devices by entering their password before they use Siri.

Allow Siri querying content from the web

If the check box is cleared, Siri does not query content from the web.

Force Siri explicit language filter

If the check box is cleared, the Siri filter for explicit language is not enforced on the device.

Allow voice dialing while device is locked

If the check box is cleared, users cannot dial by using voice commands when the device is locked by a password.

Note: If the user has not configured a device password, voice dialing is always allowed.

Allow Passbook while device is locked

Passbook notifications are displayed when the device is locked.

Users can make in-app purchases.

Allow in-app purchase

Force user to enter store password for all purchases

Users must enter their Apple ID password to make any purchase.

If the check box is cleared, there is a brief grace period during which users can make subsequent purchases without having to enter their password again.

Allow multiplayer gaming

Allow Game Center

Allow adding Game Center friends

Allow find my friends modification

Allow host pairing

Users can play multi-player games in Game Center.

If the check box is cleared, Game Center is unavailable.

Users can add friends in Game Center.

If the check box is cleared, modifications to the Find my

Friends app are unavailable.

If the check box is cleared, host pairing is turned off with the exception of the supervision host. If no supervision host certificate is configured, all pairing is turned off.

118

administrator help

Setting/Field Description

Allow pairing with Apple Watch

Allow AirDrop

Allow Control Center on lock screen

If the check box is cleared, users cannot pair the device with an Apple Watch. Any currently paired Apple Watch is unpaired.

Content sharing with AirDrop is turned on.

If the check box is cleared, the Control Center is unavailable when the device screen is locked.

Allow Notification Center on lock screen

If the check box is cleared, the Notification Center is unavailable when the device screen is locked.

Allow Today view on lock screen

If the check box is cleared, the Today view is unavailable when the device screen is locked.

Allow News

Allow over-the-air PKI updates

The News app is available.

Over-the-air PKI updates are possible.

Allow iBooks Store

Allow explicit sexual content in iBooks

Store

Users can purchase books in iBooks.

If the check box is cleared, explicit sexual content through iBooks Store is blocked.

Allow user to install configuration profiles

Users can install configuration profiles.

Allow iMessage

Users can use iMessage to send or receive text messages.

Allow app removal

Allow erase all contents and settings

Users can remove apps from the device.

If the check box is cleared, the Erase all Content And

Settings option in the Reset UI is unavailable.

Allow internet search result for Spotlight

If the check box is cleared, Spotlight does not return internet search results.

Allow enabling of restrictions option

If the check box is cleared, the Enable Restrictions option in the Reset UI is unavailable.

Allow Handoff

Allow device name modification

Users can use the Apple Continuity feature Handoff. With

Handoff, users can start to work on a document, email or message on one device and continue from another device.

Users can change the device name.

119

Sophos Mobile Control

Setting/Field Description

Allow wallpaper modification

Allow keyboard shortcuts

Allow automatic app download

Users can change the wallpaper.

Users can use keyboard shortcuts.

If the check box is cleared, the automatic downloading of apps purchased on other devices is turned off. This does not affect updates to existing apps.

Allow Apple Music

Allow Apple Music Radio

Users can access the Apple Music library.

Users can access Apple Music Radio.

Allow modification of Bluetooth settings

Users can modify the Bluetooth settings.

Company data

Setting/Field Description

Allow documents to be shared only within managed apps/accounts

With this setting you define a restriction on opening documents with apps or accounts (for example a company email account) managed by Sophos Mobile Control.

If users have an email account managed by Sophos Mobile

Control and apps managed by Sophos Mobile Control on their devices, attachments from the managed email account can only be opened with managed apps. In this way you can prevent corporate documents from being opened in unmanaged apps.

Allow documents to be shared only within unmanaged apps/accounts

With this setting you define a restriction on opening documents with apps/accounts (for example a private email account) not managed by Sophos Mobile Control.

If users have an email account and apps not managed by

Sophos Mobile Control on their devices, attachments from the unmanaged email account can only be opened with unmanaged apps. In this way you can prevent personal documents from being opened in managed apps.

Force AirDrop documents to be used as unmanaged documents

AirDrop is considered an unmanaged drop target.

Allow managed apps to sync with iCloud

Managed apps can use iCloud synchronization.

120

administrator help

Setting/Field

Allow backup for enterprise books

Allow enterprise books notes and highlights sync

Applications

Description

Enterprise books are backed up.

Enterprise books notes and highlights are synchronized.

Setting/Field

Allow use of the iTunes Store

Allow use of Safari

Enable auto-fill

Block pop-ups

Allow JavaScript in browser

Accept cookies

Description

If the check box is cleared, the iTunes Store is unavailable and its icon is removed from the Home screen. Users cannot preview, purchase or download content.

If the check box is cleared, the Safari web browser is unavailable and its icon is removed from the Home screen.

This also prevents users from opening web clips.

If the check box is cleared, Safari does not auto-fill web forms with previously entered information.

The Safari pop-up blocker is turned on.

Web pages can execute JavaScript code on the device.

In this field, you specify if cookies will be accepted:

Always

Never

From visited sites

Allow modification of cellular data usage per app

Users can change the cellular data usage per app.

Allowed apps / Forbidden apps You can specify either Allowed apps or Forbidden apps.

Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list. For information on creating app groups, see

App groups (page 184).

121

Sophos Mobile Control

iCloud

Setting/Field

Allow backup

Allow document sync

Allow Photo Stream

Allow iCloud Photo Library

Allow shared photo streams

Allow keychain sync

Description

Users can back up their devices to iCloud.

Users can store documents in iCloud.

If the check box is cleared, users cannot turn on Photo

Stream.

Note: If you install a configuration profile that restricts the use of Photo Stream, Photo Stream photos are removed from the device. Photos are not sent from the Camera Roll to Photo Stream. If there are no further copies of these photos, they are lost.

Users can use the iCloud Photo Library.

Users can invite others to view their photo streams and can view photo streams shared by others.

The Keychain feature of iCloud for synchronizing passwords across different iOS and OS X devices is available.

Security and privacy

Setting/Field Description

Allow diagnostic data to be sent to Apple

If the check box is cleared, iOS diagnostic information is not sent to Apple.

Allow user to accept untrusted TLS certificates

If the check box is cleared, users are not asked if they want to trust certificates that cannot be verified. This setting applies to Safari and to Mail Contacts and Calendar accounts.

Trust enterprise apps

Allow password modification

Enterprise apps are trusted.

Users can add, change or remove the device password.

122

administrator help

Setting/Field

Allow account modification

Allow Touch ID to unlock device

Force limit ad-tracking

Force encrypted backups

Content ratings

Description

If the check box is cleared, users cannot modify accounts.

The Accounts menu is unavailable.

If the check box is cleared, the device cannot be unlocked by Touch ID.

Anonymous user data apps used for targeting ads are no longer provided.

Users must encrypt backups in iTunes.

Setting/Field

Allow explicit music and podcasts

Description

If the check box is cleared, explicit music or video content is hidden in the iTunes Store. Explicit content is flagged by content providers, for example record labels, when listed on the iTunes Store.

14.16.3 Roaming/Hotspot settings configuration (iOS device profile)

With the Roaming/Hotspot settings configuration you define settings for roaming and personal hotspots.

Note: Users can change these settings on their devices anytime.

Setting/Field

Enable voice roaming

Enable data roaming

Enable personal hotspot

Description

Voice roaming is available.

Data roaming is available.

The user can configure the device to serve as a personal hotspot.

123

Sophos Mobile Control

14.16.4 Exchange ActiveSync configuration (iOS device profile)

With the Exchange ActiveSync configuration you define user settings for your Microsoft Exchange

Server.

Setting/Field

Account name

Exchange ActiveSync host

Domain

User

Email address

Password

Synchronization period

SSL

Allow move

Allow recent address syncing

Description

The account name.

The address of the Microsoft Exchange Server.

Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.

The domain for this account.

The user for this account.

If you enter the variable

%_USERNAME_%

, the server replaces it with the actual user name.

The email address of the account.

If you enter the variable

%_EMAILADDRESS_%

, the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period emails are synchronized for.

If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.

All communication is sent through SSL (Secure Socket

Layer).

We recommend that you select this check box.

The user can move emails from this account to another. This also allows users to use a different account when replying to or forwarding a message from this account.

The account is included in the syncing of recently used addresses with other devices using iCloud.

124

administrator help

Setting/Field

Use in Mail only

Identity certificate

Description

The account can only be used to send messages from the Mail app. It cannot be selected as a sending account for messages created with other apps, for example Photos or Safari.

Select the identity certificate for the connection to

ActiveSync.

The list includes all certificates from Client certificate configurations of the current profile.

14.16.5 Wi-Fi configuration (iOS device profile)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Connect automatically

Hidden network

Security type

Description

The ID of the Wi-Fi network.

Automatically connect to the target network.

The target network is not open or visible.

The security type of the Wi-Fi network:

None

WEP

WPA/WPA2

Any (personal)

Corporate WEP

Corporate WPA/WPA2

Any (company)

If you select WEP, WPA/WPA2 or Any (personal), a

Password field is displayed. Enter the relevant password.

If you select Corporate WEP, Corporate WPA/WPA2 or

Any (company), the tabs Protocols, Authentication and Trust are displayed.

In the Protocols tab configure the following:

Under Accepted EAP types, specify the EAP methods to be used for authentication. Depending on the types selected here, the values in the Internal

identity field in this tab become available for selection.

125

Sophos Mobile Control

Setting/Field

Proxy

Description

Under EAP-FAST, configure the EAP-FAST Protected

Access credential settings.

In the Authentication tab, configure client authentication settings:

In the User field, enter the user name for the connection to the Wi-Fi network.

Select Require password on each connect, if the password is to be queried for each connection and transferred with the authentication.

In the Password field, enter the relevant password.

In the Identity certificate list, select the certificate for the connection to the Wi-Fi network.

Note: The certificate to be used has to be specified in a Client certificate configuration.

In the External identity field, enter the externally visible ID (for TTLS, PEAP and EAP-FAST).

In the Trust tab, configure server authentication settings:

Select the trusted certificates from the list.

Note: You must specify the certificates in a Root

certificate configuration.

In this list, select the proxy settings for the Wi-Fi connection:

None

Manually

Automatic

If you select Manually, the fields Server and port,

Authentication and Password are displayed. Enter the required proxy information. If you select Automatic, the field Proxy server URL is displayed. Enter the URL of the proxy server.

14.16.6 VPN configuration (iOS device profile)

With the VPN configuration you define VPN settings for network connections.

Setting/Field

Connection name

Description

The name of the connection shown on the device.

126

administrator help

Setting/Field

Connection type

Description

The type of the VPN connection:

Cisco AnyConnect

IPSec (Cisco)

F5

Check Point

Custom SSL

Different entry fields are shown on the VPN page depending on the connection type you select here.

Identifier (reverse DNS format) (connection type

Custom SSL)

The custom identifier in reverse DNS format.

The host name or the IP address of the server.

Server (all connection types)

Account (all connection types)

Custom data (connection type Custom SSL)

The user account for the authentication of the connection.

If your vendor has specified custom connection properties, you can enter them in this field.

To enter a property, click Add and then enter Key and Value of the property in the dialog box.

Send all traffic through VPN

Group (connection type Cisco AnyConnect)

User authentication (connection types Cisco

AnyConnect, F5, Custom SSL)

All traffic is sent through VPN.

The group that may be required for the authentication of the connection.

Select the type of user authentication for the connection:

If you select Password, a Password field is shown below the User Authentication field. Enter the password for authentication.

If you select Certificate, a Certificate field is shown below the User authentication field.

Select a certificate.

Device authentication (connection type IPSec

(Cisco))

The type of device authentication:

Keys (Shared Secret)/Group name

If you select this option, the fields Group name,

Keys (Shared Secret), Use hybrid

authentication and Request password are displayed below the Device authentication field.

Enter the required authentication information in

127

Sophos Mobile Control

Setting/Field

Proxy (all connection types)

Description the Group name and Keys (Shared Secret) fields. Select Use hybrid authentication and

Request password as required.

Certificate

If you select this option, the fields Certificate and

Including user PIN are displayed below the

Device authentication field. In the Certificate list, select the required certificate. Select

Including user PIN to include the user PIN in device authentication.

The proxy settings for the connection:

None

Manually

If you select this option, the fields Server and

port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the

Password field, enter the password for the connection to the proxy server.

Automatic

If you select this option, the Proxy server URL field is displayed. Enter the URL of the server with the proxy setting in this field.

14.16.7 Per app VPN configuration (iOS device profile)

With the Per app VPN configuration you define VPN settings to support the iOS feature Per app

VPN.

You can configure apps to automatically connect to VPN when they are started. So you can, for example, ensure that data transmitted by managed apps travels through VPN.

After you have set up per app VPN configurations, you can select a configuration on the Edit

package page of an application. See

Configure per app VPN and settings for iOS apps (page

182).

Setting/Field

Connection name

Description

The name of the connection shown on the device.

128

administrator help

Setting/Field

Connection type

Description

The type of the VPN connection:

Cisco AnyConnect

F5

Check Point

Custom SSL

Different entry fields are shown on the VPN page depending on the connection type you select here.

Identifier (reverse DNS format) (connection type

Custom SSL)

The custom identifier in reverse DNS format.

Server (all connection types)

Account (all connection types)

The host name or the IP address of the server.

The user account for the authentication of the connection.

Custom data (connection type Custom SSL)

If your vendor has specified custom connection properties, you can enter them in this field.

To enter a property, click Add and then enter Key and Value of the property in the dialog box.

Group (connection type Cisco AnyConnect)

Send all traffic through VPN

User authentication (connection type Cisco

AnyConnect, F5, Custom SSL)

In this field, enter the group that may be required for the authentication of the connection.

All traffic is sent through VPN.

In this list, select the type of user authentication for the connection:

Password

If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.

Certificate

If you select this option, the Certificate field is shown below the User authentication field.

Select a certificate.

Device authentication (connection type IPSec

(Cisco))

In this list, select the type of device authentication:

Keys (Shared Secret)/Group name

If you select this option, the fields Group name,

Keys (Shared Secret), Use hybrid

129

Sophos Mobile Control

Setting/Field

Proxy (all connection types)

Provider type

Safari domains

Description

authentication and Request password are displayed below the Device authentication field.

Enter the required authentication information in the Group name and Keys (Shared Secret) fields. Select Use hybrid authentication and

Request password as required.

Certificate

If you select this option, the fields Certificate and

Including user PIN are displayed below the

Device authentication field. In the Certificate list, select the required certificate. Select

Including user PIN to include the user PIN in device authentication.

In this list, select the proxy settings for the connection:

None

Manually

If you select this option, the fields Server and

port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the

Password field, enter the password for the connection to the proxy server.

Automatic

If you select this option, the Proxy server URL field is displayed. Enter the URL of the server with the proxy setting in this field.

The VPN connection type.

App proxy: Network traffic is sent through a VPN tunnel at the application layer.

Packet tunnel: Network traffic is sent through a

VPN tunnel at the network layer.

In this field, you can enter a list of domain strings.

When a domain that matches one of the domain strings is opened in Safari or another browser app, the VPN connection is triggered.

Use a new line for each domain string.

130

administrator help

Setting/Field Description

The rule matching behavior is as follows:

Leading and trailing dots are ignored. For example, the string

.example.com

matches the same domains as the string

example.com

.

Each string component must match a whole domain component. For example, the string

example.com

matches the domain www.example.com

, but not www.myexample.com

.

Strings with a single component only match that specific domain. For example, the string

example

matches the domain example

, but not www.example.com

.

14.16.8 Single sign-on configuration (iOS device profile)

With the Single sign-on configuration you define settings for a single sign-on for third-party apps.

Setting/Field

Name

Kerberos principal name

Realm

Description

A human-readable name for the account.

The Kerberos principal name.

If you do not enter a value, the user must enter the name during profile installation.

The Kerberos realm name.

You must enter the name in upper-case letters.

131

Sophos Mobile Control

14.16.9 Single app mode configuration (iOS device profile)

With the Single app mode configuration you define settings for the single mode that locks devices into a single app and prevents users from changing to other apps.

Setting/Field

Select source

App identifier

Disable touchscreen

Disable rotation

Disable volume buttons

Disable ringer switch

Disable sleep wake button

Disable Auto-Lock

Enable VoiceOver

Enable Zoom

Enable Invert Colors

Enable AssistiveTouch

Enable Speak Selection

Enable Mono Audio

VoiceOver

Zoom

Description

Select how you want to specify the app for the single app mode:

App list: Select the app from a list of all available iOS apps for the customer.

Custom: Manually enter the bundle ID of the app.

The app for the single app mode.

Either select an app from the list or enter a bundle ID.

Touch gestures are unavailable.

The screen does not rotate.

Volume buttons are unavailable.

The ringer switch is unavailable.

The wake button is unavailable.

The Auto-Lock feature that puts the device into sleep after an idle period is turned off.

VoiceOver is available.

The Zoom feature is available.

The Invert Colors feature is available.

AssistiveTouch is available.

The Speak Selection feature is available.

The Mono Audio feature is available.

VoiceOver adjustments are available.

Zoom adjustment are available.

132

administrator help

Setting/Field

Invert Colors

AssistiveTouch

Description

Invert Colors adjustment are available.

AssistiveTouch adjustment are available.

14.16.10 Web clip configuration (iOS device profile)

With the Web clip configuration you define web clips to be added to the Home screen of user devices. Web clips provide fast access to favorite web pages. But you can also add a web clip with a support phone number for example, to provide a quick way to dial the helpdesk.

Setting/Field

Description

URL

Can be removed

Full screen

Description

A description for the web clip.

The web address of the web clip.

If the check box is cleared, the user cannot remove the web clip. It cannot be deleted from the device unless the user removes the profile that installed it.

The web clip is opened full screen on the device. A full screen web clip opens the URL as a web app.

14.16.11 Access Point Name configuration (iOS device profile)

With the Access Point Name configuration you specify an Access Point Name (APN) configuration for iOS devices. APN configurations define how devices connect to a mobile network.

Note: The Access Point Name configuration is deprecated in favor of the Cellular configuration.

See Cellular configuration (iOS device profile)

(page 137)

Important: If these settings are not correct, the device cannot access data using the cellular network. To undo settings changes, the profile must be removed from the device.

Setting/Field

APN

Description

The APN that the device quotes when it opens a

GPRS connection with the carrier.

This must match an APN that the carrier accepts.

Otherwise, the connection cannot be established.

133

Sophos Mobile Control

Setting/Field

User name for access point

Password for access point

Proxy server and port

Description

The user name for the access point.

Note: iOS supports APN user names of up to 64 characters.

The password for the access point.

Note: iOS supports APN passwords of up to 64 characters.

The address and the port of the proxy server.

14.16.12 Web content filter configuration (iOS device profile)

With the Web content filter configuration you define forbidden URLs and allowed URLs with bookmarks.

Setting/Field

Forbidden URLs

Allowed URLs with bookmarks

Description

If you select the check box, you can define a list of blocked URLs that may not be accessed on the devices.

Click Next to display the Select web content filter

type page. On this page, you can add individual

URLs.

Use a new line for each URL.

If you select the check box, you can define allowed

URLs with bookmarks to be added to the Safari browser on the devices. All other sites are blocked.

Click Next to display the Web content filter page.

Click Add to add individual URLs as bookmarks.

134

administrator help

14.16.13 Global HTTP proxy configuration (iOS device profile)

With the Global HTTP proxy configuration you define a corporate proxy server.

Setting/Field

Global HTTP proxy

Description

Select the proxy settings for the connection:

Manually

If you select this option, the fields Server and

port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the

Password field, enter the password for the connection to the proxy server.

Automatic

If you select this option, the Proxy server URL field is displayed. Enter the URL of the server with the proxy setting in this field.

14.16.14 Root certificate configuration (iOS device profile)

With the Root certificate configuration you install a root certificate onto devices.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

14.16.15 Client Certificate configuration (iOS device profile)

With the Client certificate configuration you install a client certificate onto iOS devices.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

135

Sophos Mobile Control

14.16.16 SCEP configuration (iOS device profile)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

URL

CA name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

NT user login name

Challenge

Description

The web address of the Certificate Authority server.

Use the variable

%_SCEPPROXYURL_%

to refer to the server URL that is configured on the SCEP tab of the

System setup page.

A name that is understood by the Certificate Authority.

The name can, for example, be used to distinguish between instances.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.

For example:

Enter

CN=%_USERNAME_%

to specify a user.

Enter

CN=%_DEVPROP(serial_number)_%

to specify a device.

For information on available placeholders, see

Placeholders in profiles and policies (page 72).

Optionally, configure a Subject Alternative Name

(SAN). Select one of the available SAN types.

If you have selected a SAN type, enter the SAN value.

Retries

The web address to obtain a challenge password from the SCEP server.

Use the variable

%_CACHALLENGE_%

to refer to the challenge URL that is configured on the SCEP tab of the System setup page.

The number of retries if the server sends a response of type pending.

136

administrator help

Setting/Field

Retry delay

Key size

Use as digital signature

Use for encryption

Description

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

14.16.17 Managed domains configuration (iOS device profile)

With the Managed domains configuration you define managed domains for iOS devices.

When domains are managed, files downloaded from specific websites in Safari can only be opened using apps that were pushed to the device using MDM.

You can enter managed Email domains and Web domains. Enter one domain per line.

Note: If a managed web domain entry contains a port number, only addresses that specify that port number will be considered managed. Otherwise, only the standard ports will be considered managed (port 80 for http and 443 for https).

14.16.18 Cellular configuration (iOS device profile)

With the Cellular configuration you define cellular network settings for iOS devices.

Note: A cellular configuration cannot be installed onto a device if an APN configuration is already installed.

Setting/Field

Authentication

APN

Description

PAP

CHAP

The APN that the device quotes when it opens a

GPRS connection with the carrier.

This must match an APN that the carrier accepts.

Otherwise, the connection cannot be established.

137

Sophos Mobile Control

Setting/Field

User name for access point

Password for access point

Proxy server and port

Description

The user name for the access point.

Note: iOS supports APN user names of up to 64 characters.

The password for the access point.

Note: iOS supports APN passwords of up to 64 characters.

The address and the port of the proxy server.

14.16.19 CalDAV configuration (iOS device profile)

With the CalDAV configuration you configure the synchronization of calendar data with a CalDAV server. For example, this can be used to sync Google Calendar with an iOS device.

Setting/Field

Account name

Account host and port

Principal URL

User name, Password

Description

The display name of the CalDAV account on the device.

The host name or IP address and optionally the port number of the CalDAV server.

For example, for Google Calendar enter:

calendar.google.com:443

If required by the CalDAV server, enter the principal URL of the calendar resource.

For example, to sync with a calendar other than the primary calendar in a Google account, enter:

https://apidata.googleusercontent.com/caldav/

v2/calendar_id/user where calendar_id is the ID of the calendar you want to sync with. In the Google Calendar web application, the calendar ID is displayed in the calendar settings. See the Google Calendar help for details.

The login credentials for the CalDAV account.

For example, for Google Calendar enter the credentials of the

Google account.

138

administrator help

14.16.20 CardDAV configuration (iOS device profile)

With the CardDAV configuration you configure the synchronization of contact data with a CardDAV server. For example, this can be used to sync Google Contacts with an iOS device.

Setting/Field

Account name

Account host and port

Principal URL

User name, Password

Description

The display name of the CardDAV account on the device.

The host name or IP address and optionally the port number of the CardDAV server.

For example, for Google Contacts enter:

google.com

If required by the CardDAV server, enter the principal URL of the contacts resource.

For example, the Google CardDAV API supports the following principal URL:

https://www.googleapis.com/carddav/

v1/principals/account_name@gmail.com where account_name is the Google account name.

The login credentials for the CardDAV account.

For example, for Google Contacts enter the credentials of the

Google account.

14.16.21 IMAP/POP configuration (iOS device profile)

With the IMAP/POP configuration you add an IMAP or POP email account to the iOS device.

Setting/Field

Account name

Account type

User display name

Description

The display name of the email account on the device.

The type of the email server for incoming email.

Can be either IMAP or POP.

The display name of the user for outgoing email.

You can use the variable

%_USERNAME_%

and the server will replace it with the actual user name.

139

Sophos Mobile Control

Setting/Field

Email address

Description

The email address of the account.

You can use the variable

%_EMAILADDRESS_%

and the server will replace it with the actual email address.

Allow move

Allow recent address syncing

Use in Mail only

Allow Mail Drop

Enable S/MIME

Signing certificate

Encryption certificate

The user can move emails from this account to another. This also allows users to use a different account when replying to or forwarding a message from this account.

The account is included in the syncing for the list of recent addresses.

The account can only be used to send messages from the Mail app. It cannot be selected as a sending account for messages created with other apps, for example Photos or Safari.

Allow Apple Mail Drop for this account.

Support the S/MIME encryption standard.

The certificates that are used for email signing and encryption.

To select a certificate, you must first upload it in a Client

certificate configuration of the current profile.

Allow user to send unencrypted emails

For each outgoing email, the user can choose to encrypt it or not.

Incoming email

Email server and port

The host name or IP address and the port number of the server for incoming email (inbound server).

The user name for connecting to the inbound server.

User name

Authentication type

The authentication method for connecting to the inbound server.

Password

SSL

Outgoing email

Email server and port

The password for connecting to the inbound server (if required).

Use Secure Sockets Layer for incoming email transfer.

User name

The host name or IP address and the port number of the server for outgoing email (outbound server).

The user name for connecting to the outbound server.

140

administrator help

Setting/Field Description

Authentication type

The authentication method for connecting to the outbound server.

The password for connecting to the outbound server (if required).

Password

Use same password as for incoming email

Use the password that is specified for incoming email.

SSL

Use Secure Sockets Layer for outgoing email transfer.

14.16.22 Network usage rules configuration (iOS device profile)

With the Network usage rules configuration you specify how managed apps are allowed to use cellular data networks.

General rules

Under Rules for all managed apps, specify the settings for managed apps in general.

Setting/Field

Allow cellular data

Allow data roaming

Description

Managed apps are allowed to use data communication over cellular networks.

Managed apps are allowed to use data communication while the device is roaming on a foreign cellular network.

Exceptions

Exceptions override the general rules. Use Add exception to define rules that are specific to an app group.

Setting/Field

App group

Allow cellular data

Description

Select an app group that contains the managed apps to which the exception applies.

Managed apps from the selected app group are allowed to use data communication over cellular networks.

141

Sophos Mobile Control

Setting/Field

Allow data roaming

Description

Managed apps from the selected app group are allowed to use data communication while the device is roaming on a foreign cellular network.

Note: You cannot define multiple exceptions for the same app group.

14.17 Configurations for Sophos container policies for iOS

With a Sophos container policy you configure settings that are related to the Sophos container apps Sophos Secure Email and Sophos Secure Workspace.

For information on how to create a Sophos container policy, see

Create profile or policy (page

69).

14.17.1 General configuration (iOS Sophos container policy)

With the General configuration you define settings that apply to all Sophos container apps, if applicable.

Setting/Field

Enable Sophos container password

Password complexity

Description

Users must enter an additional password to be able to start a Sophos container app. The password has to be defined when the first container app is started after the configuration has been applied. This password applies to all container apps.

The required minimum complexity of the Sophos container password. More secure passwords are always allowed. Passwords (a mix of numeric and alphanumeric characters) are always seen as more secure than PINs (numeric characters only).

Any: Sophos container passwords do not have restrictions.

4 digit PIN

6 digit PIN

4 char password

6 char password

8 char password

10 char password

142

Setting/Field

Password age in days

Failed logins until lock

Allow fingerprint

Grace period in minutes

Lock on device lock

Last server connect

administrator help

Description

The number of days that a password can be used before users are prompted to change it.

The number of failed login attempts that are tolerated before the container apps are locked. Once they are locked an administrator needs to unlock the apps or, if allowed, users can use the Self Service Portal to do so.

Users can use their fingerprint to unlock the app.

The period of time within which no Sophos container password must be entered when a container app comes to the foreground again.

The grace period applies to all container apps. You can switch between the apps during the grace period without entering a password.

You can select 1, 2, 5, 10, 15 minutes.

When the device is locked, the Sophos container is locked as well.

If the check box is cleared, the container is locked only after the grace period has expired.

The period of time within users can use a Sophos container app without a connection to the Sophos

Mobile Control server.

When a Sophos container app becomes active and does not have contact with the server within the defined period of time, a lock screen will be displayed. Users can only unlock the app by tapping

Retry on the lock screen. The app will then try to connect to the server. If the connection can be established, the app will be unlocked. If not, access will be denied.

On access: Server connection is always required and the app is locked when the server cannot be reached.

1 hour: Server connection is required when the app becomes active one hour or more after the last successful server connection.

3 hours

6 hours

12 hours

1 day

143

Sophos Mobile Control

Setting/Field Description

3 days

1 week

none: No regular contact is required.

Offline starts without server connection

In this field you define how often users can start one of the Sophos container apps without a server connection.

Note: This setting requires the Sophos container password feature to be turned on.

A counter is incremented whenever users enter the

Sophos container password. If the counter exceeds the defined number, the same lock screen as for the

Last server connect setting will be displayed. The counter will be reset if a connection to the Sophos

Mobile Control server is established.

Unlimited: No server connection is required.

0: Starting the app without a server connection is not possible.

3

5

1: After one start of the app, a successful server connection is necessary.

10

20

Jailbreak allowed

Container apps are allowed to run on jailbroken devices.

App usage constraints

Here you can define constraints on using the Sophos container apps. Click Add to enter constraints.

Geo-fencing

Time-fencing

Lets you add latitude and longitude and a radius within which the Sophos container apps can be used.

Lets you specify a start and end time within which the Sophos container apps can be used. Days of the week on which the apps can be used can be specified as well.

144

administrator help

Setting/Field

Wi-Fi fencing

Description

Lets you specify Wi-Fi networks to which the device must be connected in order to use the Sophos container apps.

The device must actually be connected to one of the listed networks. Being able to see a particular network in the list of available networks is not enough.

Important: We recommend that you do not rely on

Wi-Fi fencing as the only security mechanism because Wi-Fi names can be spoofed very easily.

14.17.2 Corporate Email configuration (iOS Sophos container policy)

With the Corporate Email configuration you define user settings for your Microsoft Exchange

Server. These settings are applied to the Sophos Secure Email app if it is installed in the Sophos container.

Setting/Field

Exchange ActiveSync host

User

Email address

Domain

Support contact email

Use secure text fields

Description

The address of the Microsoft Exchange Server.

Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.

The user for this account.

If you enter the variable

%_USERNAME_%

, the server replaces it with the actual user name.

The email address of the account.

If you enter the variable

%_EMAILADDRESS_%

, the server replaces it with the actual email address.

The domain for this account.

The email address that will be used as the "Contact

Support" email address.

The content of input fields is secured. Auto-complete and auto-correction are disabled within the Sophos

Secure Email app to prevent sensitive words to be saved in the memory of the device.

145

Sophos Mobile Control

Setting/Field

Export contacts to device

Show notification details

Deny copy to clipboard

Allow external viewers

Maximum email size

Open attachments

Description

Users are allowed to export the exchange contacts with a phone number to the local device contacts.

Sophos Secure Email will keep them synchronized.

Only name and telephone number will be exported to enable the user to identify company contacts in an incoming call. Note that even after a remote reset of the Sophos Secure Email app, the information will still be available in the local storage of the device.

This option controls the display of email notifications and event reminders in the Sophos Secure Email app.

When you select the option:

Email notifications are displayed with sender and subject.

Event reminders are displayed with time, location and title.

When you deselect the option:

Email notifications are disabled.

Event reminders are displayed with time only.

Note: If you think notifications displayed on a lost or stolen device is a security risk, you may want to disable notification details.

Users cannot copy or cut texts from the Sophos

Secure Email app.

The user can save attachments or open them in other apps.

If required, select the maximum email size for Sophos

Secure Email app from the list.

If you select this option, Save and View buttons are displayed under the attachment. Save passes the attachment on to Sophos Secure Workspace, View opens the file in Sophos Secure Email. If Sophos

Secure Email cannot open the file, users can select where to pass the file on to.

If you deselect this option, attachment cannot be opened or passed on to other apps.

146

administrator help

Setting/Field

Add

Description

Click Add to configure settings that a future version of the Sophos Secure Email app might require.

Important: Only configure these settings if instructed by the Sophos support team.

14.17.3 Corporate Documents configuration (iOS Sophos container policy)

Configure storage providers

For each storage provider you can define the following settings separately:

Setting/Field

Enable

Offline

Open in (encrypted)

Open in (unencrypted)

Clipboard

Description

The storage provider is available in the app.

Users are allowed to add files from the storage provider to the app's Favorites list for offline use.

Users can share encrypted files with other apps via

Open In.

Users can share unencrypted files with other apps via Open In.

Users can copy parts of a document and paste them into other apps.

Enterprise provider settings

For Egnyte and WebDAV provider, also referred to as enterprise provider, you can centrally define server settings and login credentials. These cannot be changed by users.

Credential settings that you do not define centrally can be chosen by the users in the app's provider credential screens.

For example you can centrally define the server and user account to be used but you can leave the password field undefined. Users then would have to know the password when accessing the storage provider.

147

Sophos Mobile Control

Setting/Field

Name

Server

User name

Password

Upload folder

Other settings

Setting/Field

Enable Documents

Passphrase complexity

Description

The name of the provider that is displayed in the

Sophos Secure Workspace app.

In this field, enter:

The URL of the root folder on the Corporate

Documents WebDAV server.

The URL of the root folder on the Egnyte server.

The URL of the root folder on the WebDAV server.

Use the following format:

https://server.company.com

In this field, enter the user name for the relevant server.

In this field, enter the password for the relevant account.

In this field, enter the upload folder for the relevant account.

Description

This turns on the Documents feature to securely distribute company documents.

The required minimum complexity of passphrases for encryption keys. More secure passphrases are always allowed.

You can select the following settings:

4 char password

6 char password

8 char password

10 char password

148

administrator help

14.17.4 Corporate Browser configuration (iOS Sophos container policy)

With the Corporate Browser configuration you define settings for the Corporate Browser feature of the Sophos Secure Workspace app.

The Corporate Browser allows you to securely access corporate intranet pages and other allowed pages. You can define domains and bookmarks within a domain.

Every bookmarks belongs to a certain domain. When you use Add bookmark to define a bookmark, the domain entry is created automatically if it does not exist.

Domain settings

Setting/Field

URL

Allow copy/paste

Allow open with

Allow save password

Description

The domain that you want to allow.

Users can copy and paste text from the Corporate

Browser to other apps.

Users can download attachments or pass them on to other apps.

Users can save their passwords in the Corporate

Browser.

Bookmark settings

Setting/Field

Name

URL

Description

The name for the bookmark.

The web address for the bookmark.

14.17.5 Client certificate configuration (iOS Sophos container policy)

With the Client certificate configuration you install a client certificate onto devices. This certificate will be available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the Sophos container.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.

149

Sophos Mobile Control

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

14.17.6 Root certificate configuration (iOS Sophos container policy)

With the Root certificate configuration you upload a root certificate to devices. This certificate will be available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the Sophos container.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

14.17.7 SCEP configuration (iOS Sophos container policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP). These certificates are available to the

Sophos Secure Workspace app if it is installed in the Sophos container.

Note: You must first add a Root certificate configuration to upload the CA certificate of the

SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Alias name

Subject

Description

The web address of the Certificate Authority server.

Use the variable

%_SCEPPROXYURL_%

to refer to the server URL that is configured on the SCEP tab of the System setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the

CN=

prefix.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.

For example:

Enter

CN=%_USERNAME_%

to specify a user.

Enter

CN=%_DEVPROP(serial_number)_%

to specify a device.

150

administrator help

Setting/Field

Type of Subject Alternative Name

Value of Subject Alternative Name

NT user login name

Challenge

Description

For information on available placeholders, see

Placeholders in profiles and policies (page 72).

Optionally, configure a Subject Alternative Name

(SAN). Select one of the available SAN types.

If you have selected a SAN type, enter the SAN value.

Root certificate

Key size

Use as digital signature

Use for encryption

The web address to obtain a challenge password from the SCEP server.

Use the variable

%_CACHALLENGE_%

to refer to the challenge URL that is configured on the SCEP tab of the System setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root

certificate configurations of the current profile.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

14.18 Configurations for Windows Mobile policies

With a Windows Mobile policy you configure various aspects of Windows Mobile devices, like password policies, restrictions or Wi-Fi settings.

For information on how to create a Windows Mobile policy, see

Create profile or policy

(page 69).

151

Sophos Mobile Control

14.18.1 Password policies configuration (Windows Mobile policy)

With the Password policies configuration you define password rules for devices.

Setting/Field

Password type

Description

Select the type of password you want to define:

Alphanumeric

Alphanumeric or numeric

Allow simple password

Minimum password length

Maximum number of failed attempts

Time in minutes until the device is locked

Password history

Passwords can contain sequential or repeated characters, for example

abcde

or

1111

.

The minimum number of characters a password must contain.

The maximum number of failed login attempts to enter the correct password before the device is wiped.

Enter a value between

1

and

999

, or

0

for no restriction.

The time period (in minutes) after which the device is locked if it has not been used. The user can unlock the device.

Enter a value between

1

and

999

, or

0

for no restriction.

The number of old passwords that are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password.

Enter a value between

1

and

999

, or

0

for no restriction.

Maximum password age in days

The number of days after which users must change their password.

Enter a value between

1

and

730

, or

0

for no restriction.

Minimum number of different character groups

The minimum number of non-alphanumeric characters (for example & or !) a password must contain.

Allow the password grace period to be set

Users are allowed to set the password grace period.

152

administrator help

14.18.2 Restrictions configuration (Windows Mobile policy)

With the Restrictions configuration you define restrictions for devices.

Device

Setting/Field

Forbid SD card

Forbid unencrypted device

Description

Users cannot access the storage card. This does not prevent apps from accessing the storage card.

Internal storage encryption is turned on.

Important: After internal storage encryption has been turned on on a device, you cannot turn it off again through a policy.

Note: You must enable BitLocker on the device before applying the policy.

Forbid action center notifications above lock screen

No Action Center notifications are displayed above the device lock screen.

Forbid manual addition of non-Microsoft email accounts

Forbids adding all types of email accounts, as well as Exchange, Office 365 and Outlook.com accounts.

Forbid Microsoft account connection

The Microsoft account is the system account used for synchronization, backup and the Store.

Forbid developer mode

Forbid Windows Store

Forbid native browser

Forbid camera

Telemetry

The Windows developer mode is turned off.

The app store is unavailable.

The Microsoft Edge browser is unavailable.

The Privacy setting Let apps use my camera is turned off.

Select if the device can send diagnostic and usage telemetry data:

Allowed

Allowed, except for secondary data requests

Not allowed

153

Sophos Mobile Control

Various

Setting/Field

Forbid copy and paste

Forbid Cortana

Forbid "Save as" for Office files

Forbid screen capture

Forbid sharing of Office files

Forbid "Sync my settings"

Forbid voice recording

Wi-Fi

Description

The clipboard is unavailable.

Cortana is turned off.

Users cannot save a file on the device as an Office file.

Screen captures are turned off.

Users cannot share Office files.

Device settings cannot be synchronized to and from other Windows devices.

Voice recording is turned off.

Setting/Field

Forbid Wi-Fi

Forbid internet sharing

Forbid Wi-Fi Sense (hotspot auto-connect)

Forbid hotspot reporting

Forbid manual configuration

Description

Wi-Fi connections are turned off.

Internet Connection Sharing (ICS) is turned off.

The device does not automatically connect to Wi-Fi hotspots.

The device does not send information about Wi-Fi connections.

Users cannot configure Wi-Fi connections beyond the connections that are configured by Sophos Mobile

Control.

154

administrator help

Connectivity

Setting/Field

Forbid NFC

Forbid Bluetooth

Forbid USB connection

Description

Near Field Communication (NFC) is turned off.

Bluetooth is turned off.

USB connection between the device and a computer to sync files or to use developer tools to deploy or debug applications is forbidden. This does not affect

USB charging.

Roaming and costs

Setting/Field

Forbid cellular data roaming

Forbid VPN over cellular

Forbid VPN roaming over cellular

Description

Data connections over foreign cellular networks are turned off.

VPN connections over cellular networks are turned off.

VPN connections over foreign cellular networks are turned off.

Security and privacy

Setting/Field Description

Forbid Bing Vision to store images from Bing

Vision search

Bing Vision does not store the contents of the images captured when performing Bing Vision search.

Forbid use of location when searching

Forbid manual installation of root certificates

The search cannot utilize location information.

Users cannot manually install root and intermediate

CA certificates.

155

Sophos Mobile Control

Setting/Field

Forbid locating

SafeSearch permission

Description

All location privacy settings on the device are turned off. No apps can use the location service. This also forbids Sophos Mobile Control to locate the device.

The level of search result filtering that is enforced on the device:

Moderate: Moderate filtering against adult content. Valid search results are not filtered.

Strict: Highest filtering against adult content.

Unenrollment

Setting/Field

Forbid user to reset the phone

Forbid manual MDM unenrollment

Description

Users cannot factory reset the device through the control panel or hardware key combinations.

Users cannot delete the workplace account.

14.18.3 Exchange ActiveSync configuration (Windows Mobile policy)

With the Exchange ActiveSync configuration you define user settings for your Microsoft Exchange

Server.

Setting/Field

Account name

Exchange ActiveSync host

Domain

User

Description

The account name.

The address of the Microsoft Exchange Server.

Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.

The domain for this account.

The user for this account.

If you enter the variable

%_USERNAME_%

, the server replaces it with the actual user name.

156

administrator help

Setting/Field

Email address

Password

Synchronization period

Synchronization interval

SSL

Synchronize content types

Description

The email address of the account.

If you enter the variable

%_EMAILADDRESS_%

, the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period emails are synchronized for.

If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

All communication is sent through SSL (Secure Socket

Layer).

We recommend that you select this check box.

The content types to be synchronized.

14.18.4 Wi-Fi configuration (Windows Mobile policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Connect automatically

Hidden network

Security type

Proxy

Description

In this field, enter the ID of the Wi-Fi network.

The connection will be established automatically.

The target network is not open or visible.

Select the Security type from the list. If you select either WPA-PSK or WPA2-PSK you must specify the password.

If you select Manually from the list, you must specify

Server and port.

157

Sophos Mobile Control

14.18.5 App restrictions configuration (Windows Mobile policy)

With the App restrictions configuration you specifically allow or block apps on the devices.

Setting/Field

Allowed apps

Forbidden apps

App group

Description

Contains a set of individual apps that users are allowed to install and use on the device. Users will be unable to install or use any apps that are not explicitly listed.

Use Allowed apps when you know the list of apps that you want to allow and want to block all other apps.

Contains a set of individual apps that users are prevented from installing on the device. Users will be able to install any apps that are not explicitly listed.

Use Forbidden apps when you know the list of apps that you want to block and want to allow all other apps.

Select the App group that contains the list of apps you want to allow or block.

Note: The app group has to be created beforehand.

See

App groups (page 184).

14.18.6 Root certificate configuration (Windows Mobile policy)

With the Root certificate configuration you install a root certificate onto devices.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

14.18.7 SCEP configuration (Windows Mobile policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

Description

Description

A description for the configuration.

158

Setting/Field

URL

Subject

Subject Alternative Name

Challenge

Root certificate

Retries

Retry delay

Key size

administrator help

Description

The web address of the Certificate Authority server.

Use the variable

%_SCEPPROXYURL_%

to refer to the server URL that is configured on the SCEP tab of the

System setup page.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid X.500 name.

For example:

Enter

CN=%_USERNAME_%

to specify a user.

Enter

CN=%_DEVPROP(serial_number)_%

to specify a device.

For information on available placeholders, see

Placeholders in profiles and policies (page 72).

Optionally, configure one or more Subject Alternative

Name (SAN) values.

Click Add and then enter a SAN type and a SAN value.

The web address to obtain a challenge password from the SCEP server.

Use the variable

%_CACHALLENGE_%

to refer to the challenge URL that is configured on the SCEP tab of the System setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current profile.

The number of retries if the server sends a response of type pending.

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

159

Sophos Mobile Control

Setting/Field

Use as digital signature

Use for encryption

Hash algorithm

Description

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

Select one or more hash algorithms that are supported by the SCEP server.

14.19 Configurations for Windows Desktop policies

With a Windows Desktop policy you configure various aspects of Windows Desktop devices, like password policies, restrictions or Wi-Fi settings.

For information on how to create a Windows Desktop policy, see Create profile or policy

(page

69).

14.19.1 Password policies configuration (Windows Desktop policy)

With the Password policies configuration you define password rules for devices.

Note: Password complexity rules (for example length, number of uppercase and lowercase letters) for Windows Desktop devices are fixed and cannot be set by a Sophos Mobile Control policy. For details see

Windows Desktop password complexity rules (page 71).

Note: Password policies cannot be assigned to a Windows Desktop device, if there are other local users configured on the device (in addition to the user that is enrolled with Sophos Mobile

Control), and at least one of them is not allowed to change their password.

Setting/Field

Maximum number of failed attempts

Time in minutes until the device is locked

Description

The maximum number of failed login attempts to enter the correct password before the device is wiped.

Enter a value between

1

and

999

, or

0

for no restriction.

The time period (in minutes) after which the device is locked if it has not been used. The user can unlock the device.

Enter a value between

1

and

999

, or

0

for no restriction.

160

administrator help

Setting/Field

Password history

Maximum password age in days

Description

The number of old passwords that are remembered and compared with new ones. When the user defines a new password, it is not accepted if it matches a previously used password.

Enter a value between

1

and

999

, or

0

for no restriction.

The number of days after which users must change their password.

Enter a value between

1

and

730

, or

0

for no restriction.

14.19.2 Restrictions configuration (Windows Desktop policy)

With the Restrictions configuration you define restrictions for devices.

Device

Setting/Field Description

Forbid SD card

Users cannot access the storage card. This does not prevent apps from accessing the storage card.

Forbid manual addition of non-Microsoft email accounts

Forbids adding all types of email accounts, as well as Exchange, Office 365 and Outlook.com accounts.

Forbid developer mode

Forbid camera

Disable Edge autofill

The Windows developer mode is turned off.

The Privacy setting Let apps use my camera is turned off.

The Save form entries setting in the Edge web browser is turned off and cannot be turned on by the user.

If the check box is cleared, the setting is turned on and cannot be turned off by the user.

Disable Edge F12 Developer Tools

The F12 Developer Tools of the Edge web browser are unavailable.

161

Sophos Mobile Control

Setting/Field

Disable Edge pop-up blocker

Disable AutoPlay settings

Disable Date & Time settings

Disable Language settings

Disable Power & Sleep settings

Disable Region settings

Disable Sign-in settings

Disable VPN settings

Disable Workplace settings

Disable Account settings

Telemetry

Description

The Block pop-ups setting in the Edge web browser is turned off and cannot be turned on by the user.

If the check box is cleared, the setting is turned on and cannot be turned off by the user.

The relevant sections of the Windows Control Panel are unavailable. The user cannot change any of these settings after the policy has been assigned to the device.

Note: Disable AutoPlay settings does not affect connected devices, like for example mobile phones.

Select if the device can send diagnostic and usage telemetry data:

Allowed

Allowed, except for secondary data requests

Not allowed

Various

Setting/Field

Forbid Cortana

Forbid "Sync my settings"

Description

Cortana is turned off.

Device settings cannot be synchronized to and from other Windows devices.

162

administrator help

Setting/Field

Disable Windows tips

Description

The Windows notification setting Show me tips

about Windows is cleared and unavailable.

Wi-Fi

Setting/Field

Forbid internet sharing

Forbid Wi-Fi Sense (hotspot auto-connect)

Description

Internet Connection Sharing (ICS) is turned off.

The device does not automatically connect to Wi-Fi hotspots.

Connectivity

Description

Bluetooth is turned off.

Setting/Field

Forbid Bluetooth

Security and privacy

Setting/Field

Forbid use of location when searching

Unenrollment

Setting/Field

Forbid manual MDM unenrollment

Description

The search cannot utilize location information.

Description

Users cannot delete the workplace account.

163

Sophos Mobile Control

14.19.3 Exchange ActiveSync configuration (Windows Desktop policy)

With the Exchange ActiveSync configuration you define user settings for your Microsoft Exchange

Server.

Important: If you use multiple configurations to set up Exchange ActiveSync accounts, the devices might only be able to retrieve mail for one account. This typically happens when the accounts are located on different Exchange ActiveSync servers and there are different mailbox policies defined on these servers. Because the Windows Desktop devices can only enforce a single mailbox policy, they will fail to connect to the accounts that use a different policy.

Setting/Field

Account name

Exchange ActiveSync host

Domain

User

Email address

Password

Synchronization period

Synchronization interval

SSL

Description

The account name.

The address of the Microsoft Exchange Server.

Note: If you use the SMC EAS proxy, enter the URL of the SMC proxy server.

The domain for this account.

The user for this account.

If you enter the variable

%_USERNAME_%

, the server replaces it with the actual user name.

The email address of the account.

If you enter the variable

%_EMAILADDRESS_%

, the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period emails are synchronized for.

If you select a time period, only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

All communication is sent through SSL (Secure Socket

Layer).

We recommend that you select this check box.

164

administrator help

Setting/Field

Synchronize content types

Description

The content types to be synchronized.

14.19.4 Wi-Fi configuration (Windows Desktop policy)

Setting/Field

SSID

Connect automatically

Hidden network

Description

In this field, enter the ID of the Wi-Fi network.

The connection will be established automatically.

The target network is not open or visible.

14.19.5 Root certificate configuration (Windows Desktop policy)

With the Root certificate configuration you install a root certificate onto devices.

In the File field, navigate to the relevant certificate and click Upload a file. The name of the certificate is shown in the Certificate name field.

Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.

165

Sophos Mobile Control

15 Task bundles

By using task bundles you can bundle several tasks in one transaction. So you can bundle all tasks necessary to have a device enrolled and configured:

■

■

Enroll the device.

Apply required policies.

■

■

Install required applications (for example managed apps for iOS devices).

Apply required profiles.

You can also include wipe commands in task bundles to automatically wipe non-compliant (for example jailbroken or rooted) devices. For further information, see

Compliance rules

(page 41).

15.1 Create task bundle

1. On the menu sidebar, under CONFIGURE, click Task bundles and select Android or Apple

iOS.

2. On the Task bundles page, click Create task bundle.

The Edit task bundle page is displayed.

3. Enter a name and, optionally, a version and a description for the new task bundle in the relevant fields.

4. When you select the Selectable for compliance actions option, the task bundle can be

transferred onto a device when the device breaks a compliance rule. See Compliance rules

(page 41).

Note: This option will be disabled when you edit an existing task bundle and the task bundle is already used as a compliance action.

5. On the menu sidebar, under CONFIGURE, click Task bundles and select Android or Apple

iOS.

6. Click Create task.

7. Select the task type and click Next.

The next view depends on the task type you have selected. In each view you can specify your own meaningful task names. These task names are shown during installation on the Self

Service Portal.

8. Follow the wizard steps to add the required task and click Apply to create the task.

For a description of the available task types, see

Available Android task types

(page 167) and

Available iOS task types

(page 170).

9. Optional: Add further tasks to the task bundle.

Tip: You can change the installation order of the tasks by using the sort arrows on the right-hand side of the tasks list.

166

administrator help

10. After you have added all required tasks to the task bundle, click Save on the Edit task bundle page.

The task bundle is available for transfer. It is displayed on the Task bundles page.

Note: When you edit an existing task bundle which is used as Initial package in the Self Service

Portal settings, the enrollment task cannot be deleted. See Configure Self Service Portal settings

(page 25).

15.2 Available Android task types

The following task types are available for Android task bundles:

Enroll

When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.

When the task is transferred to a device that is already enrolled, no enrollment email is sent.

Install profile or assign policy

Select a profile or policy from the list of available profiles and policies. For information on how to

add profiles or policies to this list, see Profiles and policies (page 69).

When the task is transferred to devices, the profile is silently installed or the policy is silently assigned.

You can add more than one task of this type to a task bundle.

Remove profile

In Select source, select Profiles and then select a profile from the list.

In addition to the profiles that are available on the Sophos Mobile Control server, the list includes profiles that are in use on the managed devices.

You can also remove a profile that is not contained in the list. Select Identifier and then enter the identifier of the profile you want to remove from devices.

When the task is transferred to devices, the profile is silently removed.

You can add more than one task of this type to a task bundle.

Note: You cannot directly remove a Sophos container policy or a Mobile Security policy from devices. Instead, use the device action Unenroll Sophos container or Unenroll SMSec. This will also remove the related policies from the device.

167

Sophos Mobile Control

Install app

Select an app from the list of all available apps. For information on how to add apps to this list, see

Add app (page 174).

When the task is transferred to devices, users receive a notification on their devices that Sophos

Mobile Control wants to install the app. Users can tap OK to start the process, or Not now to be notified again after a short period of time.

If users tap OK but then tap Cancel in the subsequent Android dialog, the task fails.

If the app is already installed on a device that receives the task, it is updated.

You can add more than one task of this type to a task bundle.

Install Android for Work app

This task type is available if you have configured Android for Work for the customer.

Select an app from list of all available work apps. For information how to add apps to this list, see

Edit work app (page 196).

The installation task is sent to a Google service. Google then manages the installation of the app onto the device. On the Task view page, the state of the task is successful when it has been sent to Google.

You can add more than one task of this type to a task bundle.

Alternatively, you can install work apps from the Android for Work apps page. See Install work app (page 198).

For information how to uninstall a work app from devices, see Uninstall work app (page 199).

Remove app

In Select source, select Apps to select an app for removal from the list of available apps.

In addition to the apps that are available on the Sophos Mobile Control server, the list includes apps that are in use on the managed devices - with the exception of Android system apps and apps that have been pre-installed by the device manufacturer.

You can also remove an app that is not contained in the list. Select Identifier and then enter the package name of the app you want to remove from devices. If you select Knox container app, the app will be removed from the Samsung Knox container.

When the task is transferred to devices, users receive a notification on their devices that Sophos

Mobile Control wants to remove the app. Users can tap OK to start the process, or Not now to be notified again after a short period of time.

If users tap OK but then tap Cancel in the subsequent Android dialog, the task fails.

If the app is not installed on a device that receives the task, no notification is displayed.

You can add more than one task of this type to a task bundle.

168

administrator help

Send message

Enter a plain text to be displayed on the devices.

When the task is transferred to devices, the message text is displayed in a notification window.

Users can display past messages on the Messages page of the Sophos Mobile Control app.

You can add more than one task of this type to a task bundle.

Unenroll

When the task is transferred to devices, they are unenrolled from Sophos Mobile Control. See

Unenroll devices (page 54). Device users do not need to confirm the operation.

You cannot add an Unenroll and a Wipe task to the same task bundle.

Wipe

When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.

Important: Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.

Note: When a Wipe task is transferred to a device that is enrolled with Android for Work, only the work profile and all work apps are removed.

You cannot add an Unenroll and a Wipe task to the same task bundle.

Knox container: lock

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container is locked.

If the task is transferred to a device that does not support Samsung Knox, the task fails.

Knox container: unlock

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container is unlocked.

If the task is transferred to a device that does not support Samsung Knox, the task fails.

Knox container: reset password

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container password is reset. Users must set a new password to unlock the Knox container.

If the task is transferred to a device that does not support Samsung Knox, the task fails.

169

Sophos Mobile Control

Knox container: remove

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container

(including any container-related configuration) is removed.

If the task is transferred to a device that does not support Samsung Knox, the task fails.

Trigger SMSec scan

When the task is transferred to devices, the Sophos Mobile Security app is silently triggered to perform a scan against malware and potentially unwanted apps (PUAs).

This task requires that Sophos Mobile Security is managed from Sophos Mobile Control, that is,

a Mobile Security policy is assigned to the device. See Manage Sophos Mobile Security (page

205).

If Sophos Mobile Security is not managed by Sophos Mobile Control on a device that receives the task (that is, if a Mobile Security policy is not assigned to the device), the task remains in the state Will be retried.

15.3 Available iOS task types

The following task types are available for iOS task bundles:

Enroll

When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.

When the task is transferred to a device that is already enrolled, no enrollment email is sent.

Install profile or assign policy

Select a profile or policy from the list of available profiles and policies. For information on how to

add profiles or policies to this list, see Profiles and policies (page 69).

When the task is transferred to devices, the profile is silently installed or the policy is silently assigned.

You can add more than one task of this type to a task bundle.

Remove profile

In Select source, select Profiles and then select a profile from the list.

In addition to the profiles that are available on the Sophos Mobile Control server, the list includes profiles that are in use on the managed devices.

170

administrator help

You can also remove a profile that is not contained in the list. Select Identifier and then enter the identifier of the profile you want to remove from devices.

When the task is transferred to devices, the profile is silently removed.

You can add more than one task of this type to a task bundle.

Note: You cannot directly remove a Sophos container policy from devices. Instead, use the device action Unenroll Sophos container. This will also remove the related policy from the device.

Install provisioning profile

Select an app provisioning profile from the list of available profiles. For information on how to add

profiles to this list, see Import provisioning profiles for iOS apps (page 71).

When the task is transferred to devices, the provisioning profile is silently installed.

Remove provisioning profile

In Select source, select Profiles and then select a provisioning profile from the list.

In addition to the profiles that are available on the Sophos Mobile Control server, the list includes profiles that are in use on the managed devices.

You can also remove a provisioning profile that is not contained in the list. Select Identifier and then enter the identifier of the profile you want to remove from devices.

When the task is transferred to devices, the provisioning profile is silently removed.

Install app

Select an app from the list of all available apps. For information on how to add apps to this list, see

Add app (page 174).

When the task is transferred to devices, users receive a notification on their devices that Sophos

Mobile Control wants to install the app. Users can tap Install to start the process, or Cancel to reject the installation.

If users reject the installation, the task fails.

If the app is already installed on a device that receives the task, it is updated.

You can add more than one task of this type to a task bundle.

Remove app

In Select source, select Apps to select an app for removal from the list of available apps.

In addition to the apps that are available on the Sophos Mobile Control server, the list includes apps that are in use on the managed devices - with the exception of iOS system apps.

You can also remove an app that is not contained in the list. Select Identifier and then enter the bundle ID of the app you want to remove from devices.

171

Sophos Mobile Control

When the task is transferred to devices, the app is removed silently.

You can add more than one task of this type to a task bundle.

Send message

Enter a plain text to be displayed on the devices.

When the task is transferred to devices, the message text is displayed in a notification window.

Users can display past messages on the Messages page of the Sophos Mobile Control app.

You can add more than one task of this type to a task bundle.

Unenroll

When the task is transferred to devices, they are unenrolled from Sophos Mobile Control. See

Unenroll devices (page 54). Device users do not need to confirm the operation.

You cannot add an Unenroll and a Wipe task to the same task bundle.

Wipe

When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.

Important: Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.

You cannot add an Unenroll and a Wipe task to the same task bundle.

15.4 Duplicate task bundles

Since creating a task bundle can be time-consuming, you can duplicate finished task bundles.

This function is helpful if several extensive task bundles with similar tasks are required. Then only a few tasks need to be deleted or added.

Note: You can only duplicate task bundles if they are not edited at the same time. Copies are named “Copy of” plus the name of the original. You can rename the bundles according to your requirements.

1. On the menu sidebar, under CONFIGURE, click Task bundles and select Android or Apple

iOS.

The Task bundles page is displayed.

2. Click the blue triangle next to the task bundle you want to duplicate and then click Duplicate.

The task bundle is duplicated and shown on the Task bundles page. You can now edit the duplicated task bundle as required. To edit the task bundle, click the blue triangle next to it and then click Edit.

172

administrator help

15.5 Transfer task bundles to individual devices or to device groups

1. On the menu sidebar, under CONFIGURE, click Task bundles and select Android or Apple

iOS.

The Task bundles page is displayed.

2. Click the blue triangle next to the required task and then click Transfer.

The Select devices page is displayed.

3. On this page, you can:

■

■

Select individual devices you want to transfer the task bundle to.

Click Select device groups, to open the Select device groups page and select one or several device groups for transferring the task bundle.

4. After you have made your selection, click Next.

The Set execution date page is displayed.

5. Under Scheduled date, select Now or specify a Date and Time for the execution of this task.

6. Click Finish.

The Task view is shown.

The task bundle is transferred to the selected devices at the specified date and time.

173

Sophos Mobile Control

16 Apps

You configure apps in Sophos Mobile Control to make them available for installation through the

Sophos Mobile Control console (administrator-initiated) or through the Sophos Mobile Control app (user-initiated).

To make an app available in Sophos Mobile Control, you can do one of the following:

■

You upload the app package to the Sophos Mobile Control server. This option is not available for Windows Mobile apps.

■

You provide a link to the app in the relevant app store.

For both options, see section

Add app (page 174).

To install an app on a device, create a task bundle that contains an Install app task. For Android and iOS devices, you can create such task bundles directly from the Apps page. See

Install app

(page 176).

Note:

To be able to install app packages that are stored on the Sophos Mobile Control server (in contrast to the installation from the app store), the following conditions must be met:

■

■

For Android, the Android security setting Unknown sources must be enabled on the devices.

When you try to install an APK file when Unknown sources is disabled, the Sophos Mobile

Control app will direct the users to the page where they can enable the setting. This restriction does not apply to devices with LG GATE, Samsung Knox or Sony Enterprise API.

For iOS, the installation of apps from IPA files is only possible for self-developed apps. When the app is ready for distribution, you must create a provisioning profile for the app and make it available on the devices, either installed separately beforehand or included in the app's IPA file. You can use Sophos Mobile Control to distribute provisioning profiles to your iOS devices.

See

Import provisioning profiles for iOS apps

(page 71). For details on provisioning profiles, see the iOS Developer Library.

16.1 Add app

You make an app available for installation either by uploading the app package or by linking to the app in the relevant app store.

1. On the menu sidebar, under CONFIGURE, click Apps and then select the platform for which you want to add the app.

2. On the Apps page, click Add app and then select:

■

■

Android package or iOS package to add the app by uploading the APK file (for Android apps) or IPA file (for iOS apps).

Android link, iOS link or Windows Mobile link to add the app by linking to it in the relevant app store.

On the next page, you configure the app details.

174

administrator help

Note: For iOS links, you can click Search in iTunes to search for the app in the iTunes database.

When you select an app in the search results list, the relevant fields on the Edit iOS link page will be populated from the corresponding iTunes values.

3. Enter a Name for the new app.

4. Optional: For app packages, enter a Version that is displayed in the Enterprise App Store.

For app links, the version is displayed as

Google Play Store

or

App Store

. In the

Enterprise App Store this is replaced by the actual version from the app store.

5. Optional: In the App identifier field, enter the internal identifier of the app.

Leave this field empty if you do not know the exact identifier. In most cases, Sophos Mobile

Control can read the value from the app itself and then fills in this field automatically.

6. Optional: In the App category field, enter a category name, for example

Recommended

.

When you make the app available in the Enterprise App Store as described in the next step, the app will be listed in a section with that name.

7. You can make the app available in the Enterprise App Store so that it's installation can be initiated by the user. Click Show next to Available to device groups and select one or more device groups for which the app will be listed in the Enterprise App Store.

8. For iOS devices, when you select SMC managed installation, the app will be installed as a managed app.

Certain device profile settings are only available for managed apps.

Note: The SMC managed installation setting only affects apps that are installed by the user from the Enterprise App Store. Apps that you install from the Sophos Mobile Control console are always managed.

For information on managed apps, see

Managed apps for iOS (page 177).

9. Optional: In the Description text field, enter a description that is displayed in the Enterprise

App Store.

Note: You may use the placeholder

%_appstoretext_%

anywhere in your description text.

In the Enterprise App Store, this is replaced by the actual app description from Google Play or the App Store.

10. Click Show next to Operating systems and select the operating system versions the app applies to.

11. For Samsung Knox devices, when you select Install in Knox container, the app will be installed inside the Knox container.

This option is only available when a Samsung Knox Premium license key is configured on the

System setup page.

12. Configure the app source.

■

For app links, enter the URL of the app in the relevant app store in the Link field.

To determine the URL, click the link below the Link field to open the app store in a new browser tab and navigate to the app page. Then copy the URL from the tab's address bar and paste it into the Link field.

175

Sophos Mobile Control

■

For app packages, click Upload a file to upload the app to the Sophos Mobile Control server. Navigate to the APK file (for Android apps) or IPA file (for iOS apps) and click Open.

Note:

The package file size must not exceed a certain limit.

For on-premise installations, the limit is configured by your super administrator. For Sophos

Mobile Control as a Service, it is set to 100 MB per package.

13. When you have configured the app details, click Save to save the app settings and to return to the Apps page.

The app is available for installation. It is displayed on the Apps page. If you have configured the

Available to device groups field, the app is also displayed in the Enterprise App Store of the

Sophos Mobile Control app from where users can install it. The installation process runs unattended or with very little user interaction.

16.2 Install app

Note: This section only applies to Android and iOS devices.

When you have added an app to Sophos Mobile Control as described in Add app

(page 174), you can manually install it on selected devices or device groups.

1. On the menu sidebar, under CONFIGURE, click Apps and then click Android or Apple iOS.

2. On the Apps page, click the blue triangle next to the required app and then click Install.

3. Select the devices on which you want to install the app. Do one of the following:

■

■

Select individual devices.

Click Select device groups and then select one or more device groups.

When you are ready, click Next.

4. On the Set execution date page, specify the date when the app will be installed:

■

■

Select Now for an immediate execution.

Select Date and then enter a date and a time for a scheduled execution.

5. Click Finish.

The selected app is installed onto the selected devices at the specified date.

On supervised iOS devices and on Android devices with the Sophos Samsung Plugin app installed, apps are installed silently, that is without user interaction.

16.3 Uninstall app

Note: This section only applies to Android and iOS devices.

When you have added an app to Sophos Mobile Control as described in Add app

(page 174), you can manually uninstall it from selected devices or device groups.

1. On the menu sidebar, under CONFIGURE, click Apps and then click Android or Apple iOS.

2. On the Apps page, click Uninstall.

176

administrator help

3. Select the devices from which you want to uninstall an app. Do one of the following:

■

■

Select individual devices.

Click Select device groups and then select one or more device groups.

When you are ready, click Next.

4. On the Select app page, select the required app.

5. On the Set execution date page, specify the date when the app will be uninstalled:

■

■

Select Now for an immediate execution.

Select Date and then enter a date and a time for a scheduled execution.

6. Click Finish.

The selected app is uninstalled from the selected devices at the specified date.

Managed apps on supervised iOS devices are uninstalled silently, that is without user interaction.

Tip: Alternatively, you can use the following procedure to uninstall an app from a single device:

Open the device's Show device page, go to the Installed apps tab and then click the trash can icon next to the app name.

16.4 Managed apps for iOS

For iOS apps that you add to Sophos Mobile Control, you can choose to have the app installed as managed or unmanaged on the users’ devices.

Managed apps have the following characteristics:

■

When users select a managed app in the Enterprise App Store, an installation task is created and processed in Sophos Mobile Control. In contrast, when users select an unmanaged app, they are redirected to the Apple App Store to install the app from there.

■

■

■

You can uninstall managed apps through the Sophos Mobile Control console. This is not possible for unmanaged apps.

On supervised iOS devices, managed apps are installed and uninstalled silently, that is without user interaction.

Certain settings in iOS device profiles are only available for managed apps.

■

When an iOS device is unenrolled from Sophos Mobile Control, all managed apps are automatically removed from the device. Unmanaged apps will remain on the device.

The following rules determine if an app is installed managed or unmanaged:

■

Apps that you install from the Sophos Mobile Control console are always managed.

■

■

Apps that the user installs from the App Store are always unmanaged.

Apps that the user installs from the Enterprise App Store are managed if you have activated the SMC managed installation setting in the app properties, as described in

Add app (page

174).

To check the app status on a device, open the Show device page for that device and go to the

Installed apps tab. See The Show device page

(page 55).

Tip: If a user has installed an unmanaged app you can convert it into a managed app. To do this, configure the app in Sophos Mobile Control as managed, and then create an installation task

177

Sophos Mobile Control for it. Because the app is already installed, it is not installed again, but its status changes from

unmanaged to managed.

16.5 Manage apps purchased through Apple VPP

With the Apple Volume Purchase Program (VPP), you can buy iOS apps in volume for distribution within your company.

After an order placed with Apple VPP has been completed, you can download an sToken (service token) that contains the licenses for the apps purchased.

In Sophos Mobile Control, you can provide the licenses included in the sToken to users by inviting them to become authorized Apple VPP users. After users have accepted their invitation, they become authorized VPP users and you can assign VPP apps to them. Users can install assigned

VPP apps onto their devices using iTunes.

You can also assign VPP apps to devices with iOS 9 or higher. You do not need to invite devices to VPP. You install an assigned VPP app on a device through Sophos Mobile Control.

The process for inviting users to become authorized VPP users differs depending on whether you use Sophos Mobile Control's internal or external user management. The instructions in the subsequent sections cover both.

For information on internal and external user management, see the Sophos Mobile Control super administrator guide .

For detailed information on how to enroll and use Apple VPP, see http://www.apple.com/business/vpp/ .

For detailed information on how to assign VPP apps to users or devices, see

Automatically assign

VPP apps (page 181) and Manually assign VPP apps (page 181).

16.5.1 Set up a VPP sToken

To provide licenses for apps purchased through the Apple Volume Purchase Program (VPP) in

Sophos Mobile Control, you need to set up an sToken (service token).

1. On the menu sidebar, under SETTINGS, click Setup > System setup.

2. On the System setup page, click the Apple VPP tab.

3. Click the Apple iTunes VPP Portal link.

This opens the Apple VPP web portal in a new browser window.

4. On that page, select Business.

5. In the Business Store Sign In dialog, enter your Apple ID and your password.

6. Go to the Account Summary page and click Download Token.

The sToken is generated and saved to your local computer in a text file with extension

.vpptoken

, using the download settings of your web browser.

7. Optional: Move the sToken file to a location that you can access from the Sophos Mobile

Control console.

178

administrator help

8. Go back to the Apple VPP tab of the Sophos Mobile Control console, click Upload a file, select the sToken file and then click Open.

Sophos Mobile Control reads in the file and populates the Organization and Expiry date fields from the sToken details.

9. In the Automatically assign VPP apps on installation list, you can configure the automatic

assignment of VPP apps. See Automatically assign VPP apps (page 181).

10. Optional: Fill in the remaining fields of the Apple VPP tab.

In the Country field, enter your two-letter country code, for example

US

for the United States.

11. Click Save.

Note: To notify when the sToken is about to expire, Sophos Mobile Control sends several email reminders to all administrators of the relevant customer, starting 30 days prior to the expiry date.

16.5.2 Invite users to Apple VPP

You need to set up an sToken before you can invite users to the Apple Volume Purchase Program

(VPP). See

Set up a VPP sToken

(page 178).

1. On the menu sidebar, under MANAGE, click Users.

2. On the Show users page, you can invite all users or individual users to Apple VPP:

■

To invite all users:

1. Click Invite users to Apple VPP at the top of the Show users page.

2. Click Yes in the confirmation dialog box.

■

To invite a single user:

1. Click the required user name.

2. On the Show user page, click Invite user to VPP.

3. Click Yes in the confirmation dialog box.

■

To invite a single user, when using external user management and the user has no devices enrolled yet:

1. Click Search and invite a user to Apple VPP at the top of the Show users page.

2. In the Search user dialog, search for the user either by name or by email address.

3. In the search result list, select the user that you want to invite to Apple VPP.

4. Click Apply.

Sophos Mobile Control sends an invitation email to all relevant users.

Users must follow the link in their invitation email to connect their Apple iTunes account with Apple

VPP. Afterward, they can install and use the apps that are licensed by your company.

Note:

When you are using external user management and invite all users to Apple VPP, users that do not have an email address assigned will be registered for Apple VPP, but do not receive the link to connect their Apple iTunes account with Apple VPP.

For information on how to complete the VPP registration process in this case, see

Invite users without email address to Apple VPP

(page 180).

179

Sophos Mobile Control

16.5.3 Invite users without email address to Apple VPP

Prerequisite: This procedure requires a super administrator account, so it does not apply to

Sophos Mobile Control as a Service.

When you invite users from an external user directory to Apple VPP as described in

Invite users to Apple VPP

(page 179), users that do not have an email address assigned will be registered for

Apple VPP, but will not receive the link to connect their Apple iTunes account with Apple VPP.

If this happens, perform the following steps to complete the Apple VPP registration process.

1. As Sophos Mobile Control super administrator, download the server log files.

See the Sophos Mobile Control super administrator guide .

2. Identify the affected user accounts from the log files.

3. On the menu sidebar of the Sophos Mobile Control console, under MANAGE, click Users.

4. On the Show users page, click one of the affected user names.

5. On the Show user page, click Show invitation link.

For external users without email address, this function does not send an invitation email, but instead shows the invitation link in a message box.

6. Copy the link from the message box and communicate it to the user.

7. Repeat this for all affected users.

The users need to follow the link to connect their Apple iTunes account with Apple VPP.

16.5.4 Manage Apple VPP users

When you have set up an Apple VPP sToken as described in Set up a VPP sToken (page 178),

the Show user page of each user includes an Apple Volume Purchase Program (VPP) section.

In this section, you can perform the following tasks to view or edit the Apple VPP status of the user:

■

View the Apple VPP user status. This can be:

■

Not registered: The user has not been invited to Apple VPP.

■

■

Registered: The user has been invited to Apple VPP, but has not connected their Apple iTunes account with Apple VPP.

Associated: The user has connected their Apple iTunes account with Apple VPP and can install VPP apps.

■

■

View the Apple VPP apps that the user has installed.

Invite the user to Apple VPP by clicking Invite user to VPP.

In most cases, an email with an invitation link is sent to the user. If the user account does not contain an email address, an invitation link will be displayed in a message box.

■

■

Send another invitation email if the user did not receive or lost the initial email, by clicking

Re-send invitation email.

Deregister the user from Apple VPP by clicking Delete VPP registration.

180

administrator help

16.5.5 Automatically assign VPP apps

By default, apps that you purchased through the Apple Volume Purchase Program (VPP) are automatically assigned to the device on which the app is installed. If the device does not support the assignment of VPP apps, the app is assigned to the user that is assigned to the device.

Note: To support the assignment of VPP apps, the device must have the status managed and use iOS 9 or higher.

You can invert the order of precedence and favor user assignment over device assignment, or you can disable automatic assignment and instead assign VPP apps manually, as described in

Manually assign VPP apps

(page 181).

The automatic assignment of VPP apps is configured per customer.

1. On the menu sidebar, under SETTINGS, click Setup > System setup.

2. On the System setup page, click the Apple VPP tab.

3. In the list Automatically assign VPP apps on installation, select the desired option:

■

■

■

Preferably to device: If the device supports it, the VPP app is assigned to the device.

Otherwise, the VPP is assigned to the user that is assigned to the device. If there is no user assigned to the device, app assignment will fail.

Preferably to user: If a user is assigned to the device, the VPP app is assigned to that user. Otherwise, the app is assigned to the device. If the device does not support it, app assignment will fail.

Disabled: VPP apps are not assigned automatically. If you select this option, VPP apps must be assigned manually.

16.5.6 Manually assign VPP apps

This section describes the manual assignment of individual VPP apps. By default, apps that you purchased through the Apple Volume Purchase Program (VPP) are automatically assigned to the device on which the app is installed. See

Automatically assign VPP apps (page 181).

You can assign apps that you purchased through the Apple Volume Purchase Program (VPP) to users or to devices. After you assign a VPP app to users that are associated with Apple VPP, they can install it on all iOS devices that are associated with their Apple ID. After you assign a

VPP app to devices, you can push it to the devices through Sophos Mobile Control.

To assign a VPP app to users or devices:

1. On the menu sidebar, under CONFIGURE, click Apps > Apple iOS.

This opens the Apps page that displays a list of all apps that you have added to Sophos Mobile

Control.

2. To add apps you purchased through Apple VPP to the app list, click Import VPP apps.

This retrieves the app information from the Apple VPP server and creates app entries in Sophos

Mobile Control, if required.

3. Click the blue triangle next to the VPP app you want to assign to users or devices and then click Edit.

4. On the Edit iOS link page, click Show next to the VPP licenses option.

This opens the VPP licenses dialog.

181

Sophos Mobile Control

5. To assign the app to one or more users, click VPP users and then select the required users.

The list contains all users that are registered for or associated with Apple VPP.

6. To assign the app to one or more devices, click Devices and then select the required devices.

The list contains all devices with iOS 9 or higher and status Managed.

7. Click Apply to confirm the changes and to close the VPP licenses dialog.

8. Click Save to save the changes and to synchronize the app assignment with the Apple VPP server.

Tip: To discard assignment changes that you made in the VPP licenses dialog, click Apply to close the dialog box and then click Back to leave the Edit iOS link page without saving the changes to the database.

To install the assigned app on a device:

■

After the app is assigned to users, it is listed in the Purchased view of the iTunes app on their devices. The users can install it from there.

■

After the app is assigned to devices, you can install it through Sophos Mobile Control. See

Install app

(page 176).

To deassign an app:

■

Open the VPP licenses dialog box as described before and then clear the selection of the required users or devices.

Note: Because the status of VPP apps is managed by the Apple VPP server, it may take some time until changes that you make in Sophos Mobile Control are visible on the devices.

16.5.7 Synchronize VPP license information

For performance reasons, Sophos Mobile Control keeps a local copy of VPP license information.

You can trigger Sophos Mobile Control to synchronize its VPP data with the Apple VPP server.

Note: You only need to synchronize the VPP data if the displayed license information for an app is incorrect.

1. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the Apple

VPP tab.

2. Click Clear VPP cache.

Sophos Mobile Control discards its local VPP information for the customer and synchronizes the data with the Apple VPP server.

Note: For information how to display the license information for a VPP app, see Manually assign

VPP apps

(page 181).

16.6 Configure per app VPN and settings for iOS apps

For iOS apps, you can select a per app VPN to support the iOS feature Per app VPN. With this feature, apps can be configured to automatically connect to VPN when they are started. You can also configure settings for the app that will be deployed on the device during the app installation.

182

administrator help

Prerequisites:

■

■

To be able to select a per app VPN, you need to define a Per app VPN configuration in an iOS configuration profile. See

Per app VPN configuration (iOS device profile)

(page 128).

To define settings, you need to know the required parameter and the parameter type.

1. On the menu sidebar, under CONFIGURE, click Apps and then click Apple iOS.

2. On the Apps page, click the blue triangle next to the required app and then click Edit.

3. On the Edit iOS link or Edit iOS package page, click Show next to the Settings and VPN field.

4. On the Edit settings and VPN page, select the required configuration from the Per app VPN list to define the VPN the app is supposed to connect to.

5. To add managed settings, click Create parameter.

6. In the Configuration parameter dialog, configure the following: a) In the Parameter field, enter the required parameter, for example, SMC_URL.

b) In the Value field, enter the parameter value, for example,

smc.sophos.com

.

c) In the Type list, select the parameter type: String, Bool, Integer or Real.

d) Click Apply.

The set of managed settings is displayed on the Edit Settings and VPN page.

7. On the Edit settings and VPN page, click Apply.

8. Click Save.

The selected per app VPN will be used when the app connects to VPN. The settings will be provided to the devices during the app installation.

183

Sophos Mobile Control

17 App groups

In Sophos Mobile Control you create app groups to define list of apps for profiles, policies and compliance rules.

App groups are used in the following settings:

■

In the App Protection configuration of Android device profiles.

■

■

■

■

In the App Control configuration of Android device profiles.

In the Restrictions configuration of Android device profiles, iOS device profiles and Knox container profiles.

In the App restrictions configuration of Windows Mobile policies.

In compliance rules to specify lists of allowed, forbidden and mandatory apps.

17.1 Create app group

1. On the menu sidebar, under SETTINGS, click App groups and then select the platform for which you want to create the group.

2. On the App group page, click Create app group.

3. On the Edit app group page, enter a Name for the new app group and then click Add app.

4. In the Edit app dialog box you can either select an app from a list or enter custom app data.

■

■

To select an app from a list, click App list and then select an app from the list of all apps that are currently installed on the managed devices for the platform you selected.

To enter custom app data for an Android app, click Custom and then configure the following information:

■

App name: An arbitrary name that is used to identify the app.

■

Identifier: The package name of the app. The package name can be retrieved from the app's URL in Google Play. For example for the Sophos Mobile Control Android app, the

Google Play URL is https://play.google.com/store/apps/details?id=com.sophos.mobilecontrol.client.android

and the package name is

com.sophos.mobilecontrol.client.android

.

■

To enter custom app data for an iOS app, click Custom and then configure the following information:

■

App name: An arbitrary name that is used to identify the app.

■

Identifier: The bundle ID of the app.

184

administrator help

■

To enter custom app data for a Windows Mobile app, click Custom and then configure the following information:

■

App name: An arbitrary name that is used to identify the app.

■

Link: The URL of the app in the Windows Store. For example, the Windows Store URL of the Sophos Mobile Control Windows app is https://www.microsoft.com/en-us/store/apps/mobile-control/9nblggh0g04v.

■

GUID: If you know the GUID of the app, you can enter it instead of the link. Otherwise, leave this field empty.

5. After you have selected an app from the list or entered custom app data, click Add to add it to the app group.

6. Optional: Add more apps to the app group.

7. When you are ready, click Save to save the app group.

17.2 Import app group

You can create an app group by importing a UTF-8 encoded comma-separated values (CSV) file with up to 10,000 apps.

Note: Use a text editor for editing the CSV file. If you use Microsoft Excel, values entered may not be resolved correctly. Make sure that you save the file with extension

.csv

.

Tip: A sample file with the correct column names and column order is available for download from the Import apps page.

To import apps from a CSV file and add them to an app group:

1. On the menu sidebar, under SETTINGS, click App groups and then select the platform for which you want to create the group.

2. On the App group page, click Create app group.

3. On the Edit app group page, enter a Name for the new app group and then click Import

apps.

4. On the Import apps page, click Upload a file and then navigate to the CSV file that you have prepared.

The entries are read in from the file and are displayed.

5. If the data is not formatted correctly or is inconsistent, the file as a whole cannot be imported.

In this case, follow the error messages that are displayed next to the relevant entries, correct the content of the CSV file accordingly and upload it again.

6. Click Finish to add the apps to the app group.

7. On the Edit app group page, click Save.

185

Sophos Mobile Control

18 Corporate documents

Note: This feature requires an SMC Advanced license.

In Sophos Mobile Control, you can upload files for distribution to the devices of your users.

■

■

Documents managed in Sophos Mobile Control are automatically added to the Corporate

Documents store of Sophos Secure Workspace.

In the Corporate Documents store on the device, the Category that can be defined for each document is shown as folder.

■

■

If Sophos Secure Workspace is not managed by Sophos Mobile Control, the Corporate

Documents store is not visible.

Documents in Corporate Documents are read only. They cannot be edited in Sophos Secure

Workspace and then uploaded again.

To distribute corporate documents:

1. Install the Sophos Secure Workspace app onto the devices. See Apps (page 174).

2. Assign a Sophos container policy with a Corporate Documents configuration.

3. Upload documents to Sophos Mobile Control.

18.1 Add corporate documents

Prerequisite: You have activated an SMC Advanced license.

To distribute documents to devices:

1. On the menu sidebar, under CONFIGURE, click Documents.

The Documents page is displayed.

2. Click Add document.

The Edit document page is displayed.

3. Enter a category for the document.

■

The Category is the name of the folder in which the document is displayed in the Corporate

Documents store on the device.

■

■

Multiple files can have the same Category.

If you leave this field blank, the file will be shown in the root folder of Corporate Documents.

186

administrator help

4. Define settings for the document:

■

Select Copy to clipboard to allow users to copy the document to the clipboard.

■

■

Select Share document to allow users to share the document.

Select Use document offline to allow users to create a Favorite for the document.

When a plain document from Corporate Documents is marked as Favorite, it will be stored encrypted in the Sophos Secure Workspace app. When sharing the document is allowed, the encrypted favorite file will be decrypted automatically before it is forwarded to other apps. If you clear the Use document offline check box and users already have offline copies, the file stored in Sophos Secure Workspace Favorites on the managed devices will be removed automatically as part of the next synchronization.

5. Click Show next to Assigned groups and select the group that should have access to the document.

6. Add a description for the document.

7. Click Upload a file and navigate to the document. Select it and click Open.

The document file size must not exceed a certain limit.

For on-premise installations, the limit is configured by your super administrator. For Sophos

Mobile Control as a Service, it is set to 5 MB per document.

8. Repeat this step for each document you want to distribute.

The document is added to the documents list. It is distributed to the users, who can view it in the

Sophos Secure Workspace app.

187

Sophos Mobile Control

19 Android for Work

Android for Work is a Google program to separate personal and corporate data on an Android device.

If you have registered your company with Android for Work, you can set up Sophos Mobile Control as a third-party EMM (Enterprise Mobility Management) provider for your Android for Work domain.

Android for Work supports different deployment scenarios. Sophos Mobile Control uses the BYOD

(bring your own device) scenario:

■

Users have to create a work profile on their devices.

■

■

■

■

■

The work profile will be attached to the primary device profile, that is the personal profile, so that its content is available to the personal profile.

Sophos Mobile Control manages the content of the work profile. It registers itself as the profile

owner.

When a device is enrolled with Android for Work, all the apps in the work profile, including the

Sophos Mobile Control app, are marked with a briefcase badge.

Users use the badged version of the Google Play Store app to install work apps from Google

Play for Work.

You can configure the content and layout of Google Play for Work using Sophos Mobile Control.

Related Links

Android for Work Help Center (external link)

19.1 Set up Android for Work

You must initially set up Android for Work for a customer to enable the Android for Work features.

1. Register an Android for Work domain with Google.

2. Create an enterprise service account and configure the APIs that are required to communicate with the Google services.

3. Bind Sophos Mobile Control to your Android for Work domain.

188

administrator help

19.1.1 Register domain with Google

In the first stage of the setup procedure for Android for Work, you register a domain with Google

(Managed Google Domain), create a domain administrator (Managed Google Account) and verify your domain ownership.

Note: If you already have a Managed Google Domain, for example because you have signed up for G Suite (formerly Google Apps), you can skip this section. Instead, enable Android for Work for your domain from the Google Admin console.

1. Click the following link https://www.google.com/a/signup/?enterprise_product=ANDROID_WORK to sign up for Android for Work.

2. Fill the web form with the required information.

■

Under About your business, enter the domain that will be used as the Managed Google

Domain in Business domain address. For example, you could use the domain of your

Sophos Mobile Control server.

Note: If you want to configure Android for Work for more than one customer in Sophos

Mobile Control, you need a separate domain for each customer.

■

Under Your Google admin account, enter the credentials for a new domain administrator.

Note: Make a note of the credentials as you will need them later in the setup procedure.

3. Click the button to create the domain administrator account.

This opens the setup page for Android for Work in the Google Admin console.

Tip: You can also access the setup page manually: Open the following web address https://admin.google.com

and log in with the credentials of the domain administrator you’ve created.

4. In the Google Admin console, start the procedure to verify your domain ownership.

Follow the instructions provided by Google to verify your domain.

After your domain ownership is verified, you receive a token to connect your Android for Work domain with your third-party EMM provider, that is, with Sophos Mobile Control.

Next, you must create a Google service account and configure the relevant APIs for Android for

Work. See

Configure Google service account

(page 189).

19.1.2 Configure Google service account

In the second stage of the setup procedure for Android for Work, you create and configure a

Google service account.

Prerequisite: You have a domain administrator account for your Android for Work domain.

A Google service account is a special type of Google account for an application. This account is used by Sophos Mobile Control to communicate with the Google Android for Work API.

Create a project:

1. Click the following link https://console.developers.google.com/apis/library to open the Google

API console. Log in with the credentials of your domain administrator account.

189

Sophos Mobile Control

2. In the header bar of the Google API console, click Project > Create project.

If you already have a project, the header bar shows the project name instead of the word

Project.

3. In the New project dialog, enter a project name, for example

Android for Work

, and then click Create.

Enable the required APIs:

4. On the menu sidebar, click Library, and then enter the string

admin sdk

in the search field.

5. In the search result list, click Admin SDK.

6. At the top of the Admin SDK page, click Enable.

7. Click Library again and repeat the previous three steps for the Google Play EMM API.

This time, use

emm

as a search string.

Create a service account:

8. On the Google Play EMM API page, click Go to Credentials.

9. In step one of the Add credentials to your project page, click the service account link.

10. On the Service Accounts page, click Create Service Account.

11. In the Create service account dialog box, enter the following settings: a) In Name, enter a name to identify the service account, for example

Android for Work

.

b) Select Furnish a new private key and then select JSON.

c) Select Enable G Suite Domain-wide Delegation.

d) In Product name for the consent screen, enter for example

Android for Work

.

When you click Create, the private key for your service account is generated and saved to your computer in a JSON file.

Note: Store the JSON file in a secure location. You need it to bind Sophos Mobile Control to your Android for Work domain.

Configure API access:

12. Click the following link https://admin.google.com

to open the Google Admin console and log in with the credentials of your domain administrator account.

13. Click Security and then click Advanced settings.

Tip: You may need to click Show more to display Advanced settings.

14. Click Manage API client access.

15. Open the JSON file in a text editor and copy the client_id

value into the Client Name field.

For example, if your JSON file contains a line

"client_id": "123456789", then enter

123456789

in the Client Name field.

190

administrator help

16. In the One or more API Scopes field, enter the following two URLs, separated by a comma: https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/androidenterprise

17. Click Authorize.

You can now bind Sophos Mobile Control to your Android for Work domain. See Bind Sophos

Mobile Control to your domain

(page 191).

19.1.3 Bind Sophos Mobile Control to your domain

In the third stage of the setup procedure for Android for Work, you bind Sophos Mobile Control to your Android for Work domain.

Prerequisites:

■

You have a domain administrator account for your Android for Work domain.

■

■

You have verified your domain ownership.

You have enabled the Android for Work APIs.

■

You have created a service account for Android for Work.

1. Log in to the Sophos Mobile Control console. Use an administrator account for the customer for which you want to set up Android for Work.

2. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Android tab.

3. Under Android for Work, click Configure.

4. In the dialog box that opens, configure the following settings:

Business domain

Domain administrator

EMM token

Your Android for Work domain that has been verified by Google.

The name of your domain administrator account.

This is the administrator that you created when you registered your Android for Work domain with

Google.

The token that you received from Google after you verified your domain ownership.

You can view the token when you log in to the

Google admin console ( https://admin.google.com

) with your domain administrator credentials and navigate to Security > Android for Work settings.

5. Click Upload a file and then navigate to the JSON file that you downloaded from Google when creating the service account for Android for Work.

6. Click Bind.

7. On the Android tab, click Save.

191

Sophos Mobile Control

Sophos Mobile Control contacts the Google web service to bind itself as an EMM provider to your

Android for Work domain.

In the final stage of the setup procedure for Android for Work, you must configure the Google

EMM settings. See

Configure EMM settings (page 192).

19.1.4 Configure EMM settings

In the final stage of the setup procedure for Android for Work, you configure the Google EMM settings.

Prerequisite: You have bound Sophos Mobile Control to your Android for Work domain.

1. Click the following link https://admin.google.com

to open the Google Admin console and log in with the credentials of your domain administrator account.

2. Click Security and then click Manage EMM provider for Android.

Tip: You may need to click Show more to display Manage EMM provider for Android.

3. Under General Settings, select Enforce EMM policies on Android devices.

This completes the setup procedure for Android for Work.

19.2 Configure Android for Work

To enable your users to enroll their devices with Android for Work, you must complete the following configuration tasks:

1. Create an Android for Work policy and configure at least one Restrictions configuration. See

Configurations for Android for Work policies

(page 92).

2. Create a task bundle that is transferred to a device when a user enrolls with Android for Work on the Self Service Portal. The task bundle must contain at least an Enroll task and an Install

profile or assign policy task for an Android for Work policy. You may use different task bundles for corporate and private devices. See

Create task bundle (page 166).

3. In the Self Service Portal setup, decide whether enrollment with Android for Work is optional or mandatory when users enroll a device with Sophos Mobile Control. See

Configure Android for Work device enrollment

(page 192).

19.2.1 Configure Android for Work device enrollment

Your users enroll their devices with Android for Work through the Self Service Portal. In Sophos

Mobile Control, you configure whether enrollment with Android for Work is optional or mandatory, and which task bundles are transferred to the devices.

Prerequisites

■

You have configured Android for Work for the customer.

■

You have created a task bundle for the Android for Work device enrollment. The task bundle must contain at least an Enroll task and an Install profile or assign policy task for an Android for Work policy. You may use different task bundles for corporate and private devices.

1. On the menu sidebar, under SETTINGS, click Setup > Self Service Portal, and then click the Group settings tab.

192

administrator help

2. Click the blue triangle next to the Self Service Portal group for which you want to configure the Android for Work device enrollment, and then click Edit. Or create a new group.

The Self Service Portal group must be configured for the Android platform.

For details on the Self Service Portal configuration, see Configure Self Service Portal settings

(page 25).

3. In at least one of the columns Initial package - corporate devices and Initial package -

personal devices, you must select a task bundle to be executed on corporate and personal devices.

4. Set whether enrollment is required or not in Android for Work - corporate devices and

Android for Work - personal devices.

■

■

Optional: Users can choose to enroll with Android for Work when they enroll their devices with Sophos Mobile Control.

Required: Enrollment with Android for Work is mandatory.

5. Click Apply.

6. In the Group settings tab, click Save.

19.3 Manage Android for Work users

A user must have a Managed Google Account to enroll a device with Android for Work. This

Android for Work account is connected to the domain that you registered with Google.

Android for Work account names are formed like an email addresses, for example user@your_android_for_work_domain

.

When a user enrolls a device with Android for Work on the Self Service Portal, Sophos Mobile

Control checks if an Android for Work account for the user already exists on the Google server.

For this, the left part of the user’s email address in Sophos Mobile Control is combined with your

Android for Work domain. If an account with that name does not exist, Sophos Mobile Control creates it.

Example: If the user’s email address in Sophos Mobile Control is user@your_company.com

and your Android for Work domain is your_android_for_work_domain

, Sophos Mobile

Control checks the Google server for an account user@your_android_for_work_domain

.

Other than creating an Android for Work account during enrollment, Sophos Mobile Control does not manage the account lifecycle. If you delete the user account in Sophos Mobile Control, the user’s Android for Work account remains.

You can manage the Android for Work accounts for your domain from the Google Admin console.

If required, you can create Android for Work accounts from your LDAP directory, using Google

Apps Directory Sync (GADS).

Related Links

Google Admin console (external link)

About Google Apps Directory Sync (external link)

193

Sophos Mobile Control

19.4 Enroll devices with Android for Work

Your users enroll their devices with Android for Work during the enrollment with Sophos Mobile

Control through the Self Service Portal. Enrollment with Android for Work through the Sophos

Mobile Control console is not possible.

However, you can unenroll a user’s device from Android for Work through the Sophos Mobile

Control console, for example to delete corporate data from the device in case of lost or theft.

Note: Sophos Mobile Control supports the enrollment with Android for Work for devices with

Android 6 or higher.

19.5 Lock work profile

For devices that are enrolled with Android for Work, you can lock or unlock the work profile. When the work profile is locked, all work apps are unavailable and no notifications are displayed for work apps.

Tip: Users can lock the work profile from the Quick Settings panel on their device, for example when they are on leave.

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the blue triangle next to the device for which you want to lock or unlock the work profile and then click Show.

3. Click Actions > Set container access.

4. Select the access permissions.

■

■

■

Deny: The work profile is locked. Users can no longer access apps or data within the work profile.

Allow: The work profile is unlocked.

Auto mode: The work profile is locked if the device violates a compliance rule that contains a Lock container action. This is the default behavior if you have not set an access permission.

5. Click Yes.

The device is synchronized with the Sophos Mobile Control server. Once this is complete the setting is applied to the device.

19.6 Remove work profile from device

For devices that are enrolled with Android for Work, you can remove the work profile. For example to delete corporate data from the device in case of lost or theft.

When you remove the work from the device, all work apps, including the Sophos Mobile Control app, are also removed. In the Sophos Mobile Control console, the device is displayed with status

Unenrolled.

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the blue triangle next to the device from which you want to remove the work profile and then click Show.

194

administrator help

3. Click Actions > Wipe Android for Work.

A task to remove the work profile is created and transferred to the device. You can display the task status on the Task view page.

Note: If the user has already removed the work profile manually, the task fails as the device cannot receive it anymore.

To re-enroll the device with Android for Work, the user must repeat the enrollment procedure on the Self Service Portal.

19.7 User-initiated work profile removal

Users can remove the work profile from their device, either accidentally or intentionally. Sophos

Mobile Control is unable to detect this type of removal. It continues to display the device status as Managed (Android for Work).

After the user has removed the work profile, the device cannot synchronize with the Sophos

Mobile Control server.

Tip: You can use the Devices not synchronized in last 7 days report to identify potentially affected devices.

If the work profile was removed accidentally, you can re-enroll the device with Android for Work:

1. You delete the device from Sophos Mobile Control.

2. The user repeats the enrollment procedure through the Self Service Portal.

19.8 Work apps

Work apps are apps that are compatible with Android for Work.

You use Google Play for Work to select the work apps that are available to your Android for Work users. Your users install these apps through the Google Play Store app in their work profile.

You must perform the following tasks in Google Play for Work and in Sophos Mobile Control to make work apps available to your users:

1. In Google Play for Work, you select the apps for your Android for Work domain. To do this:

■

Approve the app.

■

Purchase app licenses.

■

Accept the app permissions.

See

Approve work app

(page 196).

2. In Sophos Mobile Control, you configure the app. To do this:

■

Define the location of the app in the Google Play Store app on the users’ devices.

■

For apps that support it, configure custom app settings.

■

For paid apps, assign users a license for the app.

See

Edit work app (page 196).

195

Sophos Mobile Control

19.8.1 Approve work app

1. Open the Google Play for Work Store ( https://play.google.com/work ) and log in with your

Google administrator account.

2. In the Google Play for Work Store, select the app you want to make available to your users.

3. Either click Approve (for free apps) or Buy (for paid apps).

Note: Paid apps for Android for Work are currently only available in the United States and in

Canada.

4. If the app requires permissions, accept these on behalf of your company.

When your users install that app, they are not asked to grant permissions.

5. For paid apps, enter the number of licenses and the payment method.

Note: If you receive an error when trying to buy an app, check in the Google Admin console that Google payment services are enabled for your domain or your account.

At this stage, the app is approved for your domain but users are not able to install it yet. You must complete the allocation process in Sophos Mobile Control. See

Edit work app (page 196).

Note: If an update to your work app includes additional app permissions, you must accept these before your users can install the update. In the Google Play for Work menu, click Update to view and approve pending updates.

Related Links

Google Play for Work (external link)

Google Admin console (external link)

Google Play for Work Help Center (external link)

19.8.2 Edit work app

After you have approved an app in the Google Play for Work Store, you must configure the app in Sophos Mobile Control to make it available to your Android for Work users.

1. On the menu sidebar, under CONFIGURE, click Apps and then click Android.

2. On the Apps page, click Android for Work apps.

This opens the Android for Work apps page that displays a list of all work apps that you have approved in the Google Play for Work Store.

3. Click Retrieve app list from Google to synchronize the changes you made in the Google

Play for Work Store. After synchronization, users can install the apps through the Google Play

Store app in their work profile.

4. Click the blue triangle next to the required app and then click Edit.

5. Use the Page and App category fields to define the location of the app in the Google Play

Store app on the users’ devices: a) In the Page list, select the page in which the app will appear. The page items are pre-configured by Sophos Mobile Control and cannot be changed.

b) In the App category field, enter the name of a category in which the app will appear.

196

administrator help

When you start to type in the App category field, a list of matching categories is displayed.

If you enter a category that is not available, it is created.

6. For paid apps, the Edit Android for Work app page contains a Licenses field. Click Show next to the Licenses field to view or edit the license information for the app.

It may take a few seconds before Sophos Mobile Control retrieves the license information from

Google.

a) In the Licenses dialog, you can see the number of used and remaining licenses for the app, and the Android for Work users that have a license assigned.

b) Select users to assign them a license for the app, or deselect users to remove their license.

Click Apply to close the Licenses dialog.

7. If the app offers managed configuration, the Edit Android for Work app page contains an

App settings button. Click that button to view or edit the available app settings.

For information on the available settings, see the documentation that is provided by the app developer.

8. On the Edit Android for Work app page, click Save to save your changes.

9. On the Android for Work apps page, click Send configuration to Google to send the updated layout information and app configuration to Google.

Note: If you skip this last step, the app configuration is only stored locally in Sophos Mobile

Control. It is not transferred to the Google server and is not available to your users.

After the data is synchronized to the Google server, the work app is available through the Google

Play Store app in the work profile. Free apps are available to all of your users, while paid apps are only available to users that have a license assigned.

19.8.3 Work app settings

Setting/Field

Title

Product ID

Pricing

Distribution type

Description

The external app name as displayed in the Google

Play for Work Store.

The internal app name.

The pricing type:

Free

Free with in-app purchases

Paid

Public (Google-hosted): The app is available to the general public in Google Play for Work.

197

Sophos Mobile Control

Setting/Field Description

Private (Google-hosted): The app is developed by you and only available to users within your

Android for Work domain. The APK file was uploaded to Google Play for Work.

Private (self-hosted): Like Private

(Google-hosted), but the APK file is installed from your local server. Google Play for Work is only used to manage the distribution.

Google Play for Work URL, Google Play URL The web address of the app in Google Play for Work and Google Play.

Click the link to open that page in a new browser window.

Page

App category

Licenses

App settings

The page on which the app will appear in the users’

Google Play Store app.

The values are pre-configured by Sophos Mobile

Control and cannot be changed.

The name of a category under which the app will appear in the users’ Google Play Store app.

Click Show next to Licenses to view or edit the license information for the app.

This setting is only available for paid apps.

Click App settings to view or edit app-specific settings.

For information on the available settings, see the documentation provided by the app developer.

This setting is only available if the app offers managed configuration.

19.8.4 Install work app

After you have approved a work app in Google Play for Work and have assigned app licenses to your users, you can install the app to selected devices or device groups.

Note: Users can install approved apps through the Google Play Store app in their work profile.

1. On the menu sidebar, under CONFIGURE, click Apps and then click Android.

2. On the Apps page, click Android for Work apps.

3. Click the blue triangle next to the required app and then click Install.

198

administrator help

4. Select the devices on which you want to install the app. Do one of the following:

■

■

Select individual devices.

Click Select device groups and then select one or more device groups.

When you are ready, click Next.

5. On the Set execution date page, specify the date when the app will be installed:

■

■

Select Now for an immediate execution.

Select Date and then enter a date and a time for a scheduled execution.

6. Click Finish.

The installation task is sent to a Google service. Google then manages the installation of the app onto the device. On the Task view page, the state of the task is successful when it has been sent to Google.

19.8.5 Uninstall work app

You can uninstall a work app from selected devices or device groups.

1. On the menu sidebar, under CONFIGURE, click Apps and then click Android.

2. On the Apps page, click Android for Work apps.

3. On the Android for Work apps page, click Uninstall.

4. Select the devices from which you want to uninstall an app. Do one of the following:

■

■

Select individual devices.

Click Select device groups and then select one or more device groups.

When you are ready, click Next.

5. On the Select app page, select the required app.

6. On the Set execution date page, specify the date when the app will be uninstalled:

■

■

Select Now for an immediate execution.

Select Date and then enter a date and a time for a scheduled execution.

7. Click Finish.

A task to uninstall the app is sent to a Google service. Google then manages the removal of the app from the device. On the Task view page, the state of the task is successful when it has been sent to Google.

Tip: Alternatively, you can use the following procedure to uninstall an app from a single device:

Open the device's Show device page, go to the Installed apps tab and then click the trash can icon next to the app name.

19.8.6 Licenses for work apps

By assigning licenses for paid work apps to users, you define which apps are available to a user.

You only assign licenses for paid work apps to users. Free apps that you have approved in Google

Play for Work are automatically available to all of your users after you synchronize the app list from Google to Sophos Mobile Control.

199

Sophos Mobile Control

Tip: You do not need to assign a license for administrator-initiated app installations. When you install a work app as described in

Install work app (page 198), a license from your pool of purchased

licenses will automatically be assign to the relevant users.

You configure the license assignment on the Edit Android for Work app page. See Edit work app (page 196).

19.8.7 Layout of Google Play for Work

You can define the location of each work app in the Google Play Store app on the users’ devices.

The configurable layout elements are Pages and Categories.

■

■

■

■

Pages are named, vertically scrollable views. Pages and their names are pre-defined by

Sophos Mobile Control.

Categories are named, horizontally scrollable subsections of a page that you define. In the

Google documentation, categories are also called clusters.

Each category is specific to a certain page, and each app appears within a certain category.

Pages that do not contain any apps are not displayed.

■

You can configure up to 30 categories per page and up to 100 apps per category.

For each app, you define the page and, optionally, the category in which the app is displayed in the Google Play Store app on the users’ devices. By default, apps are placed on a page named

Other.

You configure the store layout on the Edit Android for Work app page. See

Edit work app (page

196).

19.8.8 Configurable work apps

A work app can offer a managed configuration. This feature is included by the app developer and allows you to configure custom settings for the app.

If an app supports managed configuration, a note This app offers managed configuration is displayed on the app’s page in Google Play for Work.

You configure the app settings on the Edit Android for Work app page. See Edit work app

(page

196).

19.8.9 Private and self-hosted work apps

All work apps that you want to make available to your users must be distributed through Google

Play for Work.

■

Public work apps are apps that are available to all users with an Google Play for Work account.

■

■

Private work apps are apps developed by you that are only available to users inside your domain.

Self-hosted work apps are private apps for which the application package (that is the APK file) is located on a server belonging to your organization instead of the Google server. However,

200

administrator help the app store metadata for self-hosted apps must be uploaded to Google so that the app can be distributed through Google Play for Work.

For information on private work apps, see the Android for Work Developer web pages (external link).

201

Sophos Mobile Control

20 Create administrators

1. On the menu sidebar, under SETTINGS, click Setup > Administrators to open the Show

administrators page, and then click Create administrator.

2. On the Edit administrator page, configure the account details for the administrator.

■

■

When External LDAP directory is used as the user directory for the customer, you can click Lookup user via LDAP to select an existing LDAP account.

If you do not use an external user directory enter the relevant data for Login name, First

name, Last name, Email address and Password.

The password that you specify is a one-time password. When the administrator logs in for the first time they are prompted to change it.

Note: The Login name only supports the following characters:

■

Uppercase characters A-Z (Latin alphabet)

■

■

■

Lowercase characters a-z (Latin alphabet)

Digits 0-9

Special characters

!._-#

3. In the Role list, select one of the available roles.

The role defines the type of access rights the new administrator will have to Sophos Mobile

Control. See User roles (page 10).

4. Click Save to create the administrator account.

The new administrator is created and shown on the Show administrators page. Forward the user credentials (user, customer and one-time password) to the new user. The new user can log in to the Sophos Mobile Control console and is prompted to change the password.

202

administrator help

21 Send message to devices

You can send a custom message to managed devices.

Note: You cannot send messages to Windows Desktop devices.

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed.

2. Select one or more devices, click Actions and then click Send message.

3. In the Enter message dialog, enter the message you want to send.

The message can contain up to 500 characters. Below the text field, the number of remaining characters is displayed.

4. Click Finish.

203

Sophos Mobile Control

22 Advanced license

When you activate an SMC Advanced license, you can use these additional features:

■

Manage the Sophos Secure Workspace and Sophos Secure Email apps. See Manage Sophos container apps

(page 210).

■

For Android devices, manage the Sophos Mobile Security app. See

Manage Sophos Mobile

Security

(page 205).

After you have received your license key you need to activate the license.

Activate an SMC Advanced license for on-premise installations

For on-premise installations of Sophos Mobile Control, licenses are managed by the super administrator in customer management. For further information, see the Sophos Mobile Control super administrator guide .

Activate an SMC Advanced license for Sophos Mobile Control as a

Service

In the Sophos Mobile Control console, go to SETTINGS > Setup > System setup > License and enter your license key in the Advanced license key field.

204

administrator help

23 Manage Sophos Mobile Security

Note: This feature requires an SMC Advanced license.

Sophos Mobile Security is a security app for Android devices that protects devices from malicious apps and assists users in detecting app permissions that could be a security risk. Its web filtering capability allows you to filter websites by category and lets you block inappropriate content.

You can manage the Sophos Mobile Security app on devices that are enrolled with Sophos Mobile

Control as follows:

■

You can configure settings for the Sophos Mobile Security app on all managed devices remotely and centrally through the Sophos Mobile Control console.

■

■

■

You can make sure that the Sophos Mobile Security app is installed on the devices and runs scans at defined intervals. You can define this as a compliance rule.

You can trigger scans for specific devices.

You can view scan results for devices in the Sophos Mobile Control console.

For further information on Sophos Mobile Security, see the Sophos Mobile Security help.

23.1 Configure antivirus settings for Sophos Mobile Security

Prerequisite: You have activated an SMC Advanced license.

1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click Android.

The Profiles and policies page is displayed.

2. Click Create and select Mobile Security policy.

The Edit policy page is displayed.

3. Enter a Name and a Version for the new profile.

4. In the Description field, enter a description for the profile.

5. Click Add configuration.

The Available configurations page is displayed.

6. Select Antivirus and click Next.

The settings view of the configuration is displayed.

7. Go to the Antivirus tab.

8. Under General, you can specify the following: a) In the Cloud scan mode field, define when Sophos Mobile Security should scan for the latest malware information. Select one of the following options to define when the app should use a cloud lookup:

■

Always

■

Not while roaming

205

Sophos Mobile Control

■

Wi-Fi only

With this setting you can control the data traffic of the app. If you set Cloud scan mode to

Wi-Fi only, the cloud lookup will only be performed when the device has a Wi-Fi connection.

If you set Cloud scan mode to Not while roaming, a cloud lookup will never be performed while the device is roaming on a foreign network.

b) In the Scheduled scan interval list, select how often scans are carried out.

9. Under Targets, you can select the following: a) Select Scan system apps to include system apps in scans.

System apps are not scanned by default as they are protected by the Android OS and cannot be removed by the user. But you can activate the scanning of system apps here.

b) Select Scan SD Card, USB to scan all files on SD cards, USB and other external storage devices in addition to the default scanning of all installed apps.

10. Under PUAs, you can do as follows: a) Select Detect PUAs to scan for Potentially Unwanted Applications.

Potentially Unwanted Applications (PUAs) are apps that, while not malicious, are generally considered unsuitable for business networks. PUAs include adware, dialers, system monitors, remote administration tools, and hacking tools. However, certain apps that can fall into the PUA category might be considered useful by some users.

If you select this option, Sophos Mobile Security will detect PUAs during scans and notify the device user accordingly.

b) Select Enable user to allow PUAs to enable users to allow apps although they have been identified as PUAs. The user can mark them as ignored. In subsequent scans, these apps will not be shown as PUAs.

11. Under Apps with low reputation, you can specify how to deal with these apps. Classification of apps is based on Sophos Live Protection data. Under Mode, you can do as follows: a) Select Allow to turn off scanning for low reputation apps.

b) Select Warn to display a warning on the device when a low reputation app is detected.

Users can then choose how to deal with the app. They can add it to a list of allowed apps so that no further warning is displayed if this app is detected.

c) Select Block in order to prevent low reputation apps from being started. A warning will be displayed but the user cannot start the app.

12. Under Live protection, you can do as follows: a) Make sure that Scan notification is selected to receive scan notifications.

b) Select Monitor SD card to monitor the SD card for any changes. If new files are stored on the card, they are scanned.

13. If your scan results include apps that should be allowed to start, you can add them to the list of allowed apps. Apps on this list will always be allowed to start. The apps will not be reported.

To identify such an app, you can use the scan results of Sophos Mobile Security. See View

Sophos Mobile Security scan results (page 208). Before you can allow these apps to start on

the devices, you must add them to an App group, as described in App groups (page 184).

206

administrator help

14. To add allowed apps, select the App group containing the allowed apps.

15. Click Apply.

23.2 Configure web filtering settings for Sophos Mobile

Security

Prerequisite: You have activated an SMC Advanced license.

The Sophos Mobile Security app protects you from browsing sites with malicious, undesirable or illegal content.

Note: Web filtering only works with the Android web browser or with Google Chrome.

1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click Android.

The Profiles and policies page is displayed.

2. Click Create and select Mobile Security policy.

The Edit policy page is displayed.

3. Enter a Name and a Version for the new profile.

4. In the Description field, enter a description for the profile.

5. Click Add configuration.

The Available configurations page is displayed.

6. Select Web filtering and click Next.

The Web filtering page is displayed.

7. In the Filter malicious websites field, specify whether you want to Allow access to malicious websites, Warn the user against malicious websites, or Block these sites.

8. Under Filter websites by category, specify for each category whether you want to Allow access to websites of this category, Warn the user against potential malicious, undesirable or illegal content, or Block websites of this category.

Websites are categorized based on data from SophosLabs. The data is updated constantly.

9. Under Website exceptions, you can define: a) Allowed domains: add domains or IP addresses that are allowed, even though the category they belong to is blocked.

b) Blocked domains: add domains or IP addresses that are blocked, even though the category they belong to is allowed.

You can insert domain names or IP addresses. Examples: www.company.com, *.company.com,

10.2.0.1, 10.2.0.1/24

10. Click Apply.

Users cannot change the settings that you specified in the Sophos Mobile Control.

207

Sophos Mobile Control

23.3 Define Sophos Mobile Security compliance rules

Prerequisite: You have activated an SMC Advanced license.

You can configure compliance rules that relate to Sophos Mobile Security.

1. Add a new compliance rule or open an existing set for editing. For further information, see

Compliance rules (page 41).

2. Go to the Android tab.

3. In the Max. SMSec scan interval field, you can specify the maximum scan interval for malware scans performed by the Sophos Mobile Security app.

4. In the Denial of SMSec permissions allowed list, select whether a denial of the required permissions results in a compliance violation.

5. In the Malware apps allowed list, select whether detected malware apps are allowed.

6. In the Suspicious apps allowed list, select whether detected suspicious apps are allowed.

7. In the PUAs allowed list, select whether detected PUAs (Potentially Unwanted Apps) are allowed.

8. After you have configured all required settings, click Save.

23.4 View Sophos Mobile Security scan results

Prerequisite: You have activated an SMC Advanced license.

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed with all devices enrolled with Sophos Mobile Control for this customer.

2. Click the blue triangle next to the required device and then click Edit or click its name.

The Show device or the Edit device page is displayed.

3. Go to the Scan results tab.

The tab shows the Sophos Mobile Security scan results. The non-clean packages, for example,

Potentially Unwanted Apps, are shown in a table. Under Threat name, you can click the links to display further information from Sophos Labs about the relevant threat.

4. Go to the Compliance violations tab to view the compliance violations related to the scan results. The violations shown depend on the Sophos Mobile Security compliance rules.

208

administrator help

23.4.1 Create a list of allowed PUAs and apps with low reputation

You can use the scan results to create a list of allowed apps. This list will be valid for all Android devices with the Sophos Mobile Security app installed for the customer you are logged on to.

1. Go to the Scan results tab of one of your scanned devices.

The non-clean packages are shown in a table. The Threat name column indicates whether the displayed package is a low reputation app, a PUA or malware. You can click the links to display further information on the relevant threat from SophosLabs.

Detected low reputation apps and PUAs have a blue check mark icon to the left of the package name. Only these apps can be added to the allowed apps list.

2. Click the blue check mark icon to add the app to the allowed apps list.

3. In the dialog box, click Yes to confirm the operation.

The app is added to the allowed apps list.

4. Repeat this step for all apps you want to add.

5. To view the list, go to Settings and click General.

6. Click Show allow list.

All apps you added are displayed. Apps on this list will be allowed to start on all managed devices. The apps are not reported anymore.

When you click Clear allow list, all entries in the list are deleted.

209

Sophos Mobile Control

210

24 Manage Sophos container apps

Note: This feature requires an SMC Advanced license.

For better data separation on the managed devices, Sophos Mobile Control provides the Sophos container apps Sophos Secure Email and Sophos Secure Workspace:

■

■

Sophos Secure Email is an app for Android and iOS devices that provides a secure container for managing your email, calendar and contacts.

Sophos Secure Workspace is an app for Android and iOS devices that allows users to access encrypted files stored in the cloud. Files can be decrypted and viewed in a seamless way.

Encrypted files can be handed over by other apps and uploaded to one of the supported cloud storage providers. Alternatively, the documents can be stored locally within the app.

With Sophos Secure Workspace, you can read files encrypted by SafeGuard Cloud Storage or SafeGuard Data Exchange. Both are modules of SafeGuard Enterprise or one of its different editions. They allow you to encrypt files using a local key. These local keys are derived from a passphrase that is entered by a user. You can only decrypt a file when you know the passphrase that was used to encrypt the file.

The Sophos container provides:

■

Centrally defined password rules

■

■

Password rules for all container apps

Single-Sign-On for all container apps

■

■

■

Sophos Secure Workspace document settings

Sophos Secure Workspace browser settings

■

Sophos Secure Email settings

You can manage the Sophos apps with Sophos Mobile Control as follows:

You can configure settings for the Sophos container apps on all managed devices remotely and centrally in Sophos Mobile Control. See

Configurations for Sophos container policies for

Android (page 101) and

Configurations for Sophos container policies for iOS (page 142).

■

■

You can make sure that the Sophos container apps are installed on the devices. You can define this as a compliance rule.

You can enable secure distribution of documents using the Corporate Documents storage

provider. See Corporate documents (page 186).

■

You can enable corporate keyring synchronization between the Sophos Secure Workspace app and Sophos SafeGuard Enterprise. This makes the keys from a user's SafeGuard keyring

available in the Sophos Secure Workspace keyring. See Enable corporate keyring synchronization

(page 212).

Note: In order to manage the Sophos container apps, they must be distributed using Sophos

Mobile Control. If users already have an unmanaged version of Sophos Secure Workspace installed on their devices, they must uninstall it first and then install the managed version.

For further information on Sophos Secure Workspace, see the Sophos Secure Workspace help.

administrator help

24.1 Reset Sophos container password

Prerequisite: You have activated an SMC Advanced license.

Note: This section applies to devices that have an assigned Sophos container policy.

You can reset the Sophos container password. This is useful, for example, when users forget their password. If you reset a Sophos container password, users will be asked to define a new container password.

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed.

2. Click the device for which you want to reset the Sophos container password.

The Show device page is displayed.

3. Click Actions.

The Actions menu is displayed.

4. Click Reset Sophos container password.

5. In the dialog box, click Yes to confirm the operation.

The Sophos container password is reset. The user has to enter a new Sophos container password.

24.2 Lock and unlock the Sophos container

Prerequisite: You have activated an SMC Advanced license.

Note: This section applies to devices that have an assigned Sophos container policy.

You can lock or unlock the Sophos container, that is, set the access permissions for the Sophos container apps and for data within the Sophos container.

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device for which you want to lock or unlock the Sophos container and then click Show.

3. On the Show device page, click Actions > Set Sophos container access.

4. In the dialog box for setting the access permissions, select one of the following:

■

■

■

Deny: The Sophos container is locked. Users can no longer use it.

Allow: The Sophos container is unlocked.

Auto mode: The Sophos container is locked as long as the device violates a compliance rule for which Lock container is activated. This is the default behavior if you have not set an access permission.

5. Click Yes.

The device is triggered to synchronize with the Sophos Mobile Control server. On synchronization, the setting is applied to the device.

211

Sophos Mobile Control

24.3 Corporate keyring synchronization

Corporate keyring synchronization adds the following features to the Sophos Secure Workspace app:

■

■

The keys from a user's SafeGuard Enterprise keyring are available in the Sophos Secure

Workspace keyring (SSW keyring).

Users of the app can then use the keys to decrypt and view documents, or encrypt documents.

■

■

■

Users can continue to use local keys that were available in their SSW keyring when you enabled keyring synchronization.

Users cannot create new local keys.

For security reasons, the keys from the SafeGuard keyring are removed from a device when the Sophos container is locked.

24.3.1 Enable corporate keyring synchronization

Prerequisites:

■

You use Sophos SafeGuard Enterprise 8.0.

■

■

You have configured external user management for the Self Service Portal, using the same

Active Directory user database that is configured in SafeGuard Enterprise.

Sophos Secure Workspace is managed by Sophos Mobile Control. This requires an SMC

Advanced license.

To enable corporate keyring synchronization, you set up a connection between Sophos Mobile

Control and Sophos SafeGuard Enterprise as follows:

1. On the menu sidebar, under SETTINGS, click Setup > System setup, and then click the SGN tab.

2. Click the Certificate link to download the certificate of the Sophos Mobile Control server.

3. Open SafeGuard Management Center and go to Tools > Configuration Package Tool.

4. On the Servers tab, click Add, browse for the certificate file and then click OK. Do not change the value of the Server name field.

5. Optional: Select Recovery via mobile to enable the synchronization of BitLocker and FileVault recovery keys with the Sophos Secure Workspace app.

6. On the Managed client packages tab, configure the following settings:

■

■

■

In the Configuration Package Name field, select Managed Client (Default).

In the Primary Server field, select your SGN server.

In the Transport Encryption field, select SSL.

7. Click Create Configuration Package.

8. On the SGN tab of the Sophos Mobile Control console, click Upload a file to upload the configuration package that you created in the SafeGuard Management Center to Sophos

Mobile Control.

9. Click Save to save the SafeGuard integration settings.

212

administrator help

25 Glossary

customer device enrollment

Enterprise App Store provisioning

Self Service Portal

The tenant that manages devices.

The device to be managed (for example smartphone, tablet or

Windows 10 device).

The registration of a device with Sophos Mobile Control.

An app repository that is hosted on the Sophos Mobile Control server.

The administrator can use the Sophos Mobile Control console to add apps to the Enterprise App Store. Users can then use the Sophos

Mobile Control app to install these apps onto their devices.

The process of installing the Sophos Mobile Control app on a device.

The web interface that allows users to enroll their own devices and carry out other tasks without having to contact the helpdesk.

SMC Advanced license

With a license of type SMC Advanced you can manage the Sophos

Mobile Security, Sophos Secure Workspace and Sophos Secure

Email apps through Sophos Mobile Control.

SMSec

Abbreviation for Sophos Mobile Security.

Sophos Mobile Control client

The Sophos Mobile Control app that is installed onto the managed device.

Sophos Mobile Security

A security app for Android devices. You can manage this app with

Sophos Mobile Control, provided that a license of type SMC Advanced is activated.

Sophos Secure Email

An app for Android and iOS devices that provides a secure container for managing your email, calendar and contacts. You can manage this app with Sophos Mobile Control, provided that a license of type

SMC Advanced is activated.

Sophos Secure

Workspace

An app for Android and iOS devices that provides a secure workspace where you can browse, manage, edit, share, encrypt and decrypt documents from various storage providers or distributed by your company. You can manage this app with Sophos Mobile Control, provided that a license of type SMC Advanced is activated.

213

Sophos Mobile Control

task bundle

You create a package to bundle several tasks into one transaction.

You can bundle all tasks necessary to have a device fully enrolled and running.

Sophos Mobile Control console

The web interface that you use to manage devices.

214

administrator help

26 Technical support

You can find technical support for Sophos products in any of these ways:

■

Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.

■

■

■

Visit the Sophos support knowledgebase at www.sophos.com/en-us/support.aspx

.

Download the product documentation at www.sophos.com/en-us/support/documentation.aspx

.

Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/support-query.aspx

.

215

Sophos Mobile Control

27 Legal notices

Copyright

©

2011-2017 Sophos Limited. All rights reserved.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos is a registered trademark of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

Last update: 20170223

216