Sophos Mobile Administrator Guide
Annonce
Annonce
Sophos Mobile super administrator guide
product version: 9
Contents
(2019/05/03)
Sophos Mobile
1 About this guide
This guide describes how to carry out super administrator tasks in Sophos Mobile Admin for Sophos
Mobile on Premise.
For a description of Sophos Mobile Admin for regular administrators, see the Sophos Mobile administrator help . You can also find general information (for example prerequisites) and task descriptions in the Sophos Mobile administrator help .
The descriptions in the administrator help also apply to the super administrator, unless otherwise noted.
For Sophos Mobile in Central, see the Sophos Mobile in Central startup guide and the Sophos
Mobile in Central administrator help .
For Sophos Mobile as a Service, see the Sophos Mobile as a Service startup guide and the Sophos
Mobile administrator help .
Copyright © Sophos Limited 1
Sophos Mobile
2
2 Super administrator
In Sophos Mobile, a customer is a tenant whose devices are managed. For every customer, one or more administrator accounts exist.
Besides these regular customers and administrators, there is a super administrator customer and a related super administrator. The role of this super administrator is to set up Sophos Mobile after installation and to create and manage customers. The first super administrator account and the super administrator customer are created during Sophos Mobile installation. A super administrator can create additional super administrators later on.
For information on the initial creation of the super administrator and the super administrator customer during installation, see the Sophos Mobile installation guide .
2.1 Super administrator tasks
The following list provides an overview of the tasks that the super administrator can perform. For detailed information see the respective sections of this guide.
The super administrator can:
• Create other super administrator accounts.
• Manage Sophos Mobile licenses.
• Start the First steps wizard to perform initial configuration of the Sophos Mobile server.
• Configure technical contact information. Customer administrators can use this as a template for providing contact information for users of the Sophos Mobile Control app and the Self Service
Portal.
• Create and manage customers.
• Create reports for all customers.
• Define configuration items like profiles, task bundles, apps or settings and then transfer them to customers.
• Renew APNs certificates for all customers in one step.
• Define a default customer for the Self Service Portal login.
• Configure connections to EAS proxy servers.
• Configure connections to third-party Network Access Control systems, to enable network access management for the managed devices.
• Configure access to Sophos Mobile Admin and the Self Service Portal.
• Add a custom logo to the login pages of Sophos Mobile Admin and the Self Service Portal.
• Configure file size limits for uploaded apps and documents.
• Configure the title that is shown in the Sophos Mobile Control app.
• Configure logging of actions by administrators when they are logged in to the web portal.
• Configure system messages that are displayed on the login pages of Sophos Mobile Admin and the
Self Service Portal.
• Download server log files.
Copyright © Sophos Limited
Sophos Mobile
2.2 Super administrator customer
The super administrator customer offers a specific view of the Sophos Mobile web portal that is adapted to super administrator tasks. The differences are based on these two facts:
• The super administrator does not manage devices or users.
• The super administrator is allowed to configure Sophos Mobile system settings.
2.3 Log in as super administrator
1. Open the Sophos Mobile Admin web address that you configured during installation of Sophos
Mobile.
2. In the login dialog, enter the super administrator customer name and the credentials of the super administrator, then click Login.
2.4 Switch to a different customer
As super administrator, you can switch from the super administrator customer to a regular customer.
The administrator currently logged in and the current customer are displayed in the page header.
To switch to a different customer:
1. In the page header, click the current customer name to open the list of available customers.
The super administrator customer is the first item in the list and is marked by an asterisk.
2. Select the customer to whom you want to switch.
The Dashboard page for the selected customer is displayed.
Tip
As super administrator, you can switch to a different customer: On the Customers page, click the blue triangle next to the customer to whom you want to switch and then click Choose.
For a description of Sophos Mobile Admin for regular customers, see the Sophos Mobile administrator help .
2.5 Create additional super administrators
To create additional super administrators for the super administrator customer:
1. On the menu sidebar, under SETTINGS, click Setup > Administrators.
2. On the Show administrators page, click Create administrator.
3. Enter the account details for the new super administrator.
• When External LDAP directory is selected as user directory for the super administrator, you can click Lookup user via LDAP to select an existing LDAP account.
• When Internal directory or None is selected as user directory, enter the relevant data in the
Login name, First name, Last name, and Email address fields.
Copyright © Sophos Limited 3
Sophos Mobile
4. In the Role list, select the Administrator user role.
5. Under Authentication, set the password for the new super administrator.
For a local account, enter a one-time password that the super administrator must change at first login.
For an LDAP account, you can either use the LDAP password for authentication, or enter a onetime password.
6. Click Save to create the super administrator account.
The new super administrator is created and displayed on the Show administrator page.
Forward the credentials (login name, super administrator customer name and one-time password) to the relevant person.
4 Copyright © Sophos Limited
Sophos Mobile
3 Sophos Mobile licenses
Sophos Mobile offers two types of licenses:
• Mobile Standard license
• Mobile Advanced license
With a license of type Mobile Advanced you can manage the Sophos Mobile Security, Sophos
Secure Workspace and Sophos Secure Email apps.
For further information on managing Sophos Mobile Security, Sophos Secure Workspace and
Sophos Secure Email with Sophos Mobile, see the Sophos Mobile administrator help .
As a super administrator, you can activate your purchased licenses in the super administrator customer and assign the required number of licensed users to individual customers.
3.1 Check your licenses
Sophos Mobile uses a user-based license scheme. One user license is valid for all devices assigned to that user. Devices that are not assigned to a user require one license each.
On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the License tab.
The following information is displayed:
• Number of licenses: Maximum number of device users (and unassigned devices) of all customers that can be managed.
This field is only present for the super administrator customer.
• Maximum number of licenses: Maximum number of device users (and unassigned devices) that can be managed.
This information is only shown for regular customers.
If the super administrator did not set a quota for the customer, the number of licenses is limited by the overall number for the Sophos Mobile server.
• Used licenses: Number of licenses in use.
• Valid until: The license expiration date.
• Licensed URL: The URL of the Sophos Mobile server for which the license is issued.
If you have any questions or concerns regarding the displayed license information, contact your
Sophos sales representative.
3.2 Activate Mobile Advanced licenses
With Mobile Advanced licenses you can use Sophos Mobile to manage the Sophos Mobile Security,
Sophos Secure Workspace and Sophos Secure Email apps.
If Mobile Advanced licenses have not been activated during the initial configuration of Sophos
Mobile, the super administrator can activate them later from Sophos Mobile Admin:
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the License tab.
Copyright © Sophos Limited 5
Sophos Mobile
2. Enter your license key in the Advanced license key field and click Activate.
When the key is activated, the license details are displayed.
3.3 Assign licenses to customers
1. On the menu sidebar, under MANAGE, click Customers.
2. Click the customer you want to assign licenses to.
3. Configure the license settings: a) In the Maximum number of licenses field, enter the number of device users and unassigned devices that can be managed for the customer.
b) Select Advanced licenses if you want to enable the management of the Sophos Mobile
Security, Sophos Secure Workspace and Sophos Secure Email apps for the customer.
c) In the Valid until field, specify the expiration date for the licenses that are assigned to the customer.
After that date, no tasks can be created or processed for the customer.
4. Click Save.
6 Copyright © Sophos Limited
Sophos Mobile
4 Configure system settings
When you log in to Sophos Mobile Admin for the first time after installation, the First steps wizard assists you in configuring system settings.
You must provide the following:
• The address of your HTTP proxy server (if applicable).
• Your license key for Sophos Mobile.
• Your SSL/TLS certificates.
• The credentials for your SMTP server.
Note
You can change all settings later under Setup > Sophos setup.
1. On the HTTP proxy page, enter the address and port of a proxy server to be used for outbound
HTTP and SSL/TLS connections.
2. On the License page, enter your license key or request a trial license:
• Standard license key: Enter your Mobile Standard license key and click Activate.
• Advanced license key: Enter your Mobile Advanced license key and click Activate. You must enter a Mobile Standard license key first.
• Request trial: Enter the email address you used to download the Sophos Mobile installer from the Sophos website.
3. On the SSL/TLS page, configure the SSL/TLS certificates used for securing the connections between the Sophos Mobile server and the clients.
a) Click Auto-discover certificate(s).
In most cases the auto-discover function can discover the certificates currently in use.
b) If the certificates are not discovered automatically, upload them manually: Click Upload a file and select the relevant CER or DER encoded certificate file.
You can configure up to four certificates because, depending on your network architecture, different certificates may be in use for clients connecting from the internet or from your local intranet. The Sophos Mobile server will communicate the list of certificates to the clients. On establishing an SSL or TLS connection, the clients will only trust the server if the presented certificate is included in the list (certificate pinning).
Important
Update the certificate list when you have changed or renewed SSL certificates. At any given time, at least one valid certificate must be available. Otherwise the clients will not trust the server and will not connect to it.
4. On the SMTP page, configure the SMTP server information and logon credentials. SMTP must be configured to enable emails to be sent to new users, providing them with logon credentials. It also needs to be configured to enable enrollment through email.
Option
SMTP host
Description
The SMTP server address.
Copyright © Sophos Limited 7
Sophos Mobile
Option
Connection port
SMTP user
SMTP password
Email originator
Originator name
Send error emails
Email recipients
Description
The server port to connect to.
Note
The displayed connection types (TLS, SSL, and unencrypted) only show standard port usages. See the documentation of the SMTP server for guidelines on which port to use.
If required by the SMTP server, enter the name of a user that is allowed to connect.
The password of the SMTP user.
The email address that will appear in the From field of emails from Sophos Mobile.
The author name that will appear in the From field.
If required, you can configure a different originator name (but not email address) for each customer later on. See the Sophos
Mobile administrator help .
Sophos Mobile will send error emails, for example when an
APNs certificate expires.
Enter email addresses of the recipients that will receive error emails.
Note
Sophos Mobile does not support the OAUTH mechanism for SMTP authentication. Email providers that prefer OAUTH (like for example Google Gmail) might classify sign-in attempts from Sophos Mobile as insecure.
5. After you’ve configured the SMTP information, click Send test email to verify the email configuration.
6. Click Finish to complete the First steps wizard.
8 Copyright © Sophos Limited
Sophos Mobile
5 Configure IT contact
Provide your IT contact details so that users can get help with questions or problems.
The information you enter here is displayed in the Self Service Portal and on the users’ devices.
1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the IT contact tab.
2. Enter the contact information.
3. Click Save.
Copyright © Sophos Limited 9
Sophos Mobile
6 Manage customers
After Sophos Mobile installation and setup, a key step required for using Sophos Mobile is to create at least one customer, this means a tenant whose devices are managed in Sophos Mobile.
As a super administrator you use the super administrator customer to create and manage customers for device management with Sophos Mobile.
6.1 Customer overview
On the Customers page, an overview of all existing regular customers is displayed, including the information shown below:
Column
Name
Activated state
Valid until
Licenses
Advanced
Devices
AND iOS
WM
Win
AND T
Description
The name of the customer.
Indicates if the customer is activated.
The expiration date of the customer. The value unlimited is displayed if no expiration date is set. Dates that lie in the past are displayed in red.
The maximum number of Sophos Mobile licenses that can be used for the customer.
The value unlimited is displayed if no maximum number is set.
Indicates if Mobile Advanced licenses are enabled for the customer.
The number of enrolled devices for this customer.
The number of enrolled Android devices for this customer.
The number of enrolled iOS devices for this customer.
The number of enrolled Windows Phone and
Windows 10 Mobile devices for this customer.
The number of enrolled Windows 10 computers for this customer.
The number of enrolled Android Things devices for this customer.
10 Copyright © Sophos Limited
Column
W IoT
Directory
Sophos Mobile
Description
The number of enrolled Windows 10 IoT devices for this customer.
The type of user management that is configured for the customer.
6.2 Create a customer
You must be logged in to Sophos Mobile Admin as a super administrator to perform this task.
1. On the menu sidebar, under MANAGE, click Customers.
2. Click Create customer.
3. On the Edit customer page, configure the following settings.
Option
Name
Description
Description
The customer's name.
Text to describe the purpose of the customer account.
Maximum number of licenses The number of device users and unassigned devices that can be managed for the customer.
Advanced licenses If selected, the customer can use Sophos Mobile to manage the Sophos Mobile Security, Sophos Secure Workspace and
Sophos Secure Email apps.
Valid until
Deactivate account
The expiration date for the licenses that are assigned to the customer. After that date, you cannot create new tasks for devices that are managed for the customer.
If selected, logging in to that customer is disabled. As super administrator, you can still switch to the customer's view, using the customer list in the page header.
A deactivated account can be activated again by deselecting the Deactivate account check box.
Activated platforms
Device privacy settings
Clone settings
User directory
Select the platforms for which devices can be enrolled.
Select Allow users to locate devices to enable users to locate their devices if they are lost or stolen.
Select Allow admins to locate devices to enable administrators to locate devices.
Select Show installed apps to show the installed apps in the device details.
Select the Settings and packages check box if you want all profiles, bundles, and packages created in the super administrator account to be available in the customer's account.
Select the data source for the Self Service Portal (SSP) users to be managed by Sophos Mobile.
Choose from:
Copyright © Sophos Limited 11
Sophos Mobile
Option Description
• None. No SSP, user-specific profiles, or LDAP
administrators available: This disables the creation of user accounts for the Self Service Portal, and the lookup of accounts for Sophos Mobile Admin from an LDAP directory.
• Internal directory: Use internal user management for
Sophos Mobile Admin and the Self Service Portal. For further information, see the Sophos Mobile administrator help .
• External LDAP directory: In addition to internal user management, you can lookup accounts for Sophos Mobile
Admin and the Self Service Portal from an LDAP directory.
Click Configure external LDAP to specify the server details.
To use federated authentication with Azure Active Directory, select None. No SSP, user-specific profiles, or LDAP
administrators available..
After you’ve created the customer, configure federated authentication on the customer’s Sophos setup page. See the
Sophos Mobile administrator help .
4. Click Save.
The customer is created.
6.3 Create an administrator for the new customer
1. In the page header, click the current customer name to open the list of available customers, and then select the customer for whom you want to create an administrator account.
2. On the menu sidebar, under SETTINGS, click Setup > Administrators.
3. On the Show administrators page, click Create administrator.
4. On the Edit administrator page, enter the account details for the administrator.
• When External LDAP directory is selected as user directory for the customer, you can click
Lookup user via LDAP to select an existing LDAP account.
• When Internal directory or None is selected as user directory, enter the relevant data in the
Login name, First name, Last name, and Email address fields.
5. In the Role list, select the Administrator user role.
6. In section Authentication, set the password for the new super administrator.
For a local account, enter a one-time password that the super administrator must change at first login.
For an LDAP account, you can either use the LDAP password for authentication, or enter a onetime password.
7. Click Save to create the administrator account.
The new administrator is created.
Forward the credentials (login name, customer name and one-time password) to the relevant person.
12 Copyright © Sophos Limited
Sophos Mobile
6.4 Edit customer
1. On the menu sidebar, under MANAGE, click Customers.
2. Click the customer you want to edit.
3. On the Edit customer page, make the required changes.
4. Click Save.
6.5 Configure external directory connection
To manage user accounts for Sophos Mobile Admin and the Self Service Portal in an external LDAP user directory, you must configure the connection to your LDAP server.
Sophos Mobile can connect to the following LDAP servers:
• Active Directory
• Google Cloud Directory
• IBM Domino
• NetIQ eDirectory
• Red Hat Directory Server
• Zimbra
For supported versions, see the Sophos Mobile 9 release notes .
Note
There is no synchronization between the LDAP directory and Sophos Mobile. Sophos Mobile only accesses the LDAP directory to look up user information. Changes to an LDAP user account are not implemented on the Sophos Mobile database, and vice versa.
1. On the menu sidebar, under MANAGE, click Customers.
2. On the Customers page, click the customer for whom you want to configure an LDAP connection.
3. On the Edit customer page, under User directory, select External LDAP directory.
4. Click Configure external LDAP.
Configuration depends on the LDAP server type. The following instructions apply to Active Directory.
5. On the Server details page, configure the following settings: a) In the LDAP type field, select the LDAP server type.
b) In the Primary URL field, enter the IP address or name of the primary directory server.
Select SSL/TLS to secure the server connection by SSL or TLS (depending on what the server supports).
c) Optional: In the Secondary URL field, enter the IP address or name of a directory server
Sophos Mobile uses as fallback in case the primary server isn’t available.
d) In the User and Password fields, enter the credentials Sophos Mobile uses to authenticate with the LDAP server.
Use one of the following formats:
• <domain>\<user name>
Copyright © Sophos Limited 13
Sophos Mobile
• <user name>@<domain>.<domain code>
Note
For security reasons, we recommend you select an account with no write permissions for the directory.
6. On the Search base page, enter the distinguished name (DN) of the search base object.
The search base object defines the location in the directory from which the LDAP search begins.
7. On the Search fields page, configure the attributes of the directory service that contain the user properties Sophos Mobile uses.
Select the attribute names from the list or enter them manually.
Use the following mappings for Active Directory:
Property in Sophos Mobile
User name
First name
Last name
Attribute in Active Directory sAMAccountName givenName sn
Email mail
8. On the SSP configuration page, specify the users that are allowed to log in to the Self Service
Portal. Enter the relevant information in the LDAP directory group field, using one of the following options:
• If you enter the name of a group that is defined on the directory server, all members of that group are allowed to log in to the Self Service Portal. After you have entered the group name, click Test group to resolve the group name into a Distinguished Name (DN).
• If you leave the field empty, no users from the directory server are allowed to log in to the Self
Service Portal. Use this option if you want to enable external user management for Sophos
Mobile Admin but not for the Self Service Portal.
Note
The group you specify here is not related to the user group you define on the Group settings tab of the Self Service Portal page. With those settings, you define task bundles, Sophos
Mobile group membership and available device platforms for each user group.
For further information on the Self Service Portal group settings, see the Sophos Mobile administrator help .
9. Click Apply.
10. On the Edit customer page, click Save.
Related information
How to connect a Sophos Mobile 8.0 server with an Azure Active Directory (Sophos knowledge base article 128081)
Connecting Sophos Mobile to Google Cloud Identity / Google Cloud Directory using Secure LDAP
(Sophos knowledge base article 132870)
14 Copyright © Sophos Limited
Sophos Mobile
6.6 Deactivate customer
If a customer is no longer used for device management with Sophos Mobile, you can deactivate it.
1. On the menu sidebar, under MANAGE, click Customers.
2. Click the blue triangle next to the customer you want to deactivate, and then click Edit.
3. On the Edit customer page, select Deactivate account.
The customer is deactivated. Users managed in this customer can no longer log in to Sophos Mobile
Admin or the Self Service Portal. Devices managed in this customer can still synchronize with the
Sophos Mobile server.
6.7 Delete customer
You cannot delete a customer as long as there are:
• Devices enrolled with Sophos Mobile.
• Users registered for the Apple Volume Purchase Program (VPP).
1. On the menu sidebar, under MANAGE, click Customers.
2. Click the blue triangle next to the customer you want to delete, and then click Delete.
Note
The Delete option is only available when no devices are assigned to the customer.
6.8 Export a list of customers
You can export a list of customers in Microsoft Excel or CSV text format:
1. On the menu sidebar, under MANAGE, click Customers.
2. Optional: Filter the list of customers by entering a text string in the search field at the top of the customer list.
Only customers that match the search string are displayed. This filter will also be applied to the export.
3. On the Customers page, click the Export button at the bottom of the customer list.
4. Click one of the four icons to specify the scope and the format of the export. You can choose between these pair of options:
• Export customers from the current list page or from all pages.
• Export to Microsoft Excel or to CSV format.
The customer list is saved to your local computer, using the download settings of your web browser.
Copyright © Sophos Limited 15
Sophos Mobile
7 Reports
You can create reports of the items managed by Sophos Mobile.
Note
When you are signed in as a super administrator, reports include information for all customers.
1. On the menu sidebar, under INFORM, click Reports, and then click the name of the required report.
2. In the Choose format dialog, click one of the available icons to select the output format:
•
Click to export the report to a Microsoft Excel file.
•
Click to export the report to a CSV file.
The report is saved to your computer.
16 Copyright © Sophos Limited
Sophos Mobile
8 Manage configuration items
As a super administrator you can define configuration items like profiles, task bundles or apps and then transfer them to customers.
There are two different transfer types:
•
Clone configuration items for new customers (page 17): The items are transferred by copying
and can be edited for the receiving customer.
•
Assign customers to configuration items
(page 18): The items are transferred by link and cannot be edited for the receiving customer.
8.1 Clone configuration items for new customers
When a new customer is created, the following configuration items from the super administrator customer can be cloned, that is, transferred by copying:
• Device groups
• Compliance policies
• The settings from these tabs of the General settings page:
— Password policies
— Android
— iOS
— Windows
— Email configuration
— Technical contact
• The settings from all tabs of the Self Service Portal page.
• The settings from the APNs tab of the Apple setup page.
The configuration items are always cloned as a whole. You can select if the items will be cloned or not, but you cannot clone individual items.
Note
For information on how to define configuration items, see the Sophos Mobile administrator help .
To clone the configuration items for a new customer:
•
Create a new customer as described in Create a customer (page 11).
Under Clone settings, select Settings and packages.
The configuration items are transferred to the new customer. They can be edited by the customer administrator.
Copyright © Sophos Limited 17
Sophos Mobile
Note
When Settings and packages is selected, the new customer will also be assigned to these items of the super administrator customer:
• Profiles and policies
• Task bundles
• Apps and app groups
See
Assign customers to configuration items (page 18).
8.2 Assign customers to configuration items
A customer can be assigned to the following configuration items of the super administrator customer:
• Profiles and policies
• Task bundles
• Apps and app groups
When a customer is assigned to a configuration item, the item is transferred to that customer by link, that is, the super administrator customer's original and the assigned customer's version are actually the same item.
Because of this link, a few restrictions must be observed:
• The assigned customer's version cannot be edited or deleted. However, the administrator of that customer can duplicate a linked profile, policy or task bundles. That copy is not linked to the original item and can be edited.
• When a customer is assigned to an app, the super administrator cannot remove the assignment or delete the app as long as it is used in a task bundle of the customer.
• When a customer is assigned to a task bundle, the super administrator cannot remove the assignment or delete the task bundle as long as that customer uses the task bundle as a compliance action or enrollment package.
Note
For information on how to define configuration items, see the Sophos Mobile administrator help .
To push a configuration item to a customer:
1. From the menu sidebar, open the relevant configuration item for editing.
For example, to assign the customer to an Android task bundle, click Task bundles > Android, then click the relevant task bundle.
2. On the Edit page of the relevant item, click Show next to the Assigned customers option.
3. Select one or more customers which will be assigned to the configuration item.
You can also deselect customers that have been assigned to the configuration item before. If a customer appears dimmed, the assignment cannot be removed because the configuration item is used by that customer.
4. On the Edit page, click Save to assign the selected customers to the configuration item.
18 Copyright © Sophos Limited
Sophos Mobile
8.3 Renew APNs certificate
Prerequisite: You have uploaded a certificate for the Apple Push Notification service (APNs) to
Sophos Mobile that is about to be expire and needs to be renewed.
Important
In the Apple portal, it is important that you select the correct APNs certificate for renewal. If you renew the wrong certificate, you might need to re-enroll all iOS and macOS devices.
Sophos Mobile manages APNs certificates per customer. Even when an APNs certificate is cloned from the super administrator customer to a regular customer when that customer is created, the customer’s certificate must be renewed separately when it is about to expire.
To facilitate the renewal of APNs certificates, the super administrator can in one step renew the certificates of all customers that use the same certificate.
1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.
2. Click APNs certificate wizard.
3. On the Mode page, click Renew my APNs certificate.
4. On the CSR page, click Download certificate signing request.
This saves the certificate signing request file apple.csr
to your local computer. The signing request file is specific to the current customer.
5. On the Apple ID page, the Apple ID used to create the initial APNs certificate is displayed.
You need this ID to log into the Apple portal.
6. On the Certificate page, click Renew certificate on the Apple portal.
This opens the Apple Push Certificates Portal.
7. Log in with the Apple ID that was displayed in the wizard.
8. In the Apple Push Certificates Portal, click Renew next to your Sophos Mobile APNs certificate.
9. Upload the certificate signing request file apple.csr
you prepared earlier.
10. Download the .pem
APNs certificate file and save it to your computer.
11. On the Upload page, click Upload certificate and then browse for the .pem
file that you received from the Apple Push Certificates Portal.
12. Click Save.
13. On the next page, select one of the following options:
• Click Save for all customers concerned to renew the APNs certificate for the super administrator customer and for customers currently using the same certificate.
• Click Save only for super administrator customer to renew the APNs certificate only for the super administrator customer.
Copyright © Sophos Limited 19
Sophos Mobile
Important
If the following message is shown, you are not renewing the correct certificate:
The topic of the new certificate does not correspond to the old one. If devices have been set up with the previous certificate, they have to be set up again. Do you really want to save your changes?
This message indicates that you are about to create a new APNs certificate with a different identifier. If you confirm the message, all existing iOS and macOS devices are not manageable any more and you have to re-enroll them.
20 Copyright © Sophos Limited
Sophos Mobile
9 Android settings
On the Android tab of the Android setup page, you configure settings for Android devices:
•
Host Sophos apps on your web server
(page 21).
9.1 Host Sophos apps on your web server
You can host the Sophos apps that users install during enrollment on an internal web server instead of Google Play.
Important
• This option introduces a security risk. When you host the Sophos apps on an internal web server, you must allow app installations from outside Google Play in general.
• Make sure the latest app versions are installed on the mobile devices. Regularly upload new versions from the Sophos Product Downloads and Updates web page to your web server and then use a task bundle to install them onto the devices.
Note
We suggest you use the web server that is included in Sophos Mobile. To do so, copy the APK file to the wildfly\tools-content subdirectory of your Sophos Mobile installation directory.
For general information about how to download Sophos software, see Sophos knowledge base article 111195 .
1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the Android tab.
2. Under Select installation source, select Hosted APK file.
3. Enter the URL of the Sophos Mobile Control app in URL of the SMC APK file.
For example, if you have copied the APK file to the wildfly\tools-content subdirectory of your Sophos Mobile installation directory as recommended before, enter this URL:
<self_service_portal_address>/tools/smc.apk
The devices must be able to access the URL.
4. Likewise, enter the URL of the Sophos Mobile Security app in URL of the SMSec APK file.
This requires a Mobile Advanced license.
5. Click Save.
Copyright © Sophos Limited 21
Sophos Mobile
10 General settings for iOS device management
The super administrator can configure the following iOS specific settings:
•
Upload profile-signing certificate
(page 22).
10.1 Upload profile-signing certificate
You can upload a certificate for signing the Sophos Mobile MDM profile on iOS devices. The certificate must be qualified as digital signature and should be issued by a globally trusted CA.
Note
If you don’t upload a profile-signing certificate, the MDM profile is signed with the customer’s
SMC root certificate. In this case, the MDM profile is initially classified as untrusted because it is installed at an earlier stage in the enrollment process than the certificate.
To upload a signing certificate for the MDM profile:
1. Log in to the super administrator customer.
2. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the iOS tab.
3. Under Profile-signing certificate, click Upload certificate (PKCS #12 keystore) and then browse for the P12 keystore file that contains your certificate.
4. Enter the password for the keystore file and then click Apply.
5. Click Save.
Subject, fingerprint and expiration date of the uploaded certificate are displayed. You can use this information later to identify the certificate.
22 Copyright © Sophos Limited
Sophos Mobile
11 Configure connections to EAS proxy servers
With Sophos Mobile, you can set up an EAS proxy to filter email traffic from the managed devices to an email server.
There are two types of EAS proxy:
• The internal EAS proxy that is automatically installed with Sophos Mobile. It supports incoming
ActiveSync traffic as used by Microsoft Exchange or Lotus Traveler for iOS and Samsung Knox devices.
• A standalone EAS proxy that can be downloaded and installed separately. It communicates with the Sophos Mobile server through an HTTPS web interface.
Note
The EAS proxy ignores email traffic from your Android Things and Windows IoT devices. This allows you to assign the same user to an Internet of Things device and to a standard device.
Note
Because macOS doesn’t support the ActiveSync protocol, you can’t use the internal or the standalone EAS proxy to filter email traffic coming from Macs.
11.1 Configure a connection to the internal EAS proxy server
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the EAS
proxy tab.
2. Optional: Under General, select Restrict to Sophos Secure Email to restrict email access to the
Sophos Secure Email app, available for Android and iOS.
This prevents other email apps from connecting to your email server.
3. Under Internal, enter the Exchange or groupware server URL in the Exchange/groupware server
URL text field.
4. Select Use SSL/TLS to use a secure connection.
5. Select Allow EWS subscription requests from Secure Email to allow the Sophos Secure Email app on iOS to subscribe to push notifications through Exchange Web Services (EWS). Push notifications inform the device when there are messages for Secure Email.
Copyright © Sophos Limited 23
Sophos Mobile
Note
• By default, the EAS proxy blocks all requests to the Exchange server’s EWS interface for security reasons. If you select this check box, subscription requests are allowed. Other requests remain blocked.
• For information on how to configure EWS for your Exchange server, see Sophos knowledge base article 127137 .
6. Click Check connection to test the connection.
A message will be displayed if the server can be accessed.
7. Click Save.
11.2 Configure a connection to the standalone EAS proxy server
To configure the connection between Sophos Mobile and the standalone EAS proxy, you upload the certificate of the EAS proxy server to Sophos Mobile. The certificate was generated when you configured the EAS proxy instance.
For information on the installation and configuration of the standalone EAS proxy, see the Sophos
Mobile installation guide .
Important
If the EAS proxy service is started before you have uploaded the certificate, Sophos Mobile rejects the connection to the server and the service fails to start.
To upload the certificate of the standalone EAS proxy:
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the EAS
proxy tab.
2. Optional: Under General, select Restrict to Sophos Secure Email to restrict email access to the
Sophos Secure Email app, available for Android and iOS.
This prevents other email apps from connecting to your email server.
3. Under External, click Upload a file and navigate to the certificate file.
If you have set up more than one EAS proxy instance, repeat this for all instances.
4. Click Save.
5. In Windows, open the Services dialog and restart the EASProxy service.
24 Copyright © Sophos Limited
Sophos Mobile
12 Configure Network Access Control
Sophos Mobile includes an interface to third-party Network Access Control (NAC) systems. By configuring connections to NAC systems, you allow them to obtain a list of devices and their compliance states. Also, when you configure Network Access Control as described in this section, you can later define a compliance policy that denies network access when certain compliance rules are violated.
For information on how to define compliance policies, see the Sophos Mobile administrator help .
To configure Network Access Control:
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the Network
Access Control tab.
2. Select one of the available NAC integrations from the list:
• Sophos UTM
This option enables Sophos UTM integration (for version 9.2 and higher). The integration requires you to set the SMC server URL and admin user credentials in the WebAdmin interface of Sophos UTM, under Management > Sophos Mobile. For details, see the
Sophos UTM administration guide.
• Cisco ISE
This option enables Cisco ISE integration. Configure the following settings:
User name
Password
Password confirmation
Redirection page for blocked devices
The user name that has to be specified in Cisco ISE. It is used by Cisco ISE to log in to Sophos Mobile.
Enter a password for logging in to Sophos Mobile.
Repeat the password.
A URL to which devices are redirected if they are not allowed to access the network.
We recommend that you use the URL of the Self Service
Portal or of an information page with a link to the Self
Service Portal.
On Cisco ISE, you must configure the relevant settings so that it uses the URL of the
Sophos Mobile server and the credentials that you entered here when connecting to the NAC interface.
• Check Point
This option enables Check Point integration (for version R77.10 and higher). Configure the following settings:
User name
Password
Password confirmation
The user name that has to be specified in Check Point. It is used by Check Point to log in to Sophos Mobile.
Enter a password for logging in to Sophos Mobile.
Repeat the password.
Copyright © Sophos Limited 25
Sophos Mobile
In the Check Point Mobile Access Gateway, you must configure some specific settings, as described in the Check Point Support Center article MDM cooperative enforcement for
Mobile clients .
• Web service
This option allows you to connect a third-party NAC system to the web service interface.
Sophos Mobile offers a RESTful web service interface that delivers MAC addresses and network access status of the managed devices.
A third-party NAC system can connect to that interface by using the login credentials of a
Sophos Mobile administrator account.
For implementation details of the web service interface see the Sophos Mobile Network
Access Control interface guide .
• Custom
This option allows you to configure certificate based access to the NAC interface.
Note
The legacy Custom option is deprecated and will be removed in a future release. Use the
Web service option instead to connect a third-party NAC system to Sophos Mobile.
Click Upload a file and navigate to the certificate of the third-party NAC system. The certificate is uploaded and displayed in a table.
A third-party NAC system that presents the certificate to the Sophos Mobile server will gain access to the NAC interface.
3. On the Network Access Control tab, click Save.
26 Copyright © Sophos Limited
Sophos Mobile
13 Configure portal access
As super administrator, you can configure settings for Sophos Mobile Admin and for the Self Service
Portal that apply to all customers.
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the Web
portals tab.
2. Under Session timeouts, select the desired time values from the Admin console and Self
Service Portal lists. Sessions will be closed automatically when the user does not interact with the portal for the selected period of time.
3. Under Self Service Portal, configure the appearance of the Self Service Portal login page: a) Under Login customer preselection, you can select a default customer.
b) Clear Visible and editable to hide the customer field so that users can’t change the default customer.
c) Clear Display password reset link on login page to hide the Forgot password? link.
d) Clear Display link to admin console on login page to hide the Link to admin console link.
4. Under Allowed access list, in the input fields of the Admin console and Self Service Portal sections, enter IP addresses or subnets that are allowed to access the relevant portal. To enable access from any IP address or network, leave the fields empty.
Repeat these steps for all IP addresses or subnets that you want to configure.
a) Either enter an IP address or a subnet range in CIDR notation.
For example, enter 192.168.100.0/24 to specify the 192.168.100.0–192.168.100.255
address range.
b) Click Add to add the IP address or subnet to the list.
Important
If you specify improper addresses, you may lock out yourself from Sophos Mobile Admin.
However, you can always access the console from localhost , that is from the computer on which the Sophos Mobile server is installed.
5. Click Save.
It may take up to 60 seconds for the changes to take effect.
Copyright © Sophos Limited 27
Sophos Mobile
14 Add custom logo
As a super administrator, you can add a custom logo to the login pages of the web console and the
Self Service Portal.
The following rules apply for the logo:
• File format must be Portable Network Graphics (PNG).
• Image width should be about 200 pixel to fit the layout of the login pages.
• Image background color should be white or transparent to blend in with the background of the login pages.
To add a custom logo to the login pages:
1. Prepare a PNG file with your custom logo that complies with the rules mentioned earlier.
2. Go to the wildfly\resources\images subdirectory of your Sophos Mobile installation directory.
In this directory, there is a file customer_logo.png
. By default, this file contains an empty placeholder image of size 1 pixel x 1 pixel.
3. Replace the existing file customer_logo.png
with your custom version.
The custom logo will be displayed above the credential fields of the login pages.
You do not need to restart the Sophos Mobile service to apply the changes. However, users might need to clear the cache of their web browser in order to see the custom logo.
Note
To remove the custom logo and restore the default state of the login pages, replace the file customer_logo.png
with customer_logo.png.bak
, which contains a backup copy of the original 1 pixel x 1 pixel placeholder image.
28 Copyright © Sophos Limited
Sophos Mobile
15 Configure file upload limits
You can configure file size limits for uploaded apps and documents. When the administrator uploads app packages or documents to the Sophos Mobile server, files that exceed the configured limits are rejected.
Note
• The limits apply to all customers.
• The limits apply to a single app packages or document. There is no overall limit.
• The limits only apply to future uploads. Files that have been uploaded before the limits are configured are not restricted.
To configure the maximum size of uploaded files:
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the File
uploads tab.
2. For each of the available categories, enter the maximum size in megabytes for a single file.
3. Click Save.
Copyright © Sophos Limited 29
Sophos Mobile
16 Configure app title
As a super administrator, you can configure the title that is shown in the title bar of the Sophos
Mobile Control app. The default title is Sophos Mobile.
Note
This setting applies to all customers.
Note
This setting does not change the app name Control that is for example shown on the device desktop next to the app icon.
1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the SMC app tab.
2. Under App title, select Use custom app title to disable the default title.
3. In the Custom app title field, enter the app title that you want to use.
4. Click Save.
The Sophos Mobile Control app uses the new title once the device synchronizes with the Sophos
Mobile server.
30 Copyright © Sophos Limited
Sophos Mobile
17 Audit logging
You can log the actions of users while they are logged in to Sophos Mobile Admin. This includes the following information:
• Date
• Performed action
• User name
• Customer name
• Action details
Note
The audit log also includes all changes to Sophos Mobile database objects in general.
17.1 Enable audit logging
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the Audit
logging tab.
2. Select Enable audit logging.
3. Click Save.
4. Restart the Sophos Mobile service from the menu of the Sophos Mobile system tray icon.
17.2 View audit log
1. On the menu sidebar, under INFORM, click Audit logging.
2. On the Audit logging page, use the From and To fields to specify a time period.
3. Click Show log.
All log entries for the time within the specified time period are displayed on the Audit logging page.
4. To export the displayed list to a Microsoft Excel or CSV file, click Export at the bottom of the list and select the required format.
Copyright © Sophos Limited 31
Sophos Mobile
18 Create system messages
As a super administrator, you can create system messages that are displayed on the login pages of Sophos Mobile Admin and the Self Service Portal. You can use this for example to communicate outage times to users and administrators.
For every message you can configure:
• A start and an end date that define the validity period of the message.
• A severity level that defines how the message is displayed.
To create a system message:
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the System
messages tab.
2. Click Add system message.
3. Configure the following settings:
Option
Subject
Severity
Start date
End date
Message
Description
The message subject. When the message is displayed on the login page, only the subject is visible by default.
Select the severity level (critical, warning or note). The severity is used to tag the message with an appropriate icon.
The date from which the message is displayed.
The date until which the message is displayed.
The message body. When the message is displayed on the login page, the message body is hidden by default and can be expanded by clicking the subject line.
You can use the editor toolbar to apply basic formatting to the text.
Visible for users
Visible for administrators
If selected, the message is displayed on the login page of the
Self Service Portal.
If selected, the message is displayed on the login page of the web portal.
4. Click Apply to create the message.
5. On the System messages tab, click Save.
32 Copyright © Sophos Limited
Sophos Mobile
19 Receive Sophos notifications
As a super administrator, you can receive news and notifications from Sophos related to Sophos
Mobile. This includes information like:
• New release announcements
• New patch announcements
• App releases
• End-of-life announcements
• Security notifications
For Sophos Mobile on Premise, the notifications are pushed to the server once per day. All users that are registered for Sophos Mobile error emails will also receive these notifications.
To add a user to the list of email recipients:
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the SMTP tab.
2. Enter the user’s email address in the Email recipients field.
3. Click Save.
Note
The super administrator can view all notifications on the News page.
Copyright © Sophos Limited 33
Sophos Mobile
20 Download server log files
As a super administrator, you can download the log files of the past five days from the server.
Note
If Sophos Mobile is set up as a cluster of server nodes, only the log files of the current node are available, that is the Sophos Mobile server instance to which the load balancer currently redirects the web portal requests. For information on clustering, see the Sophos Mobile
installation guide.
To download the server log files:
1. On the menu sidebar, under SETTINGS, click About.
2. On the About page, click the Download log files link.
3. Click Ok.
A ZIP file containing the log files of the past five days is saved to your local computer, using the download settings of your web browser.
34 Copyright © Sophos Limited
Sophos Mobile
21 Technical support
You can find technical support for Sophos products in any of these ways:
• Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.
• Visit the Sophos Support knowledge base at www.sophos.com/en-us/support.aspx
.
• Download the product documentation at www.sophos.com/en-us/support/documentation.aspx
.
• Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/ support-query.aspx
.
Copyright © Sophos Limited 35
Sophos Mobile
22 Legal notices
Copyright © 2019 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos
Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.
36 Copyright © Sophos Limited
Download
Offentligt link opdateret
Det offentlige link til din chat er blevet opdateret. You may view and manage your chat links after registration here.
Dokument offentligt link
Annonce