Sophos Mobile is the EMM solution for businesses that want to spend less time and effort to manage and secure mobile devices. Manage mobile devices with the easy-to-use, web-based, unified

Sophos Central admin interface alongside endpoint, network, or server security from Sophos. Secure container apps and support for mobile OS containerization in iOS, Android Enterprise, and Samsung

Knox ensure sensitive company data stays separated from personal information on the device.

With its best-in-class data protection, comprehensive security, value-for-money, and flexible management options, Sophos Mobile is the best way to allow the use of mobile devices for work, keeping users productive, business data safe and personal data private.

Sophos Intercept X for Mobile

Sophos Intercept X for Mobile protects your Android and iOS devices without compromising performance or battery life. Powered by leading Sophos anti-malware technology, Sophos Intercept

X for Mobile offers an award-winning level of antimalware and antivirus protection together with

Potentially Unwanted App detection, privacy and security advisors, loss and theft protection, web protection, and much more.

Sophos Secure Workspace

Sophos Secure Workspace is a containerized mobile content management app for iOS and Android that provides a secure way to protect, manage, and distribute business documents and web content.

Edit Office format documents without leaving the container environment to ensure encrypted content remains secure. Anti-phishing technology protects users from malicious links in documents and content.

When managed by Sophos Mobile, admins can easily restrict access to content based on device compliance rules. In combination with Sophos SafeGuard Encryption, Sophos Secure Workspace provides seamless exchange of encrypted files—stored locally or in the cloud—between Windows, macOS, iOS and Android users.

Sophos Secure Email

Sophos Secure Email is a fully featured, secure, and containerized email app for Android and iOS that lets you isolate business email, calendar and contacts from private data on a mobile device when managed by Sophos Mobile. All company information is protected with AES-256 encryption and access can easily be revoked based on device compliance rules. Sophos Secure Email also lets

IT provision business email securely and consistently across different devices and OS variations.

Sophos Mobile

3 About Sophos Mobile Admin

Sophos Mobile Admin is the central instrument for managing devices with Sophos Mobile. It is the web interface of the server used for device management. With the web portal you can implement a corporate policy for the use of devices and apply it to the devices that are enrolled with Sophos

Mobile.

In Sophos Mobile Admin you can:

• Configure the system, for example personal settings or platform-specific settings.

• Configure compliance policies and define actions to be taken if devices no longer comply with the

rules specified. See Compliance policies

(page 33).

• Enroll devices with Sophos Mobile. See

Add devices (page 41).

• Provision new devices. See

Enroll devices (page 42).

• Install apps on enrolled devices. See

Apps (page 292).

•

Define security policies for devices. See Policies (page 99).

• Create task bundles to bundle several tasks and transfer them to the devices in one transaction.

See

Task bundles

(page 281).

•

Configure settings for the Self Service Portal. See Configure Self Service Portal (page 27).

• Carry out administrative tasks on devices, for example reset the password of devices, lock or wipe

devices if they are lost or stolen, unenroll devices. See Manage devices

(page 50).

•

Create and view reports. See Reports (page 8).

3.1 Dashboard

Note

This section applies to the Dashboard page of regular administrators. For the super administrator, the Dashboard page is used to manage customers. See the Sophos Mobile super administrator guide .

The customizable Dashboard is the regular start page of Sophos Mobile and provides access to the most important information at a quick glance. It consists of several widgets providing information about:

• Devices, all or per group

• Compliance status by platform or for all devices

• Managed status by platform or for all devices

• The SSP registration status

• The managed platform versions

You can also add devices from the Dashboard. See

Use the Add device wizard

(page 44).

The following options are available to customize the Dashboard:

• To add a widget to the page, click Add widget.

• To remove a widget from the page, click the Close button in its header.

Sophos Mobile

• To reset the page to its default layout, click Restore default layout.

• To rearrange the widgets on the page, drag a widget header.

3.2 Table views

In Sophos Mobile Admin, many pages display information in a tabular form.

These tables have common controls that you can interact with.

Above the table:

• Use the Show or hide columns icon to configure which table columns are visible.

• Enter text in the Search all fields field to only display data rows that contain that text in any column.

In the table:

• Click a column header to sort the table rows by that property. Click again to revert the sort order.

• Click an entry name to perform the default action on that entry (usually Edit).

• Click the blue triangle next to an entry name to perform more actions on that entry.

Below the table:

• Use the navigation buttons to display a specific table page.

• Use the Export icon to export either the whole table or the current page to a Microsoft Excel file or a CSV file. If you have configured a row filter, only the currently visible rows are exported.

3.3 Prerequisites

Before using Sophos Mobile Admin:

• You need a computer connected to the internet and equipped with a web browser. For information on supported browsers and the relevant versions, see the Sophos Mobile release notes.

• The super administrator must have created a customer (a tenant whose devices are managed in

Sophos Mobile). For further information, see the Sophos Mobile super administrator guide .

Note

For Sophos Mobile as a Service, a customer is predefined. Super administrators are not supported for Sophos Mobile as a Service.

• You need a Sophos Mobile user account and the relevant credentials for logging in to Sophos

Mobile Admin. The credentials consist of customer, user and password.

3.4 User roles

Sophos Mobile administrators have different roles. The role affects what an administrator can do.

The available roles are:

Role

Administrator

Limited Administrator

Reporting

Content admin

Helpdesk

Read-only

App Group Administrator

Duo API

Sophos Mobile

Description

This role can perform all available actions.

This role can enroll and manage devices, but cannot specify essential settings and cannot manage other administrators.

This role can view the list of devices and is able to create reports. For example, an auditor or an employee who needs to document the settings in Sophos Mobile.

This role is intended for employees responsible for uploading, updating or removing documents. Usually this role is assigned to a person outside the IT department. The permissions are set to limit visibility and access only the content in the

Documents menu.

This role can perform actions for support purposes, including enrolling devices and installing apps. This role does not have access to critical functions, such as defining settings and creating, deleting or editing devices/device groups, packages and policies.

This role has read-only access to all settings that are available to the Administrator role.

This role can manage app groups. A typical user is an administrator that accesses the Sophos Mobile web service interface to create, update or read app groups.

This role is required for integration with the Duo Security authentication software. Administrators with the Duo API role can access the Sophos Mobile web service interface for requesting the management status of devices.

See Duo Security integration

(page 85).

Tip

Your Sophos Mobile product delivery includes the Role Editor. Role Editor lets you easily modify existing user roles or create your own custom roles. You can find it in the %MDM_HOME%\tools

\Wizard folder, where %MDM_HOME% is the Sophos Mobile installation folder.

Related tasks

Create administrators (page 352)

3.5 Change your password

You can change your password any time after you have logged in to Sophos Mobile Admin:

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Change

password tab.

2. Enter your old password, a new one and confirm it.

Sophos Mobile

3. Select Save.

3.6 Password recovery

If you have forgotten your password for Sophos Mobile Admin, you can reset it.

1. In the Login dialog box of Sophos Mobile Admin, click Forgot password?

The Reset password dialog box is displayed.

2. Enter your account information and click Reset password.

You receive an email with a link for resetting your password.

3. Click the link.

The Change password dialog box is displayed.

4. Enter a new password, confirm it and click Change password.

Your password has been changed and you are logged in to Sophos Mobile Admin.

Sophos Mobile

4 Key steps for managing devices with

Sophos Mobile

Sophos Mobile offers a wide range of management functions depending on device types, security policies and specific requirements in your organization.

The key steps for managing devices with Sophos Mobile are:

•

Configure compliance policies for devices. See Compliance policies (page 33).

• Create device groups. See

Create device group (page 90).

Device groups are used to categorize devices. We recommend that you put devices into groups.

This helps you to manage them efficiently as you can carry out tasks on a group rather than on individual devices.

• Enroll and provision devices. See

Add devices

(page 41) and Enroll devices (page 42).

Devices can either be enrolled and provisioned by administrators in Sophos Mobile Admin or by device users in the Self Service Portal.

•

Set up policies for devices. See Policies

(page 99).

• Create task bundles. See

Task bundles (page 281).

•

Configure the available features of the Self Service Portal. See Configure Self Service Portal (page

27).

• Apply new or updated policies to enrolled devices.

Sophos Mobile

5 Reports

You can create reports of the items managed by Sophos Mobile.

1. On the menu sidebar, under INFORM, click Reports, and then click the name of the required report.

2. In the Choose format dialog, click one of the available icons to select the output format:

•

Click to export the report to a Microsoft Excel file.

•

Click to export the report to a CSV file.

The report is saved to your computer.

Sophos Mobile

6 Tasks

The Task view page gives you an overview of all tasks you created and started and displays their current state.

You can monitor all your tasks and intervene in case of problems. For example, you can delete a task that cannot be completed but blocks the device.

To delete a task, click the Delete icon next to it.

You can filter tasks according to their type and state and sort them by device name, package name, creator and scheduled date.

6.1 Monitor tasks

In Sophos Mobile Admin, you can monitor all existing tasks for devices.

• The Tasks page shows all unfinished and failed tasks as well as the finished tasks of the last few days. The Task view page is refreshed automatically, so you can watch the states of the tasks evolve.

• The Task details page shows general information about a task from the Tasks page or the Task

archive page.

• The Task archive page shows all tasks.

6.1.1 View unfinished, failed and latest finished tasks

1. On the menu sidebar, under INFORM, click Tasks.

2. On the Task view page, the State column shows the task status, for example, Completely failed.

3. In the Refresh interval (in sec.) field, you can select how often the Task view page is to be refreshed.

4. To view further details about a task, click the Show magnifier icon next to the required task.

The Task details page is displayed. Besides general information on the task (for example, device name, package name and creator) it shows the states a specific task went through, including timestamps and error codes. If there are commands to be executed by the device, an additional

Details button is available on the Task details page.

5. If available, click Details to view the commands to be processed by the device.

If there was no error, the error code is 0 . If a command has failed, the error code is displayed. In most cases there is also a description of what may have caused the command to fail.

6. To return to the Task details page, click Back.

6.1.2 View task archive

1. On the menu sidebar, under INFORM, click Tasks.

2. On the Task view page, click Task archive.

The Task archive page is displayed. It shows all finished and failed tasks in the system.

3. On this page, you can:

• Click Reload to refresh the Task archive page.

Sophos Mobile

• Delete a task from the archive by clicking the Delete icon next to the relevant task.

• Select several tasks and click Delete selected to delete them from the archive.

To go back to the Task view page, click Tasks on the menu sidebar.

6.1.3 Task states

The following table provides an overview of the task states shown on the Task view and on the

Task archive pages.

Every state is associated with a color code that indicates the state category.

Color code State

Accepted

Description

Task has been created.

Will be retried Task will be retried later.

Started

In progress

Task has been started.

Execution of the task is being prepared.

Task bundle in progress Execution of the task bundle is being prepared.

Notified The Sophos Mobile Control app was notified.

Commands sent The Sophos Mobile Control app has received the package and/or the commands.

Result evaluation started The Sophos Mobile Control app has answered and the evaluation of the result has been started.

Result incomplete

Waiting for user interaction

Result evaluation showed that not all commands’ results have been received by now.

There is a pending user action on the device.

Waiting for task completion

Device is locked

An installation task was sent to the device, but it may take some time to complete.

Task waits for the device to become unlocked (iOS).

Sophos Mobile

Color code State

Successful

Description

Package has been installed or the commands have been successfully executed.

Note

For the initial provisioning of the Sophos Mobile

Control app the task must finish with the state

Installed.

Installed

Result evaluation failed

Task partly failed

Delayed

Failed (retry queued)

Task failed

Completely failed

Not started

Skipped

Unknown

The Sophos Mobile Control app has been installed successfully. The device is provisioned now.

Result evaluation could not be executed.

Not all commands of the task could be executed successfully.

Task will be restarted later.

Task has failed and will be retried later.

Task has failed and no further retries are queued.

Task has failed, and it is not possible to retry it.

Task is part of a task bundle and was not processed yet.

Task is skipped because it’s not supported by the device.

The server has no information about the task status.

Color code Category

Open

In progress

Success

Failure

Other

Sophos Mobile

7 Alerts

The Alerts page lists the alerts that require your attention.

For each alert, the list shows the event that caused the alert, when it occurred, and which user and device are affected.

The list also shows the severity of alerts:

Gray info sign for informational alerts

Orange warning sign for medium-priority alerts

Red warning sign for high-priority alerts

Acknowledge alerts

Select one or more alerts and then click Mark as acknowledged to remove the selected alerts from the list. To display acknowledged alerts, select Show acknowledged alerts in the drop-down list above the table.

Note

Acknowledging an alert does not resolve the event that triggered it.

Warning

Alerts are automatically deleted from the Sophos Mobile database after 90 days, even if you have not acknowledged them.

Set up email reports for alerts

Sophos Mobile sends email reports for all alerts that have not been acknowledged yet. For

information on how to set up the list of recipients and the notification schedule, see Configure Email

(page 14).

Which events trigger alerts?

Alerts are created for the following events:

• Compliance violations for which you’ve turned on the Create alert action.

• Device lifecycle changes and important device actions.

• Upcoming expirations of licenses and certificates.

• Other events requiring your attention.

If Sophos Intercept X for Mobile is managed by Sophos Mobile, it creates alerts for security issues and blocked web pages.

Sophos Mobile

8 Setup

In the Setup menu section you configure the general behavior of Sophos Mobile, the interaction with devices, and the interaction with external components like Google or Apple portals.

8.1 Configure personal settings

You can adjust the appearance of Sophos Mobile Admin to your personal preferences. For example, you can set the language, the time zone, or the visible device platforms.

Note

These settings only affect the administrator account you’re currently signed in with.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Personal tab.

2. Configure the following settings:

Option

Language

Description

The user interface language.

Time zone

Unit system

Lines per page in tables

Expert mode

The time zone in which dates are shown.

The unit system for lengths (Metric or Imperial).

Activated platforms

The maximum number of entries displayed per table page.

This setting turns on additional features:

• The Show device page includes the Custom properties tab with your custom device properties.

• The Show device page includes the Internal properties tab with additional properties the device reports.

• Several policy configuration pages include the Extra

settings section to configure optional settings.

The device platforms you want to view.

In Sophos Mobile Admin, only pages and settings relevant for the selected platforms are shown.

3. Select Save.

8.2 Configure password policies

To enforce password security, configure password policies for Sophos Mobile Admin users and the

Self Service Portal.

Sophos Mobile

Note

The password policies do not apply to users from an external LDAP directory.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Password

policies tab.

2. Under Rules, you can define password requirements, like a minimum number of lower-case, upper-case or numerical characters that a password must contain to be valid.

3. Under Settings, configure the following settings: a) Password change interval (days): Enter the number of days until a password expires

(between 1 and 730 ), or leave the field empty to disable password expiration.

b) Number of previous passwords which must not be reused: Select a value between 1 and

10 , or select -- to disable this restriction.

c) Maximum number of failed login attempts: Select the number of failed login attempts until the account gets locked (between 1 and 10 ), or select -- to allow an unlimited number of failed login attempts.

4. Select Save.

8.3 Configure SMC app settings

On the SMC app tab of the General settings page, you configure settings for the Sophos Mobile

Control app on Android, iOS and Windows Mobile devices.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the SMC app tab.

2. Configure the following settings:

Option

Disable unenrollment through app

Description

Remove the Unenroll button from the Sophos Mobile Control app to prevent users from unenrolling their device through the app.

Note

To completely prevent user-initiated unenrollment, also disable the Unenroll device option in the Self

Service Portal settings. See

Create Self Service Portal configurations (page 27).

3. Select Save.

8.4 Configure Email

On the Email configuration tab, you configure settings for emails that are sent by Sophos Mobile.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Email

configuration tab.

2. In Language, select the email language.

3. In Originator name, enter the name that appears as email originator.

Sophos Mobile

4. Optional: Under Alert email settings, configure alert reports that are sent to administrators: a) In Severity, select the severity levels that are included in the report.

b) In Email recipients, specify the recipients by entering one or more valid email addresses.

c) In Email schedule, enter a time of the day when the report is sent out, and then click Add.

Repeat this to send out more than one report per day.

Note

Times are in the server time zone.

5. Click Save.

Related concepts

Alerts (page 12)

8.5 Configure IT contact

Provide your IT contact details so that users can get help with questions or problems.

The information you enter here is displayed in the Self Service Portal and on the users’ devices.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the IT contact tab.

2. Enter the contact information.

3. Select Save.

8.6 Configure privacy settings

You can prevent administrators from viewing privacy-related device information.

You can turn off the following privacy-related settings:

• Device location

When turned off, you can’t view the device location. Users can still view their device’s location in the Self Service Portal.

You can still view the Device location report that shows the last known location of all devices.

• Installed apps

When turned off, you can’t view the apps installed on a device. The Installed apps tab in the device details is not displayed and the Apps per device report is not available.

You can still view summary reports of installed apps for all devices.

To configure privacy settings:

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Privacy tab.

2. To turn off viewing device locations, click Forbid admins to locate devices.

3. To turn off displaying installed apps, click Hide installed apps.

Sophos Mobile

Note

Sophos Mobile records the following privacy-related events:

• An administrator requests a device location.

• A user requests a device location in the Self Service Portal.

• Viewing device locations in Sophos Mobile Admin is turned on or off.

• Viewing installed apps in Sophos Mobile Admin is turned on or off.

8.7 Configure iOS settings

On the iOS tab of the Apple setup page, you configure settings for iOS devices.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the iOS tab.

2. Configure the following settings:

Option

Activation Lock bypass

Synchronize device name

Description

Select Enable to be able to clear the Activation Lock on supervised devices.

When this option is selected, Sophos Mobile retrieves a bypass code when syncing with a supervised device that has Activation Lock enabled. If required, you can perform the Activation Lock bypass action from the device's Show

device page to clear Activation Lock when the device needs to be erased and re-deployed.

Activation Lock is an iOS security feature to prevent the reactivation of lost or stolen devices. Normally, you need the correct Apple ID and password to clear Activation Lock. With the Activation Lock bypass feature, you can clear Activation

Lock by providing the bypass code only.

Select Enable to manage iOS devices under the name that is configured on the device.

When this option is selected, the device name that Sophos

Mobile uses is set every time the device synchronizes with

Sophos Mobile.

When this option is deselected, you set the device name during device enrollment.

3. Select Save.

8.8 Apple Push Notification service certificates

To use the built-in Mobile Device Management (MDM) protocol of iOS and macOS devices, Sophos

Mobile must use the Apple Push Notification service (APNs) to trigger the devices.

Sophos Mobile manages APNs certificates per customer. You must create and upload the certificates for each customer that you use.

APNs certificates have a validity period of one year.

Sophos Mobile

8.8.1 Create APNs certificate

Prerequisite: You have not uploaded a certificate for the Apple Push Notification service (APNs) to

Sophos Mobile yet.

To renew an existing certificate, see Renew APNs certificate

(page 17).

Tip

You can use the same certificate for several customers. See

Copy APNs certificate to another customer (page 18).

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

2. Click APNs certificate wizard.

3. On the Mode page, click Create a new APNs certificate.

4. On the CSR page, click Download certificate signing request.

This saves the certificate signing request file apple.csr

to your local computer. The signing request file is specific to the current customer.

5. You need an Apple ID. Even if you already have an ID, we recommend that you create a new one for use with Sophos Mobile. On the Apple ID page, click Create Apple ID in the Apple portal.

This opens an Apple web page where you can create an Apple ID for your company.

Note

Store the credentials in a safe place where your colleagues can access them. Your company will need these credentials to renew the certificate each year.

6. In the wizard, enter your new Apple ID in the Apple ID field.

7. On the Certificate page, click Create certificate on the Apple portal.

This opens the Apple Push Certificates Portal.

8. Log in with your Apple ID and upload the certificate signing request file apple.csr

9. Download the .pem

APNs certificate file and save it to your computer.

10. On the Upload page, click Upload certificate and then browse for the .pem

file that you received from the Apple Push Certificates Portal.

11. Select Save.

Sophos Mobile reads the certificate and displays the certificate details on the APNs tab.

8.8.2 Renew APNs certificate

Prerequisite: You have uploaded a certificate for the Apple Push Notification service (APNs) to

Sophos Mobile that is about to be expire and needs to be renewed.

To create and upload a new certificate, see Create APNs certificate (page 17).

CAUTION

In the Apple portal, it is important that you select the correct APNs certificate for renewal. If you renew the wrong certificate, you might need to re-enroll all iOS and macOS devices.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

Sophos Mobile

2. Click APNs certificate wizard.

3. On the Mode page, click Renew my APNs certificate.

4. On the CSR page, click Download certificate signing request.

This saves the certificate signing request file apple.csr

to your local computer. The signing request file is specific to the current customer.

5. On the Apple ID page, the Apple ID used to create the initial APNs certificate is displayed.

You need this ID to log into the Apple portal.

6. On the Certificate page, click Renew certificate on the Apple portal.

This opens the Apple Push Certificates Portal.

7. Log in with the Apple ID that was displayed in the wizard.

8. In the Apple Push Certificates Portal, click Renew next to your Sophos Mobile APNs certificate.

9. Upload the certificate signing request file apple.csr

you prepared earlier.

10. Download the .pem

APNs certificate file and save it to your computer.

11. On the Upload page, click Upload certificate and then browse for the .pem

file that you received from the Apple Push Certificates Portal.

12. Select Save.

CAUTION

If the following message is shown, you are not renewing the correct certificate:

The topic of the new certificate does not correspond to the old one. If devices have been set up with the previous certificate, they have to be set up again. Do you really want to save your changes?

This message indicates that you are about to create a new APNs certificate with a different identifier. If you confirm the message, all existing iOS and macOS devices are not manageable any more and you have to re-enroll them.

For information on how to select the correct certificate, see Identify the correct APNs certificate for renewal (page 19).

8.8.3 Copy APNs certificate to another customer

You can copy a certificate for the Apple Push Notification service (APNs) to another customer within the same or a different installation of Sophos Mobile.

CAUTION

If there already exists an APNs certificate at the target location, it is important that the Topic property of the certificate that you want to copy is identical to the Topic of the existing certificate.

If you copy the wrong certificate, you might need to re-enroll all iOS and macOS devices of the customer.

Download the certificate:

1. Log in to Sophos Mobile Admin as an administrator of the customer whose APNs certificate you want to copy.

2. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

3. Make a note of the Topic value that is displayed under APNs certificate.

4. Click Download certificate as PKCS #12 file.

5. In the confirmation dialog, the password for the certificate file is displayed. Make a note of that password and then click Download.

Sophos Mobile

This saves the certificate file apns_cert.p12

to your local computer.

Upload the certificate to a different customer:

6. Log in to Sophos Mobile Admin as an administrator of the customer to whom you want to upload the certificate.

7. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

8. If there already exists an APNs certificate, verify that the Topic value is identical to the value of the certificate you are about to copy.

9. Click APNs certificate wizard.

10. On the Mode page, click Upload an APNs certificate from another Sophos Mobile customer.

11. On the Apple ID page, enter the Apple ID used to create the APNs certificate you are about to upload.

12. On the Upload page, click Upload certificate and then browse for the apns_cert.p12

file you’ve downloaded from the other customer.

13. Enter the password and then click Apply.

14. Select Save.

8.8.4 Identify the correct APNs certificate for renewal

When you renew your Apple Push Notification service (APNs) certificate for the Sophos Mobile

server as described in Renew APNs certificate (page 17), it is important that on the Apple portal

you select the correct APNs certificate for renewal.

This section describes how to identify the APNs certificate that is currently uploaded to the Sophos

Mobile server.

Retrieve the certificate identifier:

1. Log in to Sophos Mobile Admin with an administrator account for the customer whose APNs certificate needs to be renewed.

2. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

3. Make a note of the Topic value that is displayed under APNs certificate.

Identify the certificate:

4. Use your web browser to open the URL of the Apple Push Certificates Portal, https:// identity.apple.com/pushcert/ .

If you are experiencing issues with certain features of the Apple portal when using Microsoft

Internet Explorer, we recommend that you use the latest version of the Firefox, Opera, Chrome or

Safari browser instead.

5. Log in with the Apple ID that you used for the creation of the initial APNs certificate.

In the list of APNs certificates, click the Certificate Info icon next to a certificate entry.

This displays the certificate details.

7. In the Subject DN field, locate the value that follows the string UID= . If this matches the identifier that you determined in Sophos Mobile Admin, you have identified the correct certificate.

8.8.5 Check APNs connectivity of devices

Users of the Sophos Mobile Control app for iOS can check if their devices are able to connect to the

Apple Push Notification service (APNs) server.

1. In the Sophos Mobile Control app, tap the Information icon to open the About screen.

2. Tap Check APNs.

Sophos Mobile

The app tries to connect to the Apple APNs server. The expected server response time is 5 seconds or less.

Check your firewall settings if the APNs server can’t be reached. For a list of required connections see the Sophos Mobile server deployment guide .

8.9 Configure iOS AirPlay destinations

With Sophos Mobile you can remotely trigger AirPlay mirroring between an iOS device and predefined AirPlay destinations (for example AppleTV).

Note

AirPlay only works for devices within the same network.

You can define destinations for AirPlay mirroring.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the iOS

AirPlay tab.

2. In the AirPlay destinations section, click Create AirPlay destination.

The AirPlay destination page is displayed.

3. Enter the device name and, optionally, the MAC address of the AirPlay destination device. If required, enter the password of the device.

4. Click Apply.

The device is shown under AirPlay destinations in the iOS AirPlay tab of the Apple setup page.

5. Select Save.

You can trigger AirPlay mirroring between an iOS device and this destination by clicking Request

AirPlay mirroring from the Actions menu on the Show device page for the relevant device.

8.10 Android settings

On the Android tab of the Android setup page, you configure settings for Android devices:

•

Set Android management mode (page 20)

•

Host Sophos apps on your web server

(page 21).

•

Configure the synchronization interval of the Sophos Mobile Control app (page 21).

•

Enable Baidu Cloud Push service (page 22)

8.10.1 Set Android management mode

For Android devices, you can choose between the Android Enterprise and Device administrator

(legacy feature) management modes.

Android Enterprise

Device administrator (legacy feature)

Sophos Mobile Control is the device or profile owner and uses Android Enterprise to manage a device or a work area on the device.

Sophos Mobile Control is a device administrator and uses Android mobile device management

(MDM) to manage a device.

Sophos Mobile

We recommend you use Android Enterprise.

1. On the menu sidebar, under SETTINGS, select Setup > Android setup and then the Android tab.

2. In Management mode, select the management mode for Android devices.

3. Select Save.

This setting affects which policy types are available in the user interface.

If you’ve selected the Android Enterprise mode, you must set up Android Enterprise for your organization before you can enroll devices.

Related concepts

Set up Android Enterprise - Overview

(page 318)

8.10.2 Host Sophos apps on your web server

You can host the Android apps users install during enrollment, Sophos Mobile Control and Sophos

Intercept X for Mobile, on an internal web server instead of Google Play.

Warning

• This option introduces a security risk. When you host Sophos apps on an internal web server, you must allow app installations from outside Google Play in general.

• Make sure the latest app version is installed on the mobile devices. Regularly upload the newest version from the “Sophos Product Downloads and Updates” web page to your web server and then use a task bundle to install it on the devices.

To configure the installation source for Sophos Mobile Control and Sophos Intercept X for Mobile:

1. Sign in to Sophos Mobile Admin with a super administrator account.

2. On the menu sidebar, under SETTINGS, select Setup > Android setup and then the Android tab.

3. Under Select installation source, select Hosted APK file.

4. Enter the URL of Sophos Mobile Control in URL of the SMC APK file.

For example, if you have copied the APK file to an smc subdirectory below the deployment directory of your web server, enter this URL: <web_server_address>/smc/smc.apk

5. Likewise, enter the URL of the Intercept X app in URL of the Intercept X for Mobile APK file.

This requires a Mobile Advanced license.

6. Select Save.

Related information

Sophos Product Downloads and Updates

8.10.3 Configure the synchronization interval of the Sophos

Mobile Control app

The Sophos Mobile Control app synchronizes with the Sophos Mobile server at these times:

• Immediately, when it needs to communicate device-side changes.

• On request, when it is triggered by the server through the push notification services Google

Cloud Messaging (GCM) and, optionally, Baidu Cloud Push.

Sophos Mobile

• Time scheduled, every 24 hours by default.

If required, you can use a shorter interval for the time scheduled synchronization.

For Sophos Mobile on Premise, this is configured by the super administrator.

Warning

The default value of 24 hours is sufficient in most cases. We recommend that you only use a shorter interval if the push notification services do not work in your environment. Using shorter intervals impacts battery life and data consumption and causes higher server load.

To configure the synchronization interval that the Sophos Mobile Control app on Android devices uses:

1. On the menu sidebar, under SETTINGS, select Setup > Android setup and then the Android tab.

2. Under SMC app sync interval, select a value between 15 minutes and 24 hours from the Sync

interval list.

3. Select Save.

8.10.4 Enable Baidu Cloud Push service

Sophos Mobile uses the Google Firebase Cloud Messaging (FCM) service to send push notifications to Android devices, to trigger them to contact the Sophos Mobile server. In China, FCM will likely not work. Therefore, Sophos Mobile can also use Baidu Cloud Push, which is a Chinese push notification service.

If you manage Android devices that are located in China, enable the Baidu Cloud Push service as follows:

1. On the menu sidebar, under SETTINGS, select Setup > Android setup and then the Android tab.

2. In the Baidu Cloud Push service section, select Enable Baidu Cloud Push service.

3. Select Save.

When Baidu Cloud Push is enabled, Sophos Mobile sends all push notifications through FCM and through Baidu Cloud Push.

8.11 Register Samsung Knox license

If you have a Samsung Knox Premium license, you can manage the Knox container on your Samsung devices with Sophos Mobile.

To register a Samsung Knox Premium license key:

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the

Samsung Knox license tab.

2. Enter your Samsung Knox Premium license key.

You can enter a license key of type KPE Premium or KLM Workspace .

3. Select Save.

If you later decide not to use your Samsung Knox Premium license with Sophos Mobile, click

Remove to deregister the license key.

Sophos Mobile

8.12 Configure polling interval for Windows devices

For Windows devices, you can configure the polling interval at which the Windows MDM client contacts the Sophos Mobile server. Usually, the server contacts the client using push notifications.

Polling is used as a safety measure when the push notification service is not available.

Note

The default values are sufficient in most cases. Using shorter intervals impacts battery life and data consumption and causes higher server load.

1. On the menu sidebar, under SETTINGS, click Setup > Microsoft setup, and then click the MDM

polling interval tab.

2. Select polling intervals for the different Windows operating systems.

3. Select Save.

8.13 Check your licenses

Sophos Mobile uses a user-based license scheme. One user license is valid for all devices assigned to that user. Devices that are not assigned to a user require one license each.

On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the License tab.

The following information is displayed:

• Maximum number of licenses: Maximum number of device users (and unassigned devices) that can be managed.

If the super administrator did not set a quota for the customer, the number of licenses is limited by the overall number for the Sophos Mobile server.

• Used licenses: Number of licenses in use.

• Valid until: The license expiration date.

• Advanced license: The super administrator has activated a Mobile Advanced license for the customer.

If you have any questions or concerns regarding the displayed license information, contact your

Sophos sales representative.

8.14 Simple Certificate Enrollment Protocol (SCEP)

You can distribute certificates to Android, iOS, and Windows Mobile devices using the Simple

Certificate Enrollment Protocol (SCEP).

8.14.1 Prerequisites

In order to use the Simple Certificate Enrollment Protocol, the following prerequisites must be fulfilled:

Sophos Mobile

• An SCEP-enabled Windows CA exists in the environment.

• Login credentials for a user who can create a challenge code are available.

• The Sophos Mobile server has http or https access to the following sites:

— https://YOUR-SCEP-SERVER/CertSrv/MSCEP_ADMIN

— https://YOUR-SCEP-SERVER/CertSrv/MSCEP

8.14.2 Configure SCEP

Before you can use SCEP for your devices, you must configure the connection to your SCEP server.

To configure SCEP:

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the SCEP tab.

2. Specify the following: a) In the SCEP server URL field, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP.

b) In the Challenge URL field, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP_ADMIN.

Note

If you use a Windows 2003 server as the SCEP server, enter https://YOUR-SCEP-

SERVER/CertSrv/MSCEP.

c) In the User and Password fields, enter the user credentials of the user who can create a challenge code.

Note

In the User field, enter a user who has the necessary rights to enroll certificates. Use the logon format: username@domain d) In the Challenge characters field, select the character types that are used for the challenge password.

e) In the Challenge length field, accept the default length.

f) Optional: Clear the Use HTTP proxy option if you want Sophos Mobile to bypass the HTTP proxy when connecting to the SCEP server. This option is only available if the HTTP proxy is enabled.

For Sophos Mobile on Premise, the super administrator can configure an HTTP proxy that

Sophos Mobile uses for outbound HTTP and SSL/TLS connections. See the Sophos Mobile super administrator guide .

For Sophos Mobile as a Service, the HTTP proxy is always enabled.

3. Select Save.

Sophos Mobile tests the connection to your SCEP server.

To deploy a certificate using SCEP, add a SCEP configuration to an Android, iOS, or Windows

Mobile policy.

Sophos Mobile

Tip

In the policy, you can configure an interval after which the device automatically requests a certificate renewal.

8.15 Create customer properties

You can create customer-level properties.

When you create a property with name my property , you can refer to the value of the property by using the placeholder %_CUSTPROP(my property)_% . For example, you can use this to refer to a domain that is specific to the customer.

For details on placeholders, see

Placeholders in policies (page 106).

To create a customer property:

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the

Customer properties tab.

2. Click Add customer property.

3. Enter a name and a value for the customer property.

4. Click Apply.

5. Select Save.

The customer property is added to the Sophos Mobile customer.

8.16 Configure SSL/TLS certificates

On the SSL/TLS tab of the Sophos setup page, you configure SSL/TLS certificates for the secure connections between the Sophos Mobile server and the clients.

For details, see the Sophos Mobile super administrator guide .

8.17 Configure EAS proxy

On the EAS proxy tab of the Sophos setup page, you configure the EAS proxy server that is used to filter email traffic between the managed devices and your email server.

For details, see the Sophos Mobile super administrator guide .

8.18 Configure Network Access Control

On the Network Access Control tab of the Sophos setup page, you configure the connection to a

Network Access Control (NAC) system.

For details, see the Sophos Mobile super administrator guide .

Sophos Mobile

8.19 Configure email server connection

On the SMTP tab of the Sophos setup page, you configure the connection to an SMTP email server.

For details, see the Sophos Mobile super administrator guide .

8.20 Configure proxy server connection

On the HTTP proxy tab of the Sophos setup page, you configure the connection to a proxy server

Sophos Mobile uses for HTTP and SSL/TLS connections.

For details, see the Sophos Mobile super administrator guide .

8.21 Configure portal access

On the Web portals tab of the Sophos setup page, you configure the access to Sophos Mobile

Admin and to the Self Service Portal.

For details, see the Sophos Mobile super administrator guide .

8.22 Configure file upload limits

On the File uploads tab of the Sophos setup page, you configure file size limits for uploaded apps and documents.

For details, see the Sophos Mobile super administrator guide .

8.23 Turn on audit logging

On the Audit logging tab of the Sophos setup page, you turn on the logging of all actions users perform in Sophos Mobile Admin.

For details, see the Sophos Mobile super administrator guide .

8.24 Create system messages

On the System messages tab of the Sophos setup page, you create system messages that are displayed on the sign-in pages of Sophos Mobile Admin and the Self Service Portal.

For details, see the Sophos Mobile super administrator guide .

Sophos Mobile

9 Configure Self Service Portal

With the Self Service Portal you can reduce IT efforts by allowing users to enroll devices on their own and carry out other tasks without having to contact the helpdesk.

With a Self Service Portal configuration you define the following:

• The user groups allowed to use the Self Service Portal.

• The types of devices users can enroll.

• The device actions users can perform.

The Self Service Portal is available for the following platforms:

• Android

• iOS

• macOS

• Windows Mobile

• Windows

• Chrome OS

9.1 Create Self Service Portal configurations

With a Self Service Portal configuration, you configure the types of devices that users can enroll, the enrollment details, and the device actions they can perform in the Self Service Portal.

You can use different Self Service Portal configurations for different users. To do so, add users to a user group and associate the group with a configuration. You can find details on user groups in related information.

If a user belongs to several groups that are all associated with Self Service Portal configurations, the configuration with the highest priority applies.

Warning

Because of the complexity of Self Service Portal configurations, we recommend that you test device enrollment for different user groups before you roll out the settings to your actual users.

To create a Self Service Portal configuration:

1. On the menu sidebar, under SETTINGS, select Setup > Self Service Portal.

2. Select Enrollment texts and then add a terms of use text and a post-enrollment text.

When you assign these texts to your Self Service Portal configuration, they are displayed before

and after the enrollment, respectively. For details, see Create enrollment texts

(page 29).

3. On the Self Service Portal configurations page, select Add to create a configuration.

You can create several configurations and assign these to different user groups.

4. Configure the following settings:

Option

Name

Description

The name of the configuration.

Sophos Mobile

Option

User groups

Description

In the Self Service Portal, users select a configuration by this name.

Select Add and then enter a user group. The configuration is applied to all members of that group.

You can add more than one user group to a configuration, but you can’t add the same user group to different configurations.

Maximum number of devices

The maximum number of devices a user can enroll in the Self

Service Portal.

Actions Select Show and then select the management actions a user can perform in the Self Service Portal.

For details of actions supported by a device platform, see

Available Self Service Portal actions (page 29).

5. Select Add and then a device platform.

6. In the Configure platform settings dialog, configure the following settings:

Option

Display name

Description

The name of the platform settings.

In the Self Service Portal, users select an enrollment type by this name.

Description

Owner

A description of the platform settings.

This description is displayed in the Self Service Portal next to the name.

The owner mode (corporate or personal) of devices enrolled with this configuration.

Device group

Enrollment package

The device group the device is added to.

The task bundle (for Android, iOS, and macOS) or policy (for

Windows and Windows Mobile) sent to the device.

Leave this field empty to display no text.

Users must agree to the text to proceed with the enrollment.

Post-enrollment text The text to be displayed in the Self Service Portal after the enrollment.

Leave this field empty to display no text.

7. Select Apply to add the platform settings to the Self Service Portal configuration.

8. If required, configure additional platforms.

For each platform, you can configure different settings for corporate and for personal devices.

9. On the Edit Self Service Portal configuration page, select Save.

Sophos Mobile

If required, add more Self Service Portal configurations for other user groups.

On the Self Service Portal configurations page, you can use the arrow icons next to a configuration to change its priority. If Self Service Portal users match more than one configuration

(because they are a member of several groups), the configuration with the highest priority is used.

There always is a Default configuration. This configuration has the lowest priority, so that it is only used when no other configuration matches a user.

Related tasks

Create user groups (page 98)

With user groups you control Self Service Portal access and available enrollment options.

9.2 Create enrollment texts

A Self Service Portal configuration can include a terms of use text and a post-enrollment text that are displayed before and after the enrollment, respectively. You create these texts separate from the Self

Service Portal configuration and then assign them as required.

1. On the menu sidebar, under SETTINGS, click Setup > Self Service Portal.

2. Click Enrollment texts and then click the type of text to create:

• Terms of use: A mobile policy, disclaimer or agreement text that is displayed before the enrollment. Users must agree to the text to proceed with the enrollment.

• Post-enrollment text: Text to be displayed after the enrollment, for example a description of post-enrollment tasks the user must perform.

3. On the Edit enrollment text page, enter a name for the text and the text itself.

You may use HTML markup to format the text.

4. Select Save.

When you configure a Self Service Portal setting, you can select one terms of use text and one postenrollment text for every type of enrollment.

With a Self Service Portal configuration, you configure the types of devices that users can enroll, the enrollment details, and the device actions they can perform in the Self Service Portal.

9.3 Available Self Service Portal actions

Self Service Portal actions let users manage their devices. You set the available actions in the Self

Service Portal configuration.

Action

Locate device

Description

Locate a device if it’s lost or stolen.

Platforms

Android iOS

Windows Mobile

Windows

Chrome OS

Sophos Mobile

Action

Lock device

Reconfigure device

Show compliance violations

Refresh data

Reset password

Description

Lock a device if it’s lost or stolen.

Reconfigure the Sophos Mobile Control app, for example if the user uninstalled it accidentally.

For non-compliant devices, show violation details.

Synchronize a device with the Sophos Mobile server.

Depending on your compliance policy, devices might become non-compliant when they don’t synchronize regularly, for example when they are switched off for a long time. If this happens, users can perform this action to make the device compliant again.

This function is not available for devices on which Sophos Mobile only manages the

Sophos container.

Reset the lock screen password.

For Android and iOS devices, Sophos Mobile sets a temporary password. After the user has unlocked the device, they must set a new password.

For Android Enterprise work profile devices, the work profile’s password is reset.

For iOS devices, Sophos Mobile deletes the password. The user must set a new password within 60 minutes.

Android iOS

Windows Mobile

Platforms

Android iOS macOS

Windows Mobile

Android iOS macOS

Windows Mobile

Windows

Android iOS macOS

Windows Mobile

Windows

Android iOS macOS

Windows Mobile

Windows

Chrome OS

Sophos Mobile

Action

Wipe

Wipe Android work profile

Unenroll device

Delete unmanaged device

Reset App Protection password

Reset Sophos container password

Reconfigure the SMC app

Managed Lost Mode

Play Lost Mode sound

Description

Reset a device to its factory settings if it’s lost or stolen.

All data on the device is deleted.

Platforms

Android iOS macOS

Windows Mobile

Windows

Android Remove the work profile from a device. This also unenrolls the device from Sophos Mobile.

Unenroll a device from Sophos Mobile.

Delete a device from Sophos Mobile.

Android iOS macOS

Windows Mobile

Windows

Chrome OS

Android iOS macOS

Windows Mobile

Windows

Chrome OS

Android Reset the App Protection password.

Users must enter this password to use apps you’ve defined as protected.

Reset the Sophos container password.

Users must enter this password to use the

Sophos container apps Sophos Secure Email and Sophos Secure Workspace.

Reconfigure an already installed Sophos

Mobile Control app.

Android iOS

Turn Managed Lost Mode on or off.

Play a sound on a device in Managed Lost

Mode.

iOS

Windows Mobile iOS iOS

Sophos Mobile

With a Self Service Portal configuration, you configure the types of devices that users can enroll, the enrollment details, and the device actions they can perform in the Self Service Portal.

Sophos Mobile

10 Compliance policies

With compliance policies you can:

• Allow, forbid or enforce certain features of a device.

• Define actions that are executed when a compliance rule is violated.

You can create different compliance policies and assign them to device groups. This allows you to apply different levels of security to your managed devices.

Tip

If you are planning to manage both corporate and private devices, we recommend that you define separate compliance policies for at least these two device types.

10.1 Create compliance policy

1. On the menu sidebar, under CONFIGURE, click Compliance policies.

2. On the Compliance policies page, click Create compliance policy, and then select the template the policy will be based on:

• Default template: A selection of compliance rules, with no actions defined.

• PCI template, HIPAA template: Compliance rules and actions based on the HIPAA and the

PCI DSS security standard, respectively.

Your choice of template doesn’t restrict your subsequent configuration options.

3. Enter a name and, optionally, a description for the compliance policy.

Repeat the following steps for all required platforms.

4. Make sure that the Enable platform check box on each tab is selected.

If this check box is not selected, devices of that platform are not checked for compliance.

5. Under Rule, configure the compliance rules for the particular platform.

Note

Each compliance rule has a fixed severity level (high, medium, low) that is depicted by a blue icon. The severity helps you to assess the importance of each rule and the actions you should implement when it is violated.

Note

For devices where Sophos Mobile manages the Sophos container instead of the whole device, only a subset of compliance rules is applicable. In Highlight rules, select a management type to highlight the rules that are relevant.

6. Under If rule is violated, define the actions that will be taken when a rule is violated:

Option

Deny email

Description

Forbid email access.

Sophos Mobile

Option

Lock container

Deny network

Create alert

Transfer task bundle

Description

This action can only be taken if the super administrator has configured a connection to the internal or to the standalone

EAS proxy. See the Sophos Mobile super administrator guide .

This action is only available for Android, iOS, Windows and

Windows Mobile devices.

Disable the Sophos Secure Workspace and Secure Email apps.

This affects document, email and web access that is managed by these apps.

This action can only be taken when you have activated a

Mobile Advanced license.

This action is only available for Android and iOS devices.

Forbid network access.

This action can only be taken if the super administrator has configured Network Access Control. See the Sophos Mobile super administrator guide .

This action is not available for devices where Sophos Mobile only manages the Sophos container.

Trigger an alert.

The alerts are displayed on the Alerts page.

Transfer a specific task bundle to the device.

Select a task bundle from the list, or select None to transfer no task bundle when the compliance rule is violated.

This action is only available for Android, iOS, macOS and

Windows devices.

CAUTION

When used incorrectly, task bundles may misconfigure or even wipe devices. To assign the correct task bundles to compliance rules, an in-depth knowledge of the system is required.

Note

When an Android Enterprise fully managed device becomes non-compliant, all apps are disabled.

7. When you have made the settings for all required platforms, click Save to save the compliance policy under the name that you specified.

Sophos Mobile

10.2 Available compliance rules

This section lists the compliance rules that you can select for the individual platforms.

Rule

Managed required

Tamper protection turned off

Minimum SMC version

Minimum Sophos Chrome Security version

Root access allowed

Google SafetyNet compatibility required

Apps from unknown sources allowed

Description

Select actions that will be executed when a device is no longer managed.

Platforms

Android iOS macOS

Windows Mobile

Windows

Chrome OS

Chrome OS Select actions that will be executed when the Chrome Security policy has been tampered with.

The earliest allowed version of the

Sophos Mobile Control app.

The earliest allowed version of the

Sophos Chrome Security extension.

Android iOS

Windows Mobile

Android iOS

Windows Mobile

Select whether devices with root rights are allowed.

This also allows the following devices if they are classified as insecure by the operating system:

• Sony devices with Enterprise API level

4 or later

• Samsung devices with Knox Standard

SDK 5.5 (API level 17) or earlier

Android

The device must pass the

Compatibility Test Suite (CTS), a

Google SafetyNet test for Android compatibility.

Android

Select whether apps from outside

Google Play (Android) or the Chrome

Web Store (Chrome OS) are allowed.

For Android, this rule only affects devices with Android 7.x or earlier.

Android

Chrome OS

Sophos Mobile

Rule

Android Debug Bridge (ADB) allowed

Allow jailbreak

Screen lock required

Minimum OS version

Maximum OS version

Mandatory OS updates

Description

Select whether ADB (Android Debug

Bridge) is allowed.

Select whether jailbroken devices are allowed.

Platforms

Android iOS

Select whether a device password or other screen lock mechanism (like pattern or PIN) is required.

For Android, this includes the display lock types “Pattern”, “PIN” and

“Password”, but not “Swipe”.

Windows Mobile devices that have no password policy assigned are always reported as non-compliant. This is a

Windows limitation.

The earliest allowed version of the operating system.

Android iOS

Windows Mobile

Windows

Android iOS macOS

Windows Mobile

Windows

Chrome OS

The latest allowed version of the operating system.

Android iOS macOS

Windows Mobile

Windows

Chrome OS iOS Select if devices must have the latest available or the latest required update installed.

Some iOS updates are classified as required by Apple. The latest available update might be newer than the latest required update.

Sophos Mobile

Rule

Maximum interval between synchronizations

Maximum interval between SMC synchronizations

Maximum interval between

Intercept X for Mobile synchronizations

Maximum interval between

Intercept X for Mobile scans

Intercept X for Mobile permissions can be denied

Malware apps allowed

Suspicious apps allowed

PUAs allowed

Description

The maximum allowed interval at which the device must synchronize with Sophos Mobile.

The maximum allowed interval at which Sophos Mobile Control must synchronize with Sophos Mobile.

The maximum allowed interval at which Sophos Intercept X for Mobile must synchronize with Sophos

Mobile.

The maximum allowed interval at which Sophos Intercept X for Mobile must perform malware scans.

Select whether the device becomes non-compliant if the user denials the app permissions for Sophos Intercept

X for Mobile.

Select whether malware apps detected by Sophos Intercept X for

Mobile are allowed.

Select whether suspicious apps detected by Sophos Intercept X for

Mobile are allowed.

Select whether Potentially Unwanted

Apps (PUAs) detected by Sophos

Intercept X for Mobile are allowed.

Platforms

Android iOS macOS

Windows Mobile

Windows

Chrome OS iOS

Windows Mobile

Android iOS

Android

Sophos Mobile

Rule

Encryption required

Third-party profiles allowed

Data roaming allowed

Container configured

Locate permission required

SMC permissions can be denied

App is able to locate

Description

Select whether encryption is required for devices.

Users must additionally enable the

Require PIN to start device or

Require Password to start device setting when they set a screen lock.

See Sophos knowledge base article

123947 .

For macOS, this setting applies to

FileVault full-disk encryption.

For Windows Mobile, a violation is only reported if the restriction Forbid

unencrypted device is set as well.

This is a Windows limitation.

This rule is not available for iOS because iPhones and iPads are always encrypted.

Configuration profiles not managed by Sophos Mobile are allowed.

Data roaming is allowed.

Platforms

Android macOS

Windows Mobile

Windows iOS

A container must be set up and enabled on the device. This can be a

Sophos container, a Samsung Knox container, or an Android work profile.

This setting refers to the Locate function. Select whether the user has to allow the Sophos Mobile Control app at installation time to retrieve location data in order to be compliant.

The Sophos Mobile Control app needs permissions on the device to work properly. The user has to grant these permissions when the app is installed.

Select whether a denial of the required permissions results in a compliance violation.

Location services must be turned on and the Sophos Mobile Control app must be allowed to use them.

For Windows Mobile, this rule only affects Windows Phone 8.1 devices.

Android iOS

Android

Android iOS

Windows Mobile

Rule

Firewall required

System Integrity Protection required

Security updates required

Allowed apps / Forbidden apps

Mandatory apps

Sophos Mobile

Description

The macOS firewall must be turned on.

System Integrity Protection must be turned on.

Note

System Integrity Protection is a macOS security feature that limits the actions the root user can perform.

System Integrity Protection can be configured when the Mac starts up from macOS Recovery.

Platforms macOS macOS

Automatic installation of macOS security updates must be turned on.

You can specify either Allowed

apps or Forbidden apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list. For information on creating app groups, see

App groups (page 312).

If you specify Allowed apps, only the listed apps are allowed. If other apps are detected the device will no longer be compliant.

macOS

Android iOS macOS

Chrome OS

Note

Android system apps are automatically allowed.

If you specify Forbidden apps, the device will no longer be compliant if these apps are detected.

For Chrome OS, app groups can contain apps and extensions.

Specify apps that must be installed.

Select the app group containing the mandatory apps from the list. For information on creating app groups, see

App groups (page 312).

For Chrome OS, app groups can contain apps and extensions.

Android iOS macOS

Windows

Chrome OS

Sophos Mobile

Rule

Unmanaged apps from unknown sources allowed

Web Filtering turned on

Windows Defender must be turned on

Clean status from Windows

Defender required

Up-to-date Windows Defender definitions required

Description

Apps installed manually through an

IPA file are allowed.

These are self-developed apps signed with an

ad hoc provisioning profile

The Web Filtering feature of

Intercept X must be turned on.

The Windows Defender setting real-

time protection must be turned on.

Device is not compliant when

Windows Defender shows alerts.

Windows Defender must use the latest spyware definitions.

Platforms iOS iOS

Windows

10.3 Assign a compliance policy to device groups

1. On the menu sidebar, under MANAGE, click Device groups.

The Device groups page is displayed.

2. Click the device group you want to assign a compliance policy to.

There is always a Default device group available. For information on how to create your own

device groups, see Create device group

(page 90).

3. Under Compliance policies, select the compliance policies you want to apply to corporate and to personal devices.

4. Select Save.

The selected compliance policies are shown on the Device groups page for the relevant device group under Compliance policy (corporate) and Compliance policy (personal).

10.4 Check devices for compliance

After you have configured compliance policies, you can check if enrolled devices comply with these policies.

1. On the menu sidebar, under CONFIGURE, click Compliance policies.

2. Click Check now.

All enrolled devices are checked for compliance. The specified actions are carried out.

Note

When an Android Enterprise fully managed device becomes non-compliant, all apps are disabled.

Sophos Mobile

11 Devices

11.1 Add devices

Devices can be added to Sophos Mobile in the following ways:

•

Add devices manually. See Add device

(page 41).

• Import devices from a CSV file. See

Import devices

(page 42).

• Use the Add device wizard to add a device to Sophos Mobile, assign it to a user, enroll it, and

transfer an enrollment task bundle. See Use the Add device wizard (page 44).

• Enable users to enroll devices on their own in the Self Service Portal. See

Configure Self

Service Portal

(page 27). This portal reduces IT effort by allowing users to carry out tasks without contacting the helpdesk. The devices are provisioned by executing defined task bundles. See

Task bundles (page 281).

We recommend that you use device groups to group devices for easier administration. See

Device groups

(page 90).

11.1.1 Add device

We recommend that you create one or more device groups before adding your first device to Sophos

Mobile. You can then assign each device to a device group, to simplify device management. See

Create device group (page 90).

To add a new device to Sophos Mobile:

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed.

2. Click Add and then select the platform from the Add device manually menu section.

The Edit device page is displayed.

3. On the Edit device page, enter the following device details: a) In the Name field, enter a unique name for the new device.

b) In the Description field, enter a description for the new device.

c) Under Owner, select Corporate or Personal.

d) In the Email address field enter an email address.

e) In the Phone number field, enter the phone number of the new device. Enter the phone number in international format, for example +491701234567 .

f) Under Device group, select the device group the device is to be assigned to.

For information on how to create device groups, see

Create device group (page 90).

To assign a user to the device, click the Edit user assignment icon next to the User field and

then click Assign user to device. For further information, see Assign a user to a device (page

54).

5. To add custom properties to the device, go to the Custom properties tab and click Add custom

property. For further information, see Add custom device property

(page 65).

6. After you have specified all relevant device details, click Save.

Sophos Mobile

The new device is added to Sophos Mobile and displayed on the Devices page under MANAGE.

You can now provision and manage the device.

Note

For iOS devices, when you have configured Sophos Mobile to synchronize the device name

with the device as described in Configure iOS settings (page 16), the name you entered in the

Name field is replaced by the name set during synchronization.

11.1.2 Import devices

You can add new devices by importing them from a CSV file.

You can import up to 500 devices.

Users and device groups must already be available in Sophos Mobile.

The CSV file must have the following specification:

• The first row is treated as a header and is not imported.

• Values must be separated by semicolon, not by comma.

• All rows must have the correct number of semicolon characters, even if you leave out optional values.

• The file extension must be .csv

• To ensure that non-English characters are imported correctly, the file must be UTF-8 encoded.

Tip

On the Import devices page, click Example CSV to download a sample file.

To import devices from a CSV file:

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click Add > Import devices.

3. On the Import devices page, click Upload a file and then navigate to the CSV file that you have prepared.

The entries are read in from the file and are displayed.

4. If the data is not formatted correctly or is inconsistent, the file as a whole cannot be imported. In this case, follow the error messages that are displayed next to the relevant entries, correct the content of the CSV file accordingly and upload it again.

5. Click Finish to create the devices.

The devices listed in the CSV file are imported and displayed on the Devices page. You can now enroll and configure the devices.

11.2 Enroll devices

After you have added new devices in Sophos Mobile Admin, they must be enrolled with Sophos

Mobile.

Sophos Mobile

Enrollment types

Sophos Mobile supports two enrollment types:

Device enrollment

Sophos container enrollment

This enrollment type provides full Mobile Device

Management (MDM) capabilities. Sophos Mobile is able to manage the whole device.

Sophos Mobile only manages the Sophos container on the device, but not the device itself.

The Sophos container is available for Android and iOS.

Sophos container enrollment is useful in the following situations:

• You want to manage Bring Your Own Device

(BYOD) scenarios. With Sophos container enrollment, your organization can only see very limited device information, and no personal apps or data.

• Your devices are managed by a non-Sophos

MDM software, but you also want to use features provided by the Sophos container, for example corporate keyring synchronization with Sophos SafeGuard Enterprise.

• Your devices are managed by a non-Sophos

MDM software, but you want to configure additional email accounts. For example when you are a consultant company and your employees need to access your customers'

Exchange servers.

Enrollment methods

The following options are available to enroll devices:

• You can enroll individual, unmanaged devices using the Devices function. For further information,

see Enroll individual devices

(page 44).

• You can use the Add device wizard to add a device to Sophos Mobile, assign it to a user, enroll

it, and transfer an enrollment task bundle. See Use the Add device wizard (page 44).

Note

If required, you can use the Add device wizard or the auto-enrollment method to enroll iOS devices without Apple ID. This can be useful, for example to preconfigure the device before handing it over to a user. See

Enroll iOS devices without Apple ID (page 47).

Sophos Mobile

Recommendations

To enroll and configure multiple devices efficiently, the following methods are recommended:

• You can bundle the tasks necessary to enroll devices, apply required policies and install required apps (for example, managed apps for iOS devices). See

Task bundles (page 281).

• You can enable users to enroll devices in the Self Service Portal. To do so, include a task bundle for enrollment when configuring the settings for Self Service Portal use. For further information on how to select the task bundle in the Self Service Portal settings, see

Create Self Service Portal configurations

(page 27).

11.2.1 Enroll individual devices

1. On the menu sidebar, under MANAGE, click Devices and then click the device that you want to enroll.

2. On the Show device page, select an enrollment type:

• To enroll the device with Sophos Mobile, click Actions > Enroll.

• To enroll the Sophos container, click Actions > Enroll Sophos container.

3. For Sophos container enrollment, select a task bundle or policy.

The enrollment task is started and displayed on the Task view page. An email with enrollment instructions is sent to the user.

Warning

In iOS 12.2 or later, you must go to the Settings app to install the configuration profile you’ve downloaded. If you don’t install the profile within 8 minutes, it will be deleted and you must start over.

This restriction doesn’t apply to devices you assign to Sophos Mobile using the Apple Device

Enrollment Program (DEP) or Apple Configurator.

Note

On Macs, the enrollment must be performed by the user that will be managed by Sophos Mobile.

To install the enrollment policy, the user must enter an administrator password.

11.2.2 Use the Add device wizard

You can easily enroll new devices with the Add device wizard. It provides a workflow that combines the following tasks:

• Add a new device to Sophos Mobile.

• Optional: Assign a user to the device.

• Enroll the device.

• Optional: Transfer a task bundle to the device.

1. On the menu sidebar, under MANAGE, click Devices, and then click Add > Add device wizard.

Sophos Mobile

Tip

Alternatively, you can start the wizard from the Dashboard page by clicking the Add device widget.

2. On the User page, either enter search criteria to look up a user the device will be assigned to, or select Skip user assignment to enroll a device that will not be assigned to a user yet.

3. On the User selection page, select the required user from the list of users matching your search criteria.

4. On the Device details page, configure the following settings:

Option

Platform

Name

Description

Phone number

Email address

Description

The device platform.

You can only select a platform that is enabled for the customer that you logged in to.

A unique name under which the device will be managed by

Sophos Mobile.

An optional description of the device.

An optional phone number. Enter the number in international format, for example +491701234567 .

The email address to which the enrollment instructions are sent.

If user management is configured for the customer, this is the email address of the user assigned to the device.

If no user management is configured, enter an email address here.

Owner

Device group

Select the device owner type: either Corporate or Personal.

Select the device group the device will be assigned to. If you have not created a device group yet, you can select the device group Default, which is always available.

5. On the Enrollment type page, select whether you want to enroll the device or only the Sophos container.

See Configure Sophos container enrollment (page 354).

6. Select a task bundle or policy that is transferred to the device. Or select Only enroll device to enroll the device without transferring a task bundle.

7. On the Enrollment page, follow the instructions to complete the enrollment process.

Warning

This restriction doesn’t apply to devices you assign to Sophos Mobile using the Apple Device

Enrollment Program (DEP) or Apple Configurator.

Sophos Mobile

Note

On Macs, the enrollment must be performed by the user that will be managed by Sophos

Mobile. To install the enrollment policy, the user must enter an administrator password.

8. When enrollment has been completed successfully, click Finish.

Note

• When you have made all the selections, you can close the wizard without having to wait for the

Finish button to appear. An enrollment task is created and processed in the background.

• If you have selected a task bundle to be transferred to the device after enrollment, you can

monitor the task status on the Task view page. See View unfinished, failed and latest finished tasks (page 9).

• For iOS devices, when you have configured Sophos Mobile to synchronize the device name with the device as described in

Configure iOS settings

(page 16), the name you entered in the

Name field is ignored and the name that is configured on the device is used instead.

11.2.3 Auto-enroll iOS devices

You can configure iOS devices to auto-enroll with Sophos Mobile during device activation.

To do so, you use Apple Configurator 2 to assign devices to the Sophos Mobile MDM server. When the users switch on their devices for the first time, the iOS setup assistant starts. During setup, the devices are automatically enrolled with Sophos Mobile.

Note

For a detailed description of Apple Configurator 2, see the Apple Configurator 2 user guide

(external link) .

To configure auto-enrollment of iOS devices with Sophos Mobile:

1. As a one-time step to prepare auto-enrollment, create a device group that will be assigned to devices during auto-enrollment with Sophos Mobile. In the device group properties, select the

Enable iOS auto-enrollment option. See

Create device group

(page 90).

2. Make a note of the URL that is displayed in the Auto-enrollment URL field of the device group.

You need this URL when you configure devices with Apple Configurator 2.

3. Connect the iOS device you want to auto-enroll to an USB port of a Mac with Apple Configurator 2 installed.

4. In Apple Configurator 2, use the Prepare Assistant to set up the device configuration.

5. Select Manual Enrollment and then enter the auto-enrollment URL of the device group.

6. Follow the further steps of the Prepare Assistant. You can optionally configure the following aspects of the device activation:

• Enable device supervision mode.

• Configure host computers to which the device is allowed to connect with, using USB ports.

• For supervised devices, generate or choose a "supervision identity".

• Disable configuration steps of the iOS setup assistant.

Sophos Mobile

After you have completed the configuration, hand over the device to the user. When the user switches on the device for the first time, the iOS setup and the enrollment with Sophos Mobile are performed as configured.

Tip

By default, Sophos Mobile manages auto-enrolled devices under a name that is composed from the device ID and the device type. Alternatively, Sophos Mobile can use the name that is

configured on the device. See the Synchronize device name option in Configure iOS settings

(page 16).

11.2.4 Enroll iOS devices without Apple ID

You can enroll an iOS device with Sophos Mobile without having to associate the device with an

Apple ID first. This can be useful for example to preconfigure the device before handing it over to a user.

The standard enrollment method includes the installation of the Sophos Mobile Control app onto the device. Because the app is installed from the App Store and an Apple ID is required to access the

App Store, you need to associate the device with the ID before starting the enrollment.

Alternatively, you can enroll an iOS device without installing the Sophos Mobile Control app, so there is no need to associate the device with an Apple ID. This is provided by:

• The auto-enrollment method. See

Auto-enroll iOS devices

(page 46).

• The Add device wizard. See

Use the Add device wizard

(page 44).

In the wizard, do as follows:

1. On the Enrollment page, select the Enrollment without Apple ID tab.

2. Use the device's web browser to open the enrollment URL. This opens a Sophos Mobile enrollment form.

3. In that form, enter the token and then click Enroll.

4. Follow the instructions on the device to install the enrollment task bundle.

Warning

This restriction doesn’t apply to devices you assign to Sophos Mobile using the Apple Device

Enrollment Program (DEP) or Apple Configurator.

11.2.5 Enroll Android Enterprise devices

For Android Enterprise, devices are usually enrolled in the Self Service Portal.

Note

If you’ve set up Android Enterprise in Sophos Mobile for the Managed Google Play Account scenario, you can also enroll devices with the Add device wizard or with a QR code.

Prerequisites:

Sophos Mobile

• You’ve set up Android Enterprise for the Managed Google Play Account scenario. See

Set up

Android Enterprise (Managed Google Play Account scenario)

(page 319).

• You’ve created an enrollment task bundle.

To enroll an Android Enterprise device:

1. On the menu sidebar, under MANAGE, click Devices, and then click Add > Add device wizard.

2. In the Add device wizard, do as follows: a) On the User page, select Search for user and then enter search criteria to look up the user the device shall be assigned to.

b) On the User selection page, select the required user from the list of users matching your search criteria.

c) On the Device details page, in the Platform field, select Android.

d) On the Enrollment type page, select your enrollment task bundle for Android Enterprise.

Depending on the policy assigned by the task bundle, the device will be an Android Enterprise fully managed or a work profile device.

Note

On Android Enterprise fully managed devices, only the following apps are available:

• Settings

• Phone

• Play Store

• Sophos Mobile Control

• Camera (if you’ve turned on Allow camera in the Restrictions configuration)

Use the Add device wizard

(page 44)

Enroll devices with QR code

(page 67)

To enroll an Android Enterprise fully managed device with a QR code, you scan the QR code during the initial device setup.

11.2.6 Mass-enroll Android Enterprise devices

With the Sophos NFC Provisioning app you mass-enroll corporate-owned Android devices with

Sophos Mobile. You install the Sophos NFC Provisioning app on one device ( Master device ) and then transfer the enrollment settings through NFC to the devices to enroll.

The devices are set up as Android Enterprise fully managed devices.

Prerequisites:

• You’ve set up Android Enterprise for the Managed Google Play Account scenario. See

Set up

Android Enterprise (Managed Google Play Account scenario)

(page 319).

• The master device has NFC.

• The devices you want to enroll are new or reset to factory settings and have NFC.

1. Install the Sophos NFC Provisioning app from Google Play onto the master device.

2. In the Sophos NFC Provisioning app, configure the following settings:

Sophos Mobile

• Connection details of your corporate Wi-Fi network.

• Time zone and language for the new devices.

• Optional: The URL of the Self Service Portal.

• Optional: Skip device encryption.

• Optional: Skip vendor-specific setup.

• Optional: Enable system apps.

If you turn this on, all apps pre-installed by the manufacturer are enabled.

If you turn this off, only these apps are enabled: Google Play Store, Contacts, Messages,

Phone. Google recommends this for Android Enterprise fully managed devices.

3. Tap Ready for transfer and then hold the master device and the device to enroll back to back with the NFC sensors aligned.

The device is set up and enrolled with Sophos Mobile.

To enroll additional devices, tap Ready for transfer again.

11.3 Unenroll devices

You can unenroll devices that will no longer be used, for example when a user gets a new device.

This is useful if you have limited the number of devices a user can enroll in the Self Service Portal.

1. On the menu sidebar, under MANAGE, click Devices.

2. Select the desired device, click Actions and then click Unenroll.

A message is displayed prompting you to confirm that you want to unenroll the device.

Note

It is possible to select several devices for unenrollment.

3. Click Yes.

The device is unenrolled. This results in the following:

• Android devices:

— The Sophos Mobile Control device administrator is disabled.

— The server login data and all other data received are removed.

— The container apps (Sophos Secure Workspace and Sophos Secure Email) and Sophos

Intercept X for Mobile are reset.

• iOS devices:

— All policies are removed.

— All managed apps are uninstalled.

— All certificates received through Mobile Device Management are removed.

— The container apps (Sophos Secure Workspace and Sophos Secure Email) and Sophos

Intercept X for Mobile are reset.

• Macs:

— All policies are removed.

Sophos Mobile

— All certificates received through Mobile Device Management are removed.

Note

• When users disable the Sophos Mobile Control device administrator on Android devices, the

Sophos Mobile Control app unenrolls the device.

• To unenroll an Android Enterprise fully managed device, you must wipe it.

• If you’ve set up Android Enterprise for the Managed Google Play Account scenario, users can only enroll a limited number of devices. In some situations, the Google account might remain on the device after unenrollment and the device still counts as enrolled. If this happens, manually remove the Google account from the device.

11.4 Manage devices

On the menu sidebar, under MANAGE > Devices and Device groups, you can keep track of devices and device groups and carry out a number of administrative tasks.

After adding devices to Sophos Mobile you can, for example:

• View and edit device details.

• Allow or forbid email access for devices.

• Lock or unlock devices remotely.

• Reset device passwords.

• Wipe the device remotely in case of loss or theft.

• Decommission devices (Android and iOS).

• Delete devices.

11.4.1 View devices

1. On the menu sidebar, under MANAGE, click Devices.

2. Go to the required device and click its name.

The Show device page is displayed for the selected device.

Tip

On the Devices page you can display additional information by pointing to certain elements:

• Point to the "Not managed" icon of a device to display the actual status like Unenrolled or

Checked out.

• Point to the "Not compliant" icon of a device to display the severity level (high, medium, low).

11.4.2 The Show device page

On the Show device page, all relevant information for an individual device is displayed.

In the upper part of the page, you can see the most important device information at a glance.

In the lower part of the page, detailed device information is displayed on several tabs. The tabs and information shown depend on the device platform.

Sophos Mobile

From the Show device page, you can directly switch to the Edit device page. To edit the device you are viewing, click Edit.

Status

Shows essential device information like management type, management status, and compliance status.

Policies

Shows the policies and provisioning profiles installed on the device.

The tab also contains commands to assign or remove policies.

Note iOS device policies that only contain the following configurations don’t appear on the Policies tab:

• Roaming/Hotspot

• Wallpaper

These configurations are not installed on the device. They set settings that the user can change later.

Tip

The search field of the table lets you search by IDs, even though the ID is not displayed in the table.

Device properties

Shows device properties, for example, properties for model, model name, OS version, and if the device is rooted (Android) or jailbroken (iOS).

Custom properties

Shows custom device properties. These are the properties that you can create yourself. Custom device properties can, for example, be used in placeholders if no Active Directory connection is available. When you edit a device, you can also add user-specific information here.

Internal properties

Shows internal device properties, for example, ActiveSync traffic allowed, IMEI.

Compliance violations

This tab is only displayed for non-compliant devices. It shows the compliance violations of the device and the actions taken because of the violation.

Sophos Mobile

Installed apps

Shows the software installed onto the device. Different information is displayed for each platform.

The Size column shows the disk space usage of an app itself. The Data column shows the additional disk space that an app uses for user data, configurations, and so on.

You can also install or uninstall apps on this tab.

Note

• For devices where Sophos Mobile only manages the Sophos container, apps outside the

Sophos container are not listed. This includes apps that the user has installed from the

Enterprise App Store.

• For iOS, apps marked as Managed can be silently uninstalled.

• For Macs, apps from all user accounts are listed.

• For Windows computers, you can only uninstall apps that have been installed by Sophos

Mobile. If you try to uninstall an app installed by the user, the task fails.

• You can disable the Installed apps tab.

System apps

Shows Android system apps on the device.

Note

System apps cannot be removed from the device.

Knox apps

This tab shows the apps that the user has installed in the Samsung Knox container.

Knox system apps

This tab shows the system apps that are installed in the Samsung Knox container.

Scan results

This tab shows the results of the last scan Sophos Intercept X for Mobile has performed on the device.

The tab is only available if Sophos Intercept X for Mobile is managed by Sophos Mobile.

Certificates

Shows the certificates in use on the device.

For Macs, device certificates are listed but user certificates are not.

Sophos Mobile

For Windows computers, certificates installed in the user store are listed but not those installed in the device store.

Tip

In the table, point to the Subject or Issuer value to display the certificate details.

Tasks

This tab shows all unfinished and failed tasks for the device as well as the finished tasks of the last few days. You can also view these tasks, together with the tasks for all other devices, on the Task

view page.

Related concepts

Managed apps for iOS (page 304)

iOS apps can be installed as managed or as unmanaged apps.

Mobile Threat Defense with Sophos Intercept X for Mobile (page 336)

Sophos Intercept X for Mobile is a Mobile Threat Defense (MTD) solution for your Android and iOS devices.

Monitor tasks (page 9)

Related tasks

Create compliance policy

(page 33)

Configure privacy settings

(page 15)

You can prevent administrators from viewing privacy-related device information.

11.4.3 Use smart groups

Smart groups are dynamic sets of devices based on filter criteria you define.

For example, you could define a smart group “All corporate Android devices created within the last three months”.

To define a smart group:

1. On the Devices page, select Extended filter above the device list.

2. Set the filter criteria.

3. Enter a name for the smart group in Smart group and select Save.

4. Do one of the following:

• To apply the smart group to the device list, select Filter.

• To close the filter window without applying the smart group, select Close.

5. To apply the smart group later, select Smart groups above the device list and then select an entry.

Tip

• When a smart group or extended filter is active, the filter icon in the table header changes its color from blue to green.

• Remember to reset a filter when it is no longer needed. Otherwise, lists or reports may not include the results you expect.

Other smart groups actions:

Sophos Mobile

• To cancel a smart group and display all devices again, select Extended filter and then select

Reset.

• To delete a smart group, select Smart groups and then select the trashcan icon next to the smart group you want to delete.

• To edit a smart group, first apply it, then select Extended filter and make the required changes, then select Save.

• To apply an ad-hoc filter without creating a smart group, select Extended filter, set the filter criteria and then select Filter.

11.4.4 Edit devices

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the blue triangle next to the required device and then click Edit.

3. Make the necessary changes.

4. Select Save.

11.4.5 Assign a user to a device

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the required device and then click Edit.

On the Edit device page, click the Edit user assignment icon next to the User field and then click the relevant entry from the selection list:

• To assign a user to a device that has no user assigned to it yet, click Assign user to device.

• To assign a different user to a device that already has a user assigned to it, click Reassign

user to device.

• To reload the user list from the LDAP directory, click Refresh user details.

4. On the Enter user search parameters page of the assignment dialog, enter search strings in one or more fields to look up a user the device will be assigned to. For example, enter the user name or part of it.

5. On the Select user page, select the user and then click Apply.

6. On the Edit device page, click Save.

11.4.6 Deassign a user from a device

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the required device and then click Edit.

On the Edit device page, click the Edit user assignment icon next to the User field and then click Deassign user from device.

4. In the confirmation dialog, click Yes.

5. Select Save.

Sophos Mobile

11.4.7 Configure network access

Before you can configure network access for a device, Network Access Control (NAC) must be enabled in Sophos Mobile.

For Sophos Mobile on Premise, NAC is enabled by the super administrator. See the Sophos Mobile super administrator guide .

For Sophos Mobile as a Service, NAC is always enabled.

There are two options to configure network access for a device:

1. Allow or deny network access unconditionally.

2. Disable network access when the device violates a compliance rule, enable network access otherwise.

Note

Sophos Mobile does not control the network access by itself. Instead, it provides a Deny

network status that can be used by external NAC software like Sophos UTM to block network communication.

Note

Network Access Control is not possible for Macs connected via Ethernet. Sophos Mobile can only retrieve the MAC address of a Mac’s Wi-Fi network adapter, not that of its Ethernet adapter.

Because devices are identified by their MAC address, a Mac connected to the network via its

Ethernet port is treated as an unknown device when your external NAC software asks Sophos

Mobile for the device’s network status.

To configure network access for a device:

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, select the devices for which you want to set the network access mode.

3. Click Actions, and then click Set network access.

4. Select the network access mode:

• Allow: Network access for the selected devices is allowed.

• Deny: Network access for the selected devices is denied.

• Auto mode: Network access for the selected devices is based on the compliance status of the devices.

5. Click Yes to save the changes.

Note

You can’t deny network access for devices where Sophos Mobile only manages the Sophos container.

For information on how to configure network access in compliance rules, see Create compliance policy

(page 33).

Sophos Mobile

11.4.8 Scan device

Note

This feature requires a license of type Mobile Advanced.

You can perform device scans on Android devices on which Sophos Mobile manages Sophos Intercept

X for Mobile.

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the device you want to scan.

3. On the Show device page, click Actions > Scan for malware.

A task to perform a device scan is created and transferred to Sophos Intercept X for Mobile.

You can view the scan results on the Scan results tab of the Show device page. Click a threat name to display additional information from SophosLabs.

To scan several devices, create a task bundle with a Scan for malware task and transfer it to the required devices or device groups.

11.4.9 Lock device

You can remotely lock a device that is managed by Sophos Mobile. This activates the screen lock.

Restriction

These instructions don’t apply to Chrome devices.

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device that you want to lock or unlock and then click Show.

3. On the Show device page, click Actions > Lock.

4. For macOS: Set a 6-digit PIN code that must be entered on the Mac to unlock it.

5. For some device types, you can optionally enter a message that is displayed on the lock screen.

A task to activate the lock screen is created and transferred to the device.

• For all platforms except for macOS: The user must enter the device password (or the PIN or pattern, if configured) to unlock the device.

• For macOS: The Mac restarts. The user must enter the PIN code you set to unlock the device.

Note

Even for devices where Sophos Mobile only manages the Android work profile, the Lock action locks the device, not just the work profile.

Note

You can’t lock devices where Sophos Mobile only manages the Sophos container.

Sophos Mobile

Note

You can’t wipe a Mac that has been locked remotely.

Tip

In Sophos Mobile Admin, the macOS system lock PIN is displayed on the device page under

Device properties > Unlock passcode and on the Task details page under Lock PIN.

11.4.10 Reset device password

You can remotely reset the password of the following devices:

• Android devices with Android 6.x or earlier

• Android Enterprise devices

• iOS devices

• Windows Mobile devices

However, you can’t reset the password of the following devices:

• Devices where Sophos Mobile only manages the Sophos container.

• Devices where only Sophos Intercept X for Mobile is enrolled with Sophos Mobile.

• Android Enterprise devices with Android 8.x or later, if the user has not confirmed the device password.

On some devices, the user sets the password during the initial setup before the Sophos Mobile

Control app is installed. In this case, the Sophos Mobile Control app asks the user to confirm the password at every synchronization. As long as the user hasn’t confirmed the password, you can’t reset the password remotely.

To reset the password of a device:

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the device for which you want to reset the password.

3. On the Show device page, click Actions > Reset password.

4. If a one-time unlock password is displayed in the confirmation dialog, communicate it to the user.

For Android and Windows Mobile, the user must unlock the device with the one-time password and then create a new password.

For iOS, the password is removed and the device is unlocked.

11.4.11 Find device

You can find an Android or iOS device and view its location in Google Maps.

Note

For privacy reasons, all events related to device location are recorded and can be inspected later.

You can turn off viewing device locations in the Sophos Mobile privacy settings.

To find a device, the following requirements must be met:

Sophos Mobile

Android:

• The Sophos Mobile Control app is running.

• Location services are turned on.

• The Sophos Mobile Control app has the Location permission.

iOS:

• The Sophos Mobile Control app is running.

• Location Services are turned on and are allowed for the Sophos Mobile Control app.

• You can always view the location of devices in Managed Lost Mode.

Tip

Use the Locate permission required compliance rule to ensure the Sophos Mobile Control app can get the device’s location.

To find a device:

1. On the menu sidebar, under MANAGE, select Devices.

2. Select the device you want to locate.

3. Select Actions > Find.

If Find is not available, check that the Sophos Mobile Control app can get the device’s location.

4. Enter a reason for the request and then select Yes.

A task to get the device location is created and transferred to the device.

If the device is offline, the task remains in Notified status until the device connects with the server.

5. When the task is completed, select Actions > Find > Show location to view the device location in

Google Maps.

To view the location of several devices, select them on the Devices page and then select Actions >

Find. Alternatively, use the Device location report.

You can’t track the device location over time because Sophos Mobile only stores the last known location.

Related tasks

Configure privacy settings

(page 15)

You can prevent administrators from viewing privacy-related device information.

Related reference

Available compliance rules

(page 35)

Sophos Mobile

This section lists the compliance rules that you can select for the individual platforms.

11.4.12 Set client log level

By setting the log level, you configure the amount of logging information the Sophos Mobile client collects on a device.

Restriction

These instructions only apply to platforms that have a Sophos Mobile client:

• Android

• iOS

• Chrome OS

If you don’t set the log level, the user can set it in the Sophos Mobile client.

To set the log level:

1. On the menu sidebar, under MANAGE, select Devices.

2. Select the name of the device for which you want to set the log level.

3. Select Actions > Set log level.

4. Select a log level (Error, Warn, Info, Debug, Trace), or select Device default to let the user set the log level.

The amount of logging information increases from Error to Trace.

After you’ve set the log level, it’s displayed as property client.log.level.serverOverride

on the Internal properties tab.

To set the log level for several devices, select them on the Devices page and select Actions > Set

log level.

Related tasks

Get client logs (page 59)

You can remotely fetch the log files of the Sophos Mobile client on a device. For Android Enterprise devices, you’ll also receive an Android bug report.

11.4.13 Get client logs

You can remotely fetch the log files of the Sophos Mobile client on a device. For Android Enterprise devices, you’ll also receive an Android bug report.

Restriction

These instructions only apply to platforms that have a Sophos Mobile client:

• Android

• iOS

• Chrome OS

To get the log files for a device:

1. On the menu sidebar, under MANAGE, select Devices.

Sophos Mobile

2. Select the name of the device for which you want to get the log files.

3. Select Actions > Get client log files.

Sophos Mobile sends the log files to your email address. The files are not stored on the Sophos

Mobile server.

Tip

Instead of fetching the log files in Sophos Mobile Admin, you can ask the user to perform the Send

log files action.

11.4.14 Wipe device

You can remotely wipe a device that is managed by Sophos Mobile. This resets the device to its factory settings.

Restriction

You can’t wipe the following devices:

• Devices where Sophos Mobile only manages the Sophos container.

• Android Enterprise work profile devices.

• Macs you’ve locked remotely.

To wipe a device remotely:

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device that you want to wipe and then click

Show.

3. On the Show device page, click Actions > Wipe.

4. For some device types, you have to configure additional settings: a) For Android Enterprise fully managed devices, turn on Factory Reset Protection, if required.

CAUTION

If the Google accounts you configured for Factory Reset Protection are invalid, or if you don’t know the account credentials, the device becomes unusable after the wipe.

b) For iOS devices, configure these settings in the confirmation dialog:

• Preserve data plan: If a cellular data plan is available on the device, it is preserved after the factory reset.

• Forbid Quick Start: For the first device start after the factory reset, skip the Quick Start step in the Setup Assistant that allows the user to transfer content from another iPhone.

c) For Macs, set a 6-digit PIN that must be entered on the Mac to unlock it.

5. Click Yes in the confirmation dialog.

A task to wipe the device is created and transferred to the device.

Sophos Mobile

Tip

In Sophos Mobile Admin, the macOS system lock PIN is displayed on the device page under

Device properties > Unlock passcode and on the Task details page under Lock PIN.

Related concepts

Android Factory Reset Protection

(page 326)

Factory Reset Protection (FRP) is an Android security feature that prevents unauthorized access after a factory reset.

11.4.15 Turn Android Factory Reset Protection on or off

Restriction

These instructions only apply to Android Enterprise fully managed devices.

When you configure Factory Reset Protection (FRP) for an Android Enterprise fully managed device, the feature is turned on by default. If you’re sure the device isn’t lost or stolen, you can turn off FRP to simplify the setup procedure.

To turn FRP on or off:

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the device for which you want to set the FRP status.

3. On the Show device page, click Actions > Set Factory Reset Protection.

4. Select Turn on FRP or Turn off FRP.

When FRP is turned on, the device must be unlocked after a factory reset with one of the Google accounts you’ve configured for FRP.

For details on FRP, see

Android Factory Reset Protection (page 326).

CAUTION

If you’ve misconfigured FRP, the device becomes unusable when it’s reset with FRP turned on.

Tip

You can check the FRP status of a device on the Status tab of the Show device page.

Sophos Mobile

11.4.16 Configure telecom expense management

With telecom expense management (TEM) you monitor cellular data usage of individual devices.

Restriction

Telecom expense management is not available for:

• Devices with Android 5.1.1 or earlier.

• Android Enterprise work profile devices.

• Macs.

• Windows and Windows Mobile devices.

• Chrome devices.

To configure telecom expense management for specific devices:

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, select the devices for which you want to configure telecom expense management.

Only select devices with the same cellular data plan.

3. Click Actions > Configure telecom expense management.

4. Configure the following settings:

Option

Turn on monitoring

Description

If selected, monitoring cellular data usage is turned on for the selected devices.

The data volume in MB of your cellular data plan.

Data volume of plan

Alert threshold

Usage cycle reset date

A data volume threshold in MB. When the used data volume for a device exceeds this value, an alert is created.

A value between 1 and 31 to specify the day of the month when the data usage value is reset.

Note

If a month has fewer days than the value entered, the data usage value is reset on the last day of the month.

5. Click Save to apply the settings to the selected devices.

Cellular data usage is reported by a device every time it syncs with the Sophos Mobile server.

To view the current data usage of a device, open the device’s Show device page and then click

Actions > Configure telecom expense management.

Sophos Mobile

Note

The reported data usage might deviate from the values charged by your telecom provider. Data traffic caused by installed apps is reported, but not system updates, system app updates, or similar.

Tip

Use the Cellular data usage report to view the data usage for all devices that have telecom

expense management turned on. See Reports (page 8).

Note

• The data usage value is reset at these times:

— Regularly every month at the end of the day you configured.

— When you turn off telecom expense management for the device.

— When the device is unenrolled from Sophos Mobile.

• For iOS, data usage is not reported when the Sophos Mobile Control app is closed, e.g. when the user has not started the app after restarting the device.

11.4.17 Update the iOS software

You can update the iOS software for the following device types:

• Supervised devices

• Supervised Apple DEP devices

Note

This section describes how to update the iOS software for a single device. To update the iOS software for a device group, use a task bundle with an Install latest iOS update task. See

Available iOS task types (page 285).

To update the iOS software on a device:

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device and then click Show.

3. On the Show device page, click Actions > Show available updates.

A list of iOS updates that are available for the device is displayed. Updates labeled Critical are critical security updates as classified by Apple.

4. To install the latest available update, click Install latest available update.

A task to update the iOS software is created and transferred to the device.

Sophos Mobile

Tip

• To check the update status of a single iOS device, open the device’s Show device page. A warning sign is displayed next to Operating system if the device does not have the latest available iOS version installed.

• To check the update status of all iOS devices, go to the OsUpdateAvailable column of the

Devices report.

11.4.18 Configure iOS Managed Lost Mode

You can put a supervised iOS device into Managed Lost Mode. The device can’t be used until

Managed Lost Mode is turned off again in Sophos Mobile.

In Managed Lost Mode, the only actions available on the device are:

• Dial a phone number you have configured.

• Make an emergency call.

Note

• Managed Lost Mode is a different lock mode from Lost Mode, which a user can turn on in iCloud. When you turn on Managed Lost Mode in Sophos Mobile, the device can’t be unlocked in iCloud.

• Locating the device is more reliable in Managed Lost Mode than in standard lock mode. The device location is reported by iOS system functionality which does not require the Sophos

Mobile Control app to be active.

To turn on Managed Lost Mode:

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device that you want to put into Managed

Lost Mode and then click Show.

3. On the Show device page, click Actions > Turn on Managed Lost Mode.

4. Configure the following settings:

Option

Lock screen message

Description

Text that is displayed on the lock screen.

Phone number A phone number that can be dialed from the lock screen.

Footer Footnote text that is displayed at the bottom of the lock screen.

If you don’t configure a footnote, a standard note to contact an administrator is displayed.

A task to turn on Managed Lost Mode is created and transferred to the device. Managed Lost Mode is turned on immediately after the device has received the task.

When a device is in Managed Lost Mode, you can perform the following actions on the Show device page:

• To locate the device, use Actions > Locate.

• To play a sound on the device, use Actions > Play Lost Mode sound.

Sophos Mobile

• To turn off Managed Lost Mode, use Actions > Turn off Managed Lost Mode.

Tip

To find out if Managed Lost Mode is turned on, check the device property

IsMDMLostModeEnabled.

11.5 Custom device properties

In addition to the properties reported by a device itself, you can add custom properties to the device.

When you add a property with name my property , you can refer to the value of the property by using the placeholder %_DEVPROP(my property)_% . For details on placeholders, see

Placeholders in policies

(page 106).

You can add custom properties to a device in the following ways:

• You add custom properties to an individual device. See

Add custom device property (page

65).

• You create default properties that are assigned to devices as custom properties when the

devices are created. See Create default device property

(page 65).

11.5.1 Add custom device property

In addition to the properties reported by a device itself, you can add custom properties to the device.

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the blue triangle next to the required device and then click Edit.

3. On the Edit device page, go to the Custom properties tab and click Add custom property.

If the Custom properties tab is not available, check that the Expert mode system setting is turned on (under Setup > General > Personal).

4. Enter a name and a value for the property.

5. Click Apply.

6. Select Save.

The custom property is added to the device.

Note

You can’t have a custom device property with the same name as a standard device property.

11.5.2 Create default device property

You can create default properties that are assigned to devices as custom properties when the devices are created.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Default device

properties tab.

2. Click Add custom property.

3. Enter a name and a value for the property.

4. Click Apply.

Sophos Mobile

5. Select Save.

Note

You can’t have a custom device property with the same name as a standard device property.

Note

If the same default property is defined for the customer and for the super administrator customer, the value defined for the customer is used.

11.6 QR code enrollment

You can enroll Android Enterprise fully managed devices by scanning a QR code during the device setup. Use this for example to prepare devices before deploying them to your users.

Requirements:

• You’ve set up Android Enterprise in Sophos Mobile for the “Managed Google Play Account” scenario.

• The devices you want to enroll use Android 7 or later.

(page 319)

11.6.1 Set up QR code enrollment

You must configure the settings that are required to create the QR code and to enroll the device.

Prerequisite:

You’ve created a task bundle for QR code enrollment. The task bundle must have an Assign policy task for an Android Enterprise device policy and must not have an Enroll task.

To set up QR code enrollment:

1. On the menu sidebar, under SETTINGS, select Setup > Android setup, and then select the QR

code enrollment tab.

2. Select Configure Android Enterprise QR code enrollment.

3. Under Configure QR code, configure the settings for the device setup:

• Enable system apps: On Android Enterprise fully managed devices, system apps with a launcher icon are disabled by default. Select this setting to keep all system apps enabled.

• Language: The language of the Android user interface.

• Wi-Fi settings: Select the security type of the Wi-Fi connection or select Don’t configure Wi-

Fi to configure no network in the QR code. In this case, users must manually connect to a Wi-Fi network when they set up the device.

• Wi-Fi SSID: The ID of the Wi-Fi network.

• SSID is hidden: Select this if the Wi-Fi network is hidden.

• Wi-Fi password: The password for the Wi-Fi network.

Devices will automatically connect to the Wi-Fi network if it’s available.

4. Under Configure enrollment, configure how Sophos Mobile manages the device:

Sophos Mobile

• Task bundle: The task bundle transferred to the device.

• Device group: The device group devices are assigned to.

The QR code is displayed on the QR code enrollment tab. You can print it out to use it without access to Sophos Mobile Admin.

Note

• You can enroll all devices with the same QR code.

• You can revoke the QR code to prevent future enrollments. The code is also revoked when you create a new one.

Related tasks

Enroll devices with QR code

(page 67)

To enroll an Android Enterprise fully managed device with a QR code, you scan the QR code during the initial device setup.

11.6.2 Enroll devices with QR code

To enroll an Android Enterprise fully managed device with a QR code, you scan the QR code during the initial device setup.

Restriction

QR code enrollment requires Android 7 or later.

Prerequisites:

• You have a Sophos Mobile user account. You must enter the account credentials during the enrollment process.

• You have the enrollment QR code available.

To enroll a device:

1. Turn on a new device, or reset it to its factory settings if it was already in use.

2. On the Welcome page of the Android setup assistant, tap six times in the same spot.

This opens a QR code reader.

On some devices, you must connect to a Wi-Fi network so that Android can download the QR code reader.

3. Scan the QR code.

4. If the QR code doesn’t contain a Wi-Fi configuration, or if the Wi-Fi network isn’t available, connect to a network manually.

5. Follow the enrollment instructions.

The device enrolls with Sophos Mobile as an Android Enterprise fully managed device.

Depending on the device, the setup procedure might be shorter compared to a manual setup. For example, vendor-specific configuration steps might be skipped.

Sophos Mobile

11.7 Zero-touch enrollment

With Android zero-touch enrollment, you can enroll corporate-owned Android devices in bulk.

Zero-touch enabled devices automatically enroll with Sophos Mobile as an Android Enterprise fully managed device when the users turn them on.

Requirements

• You have an account for the Google zero-touch enrollment portal. Usually, the device reseller creates the account for you when you purchase your first devices.

• You’ve set up Android Enterprise in Sophos Mobile for the Managed Google Play Account scenario. See

Set up Android Enterprise (Managed Google Play Account scenario)

(page 319).

Configuration steps

To use zero-touch enrollment, perform the following steps:

1. Turn on zero-touch enrollment in Sophos Mobile Admin and configure enrollment details. See

Set up zero-touch enrollment (page 68).

2. Create a configuration for Sophos Mobile in the Google zero-touch enrollment portal. See

Create zero-touch configuration (page 69).

3. Purchase zero-touch enabled Android devices from a Google-approved enterprise reseller.

4. Assign the zero-touch configuration for Sophos Mobile to the devices. See

Deploy zero-touch devices (page 69).

Related information

Google zero-touch enrollment website (external link)

Google zero-touch enrollment help (external link)

11.7.1 Set up zero-touch enrollment

To set up zero-touch enrollment in Sophos Mobile Admin, you configure the settings applied to zerotouch enabled Android devices (“zero-touch devices”) when they enroll with your Sophos Mobile server.

Prerequisite:

You’ve created a task bundle for QR code enrollment. The task bundle must have an Assign policy task for an Android Enterprise device policy and must not have an Enroll task.

To set up zero-touch enrollment:

1. On the menu sidebar, under SETTINGS, select Setup > Android setup, and then select the Zero-

touch tab.

2. Select Use zero-touch enrollment.

3. Under Zero-touch configuration settings, select DPC extras to configure settings applied to the device:

• Language: The language of the Android user interface.

Sophos Mobile

• Time zone: The time zone set on the device.

• Enable system apps: On Android Enterprise fully managed devices, system apps with a launcher icon are disabled by default. Select this setting to keep all system apps enabled.

Based on your settings, Sophos Mobile creates a configuration code you must enter in the Google zero-touch enrollment portal.

4. Under Enrollment settings, configure the enrollment of zero-touch devices with Sophos Mobile:

• Device group: The device group devices are assigned to.

• Task bundle: The task bundle transferred to the device.

5. Select Save to save the enrollment settings.

To complete the zero-touch enrollment setup, create a configuration for Sophos Mobile in the Google zero-touch enrollment portal.

11.7.2 Create zero-touch configuration

A zero-touch configuration contains information devices need to enroll with your Sophos Mobile server.

You create this configuration in the Google zero-touch enrollment portal.

This procedure assumes that you’ve set up Android zero-touch enrollment in Sophos Mobile Admin as described in

Set up zero-touch enrollment

(page 68).

1. On the menu sidebar, under SETTINGS, select Setup > Android setup, and then select the Zero-

touch tab.

2. Click Copy next to DPC extras to copy the configuration code to the clipboard.

3. Open the Google zero-touch enrollment portal in a new browser window.

4. Create a new configuration for Sophos Mobile:

• In EMM DPC, select Sophos Mobile Control.

• In DPC extras, enter the configuration code you’ve copied to the clipboard.

5. Optionally, select the configuration as default configuration to apply it automatically to all new devices.

Related information

Google zero-touch enrollment portal (external link)

Google zero-touch enrollment help (external link)

11.7.3 Deploy zero-touch devices

To have a zero-touch enabled Android device (“zero-touch device”) enroll with your Sophos Mobile server, you assign it the Sophos Mobile configuration.

1. Check that the devices you want to deploy are registered in the Google zero-touch enrollment portal.

Usually, the reseller registers the devices for you.

2. In the Google zero-touch enrollment portal, assign the Sophos Mobile configuration to the devices.

Alternatively, select the Sophos Mobile configuration as default configuration to assign it to new devices automatically.

3. Distribute the devices to your users.

Users must have a Sophos Mobile user account.

Sophos Mobile

When a user turns the device on for the first time, the Android setup assistant starts. After the device has connected to the internet, it enrolls with Sophos Mobile as an Android Enterprise fully managed device.

Note

If a device is already set up when you register it in the Google zero-touch enrollment portal, it’s reset to its factory settings.

11.7.4 Turn off zero-touch enrollment

To turn off automatic enrollment of zero-touch enabled Android devices (“zero-touch devices”) with

Sophos Mobile:

1. On the menu sidebar, under SETTINGS, select Setup > Android setup, and then select the Zero-

touch tab.

2. Click Revoke zero-touch configuration.

Zero-touch devices still connect to your Sophos Mobile server to enroll, but the server refuses the request.

To completely disconnect Sophos Mobile from zero-touch enrollment, delete the configuration for

Sophos Mobile in the Google zero-touch enrollment portal.

11.8 Knox Mobile Enrollment

With Samsung Knox Mobile Enrollment (KME), you can enroll corporate-owned Samsung devices with Sophos Mobile in bulk. Knox Mobile Enrollment enabled devices automatically enroll with your

Sophos Mobile server when the users turn them on.

Requirements

• You have a Samsung account.

• You have an account for the Samsung Knox portal.

• The devices you want to enroll have Knox 2.4 or later, depending on the enrollment scenario you want to use. For example, Knox 2.8 or later is required for Android Enterprise full device management.

• For enrollment in Android Enterprise mode, you’ve set up Android Enterprise in Sophos Mobile for the Managed Google Play Account scenario. See

Set up Android Enterprise (Managed Google

Play Account scenario)

(page 319).

Configuration steps

To use Knox Mobile Enrollment, perform the following steps:

1. Turn on Knox Mobile Enrollment in Sophos Mobile Admin and configure enrollment details. See

Set up Knox Mobile Enrollment (page 71).

2. Create a profile for Sophos Mobile in the Samsung Knox Mobile Enrollment console. See Create

KME profile (page 71).

3. Purchase Knox Mobile Enrollment enabled devices.

Sophos Mobile

4. Assign the KME profile for Sophos Mobile to the devices. See Deploy KME devices (page

72).

Related information

Samsung Knox Mobile Enrollment website (external link)

Samsung Knox Mobile Enrollment User Guide (external link)

11.8.1 Set up Knox Mobile Enrollment

To set up Samsung Knox Mobile Enrollment (KME) in Sophos Mobile Admin, you configure the settings applied to KME devices when they enroll with your Sophos Mobile server.

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the

Samsung KME tab.

2. Click Use Knox Mobile Enrollment.

3. Under Enrollment settings, configure the enrollment of KME devices with Sophos Mobile:

• Device group: The device group KME devices are assigned to.

• Task bundle (Android): The task bundle for devices where Sophos Mobile will be Android device administrator.

• Task bundle (Android Enterprise full device management): The task bundle for Android

Enterprise fully managed devices.

The lists show task bundles that don’t have an Enroll task.

You configure the enrollment mode in the MDM enrollment profile in the Samsung Knox

Mobile Enrollment console.

• User authentication: When selected, the user must enter their Sophos Mobile credentials during the device setup. The user is assigned to the device in Sophos Mobile.

When cleared, the device enrolls with Sophos Mobile without user assignment.

4. Click Save to save the enrollment settings.

To complete the Knox Mobile Enrollment setup, create an MDM profile for Sophos Mobile in the

Samsung Knox Mobile Enrollment console.

11.8.2 Create KME profile

A Knox Mobile Enrollment (KME) profile contains information devices need to enroll with your Sophos

Mobile server. You create this profile in the Samsung Knox Mobile Enrollment console.

This procedure assumes that you’ve set up Samsung Knox Mobile Enrollment in Sophos Mobile

Admin as described in Set up Knox Mobile Enrollment

(page 71).

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the

Samsung KME tab.

2. Open the Samsung Knox portal in a new browser window and navigate to the Knox Mobile

Enrollment console.

3. In the Knox Mobile Enrollment console, create an MDM profile for Sophos Mobile.

Turn on the device owner option if you want to use Android Enterprise full device management.

4. Configure the profile using the values shown in Sophos Mobile Admin under MDM profile

configuration.

Click Copy next to a field in Sophos Mobile Admin to copy the value to the clipboard.

Sophos Mobile

There are more profile settings you can configure. See the Samsung Knox Mobile Enrollment

User Guide for details.

5. Save the profile.

Related information

Samsung Knox Mobile Enrollment console (external link)

Samsung Knox Mobile Enrollment User Guide (external link)

11.8.3 Deploy KME devices

To have a Knox Mobile Enrollment enabled device (“KME device”) enroll with your Sophos Mobile server, you assign it the Sophos Mobile profile.

1. In the Knox Mobile Enrollment console, assign the Sophos Mobile profile to the devices.

If the devices are not shown in the Knox Mobile Enrollment console, contact your reseller.

2. Distribute the devices to your users.

If you’ve selected User authentication in the KME enrollment settings in Sophos Mobile Admin, users must have a Sophos Mobile user account.

When a user turns the device on for the first time, a Knox Mobile Enrollment setup wizard starts.

After the device has connected to the internet, it enrolls with Sophos Mobile.

Depending on the enrollment mode you’ve configured in the Sophos Mobile profile in the Knox

Mobile Enrollment console, Sophos Mobile uses either Android Enterprise full device management or the Android device administrator permission to manage the device.

11.8.4 Turn off Knox Mobile Enrollment

To turn off automatic enrollment of Knox Mobile Enrollment enabled devices (“KME devices”) with

Sophos Mobile:

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the

Samsung KME tab.

2. Click Revoke KME configuration.

KME devices still connect to your Sophos Mobile server to enroll, but the server refuses the request.

To completely disconnect Sophos Mobile from Knox Mobile Enrollment, delete the profile for Sophos

Mobile in the Samsung Knox Mobile Enrollment console.

11.9 Apple DEP

With the Apple Device Enrollment Program (DEP), you can purchase iPhones, iPads, and Macs in volume for distribution within your company. DEP simplifies the deployment of mobile devices by providing the following features:

• Configurable activation process.

• Wireless enabling of supervision mode.

• Over-the-air configuration.

• Automatic enrollment of devices with Sophos Mobile during device activation.

Sophos Mobile

Tip

For detailed information on DEP, visit the Apple DEP website at https://www.apple.com/business/ it/ .

Preparation steps

To prepare the management of DEP devices with Sophos Mobile, perform the following one-time steps:

1. In Apple Business Manager, create a virtual MDM server and link it to Sophos Mobile. See Set up Apple DEP

(page 73).

2. In Sophos Mobile, create one or more DEP profiles that control various device attributes specific to DEP. With the DEP profile, you can also customize the setup assistant that starts when a

device is switched on for the first time. See Create DEP profile (page 74).

Deployment steps

When you purchase DEP devices, the typical deployment process includes the following steps:

1. Purchase the devices from Apple or an approved DEP vendor.

2. In Apple Business Manager, assign the devices to the Sophos Mobile MDM server. For this and the next step, see

Deploy DEP devices

(page 75).

3. In Sophos Mobile Admin, assign a DEP profile to the devices.

4. Distribute the devices to your users.

5. When the users switch on their devices for the first time, the customized setup assistant starts.

During setup, the devices are enrolled with Sophos Mobile and the user is assigned to the device.

6. If required, you can transfer additional task bundles to the devices to complete the provisioning.

11.9.1 Set up Apple DEP

To manage Apple DEP devices, you need to create a virtual MDM server in Apple Business Manager and link it to the Sophos Mobile server.

Prerequisites:

• You’ve enrolled your organization with Apple Business Manager.

• You’ve uploaded a certificate for the Apple Push Notification service (APNs) to Sophos Mobile.

See

Create APNs certificate (page 17).

To set up Apple DEP:

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple DEP tab.

2. Click Download public key to download the Sophos Mobile public key file for Apple DEP.

The file is saved to your local computer.

3. Open Apple Business Manager at https://business.apple.com

and sign in with your Apple

ID.

4. Go to Settings > Device Management Settings, and then click Add MDM Server.

Sophos Mobile

5. In MDM Server Name, enter a name for the MDM server, for example Sophos Mobile .

6. In Upload Public Key, upload the public key file that you downloaded from Sophos Mobile.

7. Click Save.

This opens the details page of the new MDM server.

8. Click Download Token.

At this point, you may sign out from Apple Business Manager.

9. On the Apple DEP tab of Sophos Mobile, click Upload a file and select the server token you downloaded from the Apple DEP web portal.

10. Select Save.

The DEP server token is valid for one year.

CAUTION

When you create a new server token in Apple Business Manager, you must use the same Apple

ID that you used for the creation of the initial token.

11.9.2 Reset Apple DEP

Reset the Apple DEP information stored in Sophos Mobile to remove your Apple DEP token from

Sophos Mobile, for example because you’ve uploaded the wrong token.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple DEP tab.

2. Click Reset DEP.

The Apple DEP token, all Apple DEP devices, and all Apple DEP profiles are deleted from Sophos

Mobile.

To stop managing your Apple DEP devices with Sophos Mobile, go to the Apple DEP web portal and remove Sophos Mobile as MDM server.

11.9.3 Create DEP profile

You need to set up the Apple Device Enrollment Program (DEP) before you can create DEP profiles.

See Set up Apple DEP

(page 73).

A DEP profile is assigned to a DEP device and provides information to the Apple server when the device is activated. This information includes:

• The MDM server (that is the Sophos Mobile server) assigned to manage the device.

• Configuration options for the enrollment with Sophos Mobile.

• A list of hosts that can pair with the device.

• Customization options for the setup assistant that starts when the device is switched on for the first time.

If required, you can create several DEP profiles to use different setup and enrollment settings for your DEP devices.

To create a DEP profile:

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple DEP

profiles tab.

2. Click Add.

Sophos Mobile

3. In the Edit DEP profile dialog, enter the required settings.

4. To assign the profile to all new DEP devices to which no profile has been manually assigned to, select it in the Default DEP profile assigned to new devices list.

When you select None, you have to manually assign a DEP profile to new DEP devices as

described in Deploy DEP devices (page 75). Otherwise, DEP devices will not be enrolled with

Sophos Mobile when they are activated.

5. Click Save to save your changes.

Related reference

DEP profile settings (iOS)

(page 78)

DEP profile settings (macOS)

(page 82)

11.9.4 Deploy DEP devices

Perform this procedure to connect your devices to Apple DEP and to enroll them with Sophos

Mobile.

You can manage devices that you have purchased from Apple or from an approved DEP vendor.

Before you can connect devices to Apple DEP, you need to configure the device vendor in the Apple

DEP portal.

Note

In a typical DEP workflow, you perform this procedure before handing over the devices to your users for activation and usage.

Note

For a detailed description of the Apple DEP portal, see the Apple Deployment Programs help .

To assign your devices to Sophos Mobile and to assign a DEP profile to them:

1. Open Apple Business Manager at https://business.apple.com

and sign in with your Apple

ID.

2. Go to Device Assignments.

3. Under Choose Devices, select your new devices by serial number, by order number, or upload a

CSV file containing the serial numbers of your devices.

Note

If you have purchased your devices from a reseller, they are available within 24 hours after the reseller posts your order to Apple.

4. Under Choose Action, select Assign to Server and then select the virtual MDM server that you have set up for Sophos Mobile as described in

Set up Apple DEP (page 73).

5. Click OK to perform the assignment.

At this point, you may log out from Apple Business Manager.

You may skip the remaining steps if you have configured a default DEP profile as described in Create

DEP profile

(page 74).

6. Sign in to Sophos Mobile Admin with an administrator account for the customer for which you want to manage the DEP devices.

7. On the menu sidebar, under MANAGE, click Devices and then click Apple DEP.

Sophos Mobile

The Apple DEP devices page lists all devices that you have assigned to Sophos Mobile in the

Apple DEP web portal.

8. If the devices that you just assigned to Sophos Mobile do not appear in the list, click Synchronize

with Apple DEP portal.

Note

To limit the load on the Apple DEP server, repeated synchronization is possible only after a short queue time.

9. Select the new devices and then click Actions > Assign profile.

10. In the confirmation dialog, select the DEP profile you want to assign to the devices and then click

OK.

When the purchased devices arrive at your company, you can hand them over to your users. No further configuration is required. When the users switch on their devices for the first time, the iOS setup and the enrollment with Sophos Mobile are performed as configured in the assigned DEP profile.

If you have selected the Assign user to device profile option as described in

Create DEP profile

(page 74), the users are automatically assigned to their device.

11.9.5 Manage DEP devices

DEP devices are managed in Sophos Mobile just as non-DEP devices are. See Manage devices

(page 50).

Specifically to DEP, you can assign a DEP profile to a device. The DEP profile provides information

to the Apple server when the device is activated. See Create DEP profile

(page 74).

Note

The DEP profile that is displayed in Sophos Mobile might be different to the profile that is actually used on the device. If you change the assignment after the device was activated, the device continues to use the previously assigned profile until it is wiped and activated again.

To change the DEP profile of a device:

1. On the menu sidebar, under MANAGE, click Devices and then click Apple DEP.

The Apple DEP devices page lists all devices that you have assigned to Sophos Mobile on the

Apple DEP web portal.

2. Click Synchronize with Apple DEP portal to update the DEP information.

3. Select the devices to which you want to assign a different DEP profile.

4. Click Actions and then click the required action:

• Assign profile: Select the DEP profile that will be assigned to the devices when they are activated the next time.

• Deassign profile: Assign no DEP profile when the devices are activated the next time.

The new profile assignment is displayed on the Apple DEP devices page. The changes are applied to the devices after they are wiped and activated again.

Sophos Mobile

11.9.6 Add iOS DEP device manually

You can manually register an iPhone or iPad for the Apple Device Enrollment Program (DEP). Use this for example if you haven’t purchased the device directly from Apple or from an approved DEP vendor.

CAUTION

The device is reset to its factory settings.

1. Connect the device to a USB port of a Mac with Apple Configurator 2.5 or later installed.

2. In Apple Configurator, go to File > New Profile > Wi-Fi to create a network profile for your Wi-Fi connection.

The device requires this profile to connect to the Apple DEP registration server.

3. Go to Preferences > Organization and click the Plus button to create an organization entry.

Use the Apple ID and password of your Apple DEP account. Also, select to generate a new supervision identity.

4. Go to Preferences > Servers and click the Plus button to create a server entry.

Note

You may enter any value in Enrollment URL. Apple Configurator doesn’t use the value when registering DEP devices.

5. Select the device and then select Prepare.

6. Select Manual Configuration and follow the wizard pages to prepare the device.

• Select the server and the network profile you created earlier.

• Skip the configuration of the iOS setup assistant. You configure this in the Sophos Mobile DEP profile.

7. Wait until the preparation procedure is finished. Do not turn off the device at this stage.

When the device is registered, you can select it in the Apple DEP portal by its serial number.

Before you can hand over the device to a user, enroll it with Sophos Mobile as described in Deploy

DEP devices

(page 75).

Related information

Apple Configurator 2 user guide - Prepare devices manually (external link)

11.9.7 Configure device supervision

You can configure Macs that are allowed to supervise your iOS DEP devices. These Macs can pair with an iOS DEP device even if you block USB pairing in general.

To configure a Mac for device supervision, upload its supervision identity certificate to the iOS DEP profile in Sophos Mobile.

1. On the Mac, create a new organization in Apple Configurator or use an existing organization.

2. Open the Keychain Access app.

3. Under My certificates, export the organization’s certificate.

There’s one certificate for each organization you’ve configured in Apple Configurator.

Sophos Mobile

In the export dialog, make sure the certificate is exported in CER format (.cer file name extension).

4. In your iOS DEP profile in Sophos Mobile, go to the USB pairing tab and configure the following settings: a) Clear the Allow USB pairing with all hosts check box.

b) Select Upload host certificate to upload the certificate file.

5. Optional: To configure another Mac for device supervision, do one of the following:

• Upload another certificate to the iOS DEP profile.

• Share the organization between the Macs by doing the following:

Export the organization from Apple Configurator on the first Mac and import it on the second

Mac.

• Share the supervision identity between the Macs by doing the following:

On the first Mac, export the supervision identity from Apple Configurator in PKCS #12 format

(.p12 file name extension). On the second Mac, open the .p12 file with the Keychain Access app.

Related tasks

Create DEP profile (page 74)

Related reference

DEP profile settings (iOS)

(page 78)

Related information

Apple Configurator 2 user guide - Organization preferences (external link)

11.9.8 DEP profile settings (iOS)

General settings

Setting/Field

Name

Description

Device group

Description

The name of the DEP profile.

An optional description of the DEP profile.

A device group that will be assigned to devices when they are enrolled with Sophos Mobile.

For information on device groups, see

Device groups

(page 90).

To simplify device management, we recommend that you use a separate device group for DEP devices.

Setting/Field

Task bundle

Sophos Mobile

Description

A task bundle that will be transferred onto the devices when they are enrolled with Sophos Mobile.

The list includes all task bundles that contain no enrollment task.

For information on task bundles, see Task bundles

(page 281).

Enrollment

Setting/Field

Supervise device

User can remove MDM policy

Install SMC app

User can skip MDM policy assignment

Assign user to device

Description

Supervision mode is enabled.

The user is able to remove the Sophos Mobile enrollment profile through the iOS user interface.

This option can only be deselected for supervised devices.

Install the Sophos Mobile Control app onto the device.

If you enable this option, you must also disable the

Apple ID option on the iOS setup tab to make sure that Sophos Mobile can install the app from the App

Store.

Alternatively, if you are enrolled in the Apple Volume

Purchase Program (VPP), the Sophos Mobile app can be installed as a VPP app, even if the device is not associated with an Apple ID. Devices must be in status

“managed”. See

Automatically assign VPP apps

(page

309).

The user is able to skip the setup step that applies the

Sophos Mobile enrollment profile.

During the enrollment process with Sophos Mobile, users are asked for their Self Service Portal credentials and then assigned to the device.

Use this option to auto-assign a user to the device.

iOS setup

On the iOS setup tab, you disable configuration steps of the setup assistant that starts when the device is switched on for the first time.

Sophos Mobile

Note

These settings only affect the iOS setup. If you disable a configuration step, the user is still able to enable the relevant option later. To completely disable a feature, use a Restrictions configuration.

See

Restrictions configuration (iOS device policy)

(page 178).

Setting/Field

Apple ID

Apple Pay

Location services

Terms and Conditions

Keyboard layout

Privacy

New features

Restore from backup

Disable “Move Data from Android”

Passcode

Display Zoom

Home button feedback

Cellular plan

Screen Time

Diagnostics

Touch ID

Siri

Description

Skip configuring an Apple ID. The user cannot log in with their Apple ID to access Apple services.

Skip configuring Apple Pay. The user cannot add credit or debit card information for paying in stores or within apps using Apple Pay.

Skip configuring location services. Location services are turned off.

Skip the Terms and Conditions page.

Skip configuring the keyboard layout.

Skip the page that explains the Data & Privacy icon.

Skip the pages that explain new iOS features.

Skip restoring data from an iCloud or iTunes backup, or transferring data from an Android device.

The option to transfer data from an Android device is not available.

Skip creating a passcode to unlock the device.

Skip configuring Display Zoom, that is a zoomed view providing larger icons, text and buttons.

For iPhone 7 and later, skip configuring the Home button feedback, i.e. the level of tactile feedback when clicking the virtual Home button.

Skip configuring a cellular data plan.

Skip configuring Screen Time (the reporting and limiting of time spent on the device).

Skip configuring diagnostics. Diagnostic and usage data are not sent to Apple.

Skip configuring Touch ID. The user cannot set up a fingerprint in place of a passcode.

Skip configuring Siri. Siri is turned off.

Setting/Field

Watch migration

True Tone iMessage and FaceTime iOS update information

Sophos Mobile

Description

Skip restoring Apple Watch data from an iCloud or iTunes backup.

Skip activating True Tone (the automatic adaptation of display colors based on ambient lighting conditions).

Skip activating iMessage and FaceTime.

Skip the page that informs users that iOS updates are installed automatically.

Support information

Setting/Field

Department

Phone number

Email

Description

The department or location name associated with the profile.

This name is included in the information that the user can access by clicking About Configuration during device setup.

The support phone number for your company.

This field is pre-populated with the phone number from the technical support contact details. See

Configure IT contact (page 15).

The phone number is stored internally in the DEP profile but is not available to the device user.

The support email address for your company.

This field is pre-populated with the email address from the technical support contact details. See

Configure IT contact (page 15).

The email address is stored internally in the DEP profile but is not available to the device user.

USB pairing

On the USB pairing tab, you can restrict the USB pairing of iOS DEP devices to selected Macs.

USB pairing is required to connect the device to iTunes or Apple Configurator.

Sophos Mobile

Setting/Field

Allow USB pairing with all hosts

Upload host certificate

Description

If you select the check box, you can pair the device with any computer.

If you clear the check box, you can only pair the device with Macs you’ve configured for device supervision.

You can’t pair the device with Windows computers.

Upload a supervision identity certificate.

All Macs containing the certificate in their keychain can supervise the device.

You can upload several certificates.

Note

If you clear Allow USB pairing with all hosts and don’t upload a certificate, you can’t connect the device to iTunes or Apple Configurator.

Related tasks

Create DEP profile (page 74)

Configure device supervision

(page 77)

You can configure Macs that are allowed to supervise your iOS DEP devices. These Macs can pair with an iOS DEP device even if you block USB pairing in general.

11.9.9 DEP profile settings (macOS)

General settings

Setting/Field

Name

Description

Device group

Description

The name of the DEP profile.

An optional description of the DEP profile.

A device group that will be assigned to devices when they are enrolled with Sophos Mobile.

For information on device groups, see

Device groups

(page 90).

To simplify device management, we recommend that you use a separate device group for DEP devices.

Setting/Field

Task bundle

Sophos Mobile

Description

A task bundle that will be transferred onto the devices when they are enrolled with Sophos Mobile.

The list includes all task bundles that contain no enrollment task.

For information on task bundles, see Task bundles

(page 281).

Enrollment

Setting/Field

User can skip MDM policy assignment

Assign user to device

Description

The user is able to skip the setup step that applies the

Sophos Mobile enrollment profile.

During the enrollment process with Sophos Mobile, users are asked for their Self Service Portal credentials and then assigned to the device.

Use this option to auto-assign a user to the device.

macOS setup

On the macOS setup tab, you disable configuration steps of the setup assistant that starts when the device is switched on for the first time.

Note

These settings only affect the macOS setup. If you disable a configuration step, the user is still able to enable the relevant option later. To completely disable a feature, use a Restrictions

configuration. See Restrictions configuration (macOS device policy) (page 223) and

Restrictions configuration (macOS user policy) (page 240).

Setting/Field

Apple ID

Apple Pay

FileVault disk encryption

Terms and Conditions

Passcode

Description

Skip configuring an Apple ID. The user cannot log in with their Apple ID to access Apple services.

Skip configuring Apple Pay. The user cannot add credit or debit card information for paying in stores or within apps using Apple Pay.

Skip configuring FileVault disk encryption. FileVault is turned off.

Skip the Terms and Conditions page.

Skip creating a passcode to unlock the device.

Sophos Mobile

Setting/Field

Appearance

Restore from backup

Diagnostics

Location services

Touch ID

Privacy iCloud Drive

Registration iCloud Analytics

Siri

True Tone

Display Zoom

Support information

Setting/Field

Department

Phone number

Description

Skip configuring the appearance of the user interface (light or dark).

Skip restoring data from an iCloud or iTunes backup.

Skip configuring diagnostics. Diagnostic and usage data are not sent to Apple.

Skip configuring location services. Location services are turned off.

Skip configuring Touch ID. The user cannot set up a fingerprint in place of a passcode.

Skip the page that explains the Data & Privacy icon.

Skip activating the automatic upload of files from Documents and Desktop to iCloud Drive.

Skip creating a computer account.

Skip configuring iCloud Analytics. Diagnostic and usage data from the iCloud account is not sent to Apple.

Skip configuring Siri. Siri is turned off.

Skip activating True Tone (the automatic adaptation of display colors based on ambient lighting conditions).

Skip configuring Display Zoom, that is a zoomed view providing larger icons, text and buttons.

Description

The department or location name associated with the profile.

This name is included in the information that the user can access by clicking About Configuration during device setup.

The support phone number for your company.

This field is pre-populated with the phone number from the technical support contact details. See

Configure IT contact (page 15).

The phone number is stored internally in the DEP profile but is not available to the device user.

Setting/Field

Email

Sophos Mobile

Description

The support email address for your company.

This field is pre-populated with the email address from the technical support contact details. See

Configure IT contact (page 15).

The email address is stored internally in the DEP profile but is not available to the device user.

Related tasks

Create DEP profile (page 74)

11.10 Duo Security integration

You can connect Sophos Mobile with the Duo Security authentication software. This allows Duo

Security to identify trusted devices by their Sophos Mobile management status.

To determine the trust status of a device, Duo Security uses different approaches for Android and iOS:

• For Android devices, Duo Security retrieves the trust status through the Sophos Mobile web service interface.

• For iOS devices, Duo Security determines the trust status by the existence of a certain certificate on the device.

Note

For more information on trusted devices, see the Duo Security documentation.

11.10.1 Configure Duo Security integration for Android devices

Perform the following steps to let Duo Security determine the trust status of your Android devices.

1. In Sophos Mobile, create an administrator with role Duo API.

2. In the Duo Admin Panel, enter the user name and password of that administrator.

See the Duo Security documentation for details.

To determine the trust status of an Android device, the Duo Mobile Android app reports the device

ID to the Duo Security server. The Duo Security server then retrieves the device status through the

Sophos Mobile web service interface and classifies managed devices as trusted.

Related concepts

User roles (page 4)

Related tasks

Create administrators (page 352)

11.10.2 Configure Duo Security integration for iOS devices

Perform the following steps to let Duo Security determine the trust status of your iOS devices.

Sophos Mobile

1. Configure the connection to the Duo certificate server: a) On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the Duo

Security tab.

b) Enter the settings provided by Duo Security.

2. Add a Duo device certificate configuration to the iOS device policy you are using for your iOS devices.

3. Update the iOS device policy on the devices.

This installs a Duo device certificate on the devices. The Duo Mobile iOS app detects the certificate and classifies the devices as trusted.

Related tasks

Assign a policy (page 106)

You assign a policy to devices to apply the settings it includes.

Related reference

Duo device certificate (iOS device policy)

(page 207)

11.11 TeamViewer remote control

TeamViewer is a third-party remote control tool. TeamViewer integration allows you to launch a remote control session with a managed Android or iOS device from within Sophos Mobile without having to use a session ID or password.

11.11.1 Set up TeamViewer integration

To start TeamViewer sessions from within Sophos Mobile, you must create a TeamViewer application and link it to Sophos Mobile.

To use TeamViewer with Sophos Mobile, you need the following:

• A TeamViewer license

• The license add-on for mobile device support

To set up TeamViewer integration:

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the

TeamViewer tab.

2. Click TeamViewer configuration wizard.

The wizard guides you through the setup process: a) Create a TeamViewer account.

b) Create an application in the TeamViewer Management Console and link it to Sophos Mobile.

3. Install the TeamViewer software: a) Go to the computer on which you sign in to Sophos Mobile. Install the TeamViewer Windows client from the TeamViewer website.

b) On the devices you want to control, install the TeamViewer QuickSupport app from Google

Play or from the App Store.

When you’ve set up TeamViewer integration, the Request remote control device action is available.

Sophos Mobile

Related information

TeamViewer website (external link)

TeamViewer Management Console (external link)

11.11.2 Start TeamViewer session

You can start a TeamViewer session with an Android or iOS device from within Sophos Mobile Admin.

Depending on your TeamViewer license, you can only start a limited number of sessions per hour.

To start a TeamViewer session:

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the device you want to control.

3. On the Show device page, click Actions > Request remote control.

This starts a TeamViewer session on your computer and on the selected device. After the user acknowledges the connection, you can control the device.

To start a follow-up session with the same device, the user must first close the TeamViewer client.

11.12 Sophos Chrome Security

Sophos Chrome Security is a security extension for Chrome devices.

Restriction

This feature isn’t available with the Mobile Standard license.

When you enroll Sophos Chrome Security with Sophos Mobile, you can perform the following tasks:

• Find the device.

• Send a message to the device.

• Configure websites that users are allowed to access.

Enrollment options:

• Manual enrollment:

You can enroll a Chrome device with Sophos Mobile using the Add device wizard or the Self

Service Portal. The user must install Sophos Chrome Security on their device and enter an enrollment token.

• Auto-enrollment:

If you have a G Suite account, you can configure the Sophos Chrome Security extension to automatically enroll with Sophos Mobile when a G Suite user signs in to a Chrome device.

Note

The user’s email address you configure in Sophos Mobile doesn’t need to match the account name a user uses to sign in to Chrome. To get that account name, check the

system_user_account device property on the Show device page.

Related concepts

The Show device page

(page 50)

Sophos Mobile

On the Show device page, all relevant information for an individual device is displayed.

Related tasks

Use the Add device wizard

(page 44)

Configure Sophos Chrome Security auto-enrollment (page 88)

If you have a G Suite account, you can configure the Sophos Chrome Security extension to automatically enroll with Sophos Mobile when a G Suite user signs in to a Chrome device.

11.12.1 Configure Sophos Chrome Security auto-enrollment

If you have a G Suite account, you can configure the Sophos Chrome Security extension to automatically enroll with Sophos Mobile when a G Suite user signs in to a Chrome device.

To configure Sophos Chrome Security auto-enrollment:

1. On the menu sidebar, under SETTINGS, select Setup > Chrome OS setup, and then select the G

Suite tab.

2. Select Generate connection code.

3. Configure the following settings:

Option

Owner

Description

Choose whether the devices are owned by your organization (Corporate) or not

(Personal).

Device group The Sophos Mobile device group devices are assigned to.

Chrome Security policy Optional: A Chrome Security policy that will be assigned to the extension after the enrollment.

4. Select Save.

5. Select Copy next to Connection code to copy the value to the clipboard.

6. Create a text file that contains the connection code.

Perform the remaining steps in the Google Admin console:

7. Sign in to the Google Admin console with your G Suite account.

8. Go to Device Management > Chrome Management > App Management.

9. Select Sophos Chrome Security and then select User settings.

10. Select an organizational unit.

Sophos Chrome Security auto-enrollment will only be available to users in that organizational unit.

11. Turn on Allow installation, Force installation, and Pin to taskbar.

12. Under Configure, select Override.

13. Select Upload configuration file and upload the file with the connection code you’ve prepared.

14. Save your settings.

When a user signs in with their G Suite account to any Chrome device, Sophos Chrome Security is automatically installed and enrolled with Sophos Mobile. You can manage the extension from the

Devices page in Sophos Mobile Admin.

If required, you can revoke the connection code to block future enrollments. Sophos Chrome Security extensions already enrolled are not affected.

Related information

Google Admin console (external link)

Sophos Mobile

12 Device groups

Device groups are used to categorize devices. They help you to manage devices efficiently as you can carry out tasks on a group rather than on individual devices.

A device always belongs to exactly one device group. You assign a device to a device group when you add it to Sophos Mobile.

Tip

Only group devices with the same operating system. This makes it easier to use groups for installations and other operating system specific tasks.

12.1 Create device group

1. On the menu sidebar, under MANAGE, click Device groups, and then click Create device group.

2. On the Edit device group page, enter a name and a description for the new device group.

3. Under Compliance policies, select the compliance policies that are applied to corporate and to personal devices.

4. Select Save.

Note

The device group settings contain the Enable iOS auto-enrollment option. This option allows you to enroll iOS devices with the Apple Configurator. See

Auto-enroll iOS devices

(page 46).

The new device group is created and shown on the Device groups page.

12.2 Delete device groups

1. On the menu sidebar, under MANAGE, click Device groups.

2. On the Device groups page, click the blue triangle next to the device group that you want to delete, and then click Delete.

3. In the confirmation dialog, select one of the remaining device groups to which devices from the current device group will be re-assigned.

This selection is not available when there are no devices assigned to the current device group.

4. Click Yes to delete the device group.

Note

When there is only one device group left and there are devices assigned to it, you cannot delete this device group.

Sophos Mobile

13 Users

On the People page, you manage your Sophos Mobile user accounts.

User management

When you set up a customer in Sophos Mobile, you can choose between the following types of user management:

Internal user management

External user management

Federated authentication

You create user accounts in Sophos Mobile.

You create user accounts in an LDAP directory

(for example Active Directory) and then connect the LDAP directory to Sophos Mobile. See

Configure external directory connection (page

93).

You create user accounts in Azure Active

Directory (Azure AD). When users sign in to the

Self Service Portal, they authenticate with Azure

AD. See

Configure federated authentication (page

95).

User details

For internal user management, the People page shows the users you’ve added to Sophos Mobile.

For external user management and for federated authentication, the People page only shows users relevant for Sophos Mobile:

• Users assigned to a Sophos Mobile managed device.

• Users assigned to an Apple Volume Purchase Program (VPP) app.

Click a user’s name to view the account details.

Import users

For internal user management, you can import users from a CSV file. See

Import users

(page

97).

User groups

With user groups you control Self Service Portal access and available enrollment options. To create a Self Service Portal configuration for certain users only, add them to a user group and assign that

group to the Self Service Portal configuration. See Configure Self Service Portal (page 27).

For internal user management, you add users to groups in Sophos Mobile Admin. See Create user groups

(page 98).

For external user management, Sophos Mobile uses the groups defined in your LDAP directory.

For federated authentication, Sophos Mobile uses the groups defined in Azure AD.

Sophos Mobile

13.1 Configure Self Service Portal user management

Note

For Sophos Mobile on Premise, user management for the Self Service Portal is configured by the super administrator when a customer is created. See the Sophos Mobile super administrator guide .

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the User

setup tab.

2. Under Device assignment, select what happens when you delete a user that is assigned to a device:

Option

Unassign user from device

Unenroll and delete device

Unenroll device

Description

The user assignment is removed. The device status is not changed.

The device is unenrolled from Sophos Mobile and deleted.

The device is unenrolled from Sophos Mobile.

The device status is changed to Unenrolled.

This setting is not available when you use external user management.

3. Under User management mode, select how Sophos Mobile manages user accounts:

Option

None. No SSP, user-specific policies, or

LDAP administrators available.

Internal directory

External LDAP directory

Azure AD federated authentication

Description

User management is turned off. You can’t assign users to devices and you can’t use the

Self Service Portal.

You create user accounts and user groups in

Sophos Mobile.

Sophos Mobile uses user accounts and user groups from an LDAP directory.

You create user accounts and user groups in Azure Active Directory (Azure AD). When users sign in to the Self Service Portal, they authenticate with Azure AD.

See Configure federated authentication

(page

95).

4. For external user management, click Configure external LDAP to configure the connection to your

LDAP directory.

See

Configure external directory connection (page 93).

5. Select Save.

After you’ve set the user management mode, you can’t switch directly to a different mode. Instead, select None. No SSP, user-specific policies, or LDAP administrators available. to make all options available again.

Sophos Mobile

Note

You can’t change the user management mode in the following situations:

• There are users assigned to devices.

• There are Apple Volume Purchase Program (VPP) licenses assigned to users.

13.2 Configure external directory connection

To manage user accounts for Sophos Mobile Admin and the Self Service Portal in an external LDAP user directory, you must configure the connection to your LDAP server.

Sophos Mobile can connect to the following LDAP servers:

• Active Directory

• Google Cloud Directory

• IBM Domino

• NetIQ eDirectory

• Red Hat Directory Server

• Zimbra

For supported versions, see the Sophos Mobile 9.5 release notes .

Note

There is no synchronization between the LDAP directory and Sophos Mobile. Sophos Mobile only accesses the LDAP directory to look up user information. Changes to an LDAP user account are not implemented on the Sophos Mobile database, and vice versa.

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the User

setup tab.

2. Select External LDAP directory.

3. Click Configure external LDAP.

Configuration depends on the LDAP server type. The following instructions apply to Active Directory.

4. On the Server details page, configure the following settings: a) In the LDAP type field, select the LDAP server type.

b) In the Primary URL field, enter the IP address or name of the primary directory server.

Select SSL/TLS to secure the server connection by SSL or TLS (depending on what the server supports).

c) Optional: In the Secondary URL field, enter the IP address or name of a directory server

Sophos Mobile uses as fallback in case the primary server isn’t available.

d) In the User and Password fields, enter the credentials Sophos Mobile uses to authenticate with the LDAP server.

Use one of the following formats:

• <domain>\<user name>

• <user name>@<domain>.<domain code>

Sophos Mobile

Note

For security reasons, we recommend you select an account with no write permissions for the directory.

5. On the Search base page, enter the distinguished name (DN) of the search base object.

The search base object defines the location in the directory from which the LDAP search begins.

6. On the Search fields page, configure the attributes of the directory service that contain the user properties Sophos Mobile uses.

Select the attribute names from the list or enter them manually.

Use the following mappings for Active Directory:

Property in Sophos Mobile

User name

First name

Last name

Attribute in Active Directory sAMAccountName givenName sn

Email mail

7. On the SSP configuration page, specify the users that are allowed to log in to the Self Service

Portal. Enter the relevant information in the LDAP directory group field, using one of the following options:

• If you enter the name of a group that is defined on the directory server, all members of that group are allowed to log in to the Self Service Portal. After you have entered the group name, click Test group to resolve the group name into a Distinguished Name (DN).

• If you leave the field empty, no users from the directory server are allowed to log in to the Self

Service Portal. Use this option if you want to enable external user management for Sophos

Mobile Admin but not for the Self Service Portal.

Note

The group you specify here is not related to the user group you define on the Group settings tab of the Self Service Portal page. With those settings, you define task bundles, Sophos

Mobile group membership and available device platforms for each user group.

8. Select Apply.

9. On the User setup tab, click Save.

Related information

How to connect a Sophos Mobile 8.0 server with an Azure Active Directory (Sophos knowledge base article 128081)

Connecting Sophos Mobile to Google Cloud Identity / Google Cloud Directory using Secure LDAP

(Sophos knowledge base article 132870)

13.3 Federated authentication

Federated authentication with Azure Active Directory (Azure AD) is an alternative user management mode to internal and external (LDAP) user management.

Sophos Mobile

When users sign in to the Self Service Portal, there is a fundamental difference between external user management and federated authentication:

• With external user management, users authenticate with Sophos Mobile using their LDAP credentials.

• With federated authentication, users authenticate directly with Azure AD.

This has the following advantages:

• Azure AD supports modern sign-in features such as multi-factor authentication, smart card authentication, or certificate-based authentication.

• Cross-platform single sign-on: Users only sign in once to access the Self Service Portal and other applications and resources you’ve configured for Azure AD authentication.

• You don’t need to open ports 389 (LDAP) or 636 (LDAPS) for the communication between Sophos

Mobile and your LDAP server.

13.3.1 Configure federated authentication

To use federated authentication with Azure Active Directory (Azure AD), you must register Sophos

Mobile as a Microsoft Azure application.

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the

Microsoft Azure tab.

2. Click Microsoft Azure registration wizard.

The wizard guides you through the registration process in the Microsoft Azure portal and in Sophos

Mobile Admin: a) Create an application for Sophos Mobile in the Microsoft Azure portal.

b) Enter the application ID in Sophos Mobile.

c) Upload the Sophos Mobile server certificate to your application.

d) Register a reply URL for Sophos Mobile. Azure forwards users to this Sophos Mobile page after they’ve authenticated with Azure AD.

e) Grant your application the required permissions.

3. On the Sophos setup page, click the User setup tab.

4. Select Azure AD federated authentication as user management mode.

If federated authentication is not available, switch to None. No SSP, user-specific policies, or

LDAP administrators available. first.

Note

You can use the application for Sophos Mobile you’ve created in the Azure portal also for Intune app protection. Note that Intune app protection has additional licensing requirements. See

Intune app protection

(page 341).

Sophos Mobile

13.3.2 Set a default customer for the Self Service Portal

As super administrator, you can set a default customer that is automatically selected when users access the Self Service Portal.

In Sophos Mobile you can set up several customers to manage different areas of your organization independently of each other. When users access the Self Service Portal, they have to select their customer before they enter their credentials.

You can simplify the sign-in experience by setting a default customer. While this is possible for all user management modes, it’s particularly useful for federated authentication: Users don’t see a signin page at all if they’ve already authenticated with Azure Active Directory (Azure AD).

To set a default customer for the Self Service Portal:

1. Sign in to Sophos Mobile Admin with a super administrator account.

2. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the Web

portals tab.

3. Under Self Service Portal, select Default customer and select a customer from the list.

4. Optional: Turn off Visible and editable to skip the sign-in page if the user has already authenticated with Azure AD.

Note

If you turn this off, only users of the default customer can access the Self Service Portal.

5. Select Save.

13.4 Configure LDAP connection

If you’ve set up federated authentication you can configure an LDAP connection between Sophos

Mobile and Azure Active Directory (Azure AD). You must do this if you want to use Apple DEP, Google zero-touch, or Samsung KME.

The following devices enroll automatically with Sophos Mobile when users set them up:

• iPhones, iPads, and Macs registered for the Apple device enrollment program (DEP)

• Android devices registered for Google zero-touch enrollment

• Samsung Android devices registered for Knox Mobile Enrollment (KME)

During the enrollment process, Sophos Mobile connects to Azure AD to authenticate the user.

To configure an LDAP connection:

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the LDAP

connection tab.

2. Click Configure external LDAP.

3. On the Server details page, configure the following settings: a) In the Primary URL field, enter the IP address or name of the primary directory server.

The server must support LDAPS (LDAP over SSL/TLS).

b) Optional: In the Secondary URL field, enter the IP address or name of a directory server

Sophos Mobile uses as fallback in case the primary server isn’t available.

Sophos Mobile c) In the User and Password fields, enter the credentials Sophos Mobile uses to authenticate with the LDAP server.

Use one of the following formats:

• <domain>\<user name>

• <user name>@<domain>.<domain code>

Note

For security reasons, we recommend you select an account with no write permissions for the directory.

4. On the Search base page, enter the distinguished name (DN) of the search base object.

The search base object defines the location in the directory from which the LDAP search begins.

5. Select Apply.

13.5 Create users

1. On the menu sidebar, under MANAGE, select People.

2. Click Create user.

3. On the Edit user page, select the Send registration email check box.

4. Enter the account details.

5. Select Save.

A registration email is sent to the new user.

If you click the blue triangle next to the required user, you can view the user details (Show), Edit or

Delete the user.

Note

If you click a user name, the Edit user page is displayed. This page contains the Resend

registration email button, which you can use to send the email again if the user did not receive or lost the initial email.

13.6 Import users

You can add users by importing them from a CSV file.

You can import up to 500 users.

If you specify a group that doesn’t exist, Sophos Mobile creates it.

The CSV file must have the following specification:

• The first row is treated as a header and is not imported.

• Values must be separated by semicolon, not by comma.

• All rows must have the correct number of semicolon characters, even if you leave out optional values.

• The file extension must be .csv

• To ensure that non-English characters are imported correctly, the file must be UTF-8 encoded.

Sophos Mobile

Tip

On the Import users page, select Example CSV to download a sample file.

To import users from a CSV file:

1. On the menu sidebar, under MANAGE, select People.

2. Select Import users.

3. On the Import users page, select Send registration emails.

4. Select Upload a file and then navigate to the CSV file you’ve prepared.

The entries are read in from the file and are displayed.

5. If the data is not formatted correctly or is inconsistent, the file as a whole cannot be imported. In this case, follow the error messages that are displayed next to the relevant entries, correct the content of the CSV file accordingly and upload it again.

6. Select Finish to create the user accounts.

The users are imported and displayed on the People page. They receive emails with their login credentials for the Self Service Portal.

13.7 Create user groups

With user groups you control Self Service Portal access and available enrollment options.

Note

If you manage your user accounts in an external LDAP directory, create your user groups there.

If you use federated authentication, create your user groups in Azure Active Directory.

To create a user group:

1. On the menu sidebar, under MANAGE, select People.

2. Click Show user groups.

3. On the Show user groups page, click Create group.

4. Enter a name for the group.

5. Select Save.

After you’ve created a user group, you can add users to it.

When you assign the group to a Self Service Portal configuration, that configuration only applies to the group members. See

Configure Self Service Portal

(page 27).

Sophos Mobile

14 Policies

A policy contains settings you can apply to a device or device group.

There are two types of policies:

Policies that take effect immediately when you assign them to a device. These policies are synchronized each time the device connects to Sophos Mobile. When you change the policy, you don’t have to update it on the device. To remove the settings applied by the policy, you must either update the policy or assign a different policy.

These policies are:

• Android Enterprise policies

• Sophos container policies

• Mobile Threat Defense policies

• macOS policies

• Windows policies

• Windows Mobile policies

• Chrome Security policies

Policies Sophos Mobile installs on a device when you assign them. When you change the policy, you must update it on the device. To remove the settings applied by the policy, you can uninstall it from the device.

These policies are:

• Android device policies

• Knox container policies

• iOS device policies

Related concepts

Configurations for Android device policies

(page 153)

With an Android device policy you configure settings for Android devices enrolled with Sophos Mobile in “Device administrator” management mode.

Configurations for Knox container policies

(page 172)

With a Knox container policy you configure settings for the Knox container on Samsung devices.

Configurations for iOS device policies (page 177)

With an iOS device policy you configure settings for iPhones and iPads.

Configurations for Android Enterprise device policies

(page 109)

With an Android Enterprise device policy you configure settings for Android Enterprise fully managed devices.

Configurations for Android Enterprise work profile policies

(page 123)

With an Android Enterprise work profile policy you configure settings for Android Enterprise work profile devices.

Configurations for Sophos container policies for Android (page 137)

With a Sophos container policy you configure settings for Sophos Secure Email and Sophos Secure

Workspace on devices where Sophos Mobile manages the Sophos container.

Configurations for Mobile Threat Defense policies for Android (page 149)

Sophos Mobile

With a Mobile Threat Defense policy you configure Sophos Intercept X for Mobile when it’s enrolled with Sophos Mobile.

Configurations for Sophos container policies for iOS (page 207)

With a Sophos container policy you configure settings for Sophos Secure Email and Sophos Secure

Workspace on devices where Sophos Mobile manages the Sophos container.

Configurations for Mobile Threat Defense policies for iOS (page 219)

With a Mobile Threat Defense policy you configure Sophos Intercept X for Mobile when it’s enrolled with Sophos Mobile.

Configurations for macOS device policies (page 221)

With a macOS device policy you configure settings for Macs that apply to all users.

Configurations for macOS user policies (page 238)

With a macOS user policy you configure settings for Macs that apply to users managed by Sophos

Mobile.

Configurations for Windows Mobile policies

(page 256)

With a Windows Mobile policy you configure settings for Windows Mobile devices.

Configurations for Windows policies

(page 267)

With a Windows policy you configure settings for Windows computers.

Configurations for Chrome Security policies (page 279)

With a Chrome Security policy you configure settings for the Sophos Chrome Security extension when it’s enrolled with Sophos Mobile.

100

14.1 Get started with device policies

The Policies startup wizard helps you create basic device policies for all platforms. You can enhance the policies later.

Restriction

These instructions don’t apply to Chrome devices.

To create policies with the Policies startup wizard:

1. On the dashboard, click Policies startup wizard in the Getting started tasks widget.

Tip

If you don’t see the widget, click Add widget > Getting started.

2. On the Platforms page, select the device platforms for which you want to create a policy.

3. For Android, you can select a management mode.

This setting affects which policy types are available. We recommend you use the Android

Enterprise mode.

4. On the Policies page, configure the following settings: a) Enter a name for the policy.

For each platform, a policy with this name is created.

b) Select the areas the policy manages.

If you clear a check box, the corresponding wizard page is skipped. You can configure the skipped areas (and more) later.

5. On the Passwords page, configure requirements for the device password.

Sophos Mobile

6. On the Restrictions page, configure restrictions applied to devices, like turning off the camera or other device features that could be a security risk.

7. On the Wi-Fi page, configure the connection to your corporate Wi-Fi network.

If your Wi-Fi network uses a different security type than WPA/WPA2 PSK, you can change that setting later.

8. On the Email page, configure the connection to your corporate Microsoft Exchange email server.

The placeholders %_USERNAME_% and %_EMAILADDRESS_% are replaced by the name and the email address of the user assigned to the device.

9. Click Finish.

For each platform you’ve selected, the wizard creates a policy.

To view the policy, click Policies in the menu sidebar and then click the device platform.

To change the areas managed, click the policy’s name and then click Add configuration.

If you’ve selected the Android Enterprise mode, you must set up Android Enterprise for your organization before you can enroll devices. See

Set up Android Enterprise - Overview

(page 318).

14.2 Create policy

You create policies to configure settings for devices. Create several policies if you want to manage different types of devices.

Policies consist of configurations. By adding configurations to a policy, you define the areas Sophos

Mobile manages on a device.

To create a policy:

1. On the menu sidebar, under CONFIGURE, select Policies and then select a device platform.

2. Select Create and then select a policy type.

3. Enter a name and a description.

4. For iOS and macOS device policies, enter your organization name.

5. Optional: Check the configurations Sophos Mobile has added automatically to the policy and adjust them if required.

Sophos Mobile adds these configurations automatically:

• For Sophos container policies, a General configuration.

• For Android Enterprise policies, a Restrictions configuration.

• For Mobile Threat Defense policies, a Network configuration.

6. Select Add configuration to add more configurations to the policy.

7. In the settings page of the configuration, enter the required settings.

8. Optional: Select a renewal interval in SCEP renewal interval.

This option is available if you’ve added a SCEP or Duo device certificate configuration to the policy.

The device automatically requests a certificate renewal after the interval you’ve selected, calculated from when the policy was assigned to the device. The same interval is used for all

SCEP and Duo device certificate configurations of the policy.

9. After you’ve added all required configurations, select Save.

The policy is created. You can assign it to devices.

Sophos Mobile

Related tasks

Assign a policy (page 106)

You assign a policy to devices to apply the settings it includes.

Apply policy changes to devices

(page 107)

When you change the settings of certain policies, you must update them on the devices for the changes to take effect.

14.3 Import iOS policy from Apple Configurator

For iOS, you can import a policy created in Apple Configurator or a policy exported from another instance of Sophos Mobile.

Prerequisite: Create a policy in Apple Configurator, export it unencrypted and unsigned, and save it to your computer.

Note

In Apple Configurator, policies are called profiles.

To import the policy:

1. On the menu sidebar, under CONFIGURE, select Policies > iOS.

2. Select Create > Import policy.

3. Enter a name and a description.

4. Select Upload a file and then select the file you’ve exported from Apple Configurator.

5. On the Import policy page, select Save.

The policy is imported. You assign it to devices in the same way you assign policies created in Sophos

Mobile.

Related tasks

Assign a policy (page 106)

You assign a policy to devices to apply the settings it includes.

14.4 Import iOS provisioning profile

You can import a provisioning profile for self-developed iOS apps to install it on your devices.

Prerequisite: Generate a provisioning profile in your iOS development environment and save it to your computer.

To import the provisioning profile:

1. On the menu sidebar, under CONFIGURE, select Policies > iOS.

2. Select Create > Import policy.

3. Enter a name and a description.

4. Select Upload a file and then select the provisioning profile.

5. On the Import policy page, select Save.

The provisioning profile is imported. You install it on devices in the same way you assign policies.

Related tasks

Assign a policy (page 106)

Sophos Mobile

You assign a policy to devices to apply the settings it includes.

14.5 About macOS policies

For Macs there are two types of policies:

• Device policy: When you assign a device policy to a Mac, the settings apply to all users that sign in to the Mac.

• User policy: When you assign a user policy to a Mac, the settings apply to all managed users that sign in to the Mac.

Managed users are:

• The local user that has enrolled the Mac with Sophos Mobile.

• All network users that are known to Sophos Mobile, i.e. users from the external LDAP directory you have configured for the Self Service Portal.

About device and user policies

• In addition to the enrollment policy (which is a device policy) you can assign one device policy and one user policy to a Mac.

• If there are conflicting configurations in a device policy and a user policy assigned to the same

Mac, the more restrictive configuration is applied.

• On the Mac, the assigned policies are listed under System Preferences > Profiles.

• When you update a device policy, the changes take effect the next time the device syncs.

• When you update a user policy, the changes take effect the next time a user logs in to the Mac.

• Users may remove the user policy from the Mac but it is automatically re-assigned the next time the user logs in.

• Users can’t remove the device policy.

• When a user removes the enrollment policy, the Mac is unenrolled from Sophos Mobile. This requires administrator privileges.

Related concepts

Configurations for macOS device policies (page 221)

With a macOS device policy you configure settings for Macs that apply to all users.

Configurations for macOS user policies (page 238)

With a macOS user policy you configure settings for Macs that apply to users managed by Sophos

Mobile.

14.6 Configure Chrome tamper protection

With tamper protection you ensure the integrity of the Chrome Security policy.

On Chrome devices, malicious users could potentially modify the Chrome Security policy, for example by using the Chrome developer tools. When Sophos Mobile detects that the policy was modified on a device, it re-applies the original policy and performs actions you’ve configured in a compliance policy.

Sophos Mobile

To configure tamper protection:

1. Create or edit a compliance policy for Chrome OS.

2. In the compliance policy, configure actions for the Tamper protection turned off rule.

You can create an alert or transfer a task bundle when the user modifies the policy.

3. Assign the compliance policy to the device group you use for Chrome devices.

Note

Tamper protection is always turned on, even if you don’t configure additional actions in a compliance policy.

Related tasks

Create compliance policy

(page 33)

14.7 Windows password complexity rules

Password complexity rules (for example length, number of uppercase and lowercase letters) for

Windows computers are fixed and cannot be set by a Sophos Mobile policy. Different rules apply for local and for Microsoft accounts.

Local accounts

• Password must not contain the user's account name or more than two consecutive characters from the user's full name.

• Password must be six or more characters long.

• Password must contain characters from three of the following four categories:

— Uppercase characters A-Z (Latin alphabet)

— Lowercase characters a-z (Latin alphabet)

— Digits 0-9

— Special characters (!, $, #, %, etc.)

Microsoft accounts

• Password must be eight or more characters long.

• Password must contain characters from two of the following four categories:

— Uppercase characters A-Z (Latin alphabet)

— Lowercase characters a-z (Latin alphabet)

— Digits 0-9

— Special characters (!, $, #, %, etc.)

Sophos Mobile

14.8 Knox Service Plugin

The Knox Service Plugin (KSP) is an app for Android Enterprise devices that lets you assign Knox policies to Samsung Knox Platform for Enterprise (KPE) enabled devices.

Restriction

The Knox Service Plugin supports Android Enterprise fully managed devices with Android 8.0

(Knox 3.x) and later, and Android Enterprise work profile devices with Android 9.0 (Knox 3.2.1) and later.

For details on the Knox Service Plugin and the Samsung Knox Platform for Enterprise, see the

Samsung documentation.

To use the Knox Service Plugin with Sophos Mobile, complete the following steps:

1. Approve the Knox Service Plugin in managed Google Play for your Android Enterprise account.

2. Configure the policies in the Knox Service Plugin.

3. Install the Knox Service Plugin on selected devices or device groups, or let your users install it from managed Google Play.

Related tasks

Approve managed Google Play app

(page 328)

To make an app available to your users, you must approve it.

Configure policies in the Knox Service Plugin (page 105)

The Knox Service Plugin app includes Knox policy settings you can configure.

Install managed Google Play app

(page 333)

Related information

Samsung documentation on the Knox Service Plugin

Samsung documentation on Knox Platform for Enterprise

14.8.1 Configure policies in the Knox Service Plugin

The Knox Service Plugin app includes Knox policy settings you can configure.

Prerequisite: You’ve approved the Knox Service Plugin in managed Google Play.

To configure Knox policies in the Knox Service Plugin:

1. On the menu sidebar, under CONFIGURE, select Apps > Android.

2. On the Approved apps page, select the Knox Service Plugin app.

You might have to select Approved apps to open the Approved apps page.

3. In Page and App category, configure the location of the Knox Service Plugin in the users’ Google

Play Store app.

4. Select Use managed configuration.

5. Under Managed configuration, configure the required settings.

The available settings are defined in the Knox Service Plugin and may change when new app versions are released by Samsung.

Sophos Mobile

In KPE Premium License key, you must enter your Knox license key. Otherwise, the policies are not applied when the app is installed.

6. Select Save.

7. Select Send app settings to Google to make the changes available to your users.

When you install the Knox Service Plugin on a device, the Knox policies are applied.

To remove the Knox policies, uninstall the app.

Related tasks

Approve managed Google Play app

(page 328)

To make an app available to your users, you must approve it.

14.9 Placeholders in policies

In policy settings, you can use placeholders which are replaced by a user, device, or customer property when the policy is assigned.

• %_EMAILADDRESS_% is replaced by the Email address property of the user assigned to the device.

• %_USERNAME_% is replaced by the User name property of the user assigned to the device.

• %_DEVPROP()_% is replaced by a device property.

For example, %_DEVPROP(IMEI)_% is replaced by the device’s IMEI value (if available).

You can use any of the properties listed on the Device properties and Custom properties tabs of the device’s Show device page.

• %_CUSTPROP()_% is replaced by a customer property.

For example if you’ve created a customer property “internal_id”, you can refer to it by

%_CUSTPROP(internal_id)_% .

You can use any of the properties listed under Setup > Sophos setup > Customer properties.

For macOS, user properties are replaced as follows:

• For the local Mac user, the properties from the Sophos Mobile user assigned to the device are used.

• For network users, the properties from the LDAP user account are used.

14.10 Assign a policy

You assign a policy to devices to apply the settings it includes.

To assign a policy to a device or device group:

1. On the menu sidebar, under CONFIGURE, select Policies and then select a device platform.

2. Select the blue triangle next to a policy and select Assign.

3. On the Select devices page, do one of following:

• Select individual devices.

• Select Select device groups and then select the required device groups.

4. On the Set execution date page, enter a date and time for the task to be carried out.

Sophos Mobile

This step is only relevant for the following policies:

• Android device policies

• Knox container policies

• iOS device policies

5. Click Finish.

The policy is applied to the selected devices.

If you didn’t enter a date for the task to be carried out, the policy takes effect immediately.

You can also apply a policy by using one of the following options:

• To assign a policy to a single device: On the device’s Show device page, select the Policies tab and click Assign policy.

• To assign a policy to several devices: On the Devices page, select the required devices and then select Actions > Assign policy.

• To assign a policy as part of a task bundle: Add an Assign policy task to the task bundle and transfer it to the required devices or device groups.

Related tasks

Apply policy changes to devices

(page 107)

When you change the settings of certain policies, you must update them on the devices for the changes to take effect.

14.11 Apply policy changes to devices

When you change the settings of certain policies, you must update them on the devices for the changes to take effect.

You only need to apply changes to devices for the following policies:

• Android device policies

• Knox container policies

• iOS device policies

Other policies synchronize automatically each time the device connects to Sophos Mobile.

To apply policy changes to devices:

1. On the menu sidebar, under CONFIGURE, select Policies and then select a device platform.

2. Select the blue triangle next to a policy and select Update devices.

Sophos Mobile creates a task to update the policy on all devices to which it’s assigned.

14.12 Uninstall policy from devices

You uninstall a policy from a device to remove the settings applied by the policy.

You can only uninstall the following policies from a device:

• Android device policies

• Knox container policies

• iOS device policies

Sophos Mobile

For other policies, either update the policy, assign a different policy, or unenroll the device.

Use one of the following procedures to uninstall a policy from devices:

• To uninstall a policy from a single device: a) On the menu sidebar, under MANAGE, select Devices.

b) Select a device name.

c) Select the Policies tab.

d) Select Uninstall.

• To uninstall a policy from selected devices: a) Create a task bundle with an Uninstall policy task.

b) Transfer the task bundle to the required devices or device groups.

• To uninstall a policy from all devices: a) On the menu sidebar, under CONFIGURE, select Policies and then select a device platform.

b) Click the blue triangle next to the policy you want to uninstall.

c) Select Unassign.

Related concepts

The Show device page

(page 50)

On the Show device page, all relevant information for an individual device is displayed.

Related tasks

Assign a policy (page 106)

You assign a policy to devices to apply the settings it includes.

Apply policy changes to devices

(page 107)

When you change the settings of certain policies, you must update them on the devices for the changes to take effect.

Transfer task bundles (page 291)

You can transfer task bundles to individual devices or to device groups.

14.13 Download policies

You can download policies. This is useful, for example if you need to pass the settings on to Sophos

Support.

To download a policy:

1. On the menu sidebar, go to Policies and click a device platform.

2. Click the blue triangle next to a policy and click Download.

The policy is saved to your computer.

Sophos Mobile

14.14 Configurations for Android Enterprise device policies

With an Android Enterprise device policy you configure settings for Android Enterprise fully managed devices.

14.14.1 “Password policies” configuration (Android Enterprise device policy)

With the Password policies configuration you define requirements for the display lock password.

Password type

In the Password type list, select the type of password users are allowed to configure:

Setting/Field

Pattern, PIN or password

Simple password

PIN or password

Alphanumeric password

Complex password

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.

No additional restrictions are imposed.

Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Password screen lock. The password must contain both letters and digits.

You can define a minimum length. See the following table.

Users must set a Password screen lock.

The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.

If you select Simple password, PIN or password, Alphanumeric password or Complex

password, the following fields are displayed:

Sophos Mobile

Setting/Field Description

Minimum password length The minimum number of characters a password must contain.

Maximum idle time before password prompt The time after the device is locked if it has not been used. The device can be unlocked by entering the password.

Note

The device might impose a shorter time period than what you configure here.

Maximum password age in days

Maximum sign-in attempts

Password history

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

The device is wiped after this number of incorrect sign-in attempts.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

If you select Complex password, the following additional fields are displayed:

Setting/Field

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

Minimum number of non-alphabetic characters

Minimum number of digits

Minimum number of special characters

Description

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

The minimum number of non-alphabetic characters (for example & or !) a password must contain.

The minimum number of numerals a password must contain.

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

Sophos Mobile

14.14.2 Restrictions configuration (Android Enterprise device policy)

With the Restrictions configuration you set restrictions for Android Enterprise fully managed devices.

Security

Setting/Field

Force encryption

Allow factory reset

Allow safe mode

Allow debugging

Allow screen capture

Allow user to configure credentials

Allow Smart Lock

Description

Users must encrypt their devices.

Users can reset the device to its factory settings.

Users can boot the device in safe mode.

Users can turn on the debugging features in the

Android developer options.

Users can take a screenshot of the display.

Users can install or remove certificates.

Users can turn on the Android Smart Lock feature that automatically unlocks the device in certain situations.

Note

This setting affects the device lock. It is ignored if there is also a work profile lock configured.

Allow location sharing

Allow unlocking device by fingerprint

Allow changing the account picture

Hide sensitive information on lock screen

Users can turn on location sharing.

Users can use the fingerprint sensor to unlock the device.

Users can change the photo used for their user account.

If notifications on the lock screen are turned on, sensitive notification content is hidden.

Sophos Mobile

Setting/Field

System update policy

Description

Select when system updates are installed:

• No policy: The user decides when to install system updates.

• Install automatically: System updates are installed automatically as soon as they are available.

• Install within maintenance window: System updates are installed automatically within a daily maintenance window.

Enter start and end time of the day.

• Postpone: System updates (except for security updates) are blocked for 30 days.

Accounts

Setting/Field

Allow managing accounts

Allow managing Google accounts

Description

Users can add or remove non-Google accounts such as app accounts from the device.

Users can add or remove Google accounts from the device.

Network and communication

Setting/Field

Allow SMS

Allow mobile data connection while roaming

Allow VPN

Allow Android Beam

Allow Bluetooth

Allow outgoing phone calls

Allow network reset

Enable Wi-Fi settings

Allow configuring cell broadcasts

Description

If the check box is cleared, users cannot send text messages.

If the check box is cleared, mobile data connections while roaming are turned off.

If the check box is cleared, users cannot use VPN connections.

Users can send data from apps through Android Beam

(data transfer through NFC).

If the check box is cleared, Bluetooth is turned off.

Users can make phone calls.

Users can reset network settings to their defaults.

Users can change the Wi-Fi settings.

Users can turn cell broadcast (CB) messages on or off in their messaging app.

Setting/Field

Enable cellular networks settings

Enable tethering settings

Sophos Mobile

Description

Users can change the cellular network settings.

Users can change the tethering and portable hotspot settings.

Hardware

Setting/Field

Allow camera

Allow microphone

Allow external media

Enable USB storage

Allow transfering files over USB

Description

If the check box is cleared, the camera is unavailable.

If the check box is cleared, the microphone is unavailable.

Users can connect external media like USB storage to the device.

Users can connect the device in USB Mass Storage mode (USB MSC) to a host computer, i.e. as an external hard drive.

If you clear the check box, users can still connect the device in Media Transfer mode (USB MTP) or Picture

Transfer mode (USB PTP) to transfer files.

Users can transfer files between the device and external USB storage.

Applications

Setting/Field

Allow app uninstall

Allow installing apps from unknown sources

Enable system apps

Allow wallpaper change

Description

Users can uninstall apps.

If the check box is cleared, users can only install apps from Google Play, not from unknown sources or through Android Debug Bridge (ADB).

If the check box is cleared, only these apps are enabled: Google Play Store, Contacts, Messages,

Phone. Google recommends this for Android

Enterprise fully managed devices.

If you select the check box, all apps pre-installed by the manufacturer are enabled.

If the check box is cleared, users cannot change the wallpaper.

Sophos Mobile

Setting/Field Description

Allow managing apps If the check box is cleared, users can’t perform the following tasks for apps:

• Uninstall apps

• Disable apps

• Stop apps

• Clear app cache

• Clear app data

• Clear setting Open by default

Allow disabling Google security scans Users can turn off the Google security setting Scan

device for security threats.

The setting is available in the Settings app, under

Google > Security > Google Play Protect.

Allow setting date and time

Short message

Users can set the date and time.

If the check box is cleared, network date and time is used.

A company-specific support message that is displayed to the user when functionality has been turned off.

Note

If you enter more than 200 characters, the message may be truncated.

Long message

Allowed accessibility services

Additional text to complement the short message. The text is displayed when the user taps More details in screens that display the short message.

Note

This text is also displayed on the Android Device

administrator screen for the Sophos Mobile

Control app.

Restrict the list of apps that can provide accessibility services:

• If you select All available apps, users can use all accessibility services.

• If you select Only system apps, users can only use accessibility services from system apps.

• If you select an app group, users can only use accessibility services from apps within that group, and from system apps.

Sophos Mobile

14.14.3 Exchange account configuration (Android Enterprise device policy)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server mail server.

Setting/Field

Account name

Exchange server

Domain

User

Email address

Sender

Synchronization period

SSL/TLS

Allow all certificates

Client certificate

Description

The account name.

The Exchange server address.

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The user must enter the password.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

A sender name for this account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

Allow all certificates in transfer processes from the email server.

The client certificate for the connection to the

Exchange server.

Sophos Mobile

14.14.4 Wi-Fi configuration (Android Enterprise device policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Security type

Phase 2 authorization

Identity

Anonymous identity

Password

Identity certificate

Description

The ID of the Wi-Fi network.

The security type of the Wi-Fi connection:

• None

• WEP

• WPA/WPA2 PSK

• EAP/PEAP

• EAP/TLS

• EAP/TTLS

The authentication method for phase 2 of the

EAP negotiation:

• None

• PAP

• CHAP

• MSCHAP

• MSCHAPv2

This field is available for EAP/PEAP and EAP/

TTLS connections.

The user identity.

This field is available for EAP connections.

The pseudonym identity sent unencrypted in phase 1 of the EAP negotiation.

This field is available for EAP connections.

The password for the Wi-Fi network.

The identity certificate for the connection to the

Wi-Fi network.

The list includes all certificates from Client

certificate configurations of the current policy.

This field is available for EAP connections.

Setting/Field

Trusted certificate

Sophos Mobile

Description

The root CA for the certificate of the EAP server.

The list includes all certificates from Root

certificate configurations of the current policy.

This field is available for EAP connections.

14.14.5 App Protection configuration (Android Enterprise device policy)

With the App Protection configuration you define password requirements for protecting managed

Google Play apps.

With App Protection in use, users must create a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.

If App Protection is active on a device, the command Reset App Protection password is available in the Actions menu of the Show device page. The user can also reset the App Protection password in the Self Service Portal.

Setting/Field

Password complexity

Grace period in minutes

App group

Allow fingerprint authentication

Description

The minimum complexity requirements for the password to be defined by users.

After the grace period has expired, protected apps can only be unlocked by entering a password.

Select the app group containing the apps that are password protected.

For creating app groups, see

App groups

(page

312).

Users can use their fingerprint to unlock a protected app.

Sophos Mobile

14.14.6 App Control configuration (Android Enterprise device policy)

With the App Control configuration you define apps that users are not allowed to start. For example, you can use this to block apps that have been pre-installed by the device manufacturer and cannot be uninstalled.

Setting/Field

App group

Description

Select the app group containing the blocked apps.

For information on creating app groups, see

App groups

(page 312).

14.14.7 App permissions configuration (Android Enterprise device policy)

With the App permissions configuration you configure what happens when an app requests a permission at runtime.

Setting/Field

Default response for runtime permission requests

App-specific runtime permissions

Description

The default response for runtime permission requests:

• Prompt: Users are prompted to grant a permission.

• Auto-accept: All runtime permission requests are automatically granted.

• Auto-deny: All runtime permission requests are automatically denied.

Users can’t edit permissions later if you select

Auto-accept or Auto-deny.

Grant or deny runtime permissions for specific apps.

Click Add to select an app and then select one of the following for each permission:

• Selectable: Users can edit the permission.

• Granted: The permission is granted.

• Denied: The permission is denied.

Sophos Mobile

14.14.8 Kiosk mode configuration (Android Enterprise device policy)

With the Kiosk mode configuration you turn on Android Enterprise dedicated device management.

Setting/Field

Select source

App ID

App group

Allow volume change

Turn off screen lock

Stay on while charging

Description

• None: Allow all apps. The kiosk mode restrictions are applied to the device, but the user can start any app available on the device.

• Custom, App list : Lock a single app to the screen.

• App group: Allow multiple apps to appear on the screen.

The app available in kiosk mode.

Depending on your selection in Select source, either specify the app by its identifier, or select it from the list of available apps.

The apps available in kiosk mode.

Select one of the configured app groups.

If the check box is cleared, the device’s volume buttons are disabled.

The device screen is never locked.

The device screen stays on while the device is connected to a power supply.

14.14.9 Global HTTP proxy configuration (Android Enterprise device policy)

With the Global HTTP proxy configuration you define a corporate proxy server.

Setting/Field

Proxy

Server

Port

PAC URL

Description

Select Manually to configure the connection details manually.

Select Automatic if you have a proxy auto-config (PAC) file.

The name (or the IP address) of the HTTP proxy.

The port number of the HTTP proxy.

The URL of the proxy auto-config (PAC) file.

Sophos Mobile

14.14.10 VPN configuration (Android Enterprise device policy)

With the VPN configuration you select a VPN client for Android Enterprise devices.

Setting/Field

VPN client

Description

The identifier of the VPN app.

The VPN client must be a managed Google Play app already installed on the device.

You configure the VPN connection in the app’s managed configuration. See the app documentation for details.

14.14.11 Root certificate configuration (Android Enterprise device policy)

With the Root certificate configuration you install a root certificate onto devices.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.14.12 Client certificate configuration (Android Enterprise device policy)

With the Client certificate configuration you install a client certificate onto devices.

Setting

File

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

Setting

Certificate name

Sophos Mobile

Description

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.14.13 SCEP configuration (Android Enterprise device policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Note

You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Alias name

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the

SCEP tab of the Sophos setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.

Sophos Mobile

Setting/Field

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Root certificate

Key size

Description

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in policies (page 106).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified

URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the

SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

Setting/Field

Key usage

Sophos Mobile

Description

Select what the certificate can be used for.

Use as digital signature: The certificate can be used as a digital signature.

Use for encryption: The certificate can be used for data encryption.

14.15 Configurations for Android Enterprise work profile policies

With an Android Enterprise work profile policy you configure settings for Android Enterprise work profile devices.

14.15.1 “Password policies - Device” configuration (Android

Enterprise work profile policy)

With the Password policies - Device configuration you define requirements for the display lock password.

Password type

In the Password type list, select the type of password users are allowed to configure:

Setting/Field

Pattern, PIN or password

Simple password

PIN or password

Alphanumeric password

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.

No additional restrictions are imposed.

Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Password screen lock. The password must contain both letters and digits.

You can define a minimum length. See the following table.

Sophos Mobile

Setting/Field

Complex password

Description

Users must set a Password screen lock.

If you select Simple password, PIN or password, Alphanumeric password or Complex

password, the following fields are displayed:

Setting/Field

Minimum password length

Description

The minimum number of characters a password must contain.

Maximum idle time before password prompt The time after the device is locked if it has not been used. The device can be unlocked by entering the password.

Note

The device might impose a shorter time period than what you configure here.

Maximum password age in days

Maximum sign-in attempts

Password history

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

The device is wiped after this number of incorrect sign-in attempts.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

If you select Complex password, the following additional fields are displayed:

Setting/Field

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

Description

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

Setting/Field

Minimum number of non-alphabetic characters

Minimum number of digits

Minimum number of special characters

Sophos Mobile

Description

The minimum number of non-alphabetic characters (for example & or !) a password must contain.

The minimum number of numerals a password must contain.

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

14.15.2 “Password policies - Work profile” configuration

(Android Enterprise work profile policy)

With the Password policies - Work profile configuration you define requirements for the work profile password. The user must enter that password to open an app when the work profile is locked.

Note

The settings supported may depend on the version of the operating system or on other device features. This is indicated by blue labels in Sophos Mobile Admin.

Password type

In the Password type list, select the type of password users are allowed to configure:

Setting/Field

Pattern, PIN or password

Simple password

PIN or password

Alphanumeric password

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.

No additional restrictions are imposed.

Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Password screen lock. The password must contain both letters and digits.

You can define a minimum length. See the following table.

Sophos Mobile

Setting/Field

Complex password

Weak biometric recognition

Description

Users must set a Password screen lock.

Users are allowed to use weak biometric recognition methods, like face recognition, to unlock the work profile.

Note

Weak biometric recognition methods provide similar security as a 3-digit PIN.

This means that unauthorized unlocking might happen in 1 of 1000 attempts.

If you select Simple password, PIN or password, Alphanumeric password or Complex

password, the following fields are displayed:

Setting/Field

Minimum password length

Description

The minimum number of characters a password must contain.

Maximum idle time before password prompt The time after the work profile is locked if it has not been used. The profile can be unlocked by entering the password.

Note

The device might impose a shorter time period than what you configure here.

Maximum password age in days

Maximum sign-in attempts

Password history

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

The work profile is deleted after this number of incorrect sign-in attempts.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

If you select Complex password, the following additional fields are displayed:

Setting/Field

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

Minimum number of non-alphabetic characters

Minimum number of digits

Minimum number of special characters

Sophos Mobile

Description

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

The minimum number of non-alphabetic characters (for example & or !) a password must contain.

The minimum number of numerals a password must contain.

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

14.15.3 Restrictions configuration (Android Enterprise work profile policy)

With the Restrictions configuration you set restrictions for Android Enterprise work profile devices.

Security

Setting/Field

Allow screen capture

Description

Users can capture the screen content of apps installed in the work profile.

Allow user to configure credentials

Allow work clipboard in personal apps Users can copy text from an app in the work profile and paste it into a personal app.

Pasting clipboard text from a personal app into an app in the work profile is always possible.

Allow Smart Lock

Users can install or remove certificates in the work profile.

Users can turn on the Android Smart Lock feature that automatically unlocks the device in certain situations.

Note

This setting affects the device lock. It is ignored if there is also a work profile lock configured.

Sophos Mobile

Setting/Field

Allow location sharing

Allow opening web links in personal apps

Allow debugging

Allow unlocking device by fingerprint

Allow work contact info for personal calls

Allow work contact info for Bluetooth devices

Allow searches of work contacts in personal profile

Description

Apps in the work profile can access the device’s location features.

If the check box is cleared, apps in the work profile can’t access the device’s location features, even if the user has turned location sharing on.

Web links that the user taps in an app in the work profile can be opened by a personal browser app.

Users can turn on the debugging features in the

Android developer options.

Users can use the fingerprint sensor to unlock the device.

The personal phone app displays the caller’s name for incoming calls from work contacts.

Connected Bluetooth devices display the caller’s name for incoming personal calls from work contacts.

The personal phone app includes results from work contacts when searching for caller’s names.

Accounts

Setting/Field

Allow managing accounts

Description

Users can add or remove non-Google accounts such as app accounts from the work profile.

Network and communication

Setting/Field

Allow VPN

Allow Android Beam

Description

Users can use VPN connections for apps in the work profile.

Users can send data from apps in the work profile through Android Beam (data transfer through NFC).

Sophos Mobile

Hardware

Setting/Field

Allow camera

Description

Apps in the work profile can access the camera.

Applications

Setting/Field

Allow app uninstall

Allow installing apps from unknown sources

Allow managing apps

Description

Users can uninstall apps from the work profile.

If the check box is cleared, users can only install apps in the work profile from Google Play, not from unknown sources or through Android Debug Bridge (ADB).

If the check box is cleared, users can’t perform the following tasks for apps in the work profile:

• Uninstall apps

• Disable apps

• Stop apps

• Clear app cache

• Clear app data

• Clear setting Open by default

Allow disabling Google security scans Users can turn off the Google security setting Scan

device for security threats.

The setting is available in the Settings app, under

Google > Security > Google Play Protect.

Short message A company-specific support message that is displayed to the user when functionality has been turned off.

Note

If you enter more than 200 characters, the message may be truncated.

Sophos Mobile

Setting/Field

Long message

Description

Additional text to complement the short message. The text is displayed when the user taps More details in screens that display the short message.

Note

This text is also displayed on the Android Device

administrator screen for the Sophos Mobile

Control app.

14.15.4 Exchange account configuration (Android Enterprise work profile policy)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server mail server. These settings are applied to the Gmail app in the work profile.

Setting/Field

Account name

Exchange server

Domain

User

Email address

Sender

Synchronization period

Description

The account name.

The Exchange server address.

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The user must enter the password.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

A sender name for this account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

Setting/Field

SSL/TLS

Allow all certificates

Client certificate

Sophos Mobile

Description

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

Allow all certificates in transfer processes from the email server.

The client certificate for the connection to the

Exchange server.

14.15.5 Wi-Fi configuration (Android Enterprise work profile policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Security type

Phase 2 authorization

Identity

Description

The ID of the Wi-Fi network.

The security type of the Wi-Fi connection:

• None

• WEP

• WPA/WPA2 PSK

• EAP/PEAP

• EAP/TLS

• EAP/TTLS

The authentication method for phase 2 of the

EAP negotiation:

• None

• PAP

• CHAP

• MSCHAP

• MSCHAPv2

This field is available for EAP/PEAP and EAP/

TTLS connections.

The user identity.

This field is available for EAP connections.

Sophos Mobile

Setting/Field

Anonymous identity

Password

Identity certificate

Trusted certificate

Description

The pseudonym identity sent unencrypted in phase 1 of the EAP negotiation.

This field is available for EAP connections.

The password for the Wi-Fi network.

The identity certificate for the connection to the

Wi-Fi network.

The list includes all certificates from Client

certificate configurations of the current policy.

This field is available for EAP connections.

The root CA for the certificate of the EAP server.

The list includes all certificates from Root

certificate configurations of the current policy.

This field is available for EAP connections.

14.15.6 App Protection configuration (Android Enterprise work profile policy)

With the App Protection configuration you define password requirements for protecting managed

Google Play apps, i.e. apps installed in the work profile.

With App Protection in use, users must create a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.

Setting/Field

Password complexity

Grace period in minutes

App group

Allow fingerprint authentication

Description

The minimum complexity requirements for the password to be defined by users.

After the grace period has expired, protected apps can only be unlocked by entering a password.

Select the app group containing the apps that are password protected.

For creating app groups, see

App groups

(page

312).

Users can use their fingerprint to unlock a protected app.

Sophos Mobile

14.15.7 App Control configuration (Android Enterprise work profile policy)

With the App Control configuration you define apps that users are not allowed to start.

Setting/Field

App group

Description

Select the app group containing the blocked apps.

For information on creating app groups, see

App groups

(page 312).

14.15.8 App permissions configuration (Android Enterprise work profile policy)

With the App permissions configuration you configure what happens when a managed Google Play app requests permissions at runtime.

Setting/Field

Default response for runtime permission requests

App-specific runtime permissions

Description

The default response for runtime permission requests:

• Prompt: Users are prompted to grant a permission.

• Auto-accept: All runtime permission requests are automatically granted.

• Auto-deny: All runtime permission requests are automatically denied.

Users can’t edit permissions later if you select

Auto-accept or Auto-deny.

Grant or deny runtime permissions for specific apps.

Click Add to select an app and then select one of the following for each permission:

• Selectable: Users can edit the permission.

• Granted: The permission is granted.

• Denied: The permission is denied.

Sophos Mobile

14.15.9 VPN configuration (Android Enterprise work profile policy)

With the VPN configuration you select a VPN client for Android Enterprise devices.

Setting/Field

VPN client

Description

The identifier of the VPN app.

The VPN client must be a managed Google Play app already installed on the device.

You configure the VPN connection in the app’s managed configuration. See the app documentation for details.

14.15.10 Root certificate configuration (Android Enterprise work profile policy)

With the Root certificate configuration you install a root certificate onto devices. This certificate is available to managed Google Play apps, i.e. to apps installed in the work profile.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

Sophos Mobile

14.15.11 Client certificate configuration (Android Enterprise work profile policy)

With the Client certificate configuration you install a client certificate onto devices. This certificate is available to managed Google Play apps, i.e. to apps installed in the work profile.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.15.12 SCEP configuration (Android Enterprise work profile policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP). These certificates are available to apps that are installed in the work profile.

Note

You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the

SCEP tab of the Sophos setup page.

Sophos Mobile

Setting/Field

Alias name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Root certificate

Description

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in policies (page 106).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified

URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the

SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.

Setting/Field

Key size

Key usage

Sophos Mobile

Description

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

Select what the certificate can be used for.

Use as digital signature: The certificate can be used as a digital signature.

Use for encryption: The certificate can be used for data encryption.

14.16 Configurations for Sophos container policies for Android

With a Sophos container policy you configure settings for Sophos Secure Email and Sophos Secure

Workspace on devices where Sophos Mobile manages the Sophos container.

Note

On Android Enterprise devices, this policy also installs Sophos Secure Workspace and, if the policy contains a Work email configuration, Sophos Secure Email. Approve these apps in managed Google Play before you assign the policy.

14.16.1 General configuration (Android Sophos container policy)

With the General configuration you define settings that apply to all Sophos container apps, if applicable.

Setting/Field

Enable Sophos container password

Description

Users must enter an additional password to be able to start a Sophos container app. The password has to be defined when the first container app is started after the configuration has been applied. This password applies to all container apps.

Sophos Mobile

Setting/Field

Password complexity

Always hide characters in password entry fields

Password age in days

Failed logins until lock

Allow fingerprint

Grace period in minutes

Lock on device lock

Description

The required minimum complexity of the

Sophos container password. More secure passwords are always allowed. Passwords (a mix of numeric and alphanumeric characters) are always seen as more secure than PINs

(numeric characters only).

• Any: Sophos container passwords do not have restrictions.

• 4 digit PIN

• 6 digit PIN

• 4 char password

• 6 char password

• 8 char password

• 10 char password

Characters in password entry fields are not briefly displayed before they are masked.

The number of days that a password can be used before users are prompted to change it.

The number of failed login attempts that are tolerated before the container apps are locked.

Once they are locked an administrator needs to unlock the apps or, if allowed, users can use the

Self Service Portal to do so.

Users can use their fingerprint to unlock the app.

The period of time within which no Sophos container password must be entered when a container app comes to the foreground again.

The grace period applies to all container apps.

You can switch between the apps during the grace period without entering a password.

When the device is locked, the Sophos container is locked as well.

If the check box is cleared, the container is locked only after the grace period has expired.

Setting/Field

Last server connect

Sophos Mobile

Description

The period of time within users can use a

Sophos container app without a connection to the Sophos Mobile server.

When a Sophos container app becomes active and does not have contact with the server within the defined period of time, a lock screen will be displayed. Users can only unlock the app by tapping Retry on the lock screen. The app will then try to connect to the server. If the connection can be established, the app will be unlocked. If not, access will be denied.

• On access: Server connection is always required and the app is locked when the server cannot be reached.

• 1 hour: Server connection is required when the app becomes active one hour or more after the last successful server connection.

• 3 hours

• 6 hours

• 12 hours

• 1 day

• 3 days

• None: No regular contact is required.

Sophos Mobile

Setting/Field

Offline starts without server connection

Description

In this field you define how often users can start one of the Sophos container apps without a server connection.

Note

This setting requires the Sophos container password feature to be turned on.

Root access allowed

A counter is incremented whenever users enter the Sophos container password. If the counter exceeds the defined number, the same lock screen as for the Last server connect setting will be displayed. The counter will be reset if a connection to the Sophos Mobile server is established.

• Unlimited: No server connection is required.

• 0: Starting the app without a server connection is not possible.

• 1: After one start of the app, a successful server connection is necessary.

• 3

• 5

• 10

• 20

Container apps are allowed to run on rooted devices.

App usage constraints

Here you can define constraints on using the Sophos container apps. Click Add to enter constraints.

Geo-fencing

Time-fencing

Lets you add latitude and longitude and a radius within which the Sophos container apps can be used.

Lets you specify a start and end time within which the Sophos container apps can be used.

Days of the week on which the apps can be used can be specified as well.

Setting/Field

Wi-Fi fencing

Sophos Mobile

Description

If you select Wi-Fi connection required, the

Sophos container is locked when there is no active Wi-Fi connection.

If you add Wi-Fi networks to the list, the

Sophos container is locked when the device is connected to a Wi-Fi network not listed.

Warning

We recommend that you do not rely on Wi-Fi fencing as the only security mechanism because

Wi-Fi names can be spoofed very easily.

14.16.2 Corporate Email configuration (Android Sophos container policy)

With the Corporate Email configuration you define user settings for your Microsoft Exchange Server.

These settings are applied to the Sophos Secure Email app if it is installed in the Sophos container.

Setting/Field

Exchange server

User

Email address

Domain

Support contact email

Description

The Exchange server address.

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The domain for this account.

The email address that will be used as the

"Contact Support" email address.

Sophos Mobile

Setting/Field

Export contacts to device

142

Export company names

Notification details

Deny copy to clipboard

Deny screenshots

Maximum email size

Allow viewing/sharing

Description

Users are allowed to export the Exchange contacts to the local device contacts, so that they can identify company contacts in incoming calls.

Sophos Secure Email keeps the information synchronized.

Note

The local contact information is automatically deleted in the following situations:

• When the Corporate Email configuration is removed from the

Sophos container policy (requires a restart of the Secure Email app).

• When the Sophos container is removed from the device.

• When the device is unenrolled from

Sophos Mobile.

The company name is included in the export of company contacts to the local device contacts.

When the check box is cleared, only name and phone number are exported.

Select the amount of information that is displayed in email notifications.

This setting also affects event reminders. If you select No notifications, event reminders are turned off. If you select any other value, event reminders are turned on and include time, location and title information.

Users cannot copy or cut texts from the Sophos

Secure Email app.

Users can’t take screenshots that show the

Sophos Secure Email app.

Email messages that are larger than the size you select (including attachments) are not retrieved from the Exchange server.

Users are allowed to view or share email attachments.

Setting/Field

View attachments

Share attachments

Extra settings

Sophos Mobile

Description

Select whether attachments can be viewed in all apps or only in the Sophos container apps

Sophos Secure Workspace and Sophos Secure

Email.

With all apps: Attachments can be shared with all apps that support the file format.

With container apps: Attachments are encrypted with a device key and can only be opened in Sophos Secure Workspace. The sharing action itself is not blocked.

Only configure these settings if instructed by

Sophos Support.

Note

If Sophos Secure Email isn’t installed, users receive a message to install it. When they start the app for the first time, it’s configured automatically.

14.16.3 Corporate Documents configuration (Android Sophos container policy)

With the Corporate Documents configuration you define settings for the Corporate Documents feature of the Sophos Secure Workspace app.

Configure storage providers

For each storage provider you can define the following settings separately:

Setting/Field

Enable

Offline

Open in (encrypted)

Open in (unencrypted)

Clipboard

Description

The storage provider is available in the app.

Users are allowed to add files from the storage provider to the app's Favorites list for offline use.

Users can share encrypted files with other apps via Open In.

Users can share unencrypted files with other apps via Open In.

Users can copy parts of a document and paste them into other apps.

Sophos Mobile

Enterprise provider settings

For WebDAV provider, also referred to as enterprise provider, you can centrally define server settings and login credentials. These cannot be changed by users.

Credential settings that you do not define centrally can be chosen by the users in the app's provider credential screens.

For example you can centrally define the server and user account to be used but you can leave the password field undefined. Users then would have to know the password when accessing the storage provider.

Setting/Field

Name

Server

User name

Password

Upload folder

Description

The name of the provider that is displayed in the

Sophos Secure Workspace app.

In this field, enter:

• The URL of the root folder on the

Corporate Documents WebDAV server.

• The URL of the root folder on the WebDAV server.

Use the following format: https:// server.company.com

Only the https protocol is supported.

The user name for the relevant server. You can also use the %_USERNAME_% variable.

The password for the relevant account.

The upload folder for the relevant account.

Other settings

Setting/Field

Enable Documents

Description

This turns on the Documents feature to securely distribute company documents.

Setting/Field

Passphrase complexity

Deny screenshots

Extra settings

Sophos Mobile

Description

The required minimum complexity of passphrases for encryption keys. More secure passphrases are always allowed.

You can select the following settings:

• 4 char password

• 6 char password

• 8 char password

• 10 char password

Users can’t take screenshots that show the

Sophos Secure Workspace app.

Only configure these settings if instructed by

Sophos Support.

14.16.4 Corporate Browser configuration (Android Sophos container policy)

With the Corporate Browser configuration you define settings for the Corporate Browser feature of the

Sophos Secure Workspace app.

The Corporate Browser allows you to securely access corporate intranet pages and other allowed pages. You can define domains and bookmarks within a domain.

Every bookmarks belongs to a certain domain. When you add a bookmark, the domain entry is created automatically if it does not exist.

General settings

Setting/Field

Deny screenshots

Description

Users can’t take screenshots that show the

Corporate Browser.

Domain settings

Setting/Field

URL

Allow copy/paste

Allow open with

Description

The domain that you want to allow.

Users can copy and paste text from the

Corporate Browser to other apps.

Users can download attachments or pass them on to other apps.

145

Sophos Mobile

Setting/Field

Allow save password

Description

Users can save their passwords in the

Corporate Browser.

Bookmark settings

Setting/Field

Name

URL

Description

The name for the bookmark.

The web address for the bookmark.

14.16.5 Root certificate configuration (Android Sophos container policy)

With the Root certificate configuration you install a root certificate onto devices. This certificate is available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the

Sophos container.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

Sophos Mobile

14.16.6 Client certificate configuration (Android Sophos container policy)

With the Client certificate configuration you install a client certificate onto devices. This certificate is available to the Sophos Secure Workspace app if it’s installed in the Sophos container.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.16.7 SCEP configuration (Android Sophos container policy)

Corporate Browser feature of the Sophos Secure Workspace app.

Note

You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Alias name

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the

SCEP tab of the Sophos setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.

Sophos Mobile

Setting/Field

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Root certificate

Key size

Description

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in policies (page 106).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified

URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the

SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

Setting/Field

Key usage

Sophos Mobile

Description

Select what the certificate can be used for.

Use as digital signature: The certificate can be used as a digital signature.

Use for encryption: The certificate can be used for data encryption.

14.17 Configurations for Mobile Threat Defense policies for Android

With a Mobile Threat Defense policy you configure Sophos Intercept X for Mobile when it’s enrolled with Sophos Mobile.

Warning

On Android Enterprise devices, this policy installs the Intercept X app. You must approve the app in managed Google Play before you assign the policy.

14.17.1 Network configuration (Mobile Threat Defense policy for

Android)

With the Network configuration you manage the Wi-Fi Security feature of Sophos Intercept X for

Mobile. This protects users from network-based threats.

Note

When you assign this configuration to a device, the corresponding settings in Sophos Intercept X for Mobile are disabled. The user can’t change them.

Setting/Field

Man-in-the-middle protection

Extra settings

Description

Sophos Intercept X for Mobile checks the Wi-Fi connection for man-in-the-middle attacks.

Sophos Mobile creates an alert when a man-in-the-middle attack is detected.

Only configure these settings if instructed by Sophos

Support.

Sophos Mobile

14.17.2 Antivirus configuration (Mobile Threat Defense policy for

Android)

With the Antivirus configuration you manage the malware protection settings of Sophos Intercept X for

Mobile.

Note

When you assign this configuration to a device, the corresponding settings in Sophos Intercept X for Mobile are disabled. The user can’t change them.

Setting/Field

Cloud scan mode

Scheduled scan interval

Scan system apps

Scan storage

Detect PUAs

Enable user to allow PUAs

Mode

Description

Select when Sophos Intercept X for Mobile loads the latest malware information from the Sophos server.

Select how often malware scans are performed.

If you select Daily while charging, a scan is performed when the device is connected to a power supply for more than 30 minutes.

Scan system apps.

System apps aren’t scanned by default because they are protected by the Android OS and because the user can’t uninstall them.

Scan all files on internal shared storage, SD card, and connected USB devices for threats, in addition to the default scanning of all installed apps.

Scan for Potentially Unwanted Applications (PUAs).

PUAs are apps that, while not malicious, are generally considered unsuitable for business networks. PUAs include adware, dialers, system monitors, remote administration tools, and hacking tools. However, certain apps that can fall into the PUA category might be considered useful by some users.

Users can allow an app that was classified as PUA.

Allowed apps are ignored in subsequent scans.

Select how to deal with low reputation apps:

Allow: Turn off scanning for low reputation apps.

Warn: Display a warning on the device when a low reputation app is detected. Users can choose how to deal with the app. They can add it to a list of allowed apps so that no further warning is displayed if this app is detected.

Block: The user can’t start low reputation apps.

Setting/Field

Scan notification

Monitor storage

App group

Sophos Mobile

Description

When an app is scanned after installation, Sophos

Intercept X for Mobile creates a notification.

If the check box is cleared, no notifications are created for clean apps.

Monitor internal shared storage, SD card, and connected

USB devices for changes. When new files are stored in these locations, they are scanned.

Select a group of allowed apps. The apps in that group are excluded from scans.

14.17.3 Web Filtering configuration (Mobile Threat Defense policy for Android)

With the Web Filtering configuration you manage the Web Filtering feature of Sophos Intercept X for

Mobile. This protects users from browsing sites with malicious, undesirable or illegal content.

Note

You must also turn off the Intercept X for Mobile permissions can be denied compliance rule. If you don’t, users are able to stop Web Filtering by turning off Sophos Accessibility Service.

Tip

For the purpose of testing website filtering, Sophos has created the site sophostest.com

containing example pages for each category. Although some of these pages are classified as potentially offensive or dangerous, the page content itself is harmless in all cases.

Settings

Setting/Field

Filter malicious websites

Create alerts

Filter websites by category

Description

Select whether users can access websites with malicious content.

Select whether an alert is created when the user tries to access a filtered website.

You can select if alerts are only created for blockings or also for warnings.

Select whether users can access types of websites.

Websites are categorized based on data from

SophosLabs. The data is updated constantly.

Sophos Mobile

Setting/Field

Website exceptions

Description

Configure exceptions to the category filters:

Allowed domains: Websites that are allowed, even though the category they belong to is blocked.

Blocked domains: Websites that are blocked, even though the category they belong to is allowed.

152

How to specify website exceptions

In Allowed domains and Blocked domains, enter one of the following per line (without separator):

• IPv4 or IPv6 address

203.0.113.0

2001:db8:85a3:0:0:8a2e:370:7334

• IPv4 or IPv6 subnet

203.0.113.0/24

2001:db8::/32

• Domain www.example.com

• Wildcard domain. The wildcard * must be the leftmost character.

*.example.com

*example.com

In Blocked domains, you can use a single wildcard * to block all websites.

Filtering logic

When Web Filtering evaluates whether a website must be allowed or blocked, the allow list takes precedence over the block list, and policy-defined lists take precedence over user-defined lists.

Filtering rules are applied in the following sequence:

1. If the website is included in Allowed domains, it is allowed.

2. If the website is included in Blocked domains, it is blocked.

3. If the user has added the website to the allow list, it is allowed.

4. If the user has added the website to the block list, it is blocked.

5. The website is allowed or blocked based on its category.

Supported browsers

Web Filtering can be used in combination with the following web browsers:

• Android web browser

• Firefox

Sophos Mobile

• Google Chrome

• Microsoft Edge

Other browsers may also work, but have not been tested.

14.18 Configurations for Android device policies

With an Android device policy you configure settings for Android devices enrolled with Sophos Mobile in “Device administrator” management mode.

This is a legacy policy type. We recommend that you use the Android Enterprise management mode and policies instead.

Related concepts

Configurations for Android Enterprise device policies

(page 109)

With an Android Enterprise device policy you configure settings for Android Enterprise fully managed devices.

Configurations for Android Enterprise work profile policies

(page 123)

With an Android Enterprise work profile policy you configure settings for Android Enterprise work profile devices.

Related tasks

Set Android management mode

(page 20)

For Android devices, you can choose between the Android Enterprise and Device administrator

(legacy feature) management modes.

14.18.1 Password policies configuration (Android device policy)

With the Password policies configuration you define requirements for the display lock password.

Note

The settings supported may depend on the version of the operating system or on other device features. This is indicated by blue labels in Sophos Mobile Admin.

Password type

In the Password type list, select the type of password users are allowed to configure:

Setting/Field

Pattern, PIN or password

Simple password

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.

No additional restrictions are imposed.

Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Sophos Mobile

Setting/Field

PIN or password

Alphanumeric password

Complex password

Description

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Password screen lock. The password must contain both letters and digits.

You can define a minimum length. See the following table.

Users must set a Password screen lock.

If you select Simple password, PIN or password, Alphanumeric password or Complex

password, the following fields are displayed:

Setting/Field

Minimum password length

Description

The minimum number of characters a password must contain.

Maximum idle time before password prompt The time after the device is locked if it has not been used. The device can be unlocked by entering the password.

Note

The device might impose a shorter time period than what you configure here.

Maximum password age in days

Maximum sign-in attempts

Password history

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

The device is wiped after this number of incorrect sign-in attempts.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

If you select Complex password, the following additional fields are displayed:

Setting/Field

Minimum number of letters

Description

The minimum number of letters a password must contain.

Setting/Field

Minimum number of lowercase letters

Minimum number of uppercase letters

Minimum number of non-alphabetic characters

Minimum number of digits

Minimum number of special characters

Sophos Mobile

Description

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

The minimum number of non-alphabetic characters (for example & or !) a password must contain.

The minimum number of numerals a password must contain.

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

Biometric authentication

Setting/Field

Allow fingerprint authentication

Allow iris authentication

Description

If supported by the device, the user can use fingerprint authentication to unlock the device.

If supported by the device, the user can use iris authentication to unlock the device.

14.18.2 Restrictions configuration (Android device policy)

With the Restrictions configuration you set restrictions for devices.

Security

Setting/Field

Force encryption

Force SD card encryption

Description

Users must encrypt their devices.

When the policy is assigned to a device, the user must encrypt the SD card.

Note

For some device types, users can choose to cancel the encryption. They will be reminded again on the next SD card mount.

Sophos Mobile

Setting/Field

Allow fast encryption

Allow factory reset

Allow "Developer options"

Allow safe mode

Allow USB debugging

Allow firmware recovery

Allow backup

Allow settings changes

Allow clipboard

Enable shared clipboard

Allow screen capture

Allow mock GPS locations

Allow over-the-air firmware updates

Allow audio recording

Description

Users can change the fast encryption options in the device settings.

Users can reset their devices to factory state.

Users can change the developer options.

Users can boot the device in safe mode.

Users can turn on USB debugging.

Note

For Sony devices with Enterprise API level 9 or later, clearing the Allow USB debugging check box makes all developer options unavailable.

All types of firmware updates (like over-the-air, download etc.) are allowed.

Users can create system backups.

If the check box is cleared, Google backup is turned off but other backup methods (for example Sophos Mobile backups) remain available.

Users can change device settings.

Note

You must turn this on for Samsung devices on which you want to configure a Knox container.

Users can copy any contents to the clipboard.

Allows users to copy clipboard content between apps.

If the check box is cleared, each app has an individual clipboard.

This setting is only available if you select Allow

clipboard.

Users can take a screenshot of the display.

Users can select a mock location app in the Android developer options.

Over-the-air firmware updates are allowed.

Users can perform audio recording.

Setting/Field

Allow video recording

Allow Activation Lock

Allow S Beam

Allow S Voice

Allow "Share via"

Sophos Mobile

Description

Users can record videos.

If the check box is cleared, users can still take pictures and stream videos.

Users can change the Activation Lock options in the device settings.

Users can start the Samsung S Beam app.

Users can start the Samsung S Voice app.

The Share via feature is available.

Accounts

Setting/Field

Allow multiple user accounts

Allow adding email accounts

Allow removal of the Google account

Allow auto-sync for Google accounts

Description

If the check box is cleared, multi-user support is turned off. Users or other apps cannot create additional user accounts.

If the check box is cleared, users cannot add email accounts.

This does not affect the account creation through a device policy.

If the check box is cleared, users cannot remove the

Google account from the device.

If the check box is cleared, Google accounts are not synchronized automatically. Users are still able to perform a manual sync from inside some apps like

Gmail.

Network and communication

Setting/Field

Allow airplane mode

Allow sync while roaming

Allow emergency calls only

Description

If the check box is cleared, users cannot enable airplane mode.

If the check box is cleared, synchronization while roaming is turned off.

Only emergency calls are allowed. All other calls will be blocked.

Sophos Mobile

Setting/Field

Force manual sync during roaming

Force mobile data connection

Allow SMS

Allow mobile data connection while roaming

Allow voice calls while roaming

Allow user mobile data limit

Allow VPN

Allow Wi-Fi Direct

Allow Android Beam

Allow Miracast policy

Allow Bluetooth

Allow Advanced Audio Distribution

Profile (A2DP)

Allow Audio/Video Remote Control

Profile (AVRCP)

Allow Hands-Free Profile (HFP)

Allow Headset Profile (HSP)

Allow Phone Book Access Profile

(PBAP)

Allow Serial Port Profile (SPP)

Allow NFC

Allow Wi-Fi

Description

Automatic data synchronization is turned off when the device is roaming. This affects all configured accounts, such as Google or Exchange.

Users cannot turn off cellular data.

If the check box is cleared, users cannot send text messages.

If the check box is cleared, mobile data connections while roaming are turned off.

If the check box is cleared, voice calls while roaming are turned off.

If the check box is cleared, users cannot set a mobile data limit.

If the check box is cleared, users cannot use VPN connections.

If the check box is cleared, data transfer through Wi-Fi

Direct is turned off.

If the check box is cleared, data transfer through

Android Beam is turned off. This includes the Samsung

S Beam app.

If the check box is cleared, data transfer through

Miracast is turned off.

If the check box is cleared, Bluetooth is turned off.

To allow individual Bluetooth profiles, first select the Allow Bluetooth check box and then select the profiles you want to allow.

If the Allow Bluetooth check box is cleared, the settings have no effect, i.e. all profiles are forbidden.

If the check box is cleared, NFC (near-field communication) is turned off.

If the check box is cleared, Wi-Fi is turned off.

Sophos Mobile

Tethering

Setting/Field

Allow tethering

Allow Wi-Fi tethering

Allow USB tethering

Allow Bluetooth tethering

Allow configuring Wi-Fi tethering

Description

If the check box is cleared, all tethering is turned off.

This includes tethering over Wi-Fi, USB and Bluetooth.

Note

If the check box is cleared, the settings Allow Wi-

Fi tethering, Allow USB tethering and Allow

Bluetooth tethering have no effect.

If the check box is cleared, Wi-Fi tethering (Wi-Fi

hotspot) is turned off.

If the check box is cleared, USB tethering is turned off.

If the check box is cleared, Bluetooth tethering is turned off.

The user can configure the settings of the Wi-Fi hotspot.

Hardware

Setting/Field

Allow camera

Allow camera on lock screen

Force GPS for location queries

Allow SD card

Allow moving apps to the SD card

Allow writing to unencrypted SD card

Allow microphone

Description

If the check box is cleared, the camera is unavailable.

If the check box is cleared, the camera is unavailable when the screen is locked.

To allow the camera on the lock screen you must also select the Allow camera option.

GPS information is used for device location.

If the check box is cleared, SD cards cannot be used in devices.

If the check box is cleared, users cannot move apps from the internal storage to the SD card.

If the check box is cleared, it is not possible to write to unencrypted SD cards.

If the check box is cleared, the microphone is unavailable.

Sophos Mobile

Setting/Field

Allow USB

Allow USB media player

Allow power saving mode

Allow USB host storage

Description

The USB mass storage mode and the USB media device mode (MTP) are available on the device.

If the check box is cleared, the Media Transfer

Protocol (MTP) is unavailable. Because Android uses

MTP for USB file transfer, any file transfer over USB is blocked.

If the check box is cleared, the device doesn’t enter power saving mode.

All external storage devices the user connects are mounted. This includes portable USB storage devices, external HD drives and SD card readers.

If the check box is cleared, external storage devices are not mounted.

Applications

Setting/Field

Allow app install

Allow app uninstall

Allow unsigned app install

Allow Play Store

Allow apps from unknown sources

Allow native browser

Allow app crash reports

Allow wallpaper change

Show caller info

Description

If the check box is cleared, users cannot install apps.

If the check box is cleared, users cannot uninstall apps.

If the check box is cleared, users can only install signed APK files.

If the check box is cleared, the Google Play Store app is unavailable.

If the check box is cleared, users can only install apps through the Google Play Store app.

If the check box is cleared, the native browser is unavailable. Third-party browser apps are not affected.

If the check box is cleared, apps cannot send crash reports.

If the check box is cleared, users cannot change the wallpaper.

If the check box is cleared, caller details are not displayed for incoming phone calls. All callers are displayed as “unknown”.

Sophos Mobile

Setting/Field

Allow autofill in browser

Allow cookies in browser

Description

The user can enable autofill in the settings of the native Android browser. If enabled, web pages can provide suggestions when the user is filling in form data.

If the check box is cleared, autofill is turned off and the browser setting is unavailable.

The user can enable cookies in the settings of the native Android browser. If enabled, web pages can store cookies on the device.

If the check box is cleared, cookies are turned off and the browser setting is unavailable.

Allow JavaScript in browser

Allow pop-ups in browser

The user can enable JavaScript in the settings of the native Android browser. If enabled, web pages can execute JavaScript code on the device.

If the check box is cleared, JavaScript is turned off and the browser setting is unavailable.

The user can enable pop-ups in the settings of the native Android browser. If enabled, web pages can open new browser windows.

If the check box is cleared, pop-ups are turned off and the browser setting is unavailable.

Allow changing date and time settings The user can change the date and time settings.

Allowed apps / Forbidden apps You can configure either Allowed apps or Forbidden

apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.

App installations initiated by the Sophos Mobile server are not restricted by this setting.

For information on creating app groups, see

App groups

(page 312).

14.18.3 Knox Premium restrictions configuration (Android device policy)

With the Knox Premium restrictions configuration you define restrictions for Samsung Knox devices.

These restrictions apply to the device, not to the Knox container.

Note

To enforce the Knox Premium restrictions, you must register a Samsung Knox Premium license with Sophos Mobile.

Sophos Mobile

Option

Allow firmware auto update options

Enable ODE Trusted Boot verification

Prevent installation of another administrator app

Prevent activation of another administration app

Allow Common Criteria mode

Description

The device automatically checks for firmware updates. Users cannot change this in the device settings.

The device decrypts the data partition on boot only if the binary and the kernel are official, i.e. if the device is not rooted.

If the check box is cleared, the device always decrypts the data partition on boot.

The installation of apps that require device administrator privileges is prevented. This does not affect apps that are installed by Sophos

Mobile.

The activation of device administrator privileges for apps is prevented.

The Common Criteria mode (CC mode) of the device is turned on, ensuring that the device meets the security requirements stated by the

Mobile Device Fundamentals Protection Profile

(MDFPP).

Note: CC mode is only used if the following additional requirements are met:

• Device encryption is turned on.

• Fast encryption is turned off.

• External storage encryption is turned on.

• The number of failed login attempts until device wipe is set.

• Certificate revocation is turned on.

• Password history is turned off.

14.18.4 Exchange account configuration (Android device policy)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server mail server.

Setting/Field

Account name

Exchange server

Domain

Description

The account name.

The Exchange server address.

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The domain for this account.

Setting/Field

User

Email address

Sender

Password

Synchronization period

Synchronization interval

SSL/TLS

Default account

Allow all certificates

Client certificate

Allow forwarding emails

Allow use of HTML format

Maximum attachment size in MB

Synchronize content types

Sophos Mobile

Description

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

A sender name for this account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

The account is used as the default email account.

Allow all certificates in transfer processes from the email server.

The client certificate for the connection to the

Exchange server.

Allow forwarding of emails.

Allow the use of HTML format in emails.

The maximum size of a single email message.

The content types to be synchronized.

Sophos Mobile

Note

On devices with LG GATE, Samsung Knox, or Sony Enterprise API, the email app is configured automatically. On other Android devices, users receive a message to configure the email app. The configuration details are available in the Sophos Mobile Control app.

Note

For Sony devices with Enterprise API level 6 or earlier, the Exchange account information must match the user assigned to the device.

On these devices, the Sophos Mobile Control app is not able to send the ActiveSync ID to the

Sophos Mobile server. When the device contacts the EAS proxy for the first time, the ActiveSync

ID that the email client sends is not known to Sophos Mobile. To verify the account details, the EAS proxy searches for a device with an unknown ActiveSync ID and an assigned user that matches the user information supplied by the email client. If such a device is found, the ActiveSync ID is assigned to that device and the email request is passed on to the Exchange server. Otherwise, the request is rejected.

For details, see Sophos knowledge base article 121360 .

14.18.5 Wi-Fi configuration (Android device policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Security type

Phase 2 authorization

Description

The ID of the Wi-Fi network.

The security type of the Wi-Fi connection:

• None

• WEP

• WPA/WPA2 PSK

• EAP/PEAP

• EAP/TLS

• EAP/TTLS

The authentication method for phase 2 of the

EAP negotiation:

• None

• PAP

• CHAP

• MSCHAP

• MSCHAPv2

This field is available for EAP/PEAP and EAP/

TTLS connections.

Setting/Field

Identity

Anonymous identity

Password

Identity certificate

Trusted certificate

Proxy host

Proxy port

Sophos Mobile

Description

The user identity.

This field is available for EAP connections.

The pseudonym identity sent unencrypted in phase 1 of the EAP negotiation.

This field is available for EAP connections.

The password for the Wi-Fi network.

The identity certificate for the connection to the

Wi-Fi network.

The list includes all certificates from Client

certificate configurations of the current policy.

This field is available for EAP connections.

The root CA for the certificate of the EAP server.

The list includes all certificates from Root

certificate configurations of the current policy.

This field is available for EAP connections.

The name or IP address of a proxy server for the Wi-Fi connection.

The port number of the proxy server.

14.18.6 App Protection configuration (Android device policy)

With the App Protection configuration you define password requirements for protecting apps.

With App Protection in use, users must create a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.

Setting/Field

Password complexity

Grace period in minutes

Description

The minimum complexity requirements for the password to be defined by users.

After the grace period has expired, protected apps can only be unlocked by entering a password.

Sophos Mobile

Setting/Field

App group

Allow fingerprint authentication

Description

Select the app group containing the apps that are password protected.

For creating app groups, see

App groups

(page

312).

Users can use their fingerprint to unlock a protected app.

14.18.7 App Control configuration (Android device policy)

Setting/Field

App group

Description

Select the app group containing the blocked apps.

For information on creating app groups, see

App groups

(page 312).

14.18.8 App permissions configuration (Android)

With the App permissions configuration you configure what happens when an app requests permissions at runtime.

Setting/Field

App-specific runtime permissions

Description

Grant or deny runtime permissions for specific apps.

Click Add to select an app and then select one of the following for each permission:

• Selectable: Users can edit the permission.

• Granted: The permission is granted.

• Denied: The permission is denied.

14.18.9 Kiosk mode configuration (Android device policy)

With the Kiosk mode configuration you define restrictions for devices to put them into a kiosk mode.

Click Select source and then do one of the following to specify an app that is started when the policy is assigned to a device:

• Select Custom and enter an app identifier.

Sophos Mobile

• Select App list and then select an app from the App identifier list. The list contains all apps that

you have configured on the Apps page. See Add app

(page 292).

• Select No app to configure kiosk mode without specifying an app. The kiosk mode restrictions are applied to the device, but no app is started.

Under Options, deselect hardware and software features you want to disable in kiosk mode.

When the policy is assigned to a device, the app that you specified is started. However, if you have not turn off any of the available hardware or software features, the user will be able to leave the app and use the device as normal. To set the device into a true kiosk mode, you must clear at least the

Allow Home button and Allow task manager check boxes.

Note

• The app that you specify must be installed on the device. If it is not, the transfer tasks will remain in state Incomplete until the app is installed. To install the app, create a task bundle with an Install app task, for example, and transfer it to your devices.

• For Sony devices with Enterprise API level 9 or later, if you clear any of the Allow volume

up, Allow volume down or Allow volume mute check boxes, all volume buttons of the device are disabled.

14.18.10 Access Point Name configuration (Android device policy)

With the Access Point Name configuration you specify an Access Point Name (APN) configuration for mobile devices. APN configurations define how devices connect to a mobile network.

CAUTION

We recommend that you ask your carrier for the required settings. If you select Use as default

APN and the settings are not correct, the device can’t access data through cellular networks.

Note

With the exception of the APN field, all settings are optional and should only be specified if required by your mobile network carrier.

Setting/Field

APN

User-friendly name

Server

Description

The APN that the device quotes when it opens a connection with the carrier.

This must match an APN that the carrier accepts. Otherwise, the connection cannot be established.

An optional name that is displayed on the device in addition to the APN.

The address of the HTTP server that is used for web traffic.

Sophos Mobile

Setting/Field

Port

User name, User password

Server

MMSC

Use as default APN

Description

The port of the HTTP server that is used for web traffic.

A user name and password for connecting to the APN.

The WAP Gateway Server.

The Multimedia Messaging Service Center

(MMSC).

MMS proxy server, MMS proxy port

Mobile Country Code (MCC), Mobile Network

Code (MNC)

The address and port of a HTTP server that is used for communication with the MMSC.

MCC and MNC for specifying the carrier.

The APN is only used for this carrier.

Authentication type

APN type

Bearer

Protocol

The authentication method for PPP connections.

The types of data connection that this APN is used for.

To use the APN for all data types, enter * or leave the field empty.

The Radio Access Technology (RAT) that the carrier uses.

The network protocol that is supported by the carrier.

Roaming protocol The network protocol that is supported by the carrier when in roaming mode.

If selected, devices will use this APN as default.

An error is raised when you try to select this option in more than one Access Point Name configuration.

14.18.11 VPN configuration (Android device policy)

With the VPN configuration you define VPN settings for network connections.

Setting/Field Description

Connection name The name of the connection shown on the device.

Server The host name or the IP address of the server.

Sophos Mobile

Setting/Field

Connection type

Description

The type of the VPN connection:

• L2TP/IPsec (PSK)

If you select this type, the fields User, Password and L2TP/IPsec

(PSK) are displayed. Enter the user and password. In the L2TP/IPsec

(PSK) field, enter the pre-shared key for authentication.

• L2TP/IPsec (certificate)

If you select this type, the fields Client certificate, Root certificate,

User and Password are displayed. In the fields Client certificate and

Root certificate, select the relevant certificates. In addition, enter the

User and the relevant Password.

• Cisco AnyConnect

If you select this type, you can upload XML files with an AnyConnect

VPN profile and/or an NVM (Network Visibility Module) profile. See the

Cisco AnyConnect administrator guide for information on these profiles.

14.18.12 Root certificate configuration (Android device policy)

With the Root certificate configuration you install a root certificate onto devices.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.18.13 Client certificate configuration (Android device policy)

With the Client certificate configuration you install a client certificate onto devices.

Setting

File

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

Sophos Mobile

Setting

Certificate name

Description

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.18.14 SCEP configuration (Android device policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Note

You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Alias name

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the

SCEP tab of the Sophos setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.

Setting/Field

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Root certificate

Key size

Sophos Mobile

Description

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in policies (page 106).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified

URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the

SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

Sophos Mobile

Setting/Field

Key usage

Description

Select what the certificate can be used for.

Use as digital signature: The certificate can be used as a digital signature.

Use for encryption: The certificate can be used for data encryption.

14.19 Configurations for Knox container policies

With a Knox container policy you configure settings for the Knox container on Samsung devices.

14.19.1 Password policies configuration (Knox container policy)

With the Password policies configuration you define requirements for the Knox container password.

Note

The settings supported may depend on the version of the operating system or on other device features. This is indicated by blue labels in Sophos Mobile Admin.

Password type

In the Password type list, select the type of password users are allowed to configure:

Setting/Field

Pattern, PIN or password

Simple password

PIN or password

Alphanumeric password

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.

No additional restrictions are imposed.

Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Password screen lock. The password must contain both letters and digits.

You can define a minimum length. See the following table.

Sophos Mobile

Setting/Field

Complex password

Description

Users must set a Password screen lock.

If you select Simple password, PIN or password, Alphanumeric password or Complex

password, the following fields are displayed:

Setting/Field

Minimum password length

Description

The minimum number of characters a password must contain.

Maximum idle time before password prompt The time after the Knox container is locked if it has not been used. The container can be unlocked by entering the password.

Note

The device might impose a shorter time period than what you configure here.

Maximum password age in days

Maximum sign-in attempts

Password history

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

The Knox container is deleted after this number of incorrect sign-in attempts.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

If you select Complex password, the following additional fields are displayed:

Setting/Field

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

Description

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

Sophos Mobile

Setting/Field

Minimum number of non-alphabetic characters

Minimum number of digits

Minimum number of special characters

Description

The minimum number of non-alphabetic characters (for example & or !) a password must contain.

The minimum number of numerals a password must contain.

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

Biometric authentication

Setting/Field

Allow fingerprint authentication

Allow iris authentication

Allow face authentication

Description

If supported by the device, the user can use fingerprint authentication to unlock the Knox container.

If supported by the device, the user can use iris authentication to unlock the Knox container.

If supported by the device, the user can use face authentication to unlock the Knox container.

14.19.2 Restrictions configuration (Knox container policy)

With the Restrictions configuration you configure restrictions and related settings for the Knox container of Samsung devices.

Setting/Field

Allow screen capture

Allow camera

Allow clipboard

Allow "Share via"

Allow microphone

Enforce the use of the secure keypad

Description

Users can capture the screen content of apps inside the Samsung Knox container.

Apps inside the Samsung Knox container can access the camera.

Users can copy any contents to the clipboard.

The Share via feature that certain apps use is turned on.

Apps inside the Samsung Knox container can access the microphone.

Users must use the secure keypad.

Sophos Mobile

Setting/Field

Allow addition of new email accounts

Allow data export

Allow copying files into the container

Allow Bluetooth

Allow NFC

Enforce multi-factor authentication

Allowed apps / Forbidden apps

Description

Users can add email accounts beyond the accounts that are configured by a Sophos Mobile policy.

Private apps can access data from within the Samsung

Knox container.

Private files can be copied or moved into the Samsung

Knox container.

Apps inside the Samsung Knox container can use

Bluetooth connections.

Apps inside the Samsung Knox container can use NFC

(near-field communication) connections.

More than one authentication method is required to unlock the Samsung Knox container, for example password and fingerprint.

You can configure either Allowed apps or Forbidden

apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.

App installations initiated by the Sophos Mobile server are not restricted by this setting.

For information on creating app groups, see

App groups

(page 312).

14.19.3 Exchange account configuration (Knox container policy)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server. These settings are applied to the Samsung Knox container.

Setting/Field

Account name

Exchange server

Domain

User

Description

The account name.

The Exchange server address.

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

Sophos Mobile

176

Setting/Field

Email address

Sender

Password

Synchronization period

Synchronization interval

SSL/TLS

Default account

Allow all certificates

Allow forwarding from other accounts

Allow use of HTML format

Maximum attachment size in MB

Synchronize content types

Description

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

A sender name for this account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

The account is used as the default email account.

Allow all certificates in transfer processes from the email server.

This account can be used to forward emails received by another account.

For example if we call this account A and there exists another account B in the Knox container, an email message received by account B can be forwarded using account A as sender.

Note

This setting is only used by the native Android email app.

Allow the use of HTML format in emails.

The maximum size of a single email message.

The content types to be synchronized.

Sophos Mobile

14.20 Configurations for iOS device policies

With an iOS device policy you configure settings for iPhones and iPads.

14.20.1 Password policies configuration (iOS device policy)

With the Password policies configuration you define requirements for the device password.

Note

When the Password policies configuration is assigned to a device, a grace period of 60 minutes starts. Within the grace period, the user is asked to change the password when they return to the

Home screen to comply with the policies. After the grace period, the user may not start any apps on the device, including internal apps.

Setting/Field

Allow simple value

Require alphanumeric value

Minimum password length

Minimum number of complex characters

Maximum password age in days

Maximum Auto-Lock (in minutes)

Password history

Description

Users are allowed to use sequential or repeated characters in their password, for example 1111 or abcde .

Passwords must contain at least one letter or number.

Specifies the minimum number of characters a password must contain.

Specifies the minimum number of nonalphanumeric characters (for example & or !) a password must contain.

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

In this field, you can specify the maximum value the user is allowed to configure on the device. Auto-Lock specifies how soon (in minutes) the device will be locked if it has not been used.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

Sophos Mobile

Setting/Field

Maximum grace period for device lock

Number of failed attempts until device wipe

Description

In this field, you can specify the maximum value the user is allowed to configure on the device. The grace period for device lock specifies for how long the device can be unlocked after a lock without a password prompt. If you select None, the user can select any of the intervals available. If you select

Immediately, users must enter a password every time they unlock their devices.

In this field, you can specify the number of failed attempts to enter the correct password before the device is wiped. After six failed attempts, a time delay is imposed before a password can be entered again. The delay increases with each failed attempt. After the final failed attempt, all data and settings are securely removed from the device. The time delay starts after the sixth attempt. So if you set this value to 6 or lower, no delay is imposed and the device is wiped when the attempt limit is exceeded.

14.20.2 Restrictions configuration (iOS device policy)

With the Restrictions configuration you define restrictions for devices.

Note

Some options are only available for certain versions of iOS or for supervised devices. This is indicated by blue labels in Sophos Mobile Admin.

Device

Setting/Field

Allow app installation

Allow app installation from device UI

Description

If the check box is cleared, the App Store is unavailable and its icon is removed from the Home screen. Users can’t install or update apps from the App

Store or Apple Configurator.

If the check box is cleared, the App Store is unavailable and its icon is removed from the Home screen. Users can still install or update apps from

Apple Configurator.

Sophos Mobile

Setting/Field

Allow use of camera

Allow FaceTime

Allow screen capture

Allow automatic sync while roaming

Allow Siri

Allow Siri while device is locked

Description

If the check box is cleared, the camera is unavailable and the Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.

Users can place or receive FaceTime video calls.

Users can take a screenshot of the display.

If the check box is cleared, devices that are roaming will only sync when the user accesses an account.

If the check box is cleared, users cannot use Siri, voice commands, or dictation.

If the check box is cleared, users must unlock their devices by entering their password before they use

Siri.

Allow Siri querying content from the web

Force Siri explicit language filter

Allow adding Game Center friends

Allow find my friends modification

If the check box is cleared, Siri does not query content from the web.

If the check box is cleared, the Siri filter for explicit language is not enforced on the device.

Allow voice dialing while device is locked

If the check box is cleared, users cannot dial by using voice commands when the device is locked by a password.

If the user has not configured a device password, voice dialing is always allowed.

Passbook notifications are displayed when the device is locked.

Allow Passbook while device is locked

Allow in-app purchase Users can make in-app purchases.

Force user to enter store password for all purchases

Users must enter their Apple ID password to make any purchase.

If the check box is cleared, there is a brief grace period during which users can make subsequent purchases without having to enter their password again.

Allow multiplayer gaming

Allow Game Center

Users can play multi-player games in Game Center.

If the check box is cleared, Game Center is unavailable.

Users can add friends in Game Center.

If the check box is cleared, modifications to the Find my Friends app are unavailable.

Sophos Mobile

Setting/Field

Allow host pairing

Allow pairing with Apple Watch

Force Wrist Detection

Allow AirDrop

Allow Control Center on lock screen

Allow Notification Center on lock screen

Allow Today view on lock screen

Allow News

Allow over-the-air PKI updates

Allow iBooks Store

Allow explicit sexual content in iBooks Store

Allow user to install configuration profiles

Allow iMessage

Description

If the check box is cleared, you can only pair the device with Macs you’ve configured for device supervision.

If the check box is cleared, users cannot pair the device with an Apple Watch. Any currently paired

Apple Watch is unpaired.

A paired Apple Watch must use Wrist Detection.

Content sharing with AirDrop is turned on.

If the check box is cleared, the Control Center is unavailable when the device screen is locked.

If the check box is cleared, the Notification Center is unavailable when the device screen is locked.

If the check box is cleared, the Today view is unavailable when the device screen is locked.

The News app is available.

Over-the-air PKI updates are possible.

Users can purchase books in iBooks.

If the check box is cleared, explicit sexual content through iBooks Store is blocked.

Users can install configuration profiles.

Allow app removal

Allow system app removal

Allow erase all contents and settings

Allow internet search result for

Spotlight

Allow enabling of restrictions option

Users can use iMessage to send or receive text messages.

Users can uninstall apps from the device.

Users can uninstall system apps from the device.

If the check box is cleared, the Erase all Content And

Settings option in the Reset UI is unavailable.

If the check box is cleared, Spotlight does not return internet search results.

If the check box is cleared, the Enable Restrictions option in the Reset UI is unavailable.

Sophos Mobile

Setting/Field

Allow Handoff

Allow device name modification

Allow wallpaper modification

Allow changing notification settings

Allow keyboard shortcuts

Allow dictation for keyboard input

Allow predictive keyboard

Allow auto-correction

Allow spell check

Allow automatic app download

Allow Apple Music

Allow Apple Music Radio

Allow modification of Bluetooth settings

Allow VPN creation

Force automatic date and time iOS software update delay

Description

Users can use the Apple Continuity feature Handoff.

With Handoff, users can start to work on a document, email or message on one device and continue from another device.

Users can change the device name.

Users can change the wallpaper.

Users can change the notification settings.

Users can use keyboard shortcuts.

Users can turn on the Enable Dictation keyboard setting.

Users can turn on the Predictive keyboard setting.

Users can turn on the Auto-Correction keyboard setting.

Users can turn on the Check Spelling keyboard setting.

If the check box is cleared, the automatic downloading of apps purchased on other devices is turned off. This does not affect updates to existing apps.

Users can access the Apple Music library.

Users can access Apple Music Radio.

Users can modify the Bluetooth settings.

Users can add VPN configurations.

The iOS Date & Time setting Set Automatically is turned on and can’t be turned off by the user.

The number of days that an update of the iOS software is delayed after its release date.

Enter a value from 0 (no delay) to 90.

Sophos Mobile

Company data

Setting/Field

Allow documents to be shared only within managed apps/accounts

Allow managed apps to write contacts to unmanaged accounts

Allow unmanaged apps to read contacts from managed accounts

Allow documents to be shared only within unmanaged apps/accounts

Description

This restricts the opening of documents with apps or accounts managed by Sophos Mobile, for example a corporate email account.

If users have an email account managed by Sophos

Mobile and apps managed by Sophos Mobile on their devices, attachments from the managed email account can only be opened with managed apps.

In this way you can prevent corporate documents from being opened in unmanaged apps.

If you turn this setting off, the next two settings are disabled. Contacts from managed accounts can be shared with unmanaged apps.

Managed apps can write contacts to unmanaged accounts.

Unmanaged apps can read contacts from managed accounts.

This restricts the opening of documents with apps/ accounts not managed by Sophos Mobile, for example a private email account.

If users have an email account and apps not managed by Sophos Mobile on their devices, attachments from the unmanaged email account can only be opened with unmanaged apps.

In this way you can prevent personal documents from being opened in managed apps.

AirDrop is considered an unmanaged drop target.

Force AirDrop documents to be used as unmanaged documents

Allow managed apps to sync with iCloud

Allow backup for enterprise books

Allow enterprise books notes and highlights sync

Managed apps can use iCloud synchronization.

Enterprise books are backed up.

Enterprise books notes and highlights are synchronized.

Sophos Mobile

Applications

Setting/Field

Allow use of the iTunes Store

Allow use of Safari

Enable auto-fill

Force fraud warning

Block pop-ups

Allow JavaScript in browser

Accept cookies

Allow modification of cellular data usage per app

Allowed apps / Forbidden apps

Description

If the check box is cleared, the iTunes Store is unavailable and its icon is removed from the Home screen. Users cannot preview, purchase or download content.

If the check box is cleared, the Safari web browser is unavailable and its icon is removed from the Home screen. This also prevents users from opening Web

Clips.

If the check box is cleared, Safari does not auto-fill web forms with previously entered information.

The Safari security setting to warn the user when they visit a suspected phishing website is always turned on.

The Safari pop-up blocker is turned on.

Web pages can execute JavaScript code on the device.

In this field, you specify if Safari accepts cookies.

When you allow cookies, you can specify if only cookies from the current site, from previously visited sites, or from all sites are accepted.

Users can change the cellular data usage per app.

You can specify either Allowed apps or Forbidden

apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.

For information on creating app groups, see App groups

(page 312).

iCloud

Setting/Field

Allow backup

Allow document sync

Description

Users can back up their devices to iCloud.

Users can store documents and app configuration data in iCloud.

Sophos Mobile

Setting/Field

Allow Photo Stream

Allow iCloud Photo Library

Allow shared photo streams

Allow iCloud Keychain sync

Description

Users can upload photos to My Photo Stream.

CAUTION

If you clear the check box to forbid My Photo

Stream, this also removes existing photos shared via My Photo Stream from all devices. If there are no other copies of these photos, they are lost.

Users can use iCloud Photo Library.

Users can invite others to view their photo streams and can view photo streams shared by others.

Users can use iCloud Keychain to synchronize passwords across their iPhones, iPads, and Macs.

If the check box is cleared, iCloud Keychain data is only stored locally on the device.

184

Security and privacy

Setting/Field

Allow diagnostic data to be sent to

Apple

Allow user to accept untrusted TLS certificates

Trust enterprise apps

Allow password modification

Allow account modification

Allow Touch ID to unlock device

Force limit ad-tracking

Force encrypted backups

Force configured Wi-Fi networks

Description

If the check box is cleared, iOS diagnostic information is not sent to Apple.

If the check box is cleared, users are not asked if they want to trust certificates that cannot be verified.

This setting applies to Safari and to Mail contacts and

Calendar accounts.

Enterprise apps are trusted.

Users can add, change or remove the device password.

If the check box is cleared, users cannot modify accounts. The Accounts menu is unavailable.

If the check box is cleared, the device can’t be unlocked by Touch ID.

Anonymous user data apps used for targeting ads are no longer provided.

Users must encrypt backups in iTunes.

Devices can only connect to Wi-Fi networks that have been configured by a Sophos Mobile policy.

Sophos Mobile

Setting/Field

Allow AirPrint

Allow AirPrint credentials storage

Allow iBeacon discovery of AirPrint printers

Description

Users can send files to AirPrint-enabled printers.

The AirPrint user name and password can be stored in the system keychain.

The device uses iBeacon to discover AirPrint devices.

Warning

If you allow this, malicious AirPrint devices can perform phishing attacks on network traffic.

Force trusted certificates for AirPrint over TLS

Allow Quick Start transfer to new device

Allow password auto-fill

Force authentication before auto-fill

AirPrint over TLS is rejected if the AirPrint device uses an untrusted certificate.

The user can transfer data from the device to a new device, using the Quick Start feature of the iOS Setup

Assistant.

Users can turn on the AutoFill Passwords setting, which lets them use saved password or credit card information in Safari or other apps.

If this check box is cleared, automatic suggestion of strong passwords is disabled as well.

Users must authenticate when using auto-fill.

This setting is only enforced on devices that support

Face ID or Touch ID.

Request Wi-Fi passwords from nearby devices

Allow AirDrop password sharing

The device requests passwords from nearby devices when setting up a Wi-Fi connection.

Users can share passwords from Password Manager with other users via AirDrop.

Content ratings

Setting/Field

Allow explicit music and podcasts

Description

If the check box is cleared, explicit music or video content is hidden in the iTunes Store. Explicit content is flagged by content providers, for example record labels, when listed on the iTunes Store.

Related tasks

Configure device supervision

(page 77)

Sophos Mobile

You can configure Macs that are allowed to supervise your iOS DEP devices. These Macs can pair with an iOS DEP device even if you block USB pairing in general.

14.20.3 Exchange account configuration (iOS device policy)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server.

Setting/Field

Account name

Exchange server

Domain

User

Email address

Password

OAuth

Synchronization period

SSL/TLS

Allow move

Allow recent address syncing

Description

The account name.

The Exchange server address.

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The account uses OAuth for authentication, i.e.

users authenticate with their Microsoft credentials.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

Users can move emails from this account to another. This also allows users to use a different account when replying to or forwarding a message from this account.

The account is included in the syncing of recently used addresses with other devices using iCloud.

Setting/Field

Use in Mail only

Identity certificate

Enable S/MIME

Signing certificate

Encryption certificate

Allow user to send unencrypted emails

Sophos Mobile

Description

The account can only be used to send messages from the Mail app. It cannot be selected as a sending account for messages created with other apps, for example Photos or Safari.

Select the identity certificate for the connection to the Exchange server.

The list includes all certificates from Client

certificate configurations of the current policy.

Support the S/MIME encryption standard.

The certificates that are used for email signing and encryption.

To select a certificate, you must first upload it in a Client certificate configuration of the current policy.

For each outgoing email, the user can choose to encrypt it or not.

14.20.4 Wi-Fi configuration (iOS device policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Connect automatically

Hidden network

Description

The ID of the Wi-Fi network.

Automatically connect to the target network.

The target network is not open or visible.

Sophos Mobile

Setting/Field

Security type

188

Description

The security type of the Wi-Fi network:

• None

• WEP (personal)

• WPA/WPA2 (personal)

• Any (personal)

• WEP (enterprise)

• WPA/WPA2 (enterprise)

• Any (enterprise)

If you select a type with Personal in its name, a

Password field is displayed. Enter the relevant password.

If you select a type with Enterprise in its name, the tabs Protocols, Authentication and Trust are displayed.

On the Protocols tab configure the following:

• Under Accepted EAP types, select the EAP methods to be used for authentication. Depending on the types selected on this tab, the values in the Internal identity field on this tab become available for selection.

• Under EAP-FAST, configure the EAP-FAST Protected

Access credential settings.

• In TLS minimum version and TLS maximum version, select a minimum and a maximum TLS version to be used with EAP authentication.

On the Authentication tab, configure client authentication settings:

• In the User field, enter the user name for the connection to the Wi-Fi network.

• Select Require password on each connect, if the password is to be queried for each connection and transferred with the authentication.

• In the Password field, enter the relevant password.

• In the Identity certificate list, select the certificate for the connection to the Wi-Fi network.

Note

The certificate to be used has to be specified in a

Client certificate configuration.

• In the External identity field, enter the externally visible

ID (for TTLS, PEAP and EAP-FAST).

On the Trust tab, configure server authentication settings:

Select the trusted certificates from the list.

Note

certificate configuration.

Setting/Field

Proxy

Sophos Mobile

Description

In this list, select the proxy settings for the Wi-Fi connection:

• No proxy

• Manually

• Automatic

If you select Manually, the fields Server, Port,

Authentication and Password are displayed.

Enter the required proxy information. If you select

Automatic, the field PAC URL is displayed. Enter the URL of the proxy server.

14.20.5 Single app mode configuration (iOS device policy)

With the Single app mode configuration you define settings for the operation mode that locks devices into a single app and prevents users from changing to other apps.

Setting/Field

Select source

App identifier

Disable touchscreen

Disable rotation

Disable volume buttons

Disable ringer switch

Disable sleep wake button

Disable Auto-Lock

Enable VoiceOver

Enable Zoom

Enable Invert Colors

Enable AssistiveTouch

Description

Select how you want to specify the app for the single app mode:

• App list: Select the app from a list of all available iOS apps.

• Custom: Manually enter the bundle ID of the app.

The app for the single app mode.

Either select an app from the list or enter a bundle ID.

Touch gestures are unavailable.

The screen does not rotate.

Volume buttons are unavailable.

The ringer switch is unavailable.

The wake button is unavailable.

The Auto-Lock feature that puts the device into sleep after an idle period is turned off.

VoiceOver is available.

The Zoom feature is available.

The Invert Colors feature is available.

AssistiveTouch is available.

Sophos Mobile

Setting/Field

Enable Speak Selection

Enable Mono Audio

VoiceOver

Zoom

Invert Colors

AssistiveTouch

Description

The Speak Selection feature is available.

The Mono Audio feature is available.

VoiceOver adjustments are available.

Zoom adjustment are available.

Invert Colors adjustment are available.

AssistiveTouch adjustment are available.

14.20.6 Access Point Name configuration (iOS device policy)

With the Access Point Name configuration you specify an Access Point Name (APN) configuration for iOS devices. APN configurations define how devices connect to a mobile network.

Note

The Access Point Name configuration is deprecated in favor of the Cellular configuration. See

Cellular configuration (iOS device policy)

(page 191).

CAUTION

If these settings are not correct, the device can’t access data using the cellular network. To undo settings changes, the policy must be removed from the device.

Setting/Field

APN

User name for access point

Password for access point

Description

The APN that the device quotes when it opens a GPRS connection with the carrier.

This must match an APN that the carrier accepts. Otherwise, the connection cannot be established.

The user name for the access point.

Note iOS supports APN user names of up to 64 characters.

The password for the access point.

Note iOS supports APN passwords of up to 64 characters.

Setting/Field

Server, Port

Sophos Mobile

Description

The address and port of the proxy server.

14.20.7 Roaming/Hotspot configuration (iOS device policy)

With the Roaming/Hotspot configuration you define settings for roaming and personal hotspots.

Note

Users can change these settings on their devices anytime.

Setting/Field

Enable voice roaming

Enable data roaming

Enable personal hotspot

Description

Voice roaming is available.

This setting is ignored if the mobile network operator doesn’t support voice roaming.

Data roaming is available.

The user can configure the device to serve as a personal hotspot.

This setting is ignored if the mobile network operator doesn’t support personal hotspots.

14.20.8 Cellular configuration (iOS device policy)

With the Cellular configuration you define cellular network settings for iOS devices.

Note

A Cellular configuration cannot be installed onto a device if an Access Point Name configuration is already installed.

Setting/Field

Authentication

APN

Description

PAP

CHAP

The APN that the device quotes when it opens a GPRS connection with the carrier.

This must match an APN that the carrier accepts. Otherwise, the connection cannot be established.

Sophos Mobile

Setting/Field

User name for access point

Password for access point

Server, Port

Description

The user name for the access point.

Note iOS supports APN user names of up to 64 characters.

The password for the access point.

Note iOS supports APN passwords of up to 64 characters.

The address and port of the proxy server.

14.20.9 Network usage rules configuration (iOS device policy)

With the Network usage rules configuration you specify how managed apps are allowed to use cellular data networks.

General rules

Under Rules for all managed apps, enter the settings for managed apps in general.

Setting/Field

Allow cellular data

Allow data roaming

Description

Managed apps are allowed to use data communication over cellular networks.

Managed apps are allowed to use data communication while the device is roaming on a foreign cellular network.

Exceptions

Exceptions override the general rules. Use Add exception to define rules that are specific to an app group.

Setting/Field

App group

Allow cellular data

Description

Select an app group.

The exception applies to all managed apps in that group.

Managed apps from the selected app group are allowed to use data communication over cellular networks.

Setting/Field

Allow data roaming

Sophos Mobile

Description

Managed apps from the selected app group are allowed to use data communication while the device is roaming on a foreign cellular network.

Note

You cannot define multiple exceptions for the same app group.

14.20.10 VPN configuration (iOS device policy)

With the VPN configuration you define VPN settings for network connections.

Setting/Field

Connection name

Connection type

Identifier (reverse DNS format)

Server

Account

Third-party settings

Send all traffic through VPN

Group

Description

The name of the connection shown on the device.

The type of the VPN connection:

• Cisco AnyConnect

• Cisco Legacy AnyConnect

• IPsec (Cisco)

• F5

• Check Point

• Custom SSL/TLS

Different entry fields are shown on the VPN page depending on the connection type you select here.

The custom identifier in reverse DNS format.

The host name or the IP address of the server.

The user account for the authentication of the connection.

If your vendor has specified custom connection properties, you can enter them in this field.

To enter a property, click Add and then enter

Key and Value of the property in the dialog box.

All traffic is sent through VPN.

The group that may be required for the authentication of the connection.

Sophos Mobile

194

Setting/Field

User authentication

Device authentication

Proxy

Description

The type of user authentication for the connection:

• Password

If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.

• Certificate

If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.

The type of device authentication:

• Keys (Shared Secret)/Group name

If you select this option, the fields Group

name, Keys (Shared Secret), Use hybrid

authentication and Request password are displayed below the Device authentication field. Enter the required authentication information in the Group name and Keys

(Shared Secret) fields. Select Use hybrid

authentication and Request password as required.

• Certificate

If you select this option, the fields

Certificate and Including user PIN are displayed below the Device authentication field. In the Certificate list, select the required certificate. Select Including user

PIN to include the user PIN in device authentication.

The proxy settings for the connection:

• No proxy

• Manually

If you select this option, the fields Server

and port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the Password field, enter the password for the connection to the proxy server.

• Automatic

If you select this option, the Proxy server

URL field is displayed. Enter the URL of the server with the proxy setting in this field.

Setting/Field

Provider type

Sophos Mobile

Description

The VPN connection type.

• App proxy: Network traffic is sent through a

VPN tunnel at the application layer.

• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.

14.20.11 Per app VPN configuration (iOS device policy)

With the Per app VPN configuration you define VPN settings for individual apps.

You can configure apps to automatically connect to VPN when they are started. So you can, for example, ensure that data transmitted by managed apps travels through VPN.

After you have set up per app VPN configurations, you can select a configuration on the Edit

package page of an app. See Assign a VPN connection to an iOS app

(page 310).

Setting/Field

Connection name

Connection type

Identifier (reverse DNS format)

Server

Account

Third-party settings

Send all traffic through VPN

Group

Description

The name of the connection shown on the device.

The type of the VPN connection:

• Cisco AnyConnect

• Cisco Legacy AnyConnect

• F5

• Check Point

• Custom SSL/TLS

Different entry fields are shown on the VPN page depending on the connection type you select here.

The custom identifier in reverse DNS format.

The host name or the IP address of the server.

The user account for the authentication of the connection.

If your vendor has specified custom connection properties, you can enter them in this field.

To enter a property, click Add and then enter

Key and Value of the property in the dialog box.

All traffic is sent through VPN.

The group that may be required for the authentication of the connection.

Sophos Mobile

Setting/Field

User authentication

Proxy

Provider type

Description

The type of user authentication for the connection:

• Password

If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.

• Certificate

If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.

The proxy settings for the connection:

• No proxy

• Manually

If you select this option, the fields Server

• Automatic

If you select this option, the Proxy server

URL field is displayed. Enter the URL of the server with the proxy setting in this field.

The VPN connection type.

• App proxy: Network traffic is sent through a

VPN tunnel at the application layer.

• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.

Setting/Field

Safari domains

Sophos Mobile

Description

In this field, you can enter a list of domain strings. Use a new line for each domain string.

When a domain that matches one of the domain strings is opened in Safari or another browser app, the VPN connection is triggered.

The rule matching behavior is as follows:

• Leading and trailing dots are ignored.

For example, the string .example.com

matches the same domains as the string example.com

• Each string component must match a whole domain component. For example, the string example.com

matches the domain www.example.com

, but not www.myexample.com

• Strings with a single component only match that specific domain. For example, the string example matches the domain example , but not www.example.com

14.20.12 Web Clip configuration (iOS device policy)

With the Web Clip configuration you define Web Clips to be added to the Home screen of user devices. Web Clips provide fast access to favorite web pages. But you can also add a Web Clip with a support phone number for example, to provide a quick way to dial the helpdesk.

Setting/Field

Description

URL

Can be removed

Full screen

Description

A description for the Web Clip.

The web address of the Web Clip.

If the check box is cleared, the user cannot remove the Web Clip. It cannot be deleted from the device unless the user removes the policy that installed it.

The Web Clip is opened full screen on the device. A full screen Web Clip opens the URL as a web app.

Sophos Mobile

Setting/Field

Icon

Description

Select an image to be used as the Web Clip icon on the Home screen. This must be a PNG,

GIF or JPEG image with a maximum file size of

1 MB.

The image is cropped to a square and scaled to match the display resolution. For best results, we recommend that you use an image of size

180 px by 180 px.

Note

When a favicon is defined in the HTML code of the web page, the device might display that favicon as Web Clip icon. This happens for certain web pages only, depending on how the favicon is configured in the web page code.

14.20.13 Wallpaper configuration (iOS device policy)

With the Wallpaper configuration you define background images for the lock screen and/or the Home screen of iOS devices.

Setting/Field

Apply to

Image

Description

Select whether the image is used for the Lock screen, for the

Home Screen, or both.

Select a PNG or JPEG image with a maximum file size of 5 MB that is used for the wallpaper.

iOS crops and scales the image as required. For best results, use the following image sizes (in pixels):

• 640 × 1136 (iPhone 5)

• 750 × 1334 (iPhone 6/7)

• 1242 × 2208 (iPhone 6/7 Plus)

• 1536 × 2048 (iPad, iPad mini, iPad Air)

• 2048 × 2732 (iPad Pro)

Note

Users can change the wallpaper at any time.

Sophos Mobile

14.20.14 Web content filter configuration (iOS device policy)

With the Web content filter configuration you define blocked URLs and allowed URLs with bookmarks.

Setting/Field

Blocked URLs

Allowed URLs with bookmarks

Block adult content

Description

Select this to configure URLs users are not allowed to access.

Enter one URL per line.

Select this to configure allowed URLs with bookmarks for the Safari browser.

Other URLs will be blocked.

On the Web content filter page, use this to turn on an Apple filter that blocks adult content.

For example, web pages that contain swearing or sexually explicit language.

14.20.15 Global HTTP proxy configuration (iOS device policy)

With the Global HTTP proxy configuration you define a corporate proxy server.

Setting/Field

Proxy

Server

Port

Authentication

Password

PAC URL

Description

Select Manually to configure the connection details manually.

Select Automatic if you have a proxy auto-config (PAC) file.

The name (or the IP address) of the HTTP proxy.

The port number of the HTTP proxy.

The user name to connect to the proxy server.

The password to connect to the proxy server.

The URL of the proxy auto-config (PAC) file.

14.20.16 Managed domains configuration (iOS device policy)

With the Managed domains configuration you define managed domains for iOS devices.

Email domains

Enter email domains managed by your organization. Email messages from an address that doesn’t match one of the configured domains are highlighted as out-of-domain in the Mail app.

Sophos Mobile

Web domains

Files downloaded from one of the configured domains are treated as managed documents. If you activate the Allow documents to be shared only within managed apps/accounts restriction, these documents can only be opened by managed apps.

For information on managed apps, see

Managed apps for iOS (page 304).

Note

If a managed web domain entry contains a port number, only addresses that specify that port number will be considered managed. Otherwise, only the standard ports will be considered managed (port 80 for http and 443 for https).

14.20.17 CalDAV configuration (iOS device policy)

With the CalDAV configuration you configure the synchronization of calendar data with a CalDAV server. For example, this can be used to sync Google Calendar with an iOS device.

Setting/Field

Account name

Server

Port

Principal URL

User name, Password

SSL/TLS

Description

The display name of the CalDAV account on the device.

The host name or IP address of the CalDAV server.

The port number of the CalDAV server.

If required by the CalDAV server, enter the principal URL of the calendar resource.

For example, to sync with a calendar other than the primary calendar in a Google account, enter: https://apidata.googleusercontent.com/ caldav/

v2/calendar_id/user where calendar_id is the ID of the calendar you want to sync with. In the Google Calendar web application, the calendar ID is displayed in the calendar settings. See the

Google Calendar help for details.

The login credentials for the CalDAV account.

For example, for Google Calendar enter the credentials of the Google account.

The connection to the CalDAV server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

Sophos Mobile

14.20.18 CardDAV configuration (iOS device policy)

With the CardDAV configuration you configure the synchronization of contact data with a CardDAV server. For example, this can be used to sync Google Contacts with an iOS device.

Setting/Field

Account name

Server

Port

Principal URL

User name, Password

SSL/TLS

Description

The display name of the CardDAV account on the device.

The host name or IP address of the CardDAV server.

The port number of the CardDAV server.

If required by the CardDAV server, enter the principal URL of the contacts resource.

For example, the Google CardDAV API supports the following principal URL: https://www.googleapis.com/carddav/

v1/ principals/account_name@gmail.com

where account_name is the Google account name.

The login credentials for the CardDAV account.

For example, for Google Contacts enter the credentials of the Google account.

The connection to the CardDAV server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

14.20.19 IMAP/POP configuration (iOS device policy)

With the IMAP/POP configuration you add an IMAP or POP email account to the iOS device.

Setting/Field

Account name

Account type

User display name

Description

The display name of the email account on the device.

The type of the email server for incoming email (either

IMAP or POP).

The display name of the user for outgoing email.

Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.

Sophos Mobile

Setting/Field

Email address

Allow move

Allow recent address syncing

Use in Mail only

Allow Mail Drop

Enable S/MIME

Signing certificate

Encryption certificate

Allow user to send unencrypted emails

Incoming email

Server

Port

User name

Authentication type

Password

SSL/TLS

Outgoing email

Server

Description

The email address of the account.

Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.

Users can move emails from this account to another. This also allows users to use a different account when replying to or forwarding a message from this account.

The account is included in the syncing for the list of recent addresses.

The account can only be used to send messages from the

Mail app. It cannot be selected as a sending account for messages created with other apps, for example Photos or

Safari.

Allow Apple Mail Drop for this account.

Support the S/MIME encryption standard.

The certificates that are used for email signing and encryption.

To select a certificate, you must first upload it in a Client

certificate configuration of the current policy.

For each outgoing email, the user can choose to encrypt it or not.

The host name or IP address of the server for incoming email (inbound server).

The port number of the server for incoming email (inbound server).

The user name for connecting to the inbound server.

The authentication method for connecting to the inbound server.

The password for connecting to the inbound server (if required).

The connection to the inbound server is secured by SSL or TLS (depending on what the server supports).

The host name or IP address of the server for outgoing email (outbound server).

Setting/Field

Port

User name

Authentication type

Password

Use same password as for incoming email

SSL/TLS

Sophos Mobile

Description

The port number of the server for outgoing email

(outbound server).

The user name for connecting to the outbound server.

The authentication method for connecting to the outbound server.

The password for connecting to the outbound server (if required).

Use the password that is specified for incoming email.

The connection to the outbound server is secured by SSL or TLS (depending on what the server supports).

14.20.20 Google account configuration (iOS device policy)

With the Google account configuration you set up a Google account. After the configuration is assigned to a device, the user is asked to authenticate for the Google account. After authentication, the

Google account is set up on the device and the user can enable Google services.

Setting/Field

Google email address

Account description

User name

Description

The full email address of the Google account.

An optional description of the account. The value is displayed in the Mail and Settings apps.

The user’s name. The value is used for outgoing email messages.

14.20.21 Single sign-on configuration (iOS device policy)

With the Single sign-on configuration you define settings for a single sign-on for third-party apps.

Setting/Field

Name

Kerberos principal name

Realm

Description

A human-readable name for the account.

The Kerberos principal name.

If you leave this field empty, the user must enter the name.

The Kerberos realm name.

You must enter the name in upper-case.

Sophos Mobile

Setting/Field

URLs

App IDs

Description

A list of URL prefixes that must be matched to use the account for Kerberos authentication over HTTP.

Values must begin with http:// or https://

If a value doesn’t end with / , the / is added by

Sophos Mobile.

You may use a single asterisk (*) to match all values. For example, https://*.example.com/ matches

https://www.example.com/ and https://

m.example.com/.

A list of bundle IDs of apps.

Values must be either exact matches (e.g.

com.sophos.smsec

), or prefixes, using the characters .* at the end of the string (e.g.

com.sophos.* ).

14.20.22 AirPrint configuration (iOS device policy)

With the AirPrint configuration you add AirPrint printers to the user’s AirPrint printer list.

Setting/Field

IP address

Resource path

Port

Force TLS

Description

The IP address of the AirPrint printer.

The resource path associated with the printer.

Examples:

• printers/<printer model>

• ipp/print

The listening port of the AirPrint printer.

AirPrint connections are secured by TLS.

14.20.23 Root certificate configuration (iOS device policy)

With the Root certificate configuration you install a root certificate onto devices.

Setting

File

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

Setting

Certificate name

Sophos Mobile

Description

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.20.24 Client Certificate configuration (iOS device policy)

With the Client certificate configuration you install a client certificate onto devices.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.20.25 SCEP configuration (iOS device policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

URL

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.

Sophos Mobile

Setting/Field

CA name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Retries

Retry delay

Key size

Description

A name that is understood by the Certificate

Authority. The name can, for example, be used to distinguish between instances.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(SerialNumber)_% to specify an iPhone or iPad.

For information on available placeholders, see

Placeholders in policies

(page 106).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.

The number of retries if the server sends a response of type pending.

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

Setting/Field

Key usage

Sophos Mobile

Description

Select what the certificate can be used for.

Use as digital signature: The certificate can be used as a digital signature.

Use for encryption: The certificate can be used for data encryption.

14.20.26 Duo device certificate (iOS device policy)

With the Duo device certificate configuration you enable devices to request a certificate from the Duo Security SCEP server. If this certificate is installed on a device, the Duo Mobile iOS app classifies the device as trusted.

The required settings are common for all Duo Security accounts. Do not change the pre-populated values.

14.21 Configurations for Sophos container policies for iOS

With a Sophos container policy you configure settings for Sophos Secure Email and Sophos Secure

Workspace on devices where Sophos Mobile manages the Sophos container.

14.21.1 General configuration (iOS Sophos container policy)

With the General configuration you define settings that apply to all Sophos container apps, if applicable.

Setting/Field

Enable Sophos container password

Description

Sophos Mobile

Setting/Field

Password complexity

Always hide characters in password entry fields

Password age in days

Failed logins until lock

Allow fingerprint

Grace period in minutes

Description

The required minimum complexity of the

Sophos container password. More secure passwords are always allowed. Passwords (a mix of numeric and alphanumeric characters) are always seen as more secure than PINs

(numeric characters only).

• Any: Sophos container passwords do not have restrictions.

• 4 digit PIN

• 6 digit PIN

• 4 char password

• 6 char password

• 8 char password

• 10 char password

Characters in password entry fields are not briefly displayed before they are masked.

The number of days that a password can be used before users are prompted to change it.

The number of failed login attempts that are tolerated before the container apps are locked.

Once they are locked an administrator needs to unlock the apps or, if allowed, users can use the

Self Service Portal to do so.

Users can use their fingerprint to unlock the app.

The period of time within which no Sophos container password must be entered when a container app comes to the foreground again.

The grace period applies to all container apps.

You can switch between the apps during the grace period without entering a password.

Setting/Field

Last server connect

Sophos Mobile

Description

The period of time within users can use a

Sophos container app without a connection to the Sophos Mobile server.

• On access: Server connection is always required and the app is locked when the server cannot be reached.

• 1 hour: Server connection is required when the app becomes active one hour or more after the last successful server connection.

• 3 hours

• 6 hours

• 12 hours

• 1 day

• 3 days

• None: No regular contact is required.

Sophos Mobile

Setting/Field

Offline starts without server connection

Description

In this field you define how often users can start one of the Sophos container apps without a server connection.

Note

This setting requires the Sophos container password feature to be turned on.

Jailbreak allowed

• Unlimited: No server connection is required.

• 0: Starting the app without a server connection is not possible.

• 1: After one start of the app, a successful server connection is necessary.

• 3

• 5

• 10

• 20

Container apps are allowed to run on jailbroken devices.

App usage constraints

Here you can define constraints on using the Sophos container apps. Click Add to enter constraints.

Geo-fencing

Time-fencing

Lets you add latitude and longitude and a radius within which the Sophos container apps can be used.

Lets you specify a start and end time within which the Sophos container apps can be used.

Days of the week on which the apps can be used can be specified as well.

Setting/Field

Wi-Fi fencing

Sophos Mobile

Description

If you select Wi-Fi connection required, the

Sophos container is locked when there is no active Wi-Fi connection.

If you add Wi-Fi networks to the list, the

Sophos container is locked when the device is connected to a Wi-Fi network not listed.

Warning

We recommend that you do not rely on Wi-Fi fencing as the only security mechanism because

Wi-Fi names can be spoofed very easily.

14.21.2 Corporate Email configuration (iOS Sophos container policy)

With the Corporate Email configuration you define user settings for your Microsoft Exchange Server.

These settings are applied to the Sophos Secure Email app if it is installed in the Sophos container.

Setting/Field

Exchange server

User

Email address

Domain

Support contact email

Use secure text fields

Description

The Exchange server address.

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The domain for this account.

The email address that will be used as the

"Contact Support" email address.

The content of input fields is secured. Autocomplete and auto-correction are disabled within the Sophos Secure Email app to prevent sensitive words to be saved in the memory of the device.

Sophos Mobile

Setting/Field

Export contacts to device

212

Call identification

Notifications

Description

Users are allowed to export the Exchange contacts to the local device contacts, so that they can identify company contacts in incoming calls.

Sophos Secure Email keeps the information synchronized.

Note

The local contact information is automatically deleted in the following situations:

• When the Corporate Email configuration is removed from the

Sophos container policy (requires a restart of the Secure Email app).

• When the Sophos container is removed from the device.

• When the device is unenrolled from

Sophos Mobile.

Contact information from Sophos Secure Email can be used to identify company contacts in incoming calls, without the need to export

Sophos Secure Email contacts to the device contacts.

To use this, users must turn on the following device settings:

• In the Settings app: Phone > Call Blocking &

Identification > Email

• In the Sophos Secure Email app: Settings >

Contacts > Call Identification

The notification type for new email:

• System: Notifications are managed by iOS.

They don’t include details like Sender or

Subject.

• App: Notifications are managed by the

Sophos Secure Email app. You can select how much detail is displayed. When the app is not running, no notifications are displayed.

• None: No notifications are displayed.

This setting also affects event reminders:

• System, None: Event reminders only include time information.

• App: Event reminders include time, location and title information.

Setting/Field

Deny copy to clipboard

Open attachments

Maximum email size

Extra settings

Sophos Mobile

Description

Users cannot copy or cut texts from the Sophos

Secure Email app.

In all apps: Attachments can be opened in all apps that support the file format.

In container apps: Attachments are encrypted with a device key and can only be opened in

Sophos Secure Workspace. The Open in action itself is not blocked.

Email messages that are larger than the size you select (including attachments) are not retrieved from the Exchange server.

Only configure these settings if instructed by

Sophos Support.

14.21.3 Corporate Documents configuration (iOS Sophos container policy)

With the Corporate Documents configuration you define settings for the Corporate Documents feature of the Sophos Secure Workspace app.

Configure storage providers

For each storage provider you can define the following settings separately:

Setting/Field

Enable

Offline

Open in (encrypted)

Open in (unencrypted)

Clipboard

Description

The storage provider is available in the app.

Users are allowed to add files from the storage provider to the app's Favorites list for offline use.

Users can share encrypted files with other apps via Open In.

Users can share unencrypted files with other apps via Open In.

Users can copy parts of a document and paste them into other apps.

Sophos Mobile

Enterprise provider settings

For Egnyte and WebDAV provider, also referred to as enterprise provider, you can centrally define server settings and login credentials. These cannot be changed by users.

Credential settings that you do not define centrally can be chosen by the users in the app's provider credential screens.

Setting/Field

Name

Server

User name

Password

Upload folder

Description

The name of the provider that is displayed in the

Sophos Secure Workspace app.

In this field, enter:

• The URL of the root folder on the

Corporate Documents WebDAV server.

• The URL of the root folder on the Egnyte server.

• The URL of the root folder on the WebDAV server.

Use the following format: https:// server.company.com

The user name for the relevant server. You can also use the %_USERNAME_% variable.

The password for the relevant account.

The upload folder for the relevant account.

Other settings

Setting/Field

Enable Documents

Description

This turns on the Documents feature to securely distribute company documents.

Setting/Field

Passphrase complexity

Extra settings

Sophos Mobile

Description

The required minimum complexity of passphrases for encryption keys. More secure passphrases are always allowed.

You can select the following settings:

• 4 char password

• 6 char password

• 8 char password

• 10 char password

Only configure these settings if instructed by

Sophos Support.

14.21.4 Corporate Browser configuration (iOS Sophos container policy)

With the Corporate Browser configuration you define settings for the Corporate Browser feature of the

Sophos Secure Workspace app.

The Corporate Browser allows you to securely access corporate intranet pages and other allowed pages. You can define domains and bookmarks within a domain.

Every bookmarks belongs to a certain domain. When you add a bookmark, the domain entry is created automatically if it does not exist.

Domain settings

Setting/Field

URL

Allow copy/paste

Allow open with

Allow save password

Description

The domain that you want to allow.

Users can copy and paste text from the

Corporate Browser to other apps.

Users can download attachments or pass them on to other apps.

Users can save their passwords in the

Corporate Browser.

Bookmark settings

Setting/Field

Name

Description

The name for the bookmark.

Sophos Mobile

Setting/Field

URL

Description

The web address for the bookmark.

14.21.5 Root certificate configuration (iOS Sophos container policy)

Sophos container.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.21.6 Client certificate configuration (iOS Sophos container policy)

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Sophos Mobile

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.21.7 SCEP configuration (iOS Sophos container policy)

Corporate Browser feature of the Sophos Secure Workspace app.

Note

You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Alias name

Subject

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the

SCEP tab of the Sophos setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(SerialNumber)_% to specify an iPhone or iPad.

For information on available placeholders, see

Placeholders in policies (page 106).

Sophos Mobile

Setting/Field

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Root certificate

Key size

Key usage

Description

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified

URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the

SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

Select what the certificate can be used for.

Use as digital signature: The certificate can be used as a digital signature.

Use for encryption: The certificate can be used for data encryption.

Sophos Mobile

14.22 Configurations for Mobile Threat Defense policies for iOS

With a Mobile Threat Defense policy you configure Sophos Intercept X for Mobile when it’s enrolled with Sophos Mobile.

14.22.1 Network configuration (Mobile Threat Defense policy for iOS)

With the Network configuration you manage the Wi-Fi Security feature of Sophos Intercept X for

Mobile. This protects users from network-based threats.

Note

When you assign this configuration to a device, the corresponding settings in Sophos Intercept X for Mobile are disabled. The user can’t change them.

Setting/Field

Man-in-the-middle protection

Extra settings

Description

Sophos Intercept X for Mobile checks the Wi-Fi connection for man-in-the-middle attacks.

Sophos Mobile creates an alert when a man-in-the-middle attack is detected.

Only configure these settings if instructed by Sophos

Support.

14.22.2 Web Filtering configuration (Mobile Threat Defense policy for iOS)

With the Web Filtering configuration you manage the Web Filtering feature of Sophos Intercept X for Mobile. This protects users from browsing sites with malicious, undesirable or illegal content. This configuration only affects supervised devices.

Settings

Setting/Field

Filter malicious websites

Description

Select whether users can access websites with malicious content.

Sophos Mobile

Setting/Field

Create alerts

Filter websites by category

Website exceptions

Description

Select whether an alert is created when the user tries to access a filtered website.

You can select if alerts are only created for blockings or also for warnings.

Select whether users can access types of websites.

Websites are categorized based on data from

SophosLabs. The data is updated constantly.

Configure exceptions to the category filters:

Allowed domains: Websites that are allowed, even though the category they belong to is blocked.

Blocked domains: Websites that are blocked, even though the category they belong to is allowed.

220

How to specify website exceptions

In Allowed domains and Blocked domains, enter one of the following per line (without separator):

• IPv4 or IPv6 address

203.0.113.0

2001:db8:85a3:0:0:8a2e:370:7334

• IPv4 or IPv6 subnet

203.0.113.0/24

2001:db8::/32

• Domain www.example.com

• Wildcard domain. The wildcard * must be the leftmost character.

*.example.com

*example.com

In Blocked domains, you can use a single wildcard * to block all websites.

Filtering logic

When Web Filtering evaluates whether a website must be allowed or blocked, the allow list takes precedence over the block list, and policy-defined lists take precedence over user-defined lists.

Filtering rules are applied in the following sequence:

1. If the website is included in Allowed domains, it is allowed.

2. If the website is included in Blocked domains, it is blocked.

3. If the user has added the website to the allow list, it is allowed.

4. If the user has added the website to the block list, it is blocked.

Sophos Mobile

5. The website is allowed or blocked based on its category.

14.22.3 SMS Filtering configuration (Mobile Threat Defense policy for iOS)

With the SMS Filtering configuration you define domain names for the SMS Filtering feature of Sophos

Intercept X for Mobile.

SMS Filtering protects users from SMS and MMS attacks. It moves SMS messages containing a fake domain to SMS Junk, excluding messages from senders available in Contacts.

A fake domain looks like your real domain but is slightly modified:

• Single characters are substituted, inserted, or transposed.

• The domain name is amended by prefix or suffix.

• The Top Level Domain (TLD) is different.

For example if your real domain is sophos.com

, the following are fake domains:

• s0phos.com

(substitution)

• soophos.com

(insertion)

• sohpos.com

(transposition)

• mysophos.com

(prefix)

• sophos.net

(different TLD)

Subdomains like hr.sophos.com

are not filtered.

If an SMS message is filtered, all further messages from the same sender are filtered as well.

14.23 Configurations for macOS device policies

With a macOS device policy you configure settings for Macs that apply to all users.

Related concepts

About macOS policies

(page 103)

Configurations for macOS user policies (page 238)

With a macOS user policy you configure settings for Macs that apply to users managed by Sophos

Mobile.

14.23.1 Password policies configuration (macOS device policy)

With the Password policies configuration you define requirements for the passwords of Mac user accounts.

Note

When the Password policies configuration is assigned to a device, a grace period of 60 minutes starts. Within the grace period, the user is asked to change the password when they return to the

Home screen to comply with the policies. After the grace period, the user may not start any apps on the device, including internal apps.

Sophos Mobile

Setting/Field

Allow simple value

Require alphanumeric value

Minimum password length

Minimum number of complex characters

Maximum password age in days

Maximum Auto-Lock (in minutes)

Password history

Maximum grace period for device lock

Number of failed attempts until device wipe

Description

Users are allowed to use sequential or repeated characters in their password, for example 1111 or abcde .

Passwords must contain at least one letter or number.

Specifies the minimum number of characters a password must contain.

Specifies the minimum number of nonalphanumeric characters (for example & or !) a password must contain.

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

In this field, you can specify the maximum value the user is allowed to configure on the device. Auto-Lock specifies how soon (in minutes) the device will be locked if it has not been used.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

Immediately, users must enter a password every time they unlock their devices.

Sophos Mobile

14.23.2 Restrictions configuration (macOS device policy)

With the Restrictions configuration you define restrictions for Macs.

Note

Some options are only available for certain versions of macOS. This is indicated by blue labels in

Sophos Mobile Admin.

Device

Setting/Field

Allow use of camera

Allow internet search result for

Spotlight

Allow Apple Music macOS software update delay

Description

If the check box is cleared, the camera is unavailable and the Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.

If the check box is cleared, Spotlight does not return internet search results.

Users can access the Apple Music library.

The number of days that an update of the macOS software is delayed after its release date.

Enter a value between 0 (no delay) and 90.

iCloud

Setting/Field

Allow backup

Allow iCloud Photo Library

Allow iCloud Keychain sync

Allow document sync

Allow Back to My Mac

Allow Find My Mac

Description

Users can back up their devices to iCloud.

Users can use iCloud Photo Library.

Users can use iCloud Keychain to synchronize passwords across their iPhones, iPads, and Macs.

If the check box is cleared, iCloud Keychain data is only stored locally on the device.

Users can store documents and app configuration data in iCloud.

Users can use iCloud Back to My Mac, i.e. file and screen sharing between a remote and a local Mac.

Users can use iCloud Find My Mac to locate, lock, or wipe their Mac remotely.

223

Sophos Mobile

Setting/Field

Allow iCloud Bookmarks

Allow iCloud Mail

Allow iCloud Calendar

Allow iCloud Reminders

Allow iCloud Address Book

Allow iCloud Notes

Allow iCloud Drive for Desktop and

Documents

Description

Users can use iCloud Bookmarks to synchronize web bookmarks between browsers and platforms.

Users can set up an iCloud Mail account on their Mac.

Users can use iCloud Calendar to share their calendars across their devices and with other iCloud users.

Users can use iCloud Reminders to share reminder lists across their devices and with other iCloud users.

Users can use iCloud Address Book to share contacts across their devices and with other iCloud users.

Users can use iCloud Notes to take notes and to share them across their devices and with other users.

Users can store their Mac Desktop and their

Documents folder in iCloud Drive and access them on other devices.

Security and privacy

Setting/Field

Allow Touch ID to unlock device

Allow definition lookup

Allow Auto Unlock

Allow iTunes File Sharing

Allow AirPrint

Allow iBeacon discovery of AirPrint printers

Description

If the check box is cleared, the device can’t be unlocked by Touch ID.

Users can look up definitions for highlighted words.

Users can use Auto Unlock to have their Mac automatically unlocked by their Apple Watch.

Users can use File Sharing in iTunes to copy files between their Mac and an iPhone or iPad.

Users can send files to AirPrint-enabled printers.

The device uses iBeacon to discover AirPrint devices.

Warning

If you allow this, malicious AirPrint devices can perform phishing attacks on network traffic.

Force trusted certificates for AirPrint over TLS

AirPrint over TLS is rejected if the AirPrint device uses an untrusted certificate.

Sophos Mobile

Setting/Field

Allow password auto-fill

Request Wi-Fi passwords from nearby devices

Allow AirDrop password sharing

Description

Users can turn on the AutoFill Passwords setting, which lets them use saved password or credit card information in Safari or other apps.

If this check box is cleared, automatic suggestion of strong passwords is disabled as well.

The device requests passwords from nearby devices when setting up a Wi-Fi connection.

Users can share passwords from Password Manager with other users via AirDrop.

14.23.3 Wi-Fi configuration (macOS device policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Connect automatically

Hidden network

Description

The ID of the Wi-Fi network.

Automatically connect to the target network.

The target network is not open or visible.

Sophos Mobile

Setting/Field

Security type

226

Description

The security type of the Wi-Fi network:

• None

• WEP (personal)

• WPA/WPA2 (personal)

• Any (personal)

• WEP (enterprise)

• WPA/WPA2 (enterprise)

• Any (enterprise)

If you select a type with Personal in its name, a

Password field is displayed. Enter the relevant password.

If you select a type with Enterprise in its name, the tabs Protocols, Authentication and Trust are displayed.

On the Protocols tab configure the following:

• Under EAP-FAST, configure the EAP-FAST Protected

Access credential settings.

• In TLS minimum version and TLS maximum version, select a minimum and a maximum TLS version to be used with EAP authentication.

On the Authentication tab, configure client authentication settings:

• In the User field, enter the user name for the connection to the Wi-Fi network.

• Select Require password on each connect, if the password is to be queried for each connection and transferred with the authentication.

• In the Password field, enter the relevant password.

• In the Identity certificate list, select the certificate for the connection to the Wi-Fi network.

Note

The certificate to be used has to be specified in a

Client certificate configuration.

• In the External identity field, enter the externally visible

ID (for TTLS, PEAP and EAP-FAST).

On the Trust tab, configure server authentication settings:

Select the trusted certificates from the list.

Note

certificate configuration.

Setting/Field

Proxy

Sophos Mobile

Description

In this list, select the proxy settings for the Wi-Fi connection:

• No proxy

• Manually

• Automatic

If you select Manually, the fields Server, Port,

Authentication and Password are displayed.

Enter the required proxy information. If you select

Automatic, the field PAC URL is displayed. Enter the URL of the proxy server.

14.23.4 Gatekeeper configuration (macOS device policy)

With the Gatekeeper configuration you configure macOS Gatekeeper, which blocks apps installed from forbidden sources.

Setting/Field

Allow apps downloaded from

Description

Select the required setting:

• Anywhere: Users can open all apps, regardless of where they were installed from.

• Mac App Store: Users can only open apps from Mac App Store.

• Mac App Store and identified developers:

Users can only open apps from Mac App

Store or from identified developers, i.e.

developers approved by Apple.

14.23.5 Kernel extension policy configuration (macOS device policy)

With the Kernel extension policy configuration you approve or block certain third-party kernel extensions (KEXTs). Without this configuration, macOS asks the user for approval when an app wants to install a kernel extension.

Setting/Field Description

Allow user-approved extensions

When an app wants to install a kernel extension not approved by this configuration, macOS asks the user to approve it.

If the check box is cleared, extensions not approved by this configuration are blocked.

Approve Sophos extensions Sophos kernel extensions are approved.

Sophos Mobile

Setting/Field

Approved Team IDs

Description

A list of

Team ID

values.

Kernel extensions signed by one of these IDs are approved.

To find the Team ID of a kernel extension, install it on a Mac in your test environment. Then enter the following two commands in Terminal: sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy

SELECT * FROM kext_policy;

Use Control-D to exit the sqlite3 session.

You get one line of output for every kernel extension installed. In each line, the first value is the

Team ID.

14.23.6 VPN configuration (macOS device policy)

With the VPN configuration you define VPN settings for network connections.

Setting/Field

Connection name

Connection type

Identifier (reverse DNS format)

Server

Account

Third-party settings

Send all traffic through VPN

Description

The name of the connection shown on the device.

The type of the VPN connection:

• Cisco AnyConnect

• Cisco Legacy AnyConnect

• IPsec (Cisco)

• F5

• Check Point

• Custom SSL/TLS

Different entry fields are shown on the VPN page depending on the connection type you select here.

The custom identifier in reverse DNS format.

The host name or the IP address of the server.

The user account for the authentication of the connection.

If your vendor has specified custom connection properties, you can enter them in this field.

To enter a property, click Add and then enter

Key and Value of the property in the dialog box.

All traffic is sent through VPN.

Setting/Field

Group

User authentication

Device authentication

Sophos Mobile

Description

The group that may be required for the authentication of the connection.

The type of user authentication for the connection:

• Password

If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.

• Certificate

If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.

The type of device authentication:

• Keys (Shared Secret)/Group name

If you select this option, the fields Group

name, Keys (Shared Secret), Use hybrid

authentication and Request password are displayed below the Device authentication field. Enter the required authentication information in the Group name and Keys

(Shared Secret) fields. Select Use hybrid

authentication and Request password as required.

• Certificate

If you select this option, the fields

Certificate and Including user PIN are displayed below the Device authentication field. In the Certificate list, select the required certificate. Select Including user

PIN to include the user PIN in device authentication.

Sophos Mobile

Setting/Field

Proxy

Provider type

Description

The proxy settings for the connection:

• No proxy

• Manually

If you select this option, the fields Server

• Automatic

If you select this option, the Proxy server

URL field is displayed. Enter the URL of the server with the proxy setting in this field.

The VPN connection type.

• App proxy: Network traffic is sent through a

VPN tunnel at the application layer.

• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.

14.23.7 Firewall configuration (macOS device policy)

With the Firewall configuration you define settings for the application firewall included in macOS.

Setting/Field

Turn on application firewall

Block all incoming connections

Use stealth mode

Automatically allow built-in apps

Description

The application firewall is turned on.

Sharing services, such as File Sharing or Screen Sharing, are not allowed to receive incoming connections.

This does not affect the following system services:

• configd (DHCP and other network configuration services)

• mDNSResponder (Bonjour)

• racoon (IPSec)

The computer ignores unexpected requests, such as ping requests.

Built-in apps, such as iTunes, are added to the list of apps allowed to receive connections.

You can’t turn this setting off.

Sophos Mobile

Setting/Field

Automatically allow signed downloaded apps

Allowed connections

Denied connections

Description

Apps signed by a valid certificate authority are added to the list of apps allowed to receive connections.

You can’t turn this setting off.

An app group containing apps allowed to receive connections.

For other apps, users can choose to allow or deny a connection.

An app group containing apps not allowed to receive connections.

For other apps, users can choose to allow or deny a connection.

14.23.8 Web content filter configuration (macOS device policy)

With the Web content filter configuration you define settings for a third-party app for filtering internet content.

Setting/Field

Filter name

Filter ID

Server

Organization

Description

A custom name for the filter configuration.

The bundle ID of the third-party app.

The server hosting the filtering service (host name, IP address, or

URL).

The name of your organization. The value is passed to the filtering service.

User name

Password

Certificate

Filter range

The credentials required for connecting to the filtering service.

Third-party settings

A certificate for authenticating to the filtering service.

The traffic to be filtered by the third-party app:

• Filter browser traffic: WebKit browser traffic is filtered.

• Filter socket traffic: Socket traffic is filtered.

• Filter browser and socket traffic: WebKit and socket traffic is filtered.

Additional configuration settings, if required by the third-party app.

Sophos Mobile

14.23.9 Global HTTP proxy configuration (macOS device policy)

With the Global HTTP proxy configuration you define a corporate proxy server.

Setting/Field

Proxy

Server

Port

Authentication

Password

PAC URL

Description

Select Manually to configure the connection details manually.

Select Automatic if you have a proxy auto-config (PAC) file.

The name (or the IP address) of the HTTP proxy.

The port number of the HTTP proxy.

The user name to connect to the proxy server.

The password to connect to the proxy server.

The URL of the proxy auto-config (PAC) file.

14.23.10 Managed domains configuration (macOS device policy)

With the Managed domains configuration you define managed domains for Macs.

Email domains

Enter email domains managed by your organization. Email messages from an address that doesn’t match one of the configured domains are highlighted as out-of-domain in the Mail app.

14.23.11 Single sign-on configuration (macOS device policy)

With the Single sign-on configuration you define settings for a single sign-on for third-party apps.

Setting/Field

Name

Kerberos principal name

Realm

Description

A human-readable name for the account.

The Kerberos principal name.

If you leave this field empty, the user must enter the name.

The Kerberos realm name.

You must enter the name in upper-case.

Setting/Field

URLs

App IDs

Sophos Mobile

Description

A list of URL prefixes that must be matched to use the account for Kerberos authentication over HTTP.

Values must begin with http:// or https://

If a value doesn’t end with / , the / is added by

Sophos Mobile.

A list of bundle IDs of apps.

Values must be either exact matches (e.g.

com.sophos.smsec

), or prefixes, using the characters .* at the end of the string (e.g.

com.sophos.* ).

14.23.12 AirPrint configuration (macOS device policy)

With the AirPrint configuration you add AirPrint printers to the user’s AirPrint printer list.

Setting/Field

IP address

Resource path

Description

The IP address of the AirPrint printer.

The resource path associated with the printer.

Examples:

• printers/<printer model>

• ipp/print

14.23.13 Directory service configuration (macOS device policy)

With the Directory service configuration you specify an Active Directory domain that a Mac joins when the policy is assigned to it.

Note

If the Active Directory domain you configure here is the same domain you use for the Self Service

Portal, the macOS user policy assigned to the Mac is applied to all Active Directory users that log in to the Mac.

General settings

Setting/Field

Domain host name

Description

The DNS host name of the Active Directory domain to join.

Sophos Mobile

Setting/Field

AD administrator name

Password

Organizational unit

Description

The credentials of the user account used for connecting to the Active Directory server.

This user must have permissions to add devices to the Active Directory database.

The organizational unit (OU) within the Active

Directory database where the joining computer is added.

234

User experience

Setting/Field

Create mobile account

Require confirmation before creating a mobile account

Force local home folder

Use UNC path from Active Directory

Network protocol

Default user shell

Description macOS creates a mobile account when a network user logs in for the first time.

With a mobile account, users can log in to the

Mac with their Active Directory credentials even when the Mac is not connected to the Active

Directory server.

The user decides whether to create a mobile account or not.

Select this check box to force the creation of user profiles on the startup disk. This is required for mobile accounts.

If you clear the check box, pure network home directories are used.

macOS mounts the home folder specified in the

Active Directory user account.

The protocol for mounting the home folder.

The command-line shell for the user.

If you leave this field empty, /bin/bash is used.

Mapping

Setting/Field

UID attribute

User GID attribute

Description

The Active Directory attribute that is mapped to the unique user ID (UID) in macOS.

The Active Directory attribute that is mapped to the primary group ID in macOS user accounts.

Setting/Field

Group GID attribute

Sophos Mobile

Description

The Active Directory attribute that is mapped to the group ID in macOS group accounts.

CAUTION

If you change these mapping settings later, users might lose access to previously created files.

Administrative

Setting/Field

Preferred DC server

Password trust interval in days

Namespace

Packet signing

Packet encryption

Description

The Active Directory domain controller (DC) that is consulted first.

If you leave this field empty, macOS selects the domain controller by site information and controller responsiveness.

Specify how often macOS changes the password of its Active Directory computer account.

If you leave this field empty, macOS changes its password every 14 days.

If you set a value of 0 , macOS doesn’t change the password automatically.

• Forest

Namespace support is turned on. Multiple users with the same login name that exist in different domains of the Active Directory forest can log in.

Users must enter their login name as DOMAIN

\name .

• Domain

Namespace support is turned off. Users must have a unique login name.

macOS can sign and encrypt the LDAP connections used for Active Directory communication.

• Allow: macOS decides if to sign and/or encrypt the

LDAP connections.

• Disable: macOS doesn’t sign or encrypt the LDAP connections.

• Require: macOS always signs and encrypts LDAP connections.

• SSL/TLS: macOS always uses LDAP over SSL/TLS.

Sophos Mobile

Setting/Field

Multi-domain authentication

Domain administrator groups

Restrict DDNS

Description

Users from all domains in the Active Directory forest can log in.

A list of Active Directory groups.

Members of these groups are granted administrative privileges on the Mac.

To add a group, enter the Active Directory domain name, a backslash, and the group account name. For example ADS\Domain

Admins .

Entries are case-sensitive.

A list of network interfaces.

By default, macOS uses Dynamic DNS (DDNS) for all network interfaces. To restrict DDNS to certain interfaces, enter their BSD names.

For example to restrict DDNS to the built-in

Ethernet port, enter en0 .

To enter more than one interface, press Enter after each entry.

14.23.14 Root certificate configuration (macOS device policy)

With the Root certificate configuration you install a root certificate onto Macs.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

Sophos Mobile

14.23.15 Client Certificate configuration (macOS device policy)

With the Client certificate configuration you install a client certificate onto Macs.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.23.16 SCEP configuration (macOS device policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

URL

CA name

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.

A name that is understood by the Certificate

Authority. The name can, for example, be used to distinguish between instances.

Sophos Mobile

Setting/Field

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Retries

Retry delay

Key size

Description

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(SerialNumber)_% to specify a Mac.

For information on available placeholders, see

Placeholders in policies

(page 106).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.

The number of retries if the server sends a response of type pending.

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

14.24 Configurations for macOS user policies

With a macOS user policy you configure settings for Macs that apply to users managed by Sophos

Mobile.

Sophos Mobile

Related concepts

About macOS policies

(page 103)

Configurations for macOS device policies (page 221)

With a macOS device policy you configure settings for Macs that apply to all users.

14.24.1 Password policies configuration (macOS user policy)

With the Password policies configuration you define requirements for the passwords of Mac user accounts.

Note

When the Password policies configuration is assigned to a device, a grace period of 60 minutes starts. Within the grace period, the user is asked to change the password when they return to the

Home screen to comply with the policies. After the grace period, the user may not start any apps on the device, including internal apps.

Setting/Field

Allow simple value

Require alphanumeric value

Minimum password length

Minimum number of complex characters

Maximum password age in days

Maximum Auto-Lock (in minutes)

Password history

Description

Users are allowed to use sequential or repeated characters in their password, for example 1111 or abcde .

Passwords must contain at least one letter or number.

Specifies the minimum number of characters a password must contain.

Specifies the minimum number of nonalphanumeric characters (for example & or !) a password must contain.

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

In this field, you can specify the maximum value the user is allowed to configure on the device. Auto-Lock specifies how soon (in minutes) the device will be locked if it has not been used.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

Sophos Mobile

Setting/Field

Maximum grace period for device lock

Number of failed attempts until device wipe

Description

Immediately, users must enter a password every time they unlock their devices.

240

14.24.2 Restrictions configuration (macOS user policy)

With the Restrictions configuration you define restrictions for Macs.

Note

Some options are only available for certain versions of macOS. This is indicated by blue labels in

Sophos Mobile Admin.

Device

Setting/Field

Allow use of camera

Allow internet search result for

Spotlight

Allow Apple Music macOS software update delay

Description

If the check box is cleared, the camera is unavailable and the Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.

If the check box is cleared, Spotlight does not return internet search results.

Users can access the Apple Music library.

The number of days that an update of the macOS software is delayed after its release date.

Enter a value between 0 (no delay) and 90.

Sophos Mobile

iCloud

Setting/Field

Allow backup

Allow iCloud Photo Library

Allow iCloud Keychain sync

Allow document sync

Allow Back to My Mac

Allow Find My Mac

Allow iCloud Bookmarks

Allow iCloud Mail

Allow iCloud Calendar

Allow iCloud Reminders

Allow iCloud Address Book

Allow iCloud Notes

Allow iCloud Drive for Desktop and

Documents

Description

Users can back up their devices to iCloud.

Users can use iCloud Photo Library.

Users can use iCloud Keychain to synchronize passwords across their iPhones, iPads, and Macs.

If the check box is cleared, iCloud Keychain data is only stored locally on the device.

Users can store documents and app configuration data in iCloud.

Users can use iCloud Back to My Mac, i.e. file and screen sharing between a remote and a local Mac.

Users can use iCloud Find My Mac to locate, lock, or wipe their Mac remotely.

Users can use iCloud Bookmarks to synchronize web bookmarks between browsers and platforms.

Users can set up an iCloud Mail account on their Mac.

Users can use iCloud Calendar to share their calendars across their devices and with other iCloud users.

Users can use iCloud Reminders to share reminder lists across their devices and with other iCloud users.

Users can use iCloud Address Book to share contacts across their devices and with other iCloud users.

Users can use iCloud Notes to take notes and to share them across their devices and with other users.

Users can store their Mac Desktop and their

Documents folder in iCloud Drive and access them on other devices.

Sophos Mobile

Security and privacy

Setting/Field

Allow Touch ID to unlock device

Allow definition lookup

Allow Auto Unlock

Allow iTunes File Sharing

Allow AirPrint

Allow iBeacon discovery of AirPrint printers

Description

If the check box is cleared, the device can’t be unlocked by Touch ID.

Users can look up definitions for highlighted words.

Users can use Auto Unlock to have their Mac automatically unlocked by their Apple Watch.

Users can use File Sharing in iTunes to copy files between their Mac and an iPhone or iPad.

Users can send files to AirPrint-enabled printers.

The device uses iBeacon to discover AirPrint devices.

Warning

If you allow this, malicious AirPrint devices can perform phishing attacks on network traffic.

Force trusted certificates for AirPrint over TLS

Allow password auto-fill

AirPrint over TLS is rejected if the AirPrint device uses an untrusted certificate.

Users can turn on the AutoFill Passwords setting, which lets them use saved password or credit card information in Safari or other apps.

If this check box is cleared, automatic suggestion of strong passwords is disabled as well.

Request Wi-Fi passwords from nearby devices

Allow AirDrop password sharing

The device requests passwords from nearby devices when setting up a Wi-Fi connection.

Users can share passwords from Password Manager with other users via AirDrop.

14.24.3 Exchange account configuration (macOS user policy)

With the Exchange account configuration you set up an Exchange Web Services (EWS) account for

Contacts, Mail, Reminders, and Calendar.

Setting/Field

Account name

Description

The account name.

Setting/Field

Exchange server

Domain

User

Email address

Password

OAuth

OAuth sign-in URL

SSL/TLS

Sophos Mobile

Description

The Exchange server address.

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The account uses OAuth for authentication, i.e.

users authenticate with their Microsoft credentials.

The URL of the sign-in page for OAuth authentication.

Use this setting if the Autodiscover service of the

Exchange server is turned off.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

14.24.4 Wi-Fi configuration (macOS user policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Connect automatically

Hidden network

Description

The ID of the Wi-Fi network.

Automatically connect to the target network.

The target network is not open or visible.

Sophos Mobile

Setting/Field

Security type

244

Description

The security type of the Wi-Fi network:

• None

• WEP (personal)

• WPA/WPA2 (personal)

• Any (personal)

• WEP (enterprise)

• WPA/WPA2 (enterprise)

• Any (enterprise)

If you select a type with Personal in its name, a

Password field is displayed. Enter the relevant password.

If you select a type with Enterprise in its name, the tabs Protocols, Authentication and Trust are displayed.

On the Protocols tab configure the following:

• Under EAP-FAST, configure the EAP-FAST Protected

Access credential settings.

• In TLS minimum version and TLS maximum version, select a minimum and a maximum TLS version to be used with EAP authentication.

On the Authentication tab, configure client authentication settings:

• In the User field, enter the user name for the connection to the Wi-Fi network.

• Select Require password on each connect, if the password is to be queried for each connection and transferred with the authentication.

• In the Password field, enter the relevant password.

• In the Identity certificate list, select the certificate for the connection to the Wi-Fi network.

Note

The certificate to be used has to be specified in a

Client certificate configuration.

• In the External identity field, enter the externally visible

ID (for TTLS, PEAP and EAP-FAST).

On the Trust tab, configure server authentication settings:

Select the trusted certificates from the list.

Note

certificate configuration.

Setting/Field

Proxy

Sophos Mobile

Description

In this list, select the proxy settings for the Wi-Fi connection:

• No proxy

• Manually

• Automatic

If you select Manually, the fields Server, Port,

Authentication and Password are displayed.

Enter the required proxy information. If you select

Automatic, the field PAC URL is displayed. Enter the URL of the proxy server.

14.24.5 VPN configuration (macOS user policy)

With the VPN configuration you define VPN settings for network connections.

Setting/Field

Connection name

Connection type

Identifier (reverse DNS format)

Server

Account

Third-party settings

Send all traffic through VPN

Description

The name of the connection shown on the device.

The type of the VPN connection:

• Cisco AnyConnect

• Cisco Legacy AnyConnect

• IPsec (Cisco)

• F5

• Check Point

• Custom SSL/TLS

Different entry fields are shown on the VPN page depending on the connection type you select here.

The custom identifier in reverse DNS format.

The host name or the IP address of the server.

The user account for the authentication of the connection.

If your vendor has specified custom connection properties, you can enter them in this field.

To enter a property, click Add and then enter

Key and Value of the property in the dialog box.

All traffic is sent through VPN.

Sophos Mobile

Setting/Field

Group

User authentication

Device authentication

Description

The group that may be required for the authentication of the connection.

The type of user authentication for the connection:

• Password

If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.

• Certificate

If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.

The type of device authentication:

• Keys (Shared Secret)/Group name

If you select this option, the fields Group

name, Keys (Shared Secret), Use hybrid

authentication and Request password are displayed below the Device authentication field. Enter the required authentication information in the Group name and Keys

(Shared Secret) fields. Select Use hybrid

authentication and Request password as required.

• Certificate

If you select this option, the fields

Certificate and Including user PIN are displayed below the Device authentication field. In the Certificate list, select the required certificate. Select Including user

PIN to include the user PIN in device authentication.

Setting/Field

Proxy

Provider type

Sophos Mobile

Description

The proxy settings for the connection:

• No proxy

• Manually

If you select this option, the fields Server

• Automatic

If you select this option, the Proxy server

URL field is displayed. Enter the URL of the server with the proxy setting in this field.

The VPN connection type.

• App proxy: Network traffic is sent through a

VPN tunnel at the application layer.

• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.

14.24.6 Web Clip configuration (macOS user policy)

With the Web Clip configuration you define Web Clips to be added to the macOS desktop. Web Clips provide fast access to favorite web pages. But you can also add a Web Clip with a support phone number for example, to provide a quick way to dial the helpdesk.

Setting/Field

Description

URL

Can be removed

Full screen

Description

A description for the Web Clip.

The web address of the Web Clip.

If the check box is cleared, the user cannot remove the Web Clip. It cannot be deleted from the device unless the user removes the policy that installed it.

The Web Clip is opened full screen on the device. A full screen Web Clip opens the URL as a web app.

Sophos Mobile

Setting/Field

Icon

Description

Select an image to be used as the Web Clip icon on the Home screen. This must be a PNG,

GIF or JPEG image with a maximum file size of

1 MB.

The image is cropped to a square and scaled to match the display resolution. For best results, we recommend that you use an image of size

180 px by 180 px.

Note

248

14.24.7 Web content filter configuration (macOS user policy)

With the Web content filter configuration you define settings for a third-party app for filtering internet content.

Setting/Field

Filter name

Filter ID

Server

Organization

Description

A custom name for the filter configuration.

The bundle ID of the third-party app.

The server hosting the filtering service (host name, IP address, or

URL).

The name of your organization. The value is passed to the filtering service.

User name

Password

Certificate

Filter range

The credentials required for connecting to the filtering service.

Third-party settings

A certificate for authenticating to the filtering service.

The traffic to be filtered by the third-party app:

• Filter browser traffic: WebKit browser traffic is filtered.

• Filter socket traffic: Socket traffic is filtered.

• Filter browser and socket traffic: WebKit and socket traffic is filtered.

Additional configuration settings, if required by the third-party app.

Sophos Mobile

14.24.8 Global HTTP proxy configuration (macOS user policy)

With the Global HTTP proxy configuration you define a corporate proxy server.

Setting/Field

Proxy

Server

Port

Authentication

Password

PAC URL

Description

Select Manually to configure the connection details manually.

Select Automatic if you have a proxy auto-config (PAC) file.

The name (or the IP address) of the HTTP proxy.

The port number of the HTTP proxy.

The user name to connect to the proxy server.

The password to connect to the proxy server.

The URL of the proxy auto-config (PAC) file.

14.24.9 Managed domains configuration (macOS user policy)

With the Managed domains configuration you define managed domains for Macs.

Email domains

Enter email domains managed by your organization. Email messages from an address that doesn’t match one of the configured domains are highlighted as out-of-domain in the Mail app.

14.24.10 CalDAV configuration (macOS user policy)

With the CalDAV configuration you configure the synchronization of calendar data with a CalDAV server. For example, this can be used to sync Google Calendar with a Mac.

Setting/Field

Account name

Server

Port

Description

The display name of the CalDAV account on the device.

The host name or IP address of the CalDAV server.

The port number of the CalDAV server.

Sophos Mobile

Setting/Field

Principal URL

User name, Password

SSL/TLS

Description

If required by the CalDAV server, enter the principal URL of the calendar resource.

For example, to sync with a calendar other than the primary calendar in a Google account, enter: https://apidata.googleusercontent.com/ caldav/

v2/calendar_id/user where calendar_id is the ID of the calendar you want to sync with. In the Google Calendar web application, the calendar ID is displayed in the calendar settings. See the

Google Calendar help for details.

The login credentials for the CalDAV account.

For example, for Google Calendar enter the credentials of the Google account.

The connection to the CalDAV server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

14.24.11 CardDAV configuration (macOS user policy)

With the CardDAV configuration you configure the synchronization of contact data with a CardDAV server. For example, this can be used to sync Google Contacts with a Mac.

Setting/Field

Account name

Server

Port

Principal URL

User name, Password

Description

The display name of the CardDAV account on the device.

The host name or IP address of the CardDAV server.

The port number of the CardDAV server.

If required by the CardDAV server, enter the principal URL of the contacts resource.

For example, the Google CardDAV API supports the following principal URL: https://www.googleapis.com/carddav/

v1/ principals/account_name@gmail.com

where account_name is the Google account name.

The login credentials for the CardDAV account.

For example, for Google Contacts enter the credentials of the Google account.

Setting/Field

SSL/TLS

Sophos Mobile

Description

The connection to the CardDAV server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

14.24.12 IMAP/POP configuration (macOS user policy)

With the IMAP/POP configuration you add an IMAP or POP email account to Macs.

Setting/Field

Account name

Account type

User display name

Email address

Description

The display name of the email account on the device.

The type of the email server for incoming email (either

IMAP or POP).

The display name of the user for outgoing email.

Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.

The email address of the account.

Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.

Incoming email

Server

Port

User name

Authentication type

Password

SSL/TLS

The host name or IP address of the server for incoming email (inbound server).

The port number of the server for incoming email (inbound server).

The user name for connecting to the inbound server.

The authentication method for connecting to the inbound server.

The password for connecting to the inbound server (if required).

The connection to the inbound server is secured by SSL or TLS (depending on what the server supports).

Outgoing email

Server

Port

The host name or IP address of the server for outgoing email (outbound server).

The port number of the server for outgoing email

(outbound server).

Sophos Mobile

Setting/Field

User name

Authentication type

Password

Use same password as for incoming email

SSL/TLS

Description

The user name for connecting to the outbound server.

The authentication method for connecting to the outbound server.

The password for connecting to the outbound server (if required).

Use the password that is specified for incoming email.

The connection to the outbound server is secured by SSL or TLS (depending on what the server supports).

14.24.13 Single sign-on configuration (macOS user policy)

With the Single sign-on configuration you define settings for a single sign-on for third-party apps.

Setting/Field

Name

Kerberos principal name

Realm

URLs

App IDs

Description

A human-readable name for the account.

The Kerberos principal name.

If you leave this field empty, the user must enter the name.

The Kerberos realm name.

You must enter the name in upper-case.

A list of URL prefixes that must be matched to use the account for Kerberos authentication over HTTP.

Values must begin with http:// or https://

If a value doesn’t end with / , the / is added by

Sophos Mobile.

A list of bundle IDs of apps.

Values must be either exact matches (e.g.

com.sophos.smsec

), or prefixes, using the characters .* at the end of the string (e.g.

com.sophos.* ).

Sophos Mobile

14.24.14 LDAP configuration (macOS user policy)

With the LDAP configuration you add user information from an LDAP directory to the macOS Address

Book app.

Note

To configure a Mac to join an Active Directory domain, use the Directory service configuration.

See

Directory service configuration (macOS device policy) (page 233).

Setting/Field

Account description

Host name

User name

Password

Use SSL/TLS

Search settings

Base

Scope

Description

Description

A description of the LDAP connection.

The host name or IP address of the LDAP server.

The sign-in credentials Sophos Mobile uses to connect to the LDAP server.

The connection to the LDAP server is secured by SSL or TLS (depending on what the server supports).

The nodes in the LDAP tree to start searching from, and the search scope.

The path to the start node for the search.

For example: ou=users,o=my company

The scope of sub-nodes to include in the search:

• Base node only: Only the base node.

• Base node and direct child nodes: The base node and its child nodes, that is the firstlevel sub-nodes.

• Base node and all sub-nodes: The base node and all sub nodes.

A description of the search setting.

14.24.15 App Store configuration (macOS user policy)

With the App Store configuration you restrict the App Store usage.

Setting/Field

Require admin password

Description

Users require an administrator password to install or update apps.

Sophos Mobile

Setting/Field

Restrict to updates

Forbid app adoption

Turn off update notifications

Description

Users can update apps but can’t install new apps.

App adoption allows users to assign apps to their

Apple ID that have not been installed through the

App Store. If you forbid app adoption, users can’t update these apps.

For example, this affects iLife or iWork apps bundled with the Mac.

Users don’t receive update notifications.

14.24.16 Root certificate configuration (macOS user policy)

With the Root certificate configuration you install a root certificate onto Macs.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.24.17 Client Certificate configuration (macOS user policy)

With the Client certificate configuration you install a client certificate onto Macs.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Sophos Mobile

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.24.18 SCEP configuration (macOS user policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

URL

CA name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.

A name that is understood by the Certificate

Authority. The name can, for example, be used to distinguish between instances.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(SerialNumber)_% to specify a Mac.

For information on available placeholders, see

Placeholders in policies

(page 106).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified URL of the CA server.

Sophos Mobile

Setting/Field

AD user logon name

Challenge

Retries

Retry delay

Key size

Description

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.

The number of retries if the server sends a response of type pending.

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

14.25 Configurations for Windows Mobile policies

With a Windows Mobile policy you configure settings for Windows Mobile devices.

14.25.1 Password policies configuration (Windows Mobile policy)

With the Password policies configuration you define requirements for the device password.

Setting/Field

Password type

Description

The type of password users must define:

• Alphanumeric: Password must contain both digits and letters

• Numeric: Password must only contain digits

For Windows Phone 8.1, Alphanumeric covers passwords that contain digits and/or letters.

Setting/Field

Minimum complexity of alphanumeric passwords

Allow simple password

Minimum password length

Maximum number of failed attempts

Time in minutes until the device is locked

Password history

Maximum password age in days

Allow the password grace period to be set

Sophos Mobile

Description

This defines the character classes that must be used in an alphanumeric password.

For Windows 10 Mobile:

• 1: Not applicable (if selected, 2 is used)

• 2: Digits and lowercase letters are required

• 3: Digits, lowercase letters, and uppercase letters are required

• 4: Digits, lowercase letters, uppercase letters, and special characters are required

For Windows Phone 8.1, the value you select is the number of different character classes that must be used in a password. Character classes are:

• Digits

• Lowercase letters

• Uppercase letters

• Special characters

Passwords can contain sequential or repeated characters, for example abcde or 1111 .

The minimum number of characters a password must contain.

The number of failed login attempts to enter the correct password before the device is wiped.

Enter a value between 1 and 999 , or 0 for no restriction.

The time period (in minutes) after which the device is locked if it has not been used. The user can unlock the device.

Enter a value between 1 and 999 , or 0 for no restriction.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

The number of days after which users must change their password.

Enter a value between 1 and 730 , or 0 for no restriction.

Users are allowed to set the password grace period.

Sophos Mobile

258

14.25.2 Restrictions configuration (Windows Mobile policy)

With the Restrictions configuration you define restrictions for devices.

Device

Setting/Field

Forbid SD card

Forbid unencrypted device

Description

Users cannot access the storage card. This does not prevent apps from accessing the storage card.

Internal storage encryption is turned on.

CAUTION

After internal storage encryption has been turned on on a device, you cannot turn it off again through a policy.

Note

You must enable BitLocker on the device before applying the policy.

Forbid action center notifications above lock screen

No Action Center notifications are displayed above the device lock screen.

Forbid manual addition of non-Microsoft email accounts

Forbid Microsoft account connection

Forbids adding all types of email accounts, as well as Exchange, Office 365 and Outlook.com

accounts.

Connecting to Microsoft services such as synchronization, backup, Skype, or the

Microsoft Store is not possible.

Note

This setting only affects Microsoft accounts that are set up on the device after the policy is assigned.

Forbid developer mode

Forbid Microsoft Store

Forbid native browser

Forbid camera

The Windows developer mode is turned off.

The app store is unavailable.

The Microsoft Edge browser is unavailable.

The Privacy setting Let apps use my camera is turned off.

Setting/Field

Telemetry level

Various

Setting/Field

Forbid copy and paste

Forbid Cortana

Forbid “Save as” for Office files

Forbid screen capture

Forbid sharing of Office files

Forbid “Sync my settings”

Forbid voice recording

Sophos Mobile

Description

The amount of Windows diagnostic and usage data that devices are allowed to send.

Windows 10:

• Full: All data required to identify and analyze issues.

• Enhanced: Data about how Windows and apps are used and how they perform.

• Basic: A limited set of data that’s critical for understanding the device and its configuration.

• Disabled (Windows Phone 8.1 only): Not supported on Windows 10 devices. If you select this, the Basic level is used.

Note

Levels are cumulative from bottom to top, e.g.

Enhanced includes all data from Basic.

Tip

For detailed information on the telemetry levels, see the Microsoft article Configure Windows telemetry in your organization (external link) .

Windows Phone 8.1 doesn’t support different telemetry levels:

• Full, Enhanced, Basic: Users can turn telemetry on or off.

• Disabled (Windows Phone 8.1 only): No telemetry data is submitted.

Description

The clipboard is unavailable.

Cortana is turned off.

Users cannot save a file on the device as an

Office file.

Screen captures are turned off.

Users cannot share Office files.

Device settings cannot be synchronized to and from other Windows devices.

Voice recording is turned off.

259

Sophos Mobile

Wi-Fi

Setting/Field

Forbid Wi-Fi

Forbid internet sharing

Forbid Wi-Fi Sense (hotspot auto-connect)

Forbid hotspot reporting

Forbid manual configuration

Description

Wi-Fi connections are turned off.

Internet Connection Sharing (ICS) is turned off.

The device does not automatically connect to

Wi-Fi hotspots.

The device does not send information about Wi-

Fi connections.

Users can’t configure Wi-Fi connections beyond the connections that are configured by Sophos

Mobile.

Existing user-configured and Wi-Fi Sense Wi-Fi profiles are deleted.

Connectivity

Setting/Field

Forbid NFC

Forbid Bluetooth

Forbid USB connection

Description

NFC (near-field communication) is turned off.

Bluetooth is turned off.

USB connection between the device and a computer to sync files or to use developer tools to deploy or debug apps is forbidden. This does not affect USB charging.

Roaming and costs

Setting/Field

Forbid cellular data roaming

Forbid VPN over cellular

Forbid VPN roaming over cellular

Description

Data connections over foreign cellular networks are turned off.

VPN connections over cellular networks are turned off.

VPN connections over foreign cellular networks are turned off.

Sophos Mobile

Security and privacy

Setting/Field

Forbid Bing Vision to store images from

Bing Vision search

Forbid use of location when searching

Forbid manual installation of root certificates

Forbid locating

SafeSearch permission

Description

Bing Vision does not store the contents of the images captured when performing Bing Vision search.

The search cannot utilize location information.

Users cannot manually install root and intermediate CA certificates.

All location privacy settings on the device are turned off. No apps can use the location service.

This also forbids Sophos Mobile to locate the device.

The level of search result filtering that is enforced on the device:

• Moderate: Moderate filtering against adult content. Valid search results are not filtered.

• Strict: Highest filtering against adult content.

Unenrollment

Setting/Field

Forbid user to reset the phone

Forbid manual MDM unenrollment

Description

Users cannot factory reset the device through the control panel or hardware key combinations.

Users cannot delete the workplace account.

14.25.3 Exchange account configuration (Windows Mobile policy)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server.

Setting/Field

Account name

Description

The account name.

Sophos Mobile

Setting/Field

Exchange server

Domain

User

Email address

Password

Synchronization period

Synchronization interval

SSL/TLS

Synchronize content types

Description

The Exchange server address.

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

The content types to be synchronized.

14.25.4 Wi-Fi configuration (Windows Mobile policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Connect automatically

Hidden network

Description

In this field, enter the ID of the Wi-Fi network.

The connection will be established automatically.

The target network is not open or visible.

Setting/Field

Security type

Proxy

Sophos Mobile

Description

Select the security type from the list. If you select WPA (Personal) or WPA2 (Personal) you must specify the password.

If you select Manually from the list, you must specify server and port.

14.25.5 App restrictions configuration (Windows Mobile policy)

With the App restrictions configuration you specifically allow or block apps on the devices.

Setting/Field

Allowed apps

Forbidden apps

App group

Description

Contains a set of individual apps that users are allowed to install and use on the device. Users will be unable to install or use any apps that are not explicitly listed.

Use Allowed apps when you know the list of apps that you want to allow and want to block all other apps.

Contains a set of individual apps that users are prevented from installing on the device.

Users will be able to install any apps that are not explicitly listed.

Use Forbidden apps when you know the list of apps that you want to block and want to allow all other apps.

Select the app group that contains the list of apps you want to allow or block.

Note

The app group has to be created beforehand. See

App groups

(page 312).

14.25.6 IMAP/POP configuration (Windows Mobile policy)

With the IMAP/POP configuration you add an IMAP or POP email account to the device.

Setting/Field

Account type

Account name

Description

The type of the email server for incoming email (either

IMAP or POP).

The display name of the email account on the device.

Sophos Mobile

Setting/Field

Email address

User display name

User name

Domain

Password

Server for incoming email

Use SSL/TLS for incoming email

Server for outgoing email

Use SSL/TLS for outgoing email

Authentication required for outgoing connection

Synchronization period

Automatic synchronization

Description

The email address of the account.

Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.

The display name of the user for outgoing email.

Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.

The user name for connecting to the inbound server.

The domain part of the credentials for the inbound server

(if required).

The password for connecting to the inbound server (if required).

The host name (or the IP address) and the port number of the server for incoming email (inbound server).

Format: server name:port number

You don’t need to specify the port number if the standard port is used:

• 143 (IMAP)

• 993 (IMAP with SSL)

• 110 (POP3)

• 995 (POP3 with SSL)

Use Secure Sockets Layer for incoming email transfer.

The host name (or the IP address) and the port number of the server for outgoing email (outbound server).

Format: server name:port number

Use Secure Sockets Layer for outgoing email transfer.

The outbound server requires authentication.

The same credentials as for the inbound server are used, as specified in the User name, Domain and Password fields.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval for automatic email synchronization.

Sophos Mobile

14.25.7 Root certificate configuration (Windows Mobile policy)

With the Root certificate configuration you install a root certificate onto devices.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.25.8 SCEP configuration (Windows Mobile policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

Description

URL

Description

A description for the configuration.

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.

Sophos Mobile

266

Setting/Field

Subject

Subject Alternative Name

Challenge

Root certificate

Retries

Retry delay

Key size

Key usage

Description

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in policies

(page 106).

Optionally, configure one or more Subject

Alternative Name (SAN) values.

Click Add and then enter a SAN type and a SAN value.

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.

The number of retries if the server sends a response of type pending.

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

Select what the certificate can be used for.

Use as digital signature: The certificate can be used as a digital signature.

Use for encryption: The certificate can be used for data encryption.

Sophos Mobile

14.26 Configurations for Windows policies

With a Windows policy you configure settings for Windows computers.

14.26.1 Password policies configuration (Windows policy)

With the Password policies configuration you define requirements for the passwords of Windows user accounts.

Note

Password complexity rules (for example length, number of uppercase and lowercase letters) for Windows computers are fixed and cannot be set by a Sophos Mobile policy. For details see

Windows password complexity rules (page 104).

Note

Password policies can’t be assigned to Windows computers if the following conditions are both met:

• There are other local users configured on the device in addition to the user that is enrolled with

Sophos Mobile.

• One or more of these other users are not allowed to change their password.

Setting/Field

Maximum number of failed attempts

Time in minutes until the device is locked

Password history

Maximum password age in days

Description

The number of failed login attempts to enter the correct password before the device is wiped.

Enter a value between 1 and 999 , or 0 for no restriction.

The time period (in minutes) after which the device is locked if it has not been used. The user can unlock the device.

Enter a value between 1 and 999 , or 0 for no restriction.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

The number of days after which users must change their password.

Enter a value between 1 and 730 , or 0 for no restriction.

Sophos Mobile

14.26.2 Restrictions configuration (Windows policy)

With the Restrictions configuration you define restrictions for devices.

Device

Setting/Field

Forbid SD card

Forbid manual addition of non-Microsoft email accounts

Forbid developer mode

Forbid camera

Disable Edge autofill

Disable Edge F12 Developer Tools

Disable Edge pop-up blocker

Disable AutoPlay settings

Disable Date & Time settings

Disable Language settings

Disable Power & Sleep settings

Disable Region settings

Disable Sign-in settings

Disable VPN settings

Description

Users cannot access the storage card. This does not prevent apps from accessing the storage card.

Forbids adding all types of email accounts, as well as Exchange, Office 365 and Outlook.com

accounts.

The Windows developer mode is turned off.

The Privacy setting Let apps use my camera is turned off.

The Save form entries setting in the Edge web browser is turned off and cannot be turned on by the user.

If the check box is cleared, the setting is turned on and cannot be turned off by the user.

The F12 Developer Tools of the Edge web browser are unavailable.

The Block pop-ups setting in the Edge web browser is turned off and cannot be turned on by the user.

If the check box is cleared, the setting is turned on and cannot be turned off by the user.

The relevant sections of the Windows Control

Panel are unavailable. The user cannot change any of these settings after the policy has been assigned to the device.

Note

Disable AutoPlay settings does not affect connected devices, like for example mobile phones.

Sophos Mobile

Setting/Field

Disable Workplace settings

Disable Account settings

Telemetry level

Description

The amount of Windows diagnostic and usage data that devices are allowed to send.

• Full: All data required to identify and analyze issues.

• Enhanced: Data about how Windows and apps are used and how they perform.

• Basic: A limited set of data that’s critical for understanding the device and its configuration.

• Security: Information that is required to keep the device protected with the latest security updates.

Note

Levels are cumulative from bottom to top, e.g.

Enhanced includes all data from Basic and

Security.

Tip

For detailed information on the telemetry levels, see the Microsoft article Configure Windows telemetry in your organization (external link) .

Various

Setting/Field

Forbid Cortana

Forbid “Sync my settings”

Disable Windows tips

Description

Cortana is turned off.

Device settings cannot be synchronized to and from other Windows devices.

The Windows notification setting Show me tips

about Windows is cleared and unavailable.

Wi-Fi

Setting/Field

Forbid internet sharing

Forbid Wi-Fi Sense (hotspot auto-connect)

Description

Internet Connection Sharing (ICS) is turned off.

The device does not automatically connect to

Wi-Fi hotspots.

Sophos Mobile

Setting/Field

Forbid manual configuration

Description

Users can’t configure Wi-Fi connections beyond the connections that are configured by Sophos

Mobile.

Existing user-configured and Wi-Fi Sense Wi-Fi profiles are deleted.

Connectivity

Setting/Field

Forbid Bluetooth

Security and privacy

Setting/Field

Forbid use of location when searching

Unenrollment

Setting/Field

Forbid manual MDM unenrollment

Description

Bluetooth is turned off.

Description

The search cannot utilize location information.

Description

Users cannot delete the workplace account.

14.26.3 Exchange account configuration (Windows policy)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server.

CAUTION

If you use multiple configurations to set up Exchange email accounts, the devices might only be able to retrieve mail for one account. This typically happens when the accounts are located on different Exchange servers and there are different mailbox policies defined on these servers.

Because Windows computers can only enforce a single mailbox policy, they will fail to connect to the accounts that use a different policy.

Note

Windows allows the user to reject all changes that you make to the Exchange configuration.

Setting/Field

Account name

Exchange server

Domain

User

Email address

Password

Synchronization period

Synchronization interval

SSL/TLS

Synchronize content types

Sophos Mobile

Description

The account name.

The Exchange server address.

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

The content types to be synchronized.

14.26.4 Wi-Fi configuration (Windows policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Configure manually

Select Configure manually to manually configure a Wi-Fi connection.

This option only supports connections with a WPA (Personal) or WPA2 (Personal) security type.

Sophos Mobile

Setting/Field

SSID

Connect automatically

Hidden network

Security type

Description

In this field, enter the ID of the Wi-Fi network.

The connection will be established automatically.

The target network is not open or visible.

Select the security type from the list. If you select WPA (Personal) or WPA2 (Personal) you must specify the password.

Create from existing connection

Select Create from existing connection to create a configuration from an existing Wi-Fi connection on a Windows computer.

Setting/Field

Wi-Fi profile

Description

Upload the profile file of a Windows Wi-Fi connection.

For information on how to create the file, see

Export Windows Wi-Fi profile (page 272).

272

14.26.5 Export Windows Wi-Fi profile

You need to export a Wi-Fi profile from a Windows computer if you want to create a Sophos Mobile Wi-

Fi configuration from an existing connection.

Perform this procedure on a Windows 10 computer on which the Wi-Fi connection is listed under

Known networks.

1. Open a command prompt as an administrator.

2. Check the required profile is available: netsh wlan show profiles

3. Export the profile: netsh wlan export profile "<SSID>" key=clear folder=<Destination>

Replace <SSID> by the profile name and <Destination> by the destination folder of the profile file (for example c:\temp ).

The profile is exported to an XML file. You can use the file in a Sophos Mobile Wi-Fi configuration.

Warning

The XML file contains the unencrypted Wi-Fi password. For security reasons, we strongly recommend you delete the file after you’ve uploaded it to Sophos Mobile.

Related tasks

Create policy

(page 101)

Sophos Mobile

You create policies to configure settings for devices. Create several policies if you want to manage different types of devices.

Related reference

Wi-Fi configuration (Windows policy)

(page 271)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

14.26.6 Kiosk mode configuration (Windows policy)

With the Kiosk mode configuration you set up a Windows computer to run in kiosk mode.

In kiosk mode, only a single app (the kiosk app) can run. Kiosk mode is turned on when the user associated with the kiosk mode (the kiosk user) logs in.

Note

By default, the computer remains in kiosk mode after a restart. To change this behavior, log into the computer with the kiosk user account, go to Settings > Accounts > Sign-in options, and turn off Use my sign-in info to automatically finish setting up my device after an update or

restart.

Setting/Field

User account

App AUMID

Description

The user associated with the kiosk mode (the kiosk user).

Format:

<computer name>\<user name> (local account)

<domain>\<user name> (domain account)

You can omit the <domain> part if the user name is unique across all domains.

The Application User Model ID (AUMID) of the app that is launched when the kiosk mode is turned on (the kiosk app).

For information on how to obtain the AUMID value, see the

Microsoft document Find the Application User Model ID of an installed app .

14.26.7 IMAP/POP configuration (Windows policy)

With the IMAP/POP configuration you add an IMAP or POP email account to Windows computers.

Setting/Field

Account type

Account name

Description

The type of the email server for incoming email (either

IMAP or POP).

The display name of the email account on the device.

Sophos Mobile

Setting/Field

Email address

User display name

User name

Domain

Password

Server for incoming email

Use SSL/TLS for incoming email

Server for outgoing email

Use SSL/TLS for outgoing email

Authentication required for outgoing connection

Synchronization period

Automatic synchronization

Description

The email address of the account.

Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.

The display name of the user for outgoing email.

Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.

The user name for connecting to the inbound server.

The domain part of the credentials for the inbound server

(if required).

The password for connecting to the inbound server (if required).

The host name (or the IP address) and the port number of the server for incoming email (inbound server).

Format: server name:port number

You don’t need to specify the port number if the standard port is used:

• 143 (IMAP)

• 993 (IMAP with SSL)

• 110 (POP3)

• 995 (POP3 with SSL)

Use Secure Sockets Layer for incoming email transfer.

The host name (or the IP address) and the port number of the server for outgoing email (outbound server).

Format: server name:port number

Use Secure Sockets Layer for outgoing email transfer.

The outbound server requires authentication.

The same credentials as for the inbound server are used, as specified in the User name, Domain and Password fields.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval for automatic email synchronization.

Sophos Mobile

14.26.8 Device Guard configuration (Windows policy)

With the Device Guard configuration you configure virtualization-based security (VBS) on Windows computers.

Note

All settings are applied the first time the Windows computer starts after the policy has been assigned.

Setting/Field Description

Turn on virtualization-based security (VBS) Virtualization-based security (VBS) is turned on.

Credential Guard configuration

Platform security level

•

Turn off: Turn off Credential Guard.

This doesn’t work if Credential Guard was turned on using the Turn on with UEFI lock option.

Turn on with UEFI lock: Turn on Credential

Guard and ensure that it can’t be turned off remotely.

Credential Guard can only be turned off again in the BIOS settings, requiring physical access to the computer.

Turn on without lock: Turn on Credential

Guard.

Credential Guard can be turned off again with the Turn off option, or with a Windows Group

Policy.

•

Secure Boot: VBS is turned on with as much protection as is supported by the computer’s hardware.

If the computer doesn’t have input/output memory management units (IOMMUs), VBS uses the Secure Boot UEFI feature.

If the computer has IOMMUs, VBS uses

Secure Boot with direct memory access

(DMA) protection.

Secure Boot and DMA protection: VBS uses Secure Boot with direct memory access

(DMA) protection.

VBS is not turned on if the computer doesn’t support DMA.

Sophos Mobile

14.26.9 Root certificate configuration (Windows policy)

With the Root certificate configuration you install a root certificate onto devices.

Setting

File

Certificate name

Description

Select Upload a file and then select a PKCS #12 (.pfx) certificate file.

The name of the certificate.

Sophos Mobile reads the name from the certificate file.

Note

The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.

Tip

You can drag a certificate from File Explorer to the File area to upload it.

14.26.10 Client Certificate configuration (Windows policy)

With the Client certificate configuration you install a client certificate onto Windows computers.

Setting/Field

File

Description

The certificate you want to install.

You can upload PEM and PKCS #12 certificates.

Click Upload a file and then navigate to the file that contains the certificate.

Tip

Alternatively, drag the file from File Explorer to the Upload a file area.

Certificate name

Target store

After you’ve uploaded the certificate file, this field shows the subject value of the certificate.

The certificate store where the certificate is installed:

User: The certificate is available to the user enrolled with Sophos

Mobile.

Device: The certificate is available to all users on the computer.

Setting/Field

Key location

Key is exportable

Container name

Sophos Mobile

Description

The location where the private key of the certificate is stored:

Software: The key is stored in a software-based key store.

TPM or software: The key is stored in TPM if it's available.

Otherwise the key is stored in a software-based key store.

TPM: The key is stored in the Trusted Platform Module (TPM) hardware chip. If the computer doesn’t have a TPM chip or if

TPM is turned off in the BIOS, the certificate is not installed.

Windows Hello for Business: The key is stored in a Windows

Hello for Business container.

Users can also export the private key when they export the certificate.

The name of the Windows Hello for Business container where the private key of the certificate is stored.

14.26.11 SCEP configuration (Windows policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

Description

URL

Subject

Description

A description for the configuration.

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in policies

(page 106).

Sophos Mobile

Setting/Field

Subject Alternative Name

Challenge

Root certificate

Retries

Retry delay

Key size

Key usage

Description

Optionally, configure one or more Subject

Alternative Name (SAN) values.

Click Add and then enter a SAN type and a SAN value.

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.

The number of retries if the server sends a response of type pending.

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

Select what the certificate can be used for.

Use as digital signature: The certificate can be used as a digital signature.

Use for encryption: The certificate can be used for data encryption.

Sophos Mobile

14.27 Configurations for Chrome Security policies

With a Chrome Security policy you configure settings for the Sophos Chrome Security extension when it’s enrolled with Sophos Mobile.

14.27.1 Web Filtering configuration (Chrome Security policy)

With the Web Filtering configuration you manage the Web Filtering feature of the Sophos Chrome

Security extension. This protects users from browsing sites with malicious, undesirable or illegal content.

Tip

For the purpose of testing website filtering, Sophos has created the site sophostest.com

containing example pages for each category. Although some of these pages are classified as potentially offensive or dangerous, the page content itself is harmless in all cases.

Settings

Setting/Field

Filter malicious websites

Create alerts

Check embedded content

Filter websites by category

Website exceptions

Description

Select whether users can access websites with malicious content.

Select whether an alert is created when the user tries to access a filtered website.

You can select if alerts are only created for blockings or also for warnings.

Web pages are filtered based on their own content and on embedded content like ads. For example if you set the

Gambling category to Block, all gambling websites and all pages containing gambling-related ads are blocked.

If you turn off this option, Web Filtering ignores embedded content unless it’s malicious.

Select whether users can access types of websites.

Websites are categorized based on data from

SophosLabs. The data is updated constantly.

Configure exceptions to the category filters:

Allowed domains: Websites that are allowed, even though the category they belong to is blocked.

Blocked domains: Websites that are blocked, even though the category they belong to is allowed.

Sophos Mobile

How to specify website exceptions

In Allowed domains and Blocked domains, enter one of the following per line (without separator):

• IPv4 or IPv6 address

203.0.113.0

2001:db8:85a3:0:0:8a2e:370:7334

• IPv4 or IPv6 subnet

203.0.113.0/24

2001:db8::/32

• Domain www.example.com

• Wildcard domain. The wildcard * must be the leftmost character.

*.example.com

*example.com

In Blocked domains, you can use a single wildcard * to block all websites.

IP addresses and subnets are ignored if the user refers to a website by its domain name.

Filtering logic

When Web Filtering evaluates whether a website must be allowed or blocked, the allow list takes precedence over the block list, and policy-defined lists take precedence over user-defined lists.

Filtering rules are applied in the following sequence:

1. If the website is included in Allowed domains, it is allowed.

2. If the website is included in Blocked domains, it is blocked.

3. If the user has added the website to the allow list, it is allowed.

4. If the user has added the website to the block list, it is blocked.

5. The website is allowed or blocked based on its category.

Sophos Mobile

15 Task bundles

With a task bundle you can bundle several tasks in one transaction.

For example, you can bundle all the tasks to enroll and configure a device:

• Enroll the device.

• Assign required policies.

• Install required apps (for example managed apps for iOS devices).

You can also include wipe commands in task bundles to automatically wipe non-compliant (for

example jailbroken or rooted) devices. For further information, see Compliance policies (page 33).

Task bundles are available for the following platforms:

• Android

• iOS

• macOS

• Windows

• Chrome OS

15.1 Create task bundle

You create separate task bundles for Android, iOS, and other device platforms you want to manage.

To create a task bundle:

1. On the menu sidebar, under CONFIGURE, select Task bundles and then select the platform for which you want to create a task bundle.

2. On the Task bundles page, select Create task bundle.

3. On the Edit task bundle page, enter a name and, optionally, a description for the task bundle.

The version is automatically incremented every time you save the task bundle.

4. Optional: If you select Selectable for compliance actions, you can transfer the task bundle to devices when they become non-compliant.

You configure this in a compliance policy.

5. Optional: For iOS task bundles, select Ignore app installation failures to continue the task bundle processing even if an app installation fails.

This option is only available if the task bundle contains an Install app task.

6. Select Add task and then select a task type.

7. Enter the required information and select Apply to create the task.

The task name is displayed in the Self Service Portal when the task bundle is applied.

8. Optional: Add more tasks to the task bundle, for example to install apps or to display a message on the device.

Note

You can’t mix Android and Android Enterprise tasks.

Sophos Mobile

9. Optional: Change the installation order of the tasks by using the arrow icons on the right-hand side of the tasks list.

Related concepts

Available Android task types (page 282)

Available iOS task types

(page 285)

Available macOS task types

(page 287)

Available Windows task types

(page 289)

Available Chrome OS task types

(page 290)

15.2 Available Android task types

The following task types are available for Android task bundles:

Enroll

When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.

When the task is transferred to a device that is already enrolled, the task is skipped.

Enroll Sophos container

When the task is transferred to a device that is already enrolled, the task is skipped.

Assign policy

Select a policy. For information on how to add policies to this list, see

Policies (page 99).

When the task is transferred to devices, the policy is silently assigned.

Uninstall policy

Under Select source, select Policies and then select a policy from the list.

In addition to the policies you’ve created in Sophos Mobile, the list includes all policies installed on a managed device.

You can also uninstall a policy that’s not listed if you know its identifier.

You can only uninstall Android device policies and Knox container policies. For other policy types, either update the policy, assign a different policy, or unenroll the device.

Sophos Mobile

Install app

Select an app from the list of available apps. For information on how to add apps to this list, see

Add app (page 292).

When the task is transferred to devices, users receive a notification on their devices that Sophos

Mobile wants to install the app. Users can tap OK to start the process, or Not now to be notified again after a short period of time.

If users tap OK but then tap Cancel in the subsequent Android dialog, the task fails.

If the app is already installed on a device that receives the task, it is updated.

Install managed Google Play app

This task type is available if you have configured Android Enterprise for the customer.

Select an app from the list of managed Google Play apps you’ve approved for your organization. For

information on how to add apps to this list, see Edit managed Google Play app (page 329).

The installation task is sent to a Google service. Google then manages the installation of the app onto the device. On the Task view page, the task is displayed with state successful when it has been sent to Google.

Alternatively, you can install apps from the Approved apps page. See Install managed Google Play app (page 333).

For information on how to uninstall an app from devices, see Uninstall a managed Google Play app

(page 333).

Uninstall app

Under Select source, select Apps to select an app from the list of available apps.

In addition to the apps that are available on the Sophos Mobile server, the list includes apps that are in use on the managed devices - with the exception of Android system apps and apps that have been pre-installed by the device manufacturer.

You can also uninstall an app that is not contained in the list. Select Identifier and then enter the package name of the app you want to uninstall from devices. If you select Knox container app, the app will be uninstall from the Samsung Knox container.

When the task is transferred to devices, users receive a notification on their devices that Sophos

Mobile wants to uninstall the app. Users can tap OK to start the process, or Not now to be notified again after a short period of time.

If users tap OK but then tap Cancel in the subsequent Android dialog, the task fails.

If the app is not installed on a device that receives the task, no notification is displayed.

Send message

Enter a plain text to be displayed on the devices.

When the task is transferred to devices, the message text is displayed in a notification window.

Users can display past messages in the Sophos Mobile Control app.

Sophos Mobile

Unenroll

When the task is transferred to devices, they are unenrolled from Sophos Mobile. See

Unenroll devices

(page 49). Device users do not need to confirm the operation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Wipe

When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.

CAUTION

Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.

Note

When a Wipe task is transferred to an Android Enterprise work profile device, only the work profile and all managed Google Play apps are removed.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Knox container: lock

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container is locked.

Knox container: unlock

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container is unlocked.

Knox container: reset password

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container password is reset. Users must set a new password to unlock the Knox container.

Knox container: remove

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container

(including any container-related configuration) is removed.

Sophos Mobile

Scan for malware

When the task is transferred to a device, Sophos Intercept X for Mobile scans it for malware and potentially unwanted apps (PUAs).

This task requires that Sophos Intercept X for Mobile is managed by Sophos Mobile.

15.3 Available iOS task types

The following task types are available for iOS task bundles:

Enroll

When the task is transferred to a device that is already enrolled, the task is skipped.

Enroll Sophos container

When the task is transferred to a device that is already enrolled, the task is skipped.

Assign policy

Select a policy. For information on how to add policies to this list, see

Policies (page 99).

When the task is transferred to devices, the policy is silently assigned.

Uninstall policy

Under Select source, select Policies and then select a policy from the list.

In addition to the policies you’ve created in Sophos Mobile, the list includes all policies installed on a managed device.

You can also uninstall a policy that’s not listed if you know its identifier.

You can only uninstall iOS device policies. For other policy types, either update the policy, assign a different policy, or unenroll the device.

Install provisioning profile

Select an app provisioning profile from the list of available profiles. For information on how to add

profiles to this list, see Import iOS provisioning profile

(page 102).

Sophos Mobile

When the task is transferred to devices, the provisioning profile is silently installed.

Uninstall provisioning profile

Under Select source, select Profiles and then select a provisioning profile from the list.

In addition to the profiles that are available on the Sophos Mobile server, the list includes profiles that are in use on the managed devices.

You can also remove a provisioning profile that is not contained in the list. Select Identifier and then enter the identifier of the profile you want to remove from devices.

When the task is transferred to devices, the provisioning profile is silently removed.

Reconfigure SMC app

When the task is transferred to a device, the user is asked to scan a QR code or to enter configuration details manually. This reconnects a previously uninstalled Sophos Mobile Control app to the server.

Note

This task should be preceded by an Install app task for the Sophos Mobile Control app.

Install app

Select an app from the list of available apps. For information on how to add apps to this list, see

Add app (page 292).

When the task is transferred to devices, users receive a notification on their devices that Sophos

Mobile wants to install the app. Users can tap Install to start the process, or Cancel to reject the installation.

If users reject the installation, the task fails.

If the app is already installed on a device that receives the task, it is updated.

Uninstall app

Under Select source, select Apps to select an app from the list of available apps.

In addition to the apps that are available on the Sophos Mobile server, the list includes apps that are in use on the managed devices - with the exception of iOS system apps.

You can also uninstall an app that is not contained in the list. Select Identifier and then enter the bundle ID of the app you want to uninstall from devices.

When the task is transferred to devices, the app is uninstalled silently.

286

Install latest iOS update

When the task is transferred to devices, the latest available update of the iOS software is installed.

Depending on the iOS device model, different updates might be installed.

You can update the iOS software for the following device types:

Sophos Mobile

• Supervised devices

• Supervised Apple DEP devices

For other devices, the task will fail.

Send message

Enter a plain text to be displayed on the devices.

When the task is transferred to devices, the message text is displayed in a notification window.

Users can display past messages in the Sophos Mobile Control app.

Unenroll

When the task is transferred to devices, they are unenrolled from Sophos Mobile. See

Unenroll devices

(page 49). Device users do not need to confirm the operation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Wipe

When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.

CAUTION

Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

15.4 Available macOS task types

The following task types are available for macOS task bundles:

Enroll

When the task is transferred to a device that is already enrolled, the task is skipped.

Assign device policy

Select a policy from the list of available macOS device policies. For information on how to add policies to this list, see

Policies (page 99).

When the task is transferred to devices, the policy is silently assigned to the device. If a device policy is already assigned, it is replaced.

Sophos Mobile

Assign user policy

Select a policy from the list of available macOS user policies. For information on how to add policies to this list, see

Policies

(page 99).

When the task is transferred to devices, the policy is silently assigned to the device. If a user policy is already assigned, it is replaced.

User policies are applied to users the next time they log in to the Mac.

Install app

Select an app from the list of available apps. For information on how to add apps to this list, see

Add app (page 292).

When the task is transferred to devices, the app is silently installed.

PKG package files might contain several apps. In this case, all apps are installed.

Note

A Successful task state means the device has started to download the app. To verify that the app was installed successfully, synchronize the device and check the list of installed apps on the device details page.

Unassign VPP app

Select an app from the list of available macOS VPP apps.

When the task is transferred to devices, the VPP license is removed from devices that have it assigned.

Users can continue to use the app for 30 days.

Unenroll

When the task is transferred to devices, they are unenrolled from Sophos Mobile. See

Unenroll devices

(page 49). Device users do not need to confirm the operation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Wipe

Set a 6-digit system lock PIN.

When the task is transferred to a Mac, it restarts and then begins wiping the disk. The user must enter the system lock PIN on the Mac to unlock it.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Sophos Mobile

CAUTION

Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.

Tip

In Sophos Mobile Admin, the macOS system lock PIN is displayed on the device page under

Device properties > Unlock passcode and on the Task details page under Lock PIN.

15.5 Available Windows task types

The following task types are available for Windows task bundles:

Enroll

When the task is transferred to a device that is already enrolled, the task is skipped.

Assign policy

Select a policy from the list of available device policies. For information on how to add policies to this list, see

Policies

(page 99).

When the task is transferred to devices, the policy is silently assigned to the device. If a device policy is already assigned, it is replaced.

Install app

Select an app from the list of available apps. For information on how to add apps to this list, see

Add app (page 292).

When the task is transferred to devices, the app is installed silently.

If the app is already installed on a device that receives the task, it is updated.

Uninstall app

Select an app from the list of available apps.

The list includes apps you have configured on the Sophos Mobile server and apps installed on any of the managed Windows computers - with the exception of Windows system apps.

When the task is transferred to devices, the selected app is uninstalled silently.

Sophos Mobile

Note

You can only uninstall apps that have been installed by Sophos Mobile. If you try to uninstall an app installed by the user, the task fails.

Unenroll

When the task is transferred to devices, they are unenrolled from Sophos Mobile. See

Unenroll devices

(page 49). Device users do not need to confirm the operation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Wipe

When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.

CAUTION

Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

15.6 Available Chrome OS task types

The following task types are available for Chrome OS task bundles:

Enroll

When the task is transferred to a device that is already enrolled, the task is skipped.

Assign policy

Select a policy. For information on how to add policies to this list, see

Policies (page 99).

When the task is transferred to devices, the policy is silently assigned.

Send message

Enter a plain text to be displayed on the devices.

When the task is transferred to devices, the message text is displayed in a notification window.

Users can display past messages in the Sophos Chrome Security extension.

Sophos Mobile

Unenroll

When the task is transferred to devices, they are unenrolled from Sophos Mobile. See

Unenroll devices

(page 49). Device users do not need to confirm the operation.

15.7 Duplicate task bundles

You can duplicate a task bundle to use it as a starting point for other task bundles.

When you need to create similar task bundles it is easier to duplicate an existing task bundle and edit the duplicate.

To duplicate a task bundle:

1. On the menu sidebar, under CONFIGURE, select Task bundles and then select a device platform.

2. On the Task bundles page, select the blue triangle next to the task bundle you want to duplicate and then select Duplicate.

The task bundle is duplicated.

15.8 Transfer task bundles

You can transfer task bundles to individual devices or to device groups.

1. On the menu sidebar, under CONFIGURE, click Task bundles and then click Android or iOS.

The Task bundles page is displayed.

2. Click the blue triangle next to the required task and then click Transfer.

The Select devices page is displayed.

3. On this page, you can:

• Select individual devices you want to transfer the task bundle to.

• Click Select device groups, to open the Select device groups page and select one or several device groups for transferring the task bundle.

4. After you have made your selection, click Next.

The Set execution date page is displayed.

5. Under Scheduled date, select Now or specify a date and time for the task to be carried out.

6. Click Finish.

The Task view page is shown.

The task bundle is transferred to the selected devices at the specified date and time.

Sophos Mobile

16 Apps

You configure apps to make them available for installation from Sophos Mobile Admin

(administrator-initiated) or from the Sophos Mobile Control app (user-initiated).

App management is available for the following platforms:

• Android

• iOS

• macOS

• Windows

• Windows Mobile

To make an app available in Sophos Mobile, you can do one of the following:

• Upload the app package to the Sophos Mobile server. This option is not available for Windows

Mobile apps or for devices where Sophos Mobile only manages the Sophos container.

• Provide a link to the app in the relevant app store.

For both options, see section

Add app (page 292).

To install an app on a device, create a task bundle that contains an Install app task. For Android and iOS devices, you can create such task bundles directly from the Apps page. See

Install app

(page 293).

Note

To be able to install app packages that are stored on the Sophos Mobile server (in contrast to the installation from the app store), the following conditions must be met:

• For Android, the Android security setting Unknown sources must be enabled on the devices.

When you try to install an APK file when Unknown sources is disabled, the Sophos Mobile

Control app will direct the users to the page where they can enable the setting. This restriction does not apply to devices with LG GATE, Samsung Knox or Sony Enterprise API.

• For iOS, the installation of apps from IPA files is only possible for self-developed apps. When the app is ready for distribution, you must create a provisioning profile for the app and make it available on the devices, either installed separately beforehand or included in the app's IPA file. You can use Sophos Mobile to distribute provisioning profiles to your iOS devices. See

Import iOS provisioning profile

(page 102). For details on provisioning profiles, see the iOS

Developer Library.

292

16.1 Add app

You make an app available for installation either by uploading the app package or by linking to the app in the relevant app store.

For apps on Android Enterprise devices, see Approve managed Google Play app (page 328).

To add an app to Sophos Mobile:

1. On the menu sidebar, under CONFIGURE, click Apps and then click the platform for which you want to add the app.

2. Click Add app and then select the required option:

Sophos Mobile

• Android link: Add an Android app by linking to it in Google Play.

• Android package: Add an Android app by uploading the APK file to Sophos Mobile.

• iOS link: Add an iOS app by linking to it in the App Store.

• iOS package: Add an iOS enterprise app by uploading the IPA file to Sophos Mobile.

• macOS package: Add a macOS enterprise app by uploading the PKG file to Sophos Mobile.

• Windows Mobile link: Add a Windows Mobile app by linking to it in Microsoft Store.

• Windows MSI link: Add a Windows app by linking to its MSI installation file.

• Microsoft Store link: Add a Windows app by linking to it in Microsoft Store.

3. For iOS and macOS VPP apps, click Import VPP apps to load the list of apps you’ve purchased

through the Apple Volume Purchase Program (VPP). See Manage Apple VPP apps (page 305).

4. Configure the app settings as required.

5. Click Save to save the app settings and to return to the Apps page.

The app is available for installation. It is displayed on the Apps page. If you have configured the

Available to device groups field, the app is also displayed in the Enterprise App Store of the Sophos

Mobile Control app from where users can install it. The installation process runs unattended or with very little user interaction.

Note

On devices where Sophos Mobile only manages the Sophos container, apps that you added by uploading the APK file (for Android apps) or IPA file (for iOS apps) are not available.

Related reference

App settings (Android) (page 295)

App settings (iOS)

(page 297)

App settings (macOS)

(page 299)

App settings (Windows Mobile)

(page 301)

App settings (Windows)

(page 302)

16.2 Install app

After you’ve added an app to Sophos Mobile, you can install it on selected devices or device groups.

These instructions don’t apply to the following devices:

• Android Enterprise devices. To install apps on these devices, see

Install managed Google Play app

(page 333).

• Devices where Sophos Mobile only manages the Sophos container. You can only install Sophos

Secure Workspace and Sophos Secure Email on these devices. See Manage Sophos container apps (page 355).

To install an app:

1. On the menu sidebar, under CONFIGURE, click Apps and then click the platform for which you want to install an app.

2. On the Apps page, click the blue triangle next to the required app and then click Install.

3. Select the devices on which you want to install the app. Do one of the following:

• Select individual devices.

Sophos Mobile

• Click Select device groups and then select one or more device groups.

4. On the Set execution date page, set the date when the app will be installed:

• Select Now for an immediate execution.

• Select Date and then enter a date and a time for a scheduled execution.

5. Click Finish.

The selected app is installed onto the selected devices at the specified date.

Note

On the following devices apps are installed silently, that is without user interaction:

• Supervised iOS devices

• Android Enterprise devices

• Android devices with Samsung Knox

• Android devices with LG GATE

• Android devices with Sony Enterprise API level 8 or later

• Macs

• Windows computers, if you have configured the /quiet installation option for the app.

For the Samsung, LG, and Sony devices listed above, only APK files are installed silently, not apps installed from Google Play.

Tip

You can display the status of the installation task on the Task view page.

Tip

You can also install an app by using one of the following options:

• To install an app on a single device: On the device’s Show device page, select the Installed

apps tab and click Install app.

• To install an app on several devices: On the Devices page, select the required devices and then click Actions > Install app.

• To install an app on one or more devices as part of a task bundle: Add an Install app task to the task bundle and transfer it to the required devices or device groups.

294

16.3 Uninstall app

You can uninstall an app from selected devices or device groups.

These instructions don’t apply to the following devices:

• Android Enterprise devices. To uninstall apps from these devices, see

Uninstall a managed Google

Play app

(page 333).

• Devices where Sophos Mobile only manages the Sophos container.

To uninstall an app:

1. On the menu sidebar, under CONFIGURE, click Apps and then click the platform for which you want to uninstall an app.

Sophos Mobile

2. On the Apps page, click Uninstall.

3. Select the devices from which you want to uninstall an app. Do one of the following:

• Select individual devices.

• Click Select device groups and then select one or more device groups.

4. On the Select app page, select the required app.

5. On the Set execution date page, set the date when the app will be uninstalled:

• Select Now for an immediate execution.

• Select Date and then enter a date and a time for a scheduled execution.

6. Click Finish.

The selected app is uninstalled from the selected devices at the specified date.

Note

On the following devices apps are uninstalled silently, that is without user interaction:

• Managed apps on supervised iOS devices

• Windows computers, if you have configured the /quiet installation option for the app.

Tip

Alternatively, you can use the following procedure to uninstall an app from a single device: Open the device's Show device page, go to the Installed apps tab and then click the trash can icon next to the app name.

16.4 App settings (Android)

For apps on Android Enterprise devices, see Settings for managed Google Play apps

(page 330).

General settings

Setting/Field

Name

Version

App ID

Description

The name of the app.

The version that is displayed in the Enterprise

App Store.

For app links, Sophos Mobile uses the version from Google Play.

The internal identifier of the app.

For app links, click Get data to get the value from Google Play.

For app packages, Sophos Mobile gets the value from the APK file.

Sophos Mobile

Setting/Field

App category

Available to device groups

Description

Install in Knox container

Settings for app links

Setting/Field

Link

Description

A category name, for example Productivity .

When you make the app available in the

Enterprise App Store, the app will be listed in a section with that name.

You can make the app available in the

Enterprise App Store so that its installation can be initiated by the user. Click Show and select one or more device groups for which the app will be listed in the Enterprise App Store.

The app description displayed in the Enterprise

App Store.

You may use the placeholder

%_appstoretext_% anywhere in your description text. In the Enterprise App Store, this is replaced by the actual app description from

Google Play.

For Samsung Knox devices, the app will be installed inside the Knox container.

This setting is only available if you have configured a Samsung Knox license.

Description

The URL of the app in Google Play.

To determine the URL, click Go to Google Play to open Google Play in a new browser tab and navigate to the app page. Then copy the URL from the tab's address bar and paste it into the

Link field.

After you’ve entered the URL, click Get data to fill out the App ID field automatically.

Sophos Mobile

Settings for app packages

Setting/Field

Upload a file

Description

Click Upload a file to upload the app to the

Sophos Mobile server. Navigate to the APK file and click Open.

Tip

Alternatively, drag the file from File Explorer to the

Upload a file area.

Related tasks

Add app

(page 292)

You make an app available for installation either by uploading the app package or by linking to the app in the relevant app store.

16.5 App settings (iOS)

General settings

Setting/Field

Name

Version

App ID

App category

Description

The name of the app.

For Apple VPP apps, this field is read-only.

The version that is displayed in the Enterprise

App Store.

For app links, Sophos Mobile uses the version from the App Store.

For Apple VPP apps, this field is read-only.

The internal identifier of the app.

Sophos Mobile gets this from the App Store or from the IPA file.

For Apple VPP apps, this field is read-only.

A category name, for example Productivity .

When you make the app available in the

Enterprise App Store, the app will be listed in a section with that name.

Sophos Mobile

Setting/Field

Available to device groups

Description

Description

You can make the app available in the

Enterprise App Store so that its installation can be initiated by the user. Click Show and select one or more device groups for which the app will be listed in the Enterprise App Store.

The app description displayed in the Enterprise

App Store.

You may use the placeholder

%_appstoretext_% anywhere in your description text. In the Enterprise App Store, this is replaced by the actual app description from the App Store.

Settings for app links

Setting/Field

Search in App Store

Link

Sophos Mobile managed installation

Description

Click Search in App Store to search for the app in the App Store database.

When you select an app in the search results list, the following fields are filled out automatically:

• App ID

• App category

• Link

The URL of the app in the App Store.

To determine the URL, click Obtain link to open iTunes Link Maker in a new browser tab.

Navigate to the app in Link Maker, and then copy the URL displayed under Direct Link into the Link field in Sophos Mobile Admin.

For Apple VPP apps, this field is read-only.

The app is installed as a managed app.

This setting only affects apps the user installs from the Enterprise App Store. Apps you install from Sophos Mobile Admin are always managed apps.

Note that managed apps can’t be installed from the Enterprise App Store on devices where

Sophos Mobile only manages the Sophos container.

Setting/Field

Settings and VPN

VPP licenses

Sophos Mobile

Description

Click Show to configure a VPN connection that is used when the app is started, or to configure custom app settings.

Click Show to manually assign the app to users or devices. See

Manually assign VPP apps

(page 308).

Settings for app packages

Setting/Field

Upload a file

Description

Click Upload a file to upload the app to the

Sophos Mobile server. Navigate to the IPA file and click Open.

Tip

Alternatively, drag the file from File Explorer to the

Upload a file area.

Related concepts

Managed apps for iOS (page 304)

iOS apps can be installed as managed or as unmanaged apps.

Related tasks

Add app

(page 292)

You make an app available for installation either by uploading the app package or by linking to the app in the relevant app store.

16.6 App settings (macOS)

General settings

Setting/Field

Name

Description

The name of the app.

For app packages, Sophos Mobile gets this from the PKG file.

For Apple VPP apps, this field is read-only.

Sophos Mobile

Setting/Field

Version

App ID

App category

Description

Description

The app version from the App Store.

For app packages, Sophos Mobile gets this from the PKG file.

For Apple VPP apps, this field is read-only.

The internal identifier of the app.

For app packages, Sophos Mobile gets this from the PKG file.

For Apple VPP apps, this field is read-only.

A category name, for example Productivity .

The value is currently not used.

A description of the app.

The value is currently not used.

Settings for VPP app links

Setting/Field

Link

VPP licenses

Description

The URL of the app in the App Store.

For Apple VPP apps, this field is read-only.

Click Show to manually assign the app to users or devices. See

Manually assign VPP apps

(page 308).

Settings for app packages

Setting/Field

Upload a file

Description

Click Upload a file to upload the app to the

Sophos Mobile server. Navigate to the PKG file and click Open.

Note

PKG package files might contain several apps. In this case, only the name, version, and identifier of one app are displayed.

Sophos Mobile

16.7 App settings (Windows Mobile)

Setting/Field

Name

Version

App category

Description

Available to device groups

Link

Description

The name of the app.

The app version.

Sophos Mobile uses the version from Microsoft

Store.

A category name, for example Productivity .

When you make the app available in the

Enterprise App Store, the app will be listed in a section with that name.

The app description displayed in the Enterprise

App Store.

You may use the placeholder

%_appstoretext_% anywhere in your description text. In the Enterprise App Store, this is replaced by the actual app description from

Microsoft Store.

You can make the app available in the

Enterprise App Store so that its installation can be initiated by the user. Click Show and select one or more device groups for which the app will be listed in the Enterprise App Store.

The URL of the app in Microsoft Store.

To determine the URL, click Go to Microsoft

Store to open Microsoft Store for Windows

Phone apps in a new browser tab and navigate to the app page. Then copy the URL from the tab’s address bar and paste it into the Link field.

Related tasks

Add app

(page 292)

Sophos Mobile

You make an app available for installation either by uploading the app package or by linking to the app in the relevant app store.

16.8 App settings (Windows)

General settings

Setting/Field

Name

Version

App category

Description

Description

The name of the app.

The app version.

For app links, Sophos Mobile uses the version from the Microsoft Store.

A category name, for example Productivity .

A description of the app.

Settings for MSI links

Setting/Field

ProductCode GUID

Link

SHA-256 file hash

Description

The ProductCode GUID of the MSI file.

Note

If you enter a wrong GUID value, the app can’t be uninstalled.

The URL of the MSI file.

The SHA-256 hash value of the MSI file.

Note

If you enter a wrong hash value, the app can’t be installed.

Installation options The command-line options for the msiexec.exe

installer executable.

The default option /quiet installs the app without user interaction.

For more information on these settings, see Determine settings for Windows MSI links

(page 303).

Sophos Mobile

Settings for Microsoft Store links

Setting/Field

Store ID

SKU ID

Package Family Name

Link

Description

The Store ID of the app in Microsoft Store. The value is entered automatically when you click

Get data.

The app’s SKU ID (stock-keeping unit ID) in the

Microsoft Store catalog.

Apps might have different SKU IDs for full and trial versions, or for different market regions.

If you don’t know the SKU ID for an app, use the default value 0010 .

The Package Family Name (PFN) of the app.

The value is entered automatically when you click Get data.

The URL of the app in Microsoft Store.

To determine the URL, click Go to Microsoft

Store to open Microsoft Store for Windows apps in a new browser tab and navigate to the app page. Then copy the URL from the tab's address bar and paste it into the Link field.

After you have entered the URL, click Get data to fill out the following fields automatically:

• Product ID

• Package Family Name

Related tasks

Add app

(page 292)

You make an app available for installation either by uploading the app package or by linking to the app in the relevant app store.

16.9 Determine settings for Windows MSI links

This section provides guidance on how to determine the app settings for Windows MSI links.

• ProductCode GUID

—

If you already have the Microsoft Windows SDK installed, use the included

Orca program to get the ProductCode value of an MSI file. For an example, see the description on the web page Use Orca to find MSI file GUID product code .

Alternatively, use a PowerShell script. Such scripts can be found on the internet, for example on the web page How to get MSI file information with PowerShell .

Sophos Mobile

Note

The value you enter in the ProductCode GUID field must not include surrounding brackets.

• SHA-256 file hash

—

Use the Get-FileHash PowerShell command to get the SHA-256 hash value of an MSI file:

PS> Get-FileHash <path-to-MSI-file>

For more information on the Get-FileHash command, see the Microsoft web page Get-

FileHash .

• Installation options

—

For information on the available command-line options for installing MSI files, see the Microsoft web page Standard Installer Command-Line Options .

Related reference

App settings (Windows)

(page 302)

16.10 Managed apps for iOS

iOS apps can be installed as managed or as unmanaged apps.

You can check an app’s management status on the Installed apps tab of the Show device page.

Differences between managed and unmanaged apps

• When a user installs an app from the Enterprise App Store, an installation task is created and processed in Sophos Mobile. For unmanaged apps, the user is redirected to the Apple App Store.

• You can uninstall managed apps in Sophos Mobile Admin. This is not possible for unmanaged apps.

• On supervised iOS devices, managed apps are installed and uninstalled silently, that is without user interaction.

• Some iOS device policy settings are only available for managed apps.

• Managed apps are automatically uninstalled when the device is unenrolled from Sophos Mobile.

Unmanaged apps remain installed.

Installing a managed app

You have the following options to install a managed app:

• Install the app in Sophos Mobile Admin.

• Turn on Sophos Mobile managed installation in the app settings and let the user install the app from the Enterprise App Store.

The second option is not available for apps you’ve added to Sophos Mobile by uploading the IPA package file or for devices where Sophos Mobile only manages the Sophos container.

Sophos Mobile

Changing an unmanaged app to a managed app

To change the status of an already installed app from “unmanaged” to “managed”, turn on Sophos

Mobile managed installation in the app settings and create an installation task. This will not install the app again but will make it a managed app.

16.11 Manage Apple VPP apps

You can use the Apple Volume Purchase Program (VPP) to buy iOS and macOS app licenses. You can then distribute these within your organization.

After the order is completed you can download a service token (sToken). This contains the licenses for the purchased apps.

Assigning VPP apps to users or devices

For iOS, you can choose to assign a VPP app to a user or to a device. For macOS, you assign VPP apps to devices:

• When you assign an iOS VPP app to users, they can install it on all iPhones and iPads enrolled with Sophos Mobile that are connected to their Apple ID.

• When you assign an iOS VPP app to a device, you don’t need to associate it with an Apple ID.

• When you assign a macOS VPP app to a Mac, it’s available to all users that sign in to that Mac.

See

Manually assign VPP apps

(page 308) and Automatically assign VPP apps (page 309).

Inviting users to Apple VPP

Before you can assign a VPP app to a user, you must invite them to VPP. See

Invite users to Apple

VPP (page 306).

You don’t need to invite devices to VPP.

Installing VPP apps

You install VPP apps in Sophos Mobile Admin, the same way you install other apps. See

Install app

(page 293).

Users can install iOS VPP apps from the list of purchased apps in their App Store app. This is not possible for macOS VPP apps.

Unassigning VPP apps

You unassign a VPP app in the following ways:

• You deselect the required users or devices on the app’s details page.

• iOS apps: You deselect the app on a user’s details page.

• macOS apps: You transfer a task bundle with an Unassign VPP app task to the device.

Sophos Mobile

VPP licenses are automatically released in the following situations:

• The app is uninstalled from the device.

• The device is unenrolled from Sophos Mobile.

Tip

When you unassign a VPP app, users can continue to use it for 30 days.

16.11.1 Set up Apple VPP

To set up Apple VPP, upload a token from Apple Business Manager to Sophos Mobile and configure app assignment settings.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple VPP tab.

2. Open Apple Business Manager at https://business.apple.com

and sign in with your Apple

ID.

3. Go to Settings > Apps and Books.

4. Under My Server Tokens, click Download.

If you’ve set up several locations for your organization in Apple Business Manager, click

Download next to the location that matches your Sophos Mobile customer.

5. Optional: Move the token file to a location that you can access from Sophos Mobile Admin.

6. In Sophos Mobile Admin, go back to the Apple VPP tab , click Upload a file, select the token file and then click Open.

Sophos Mobile reads in the file and populates the Organization and Expiry date fields from the token details.

7. In Automatically assign VPP apps on installation, configure the automatic assignment of VPP apps. See

Automatically assign VPP apps

(page 309).

8. Optional: Select Automatically update iOS VPP apps assigned to devices to inform the user if there’s an update available for a VPP app. This applies to VPP apps assigned to an iPhone or iPad.

For VPP apps assigned to a user, the user must check the App Store for updates.

9. Optional: Fill in the remaining fields of the Apple VPP tab.

In the Country field, enter your two-letter country code, for example US for the United States.

10. Select Save.

16.11.2 Invite users to Apple VPP

You need to set up an sToken before you can invite users to the Apple Volume Purchase Program

(VPP). See

Set up Apple VPP (page 306).

1. On the menu sidebar, under MANAGE, select People.

2. On the People page, you can invite all users or individual users to Apple VPP:

• To invite all users: a) Click Invite users to Apple VPP at the top of the People page.

b) Click Yes in the confirmation dialog box.

• To invite a single user:

Sophos Mobile a) Click the required user.

b) On the next page, click Invite user to VPP.

c) Click Yes in the confirmation dialog box.

• To invite a single user, when using external user management and the user has no devices enrolled yet: a) Click Search and invite a user to Apple VPP at the top of the People page.

b) In the Search user dialog, search for the user either by name or by email address.

c) In the search result list, select the user that you want to invite to Apple VPP.

d) Click Apply.

Sophos Mobile sends an invitation email to all relevant users.

Users must follow the link in their invitation email to connect their Apple iTunes account with Apple

VPP. Afterward, they can install and use the apps that are licensed by your company.

Note

When you are using external user management and invite all users to Apple VPP, users that do not have an email address assigned will be registered for Apple VPP, but do not receive the link to connect their Apple iTunes account with Apple VPP.

For information on how to complete the VPP registration process in this case, see

Invite users without email address to Apple VPP

(page 307).

16.11.3 Invite users without email address to Apple VPP

This procedure requires a super administrator account, so it does not apply to Sophos Mobile as a

Service.

When you invite users from an external user directory to Apple VPP as described in

Invite users to

Apple VPP

(page 306), users that do not have an email address assigned will be registered for

Apple VPP, but will not receive the link to connect their Apple iTunes account with Apple VPP.

If this happens, perform the following steps to complete the Apple VPP registration process.

1. As Sophos Mobile super administrator, download the server log files.

See the Sophos Mobile super administrator guide .

2. Identify the affected user accounts from the log files.

3. On the menu sidebar of Sophos Mobile Admin, under MANAGE, click People.

4. Click one of the affected users.

5. On the next page, click Show invitation link.

For external users without email address, this function does not send an invitation email, but instead shows the invitation link in a message box.

6. Copy the link from the message box and communicate it to the user.

7. Repeat this for all affected users.

The users need to follow the link to connect their Apple iTunes account with Apple VPP.

Sophos Mobile

308

16.11.4 Manage Apple VPP users

If you’ve set up Apple VPP, the Show user page includes an Apple Volume Purchase Program

(VPP) section.

You can view or edit the Apple VPP status of each user.

• View the Apple VPP user status.

— Registered: The user was invited to Apple VPP but hasn’t connected their Apple iTunes account with Apple VPP yet.

— Associated: The user has connected their Apple iTunes account with Apple VPP and can install VPP apps.

• View the Apple VPP apps the user has installed.

• Invite the user to the program.

An email with an invitation link is sent to the user. If the user account doesn’t contain an email address, the invitation link is displayed in a message box.

• If required, resend the invitation email.

• Deregister the user from Apple VPP.

16.11.5 Manually assign VPP apps

You can assign VPP apps to individual users or devices.

Tip

You can automatically assign an app when it’s installed. See Automatically assign VPP apps (page

309).

1. On the menu sidebar, under CONFIGURE, click Apps > iOS or Apps > macOS.

2. Click Import VPP apps.

This retrieves the app information from the Apple VPP server and creates app entries in Sophos

Mobile, if required.

3. Click the VPP app you want to assign to users or devices.

Tip

VPP apps are marked by a check mark icon in the VPP column.

4. Click Show next to VPP licenses.

5. Select the users or devices you want to assign the app to.

You can choose from all users registered for or associated with Apple VPP, and from all devices with status Managed.

You can assign macOS apps to devices only.

6. Optionally, assign the app to devices by selecting device groups: a) Click Show next to Available to device groups.

b) Select the device groups.

Sophos Mobile

7. By default, iOS VPP apps are installed as managed on the users’ devices. To install an app as unmanaged, clear the Sophos Mobile managed installation check box.

8. Click Save. This also synchronizes the app assignment with the Apple VPP server.

Note

Because the status of VPP apps is managed by the Apple VPP server, it may take some time until changes that you make in Sophos Mobile are visible on the devices.

16.11.6 Automatically assign VPP apps

You can assign VPP apps automatically when they are installed.

For iOS VPP apps, you can decide to assign them to the device or to the user assigned to the device.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple VPP tab.

2. In Automatically assign VPP apps on installation, select one of the following options:

• Prioritize device assignment: iOS VPP apps are assigned to the device. If the device doesn’t support VPP assignment, apps are assigned to the device user.

• Prioritize user assignment: iOS VPP apps are assigned to the device user. If there is no device user, apps are assigned to the device.

• Disabled: You must assign VPP apps manually.

Note

You can’t assign macOS VPP apps to users. Both Prioritize device assignment and

Prioritize user assignment turn on automatic assignment.

16.11.7 Synchronize VPP license information

For performance reasons, Sophos Mobile keeps a local copy of VPP license information. You can trigger Sophos Mobile to synchronize its VPP data with the Apple VPP server.

Note

You only need to synchronize the VPP data if the displayed license information for an app is incorrect.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple VPP tab.

2. Click Clear VPP cache.

Sophos Mobile discards its local VPP information for the customer and synchronizes the data with the

Apple VPP server.

Note

For information on how to display the license information for a VPP app, see Manually assign VPP apps (page 308).

Sophos Mobile

16.12 Assign a VPN connection to an iOS app

When you assign a VPN connection to an iOS app, the app uses that connection for all of its network communication.

Prerequisite: You have created one or more iOS device policies with a Per app VPN configuration.

See Per app VPN configuration (iOS device policy)

(page 195).

To assign a VPN connection to an app:

1. On the menu sidebar, under CONFIGURE, click Apps > iOS.

2. On the Apps page, click the required app.

3. Click Show next to Settings and VPN.

4. In VPN connection used by the app, select a VPN configuration.

The list contains Per app VPN configurations of all iOS device policies.

5. On the Edit settings and VPN page, click Apply.

6. Select Save.

16.13 Add managed app configuration (iOS)

Managed app configuration is a feature of iOS apps that lets you configure an app remotely without physical access to the device on which the app is installed.

Requirements:

• The app developer has implemented managed app configuration.

•

The app was installed as a managed app. See Managed apps for iOS

(page 304).

To add a managed app configuration:

1. On the menu sidebar, under CONFIGURE, click Apps > iOS.

2. On the Apps page, click the required app.

3. Click Show next to Settings and VPN.

4. Under Managed configuration, click Add parameter.

5. Enter the required information.

6. On the Edit settings and VPN page, click Apply.

7. Select Save.

16.14 Windows apps

For Windows computers, Sophos Mobile lists the following apps on the Show device page:

Type

Microsoft Store

Non-store

Description

Universal Windows Platform (UWP) apps installed from the Microsoft

Store or the Microsoft Store for Business and Education.

UWP apps installed from outside the Microsoft Store.

Type

System

Win32

Description

UWP apps that are part of the Windows operating system.

Win32 apps (apps installed from an MSI file).

Sophos Mobile

17 App groups

In Sophos Mobile you create app groups to define list of apps for policies.

App groups are used in the following settings:

• In the App Protection configuration of Android device policies.

• In the App Control configuration of Android device policies.

• In the Restrictions configuration of Android device, iOS device and Knox container policies.

• In the App restrictions configuration of Windows Mobile policies.

• In compliance policies to specify lists of allowed, forbidden and mandatory apps.

For Chrome OS, app groups can contain apps and extensions.

17.1 Create app group

1. On the menu sidebar, under SETTINGS, click App groups and then click the platform for which you want to create the app group.

2. Click Create app group.

3. On the Edit app group page, enter a name for the new app group and then click Add app.

4. Select an app you want to add to the group:

• To select an app from the list of all apps currently installed on your managed devices, click App

list and select an app.

• To add an app manually, click Custom and configure the app details.

Settings for Android apps:

App name

Identifier

Link

A unique name to identify the app.

The package name of the app.

You can get the package name from the app’s URL in Google

Play. For example, the URL of the Sophos Mobile Control app is play.google.com/store/apps/details?

id=com.sophos.mobilecontrol.client.android

and the package name is com.sophos.mobilecontrol.client.android

For apps from managed Google Play (apps for Android

Enterprise devices), put app: in front of the package name.

The URL of the app in Google Play.

Settings for iOS and macOS apps:

App name

Identifier

A unique name to identify the app.

The bundle ID of the app.

Sophos Mobile

Link The URL of the app in the App Store.

Settings for Windows Mobile apps:

App name

Identifier

Link

A unique name to identify the app.

The GUID of the app.

If you don’t know the GUID, fill in the Link field instead.

The URL of the app in Microsoft Store.

For example, the URL of the Sophos Mobile Control app is https://www.microsoft.com/en-us/store/p/ mobile-control-2017/9nblggh51qsj .

Settings for Windows apps:

App name

Identifier

Link

A unique name to identify the app.

The ID of the app as reported by Windows.

For MSI apps, this is the ProductCode GUID of the MSI file.

For Microsoft Store apps, this is the Package Family Name

(PFN) of the app.

The URL of the app in Microsoft Store.

Settings for Chrome OS apps and extensions:

App name A unique name to identify the app.

Identifier The package name of the app.

You can get the package name from the app’s URL in the

Chrome Web Store.

5. Click Add.

6. Optional: Repeat the previous steps to add more apps.

7. Click Save to save the app group.

17.2 Import app group

You can create an app group by importing a list of apps from a CSV file.

You can import up to 10,000 apps.

The CSV file must have the following specification:

• The first row is treated as a header and is not imported.

• Values must be separated by semicolon, not by comma.

• All rows must have the correct number of semicolon characters, even if you leave out optional values.

Sophos Mobile

• The file extension must be .csv

• To ensure that non-English characters are imported correctly, the file must be UTF-8 encoded.

Tip

On the Import apps page, click Example CSV to download a sample file.

To import apps from a CSV file and add them to an app group:

1. On the menu sidebar, under SETTINGS, click App groups and then click the platform for which you want to create the app group.

2. On the App group page, click Create app group.

3. On the Edit app group page, enter a Name for the new app group and then click Import apps.

4. On the Import apps page, click Upload a file and then navigate to the CSV file that you have prepared.

The entries are read in from the file and are displayed.

6. Click Finish to add the apps to the app group.

7. On the Edit app group page, click Save.

Sophos Mobile

18 Corporate documents

Note

This feature requires a license of type Mobile Advanced.

In Sophos Mobile, you can upload files for distribution to the devices of your users.

• Documents managed in Sophos Mobile are automatically added to the Corporate Documents storage provider in Sophos Secure Workspace.

• You can assign a category to each document from the Corporate Documents storage provider.

• Documents from the Corporate Documents storage provider are read only.

• If Sophos Secure Workspace is not managed by Sophos Mobile, the Corporate Documents storage provider is not available.

To distribute corporate documents:

1. Install the Sophos Secure Workspace app onto the devices. See

Apps

(page 292).

2. Assign a Sophos container policy with a Corporate Documents configuration.

3. Upload documents to Sophos Mobile.

18.1 Add corporate documents

Note

This feature requires a license of type Mobile Advanced.

To distribute documents to devices:

1. On the menu sidebar, under CONFIGURE, click Documents.

The Documents page is displayed.

2. Click Add document.

The Edit document page is displayed.

3. In the Category field, enter the category under which the document is displayed in the Corporate

Documents storage provider on the device.

If you leave this field blank, the file will be shown in the root folder of the Corporate Documents storage provider.

4. Define settings for the document:

• Select Copy to clipboard to allow users to copy the document to the clipboard.

• Select Share document to allow users to share the document.

• Select Use document offline to allow users to add the document to the Favorites list.

When an unencrypted document from Corporate Documents is added to the Favorites list, the local copy is stored encrypted. When sharing the document is allowed, the file is automatically decrypted before it is forwarded to other apps. If you clear the Use document

offline check box, local copies are automatically removed during the next synchronization.

5. Click Show next to Assigned groups and select the group that should have access to the document.

Sophos Mobile

6. Add a description for the document.

7. Click Upload a file and navigate to the document. Select it and click Open.

8. Repeat this step for each document you want to distribute.

The document is added to the documents list. It is distributed to the users, who can view it in the

Sophos Secure Workspace app.

Sophos Mobile

19 Android Enterprise

Android Enterprise simplifies the management of Android devices in a corporate environment.

Restriction

Android Enterprise isn’t available for Android 5.1.1 or earlier.

Android Enterprise devices enrolled with Sophos Mobile can have one of the following management modes:

Full device management

On an Android Enterprise fully managed device, Sophos Mobile can monitor and manage all settings, apps and data.

Android Enterprise full device management differs from the Android device administrator permission in the following ways:

• Users have a simplified enrollment experience.

• Users don’t need to set up a personal Google account on the device.

• Users can only install apps from managed Google Play, and you can configure the store layout.

• Only a minimum set of apps is enabled by default: Google Play Store, Contacts, Messages, Phone.

• You can install, uninstall or update apps without user interaction.

• You can configure app permissions so that users are not asked to grant permissions at runtime.

• For apps that support it, you can configure custom app settings.

• You can reset the screen lock password.

• You can configure a kiosk mode that restricts app usage to a selection of apps, not just a single app.

• You can only enroll devices that have not been set up yet, or that have been reset to their factory settings.

• There is no dedicated unenroll action. To unenroll a device, wipe it.

Work profile management

On an Android Enterprise work profile device, Sophos Mobile can only monitor and manage settings, apps and data within the work profile.

Work profile management is suitable for BYOD (bring your own device) scenarios.

Dedicated device management

An Android Enterprise dedicated device, formerly called a COSU (corporate-owned single-use) device, is locked to a single app or a set of apps. Use this for devices that serve a special purpose, for example a kiosk application.

Sophos Mobile

To set up a dedicated device, assign a Kiosk mode configuration to a fully managed device.

Related reference

Kiosk mode configuration (Android Enterprise device policy)

(page 119)

With the Kiosk mode configuration you turn on Android Enterprise dedicated device management.

Related information

Android Enterprise help (external link)

How to configure Sophos Mobile to set up device in the “corporate-owned, single-use” mode (Sophos knowledge base article 133409)

19.1 Set up Android Enterprise - Overview

To set up Android Enterprise for your organization, you can choose between two different scenarios:

Managed Google Play Account scenario

This is the easiest method to set up Android Enterprise for your organization.

• Sophos Mobile guides you through the process of setting up an Android Enterprise account for your organization.

• If required, you can create multiple Android Enterprise accounts for your organization.

• Sophos Mobile manages the whole user account lifecycle.

• Devices can be enrolled in the Self Service Portal or in Sophos Mobile Admin.

Managed Google Domain scenario

Use this method if you already have a Managed Google Domain or if you want to manage the accounts of your Android Enterprise users outside of Sophos Mobile.

• You register a Managed Google Domain with Google and prove domain ownership.

• You bind Sophos Mobile as third-party EMM (Enterprise Mobility Management) software to your

Managed Google Domain.

• Sophos Mobile creates user accounts as needed. Other than that, Sophos Mobile does not manage the account lifecycle.

• Devices can only be enrolled in the Self Service Portal, not in Sophos Mobile Admin.

Note

You can’t change the user management mode after you’ve set up Android Enterprise. For example, you can’t switch from internal user management to an external LDAP directory.

Tip

After you’ve set up Android Enterprise, you can check the active scenario under Setup > Android

setup > Android Enterprise > Android Enterprise mode.

Sophos Mobile

19.2 Set up Android Enterprise (Managed Google

Play Account scenario)

Sophos Mobile guides you through the procedure to set up Android Enterprise for your organization.

1. On the menu sidebar, under SETTINGS, select Setup > Android setup and then the Android

Enterprise tab.

2. Select Configure.

3. Select “Managed Google Play Account” scenario and then Next.

4. Select Register account.

This redirects you to a Google website where you register your organization with Android

Enterprise.

5. Sign in to the Google website with your Google account.

Note

We recommend that you create a new Google account for this purpose.

6. On the Google website, follow the steps to register your organization.

Tip

When specifying your organization name, we recommend that you include the term Sophos

Mobile and your Sophos Mobile customer name. For example:

Organization name (Sophos Mobile/Customer name)

After you have completed the registration steps, the Google website redirects you back to Sophos

Mobile.

7. In Sophos Mobile, select Finalize setup to complete the registration process.

This completes the procedure to set up Android Enterprise for your organization.

Note

After you’ve set up Android Enterprise you can’t change the user management mode, for example from internal user management to an external LDAP directory.

Sophos Mobile

320

19.3 Set up Android Enterprise (Managed Google

Domain scenario)

If you already have a Managed Google Domain or if you want to manage the accounts of your Android

Enterprise users outside Sophos Mobile, set up Android Enterprise with the Managed Google Domain scenario.

Note

After you’ve set up Android Enterprise you can’t change the user management mode, for example from internal user management to an external LDAP directory.

To set up Android Enterprise with the Managed Google Domain scenario, do as follows.

Register domain with Google

Note

If you already have a Managed Google Domain, for example because you have signed up for

G Suite (formerly Google Apps), you can skip this step.

Note

If you want to configure Android Enterprise for more than one customer in Sophos Mobile, you need a separate domain for each customer.

1. Open Google’s Sign up for Android Enterprise web page.

You can find the link in related information.

2. Enter the required information.

• Under What’s your business’s domain name?, enter the domain that will be used as the

Managed Google Domain. For example, you could use the domain of your Sophos Mobile server.

• Under How you’ll sign in, enter the credentials for a new domain administrator.

Note

Make a note of the credentials as you will need them later in the setup procedure.

3. Click the button to create the domain administrator account.

This opens the Google Admin console.

4. In the Google Admin console, start the procedure to verify your domain ownership.

Follow the instructions provided by Google to verify your domain.

After your domain ownership is verified, you receive a token to connect your Managed Google Domain with your third-party EMM provider, that is, with Sophos Mobile.

Related information

Sophos Mobile

Create Google service account

A Google service account is a special type of Google account for an application. This account is used by Sophos Mobile to communicate with the Google APIs.

Create a project:

1. Sign in to the Google API console with your domain administrator account.

You can find the link in related information.

2. In the header bar of the Google API console, click Select a project > New project.

If there’s already a project selected, click its name and then New project.

3. In the New project dialog, enter a project name, for example Android Enterprise , and then click Create.

4. Optional: If the header bar shows another project, click its name and then select the new project.

Enable the Admin SDK API:

5. Click the Navigation menu button in the top left corner and then APIs & Services > Library.

6. On the Welcome to the API Library page, enter the string admin sdk in the search field.

7. In the search result list, click Admin SDK.

8. On the Admin SDK page, click Enable.

Enable the Google Play EMM API:

9. On the Welcome to the API Library page, enter the string emm in the search field.

10. In the search result list, click Google Play EMM API.

11. On the Google Play EMM API page, click Enable.

Create a service account:

12. On the Google Play EMM API page, click Create credentials.

13. In step one of the Add credentials to your project page, click the service account link.

14. On the Service Accounts page, click Create Service Account.

15. In Service account name, enter a name to identify the service account, for example Android

Enterprise .

16. Click Create.

17. On the Service account permissions page, click Continue.

18. On the Grant users access to this service account page, click Create key.

19. Select JSON and then click Create.

The private key for your service account is generated and saved to your computer in a JSON file.

Store the JSON file in a secure location. You need it to bind Sophos Mobile to your Managed

Google Domain.

20. Click Done.

21. On the Service accounts page, click the email address of the service account you’ve created.

22. On the Service account details page, click Edit.

23. Expand the Show domain-wide delegation section and then select Enable G Suite Domain-

wide Delegation.

24. In Product name for the consent screen, enter for example Sophos Mobile .

25. Click Save.

Configure API access:

26. Sign in to the Google Admin console with your domain administrator account.

You can find the link in related information.

Sophos Mobile

27. Click Security > Advanced settings.

You may need to click Show more to display Advanced settings.

28. Click Manage API client access.

29. Open the JSON file in a text editor and copy the client_id value into the Client Name field.

For example, if your JSON file contains a line "client_id": "123456789" , then enter

123456789 in the Client Name field.

30. In One or more API Scopes, enter the following (without line break): https://www.googleapis.com/auth/admin.directory.user, https:// www.googleapis.com/auth/androidenterprise

31. Click Authorize.

Related information

Google API console

Google Admin console

Bind Sophos Mobile to your Managed Google Domain

1. Sign in to Sophos Mobile Admin.

2. On the menu sidebar, under SETTINGS, select Setup > Android setup and then the Android

Enterprise tab.

3. Click Configure.

4. Select “Managed Google Domain” scenario and then click Next.

5. Configure the following settings:

Option

Business domain

Domain administrator

EMM token

Description

Your Managed Google Domain that has been verified to Google.

The name of your domain administrator account. This is the administrator that you created when you registered your domain with

Google.

The token that you received from Google after you verified your domain ownership.

You can view the token when you sign in to the Google Admin console with your domain administrator account and go to Security >

Manage EMM provider for Android.

6. Click Upload a file and select the JSON file that you downloaded from Google when creating the service account.

The JSON file that you select must have an extension .json

7. Click Bind.

Sophos Mobile contacts the Google web service to bind itself as an EMM provider to your Managed

Google Domain.

Sophos Mobile

Configure Google EMM settings

1. Sign in to the Google Admin console with your domain administrator account.

You can find the link in related information.

2. Click Security and then click Manage EMM provider for Android.

You may need to click Show more to display Manage EMM provider for Android.

3. Under General Settings, select Enforce EMM policies on Android devices.

Related information

Google Admin console

19.4 Configure Android Enterprise device enrollment

Prerequisites:

• You have configured Android Enterprise for the customer.

Complete the following steps to configure device enrollment for Android Enterprise.

1. Create a policy for each Android Enterprise device type you want to use.

• For Android Enterprise fully managed devices, create a policy of type Android Enterprise

device policy.

• For Android Enterprise work profile devices, create a policy of type Android Enterprise work

profile policy.

2. Create a task bundle for each Android Enterprise device type you want to use.

The task bundle must contain at least an Enroll task and an Assign policy task for the policy you created earlier.

3. In the Self Service Portal group settings, select the task bundle you have created as the initial package.

You can configure different packages for corporate and personal devices. For example, use full device management for corporate devices and work profile management for personal devices.

4. Approve the Sophos Mobile Control app in Managed Google Play.

Otherwise, the app won’t update automatically.

After you’ve configured device enrollment, Self Service Portal users can enroll their Android devices with Sophos Mobile.

If you’ve set up Android Enterprise for the Managed Google Play Account scenario, you can also enroll devices using the Add device wizard.

For the Managed Google Play Account scenario, a user can only have ten devices enrolled at the same time. This limit is set by Google and might change in the future.

Related tasks

Create policy

(page 101)

Sophos Mobile

You create policies to configure settings for devices. Create several policies if you want to manage different types of devices.

Create task bundle

(page 281)

You create separate task bundles for Android, iOS, and other device platforms you want to manage.

Create Self Service Portal configurations (page 27)

With a Self Service Portal configuration, you configure the types of devices that users can enroll, the enrollment details, and the device actions they can perform in the Self Service Portal.

Approve managed Google Play app

(page 328)

To make an app available to your users, you must approve it.

Enroll Android Enterprise devices

(page 47)

For Android Enterprise, devices are usually enrolled in the Self Service Portal.

19.5 Manage users for Android Enterprise

(Managed Google Domain scenario)

Note

This topic describes the management of Google user accounts if you have set up Android

Enterprise using the Managed Google Domain scenario.

For the Managed Google Play Account scenario, Sophos Mobile transparently manages the

Google accounts of your users.

A user must have a Managed Google Account to enroll an Android Enterprise device. This account is connected to the domain that you registered with Google.

Account names are formed like an email addresses, for example user@your_managed_Google_domain .

When a user enrolls a device in the Self Service Portal, Sophos Mobile checks if a Managed Google

Account for the user already exists on the Google server. For this, the left part of the user’s email address in Sophos Mobile is combined with your Managed Google Domain. If an account with that name does not exist, Sophos Mobile creates it.

Example: If the user’s email address in Sophos Mobile is user@your_company.com

and your

Managed Google Domain is your_managed_Google_domain , Sophos Mobile checks the Google server for an account user@your_managed_Google_domain .

Other than creating a Managed Google Account for the user during enrollment, Sophos Mobile does not manage the account lifecycle. If you delete the user account in Sophos Mobile, the user’s

Managed Google Account remains.

You can manage the accounts for your Managed Google Domain from the Google Admin console.

If required, you can create accounts from your LDAP directory, using Google Apps Directory Sync

(GADS).

Related information

Google Admin console (external link)

About Google Apps Directory Sync (external link)

Sophos Mobile

19.6 Lock work profile

You can lock or unlock the work profile in Sophos Mobile Admin. When the work profile is locked, all apps in the work profile are unavailable and no notifications are displayed for these apps.

Restriction

These instructions don’t apply to Android Enterprise fully managed devices.

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the blue triangle next to the device for which you want to lock or unlock the work profile and then click Show.

3. Click Actions > Set container access.

4. Select the access permissions.

• Deny: The work profile is locked. Users can no longer access apps or data within the work profile.

• Allow: The work profile is unlocked.

• Auto mode: The work profile is locked if the device violates a compliance rule that contains a

Lock container action. This is the default behavior if you have not set an access permission.

5. Click Yes.

The device is synchronized with the Sophos Mobile server. Once this is complete the setting is applied to the device.

Tip

To lock the whole device instead of just the work profile, use Actions > Lock.

Tip

Users can lock the work profile from the Quick Settings panel on their device, for example when they are on leave.

19.7 Remove work profile from device

Restriction

These instructions don’t apply to Android Enterprise fully managed devices.

You can remove the work profile in Sophos Mobile Admin to delete corporate data from the device in case of lost or theft.

When you remove the work profile from the device, all apps installed in the work profile, including the

Sophos Mobile Control app, are also removed. In Sophos Mobile Admin, the device is displayed with status Unenrolled.

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the blue triangle next to the device from which you want to remove the work profile and then click Show.

3. Click Actions > Wipe Android work profile.

Sophos Mobile

A task to remove the work profile is created and transferred to the device.

Note

If the user has already removed the work profile manually, the task fails as the device cannot receive it anymore.

To re-create the work profile, the user must repeat the enrollment in the Self Service Portal.

19.8 User-initiated work profile removal

Users can remove the work profile from their device, either accidentally or intentionally. Sophos

Mobile is unable to detect this type of removal. It continues to display the device management status as Android Enterprise work profile management.

After the user has removed the work profile, the device cannot synchronize with the Sophos Mobile server.

Tip

You can use the Devices not synchronized in last 7 days report to identify potentially affected devices.

If the work profile was removed accidentally, it can be re-enrolled as follows:

1. You delete the device from Sophos Mobile.

2. The user repeats the device enrollment in the Self Service Portal.

19.9 Android Factory Reset Protection

Factory Reset Protection (FRP) is an Android security feature that prevents unauthorized access after a factory reset.

Restriction

These instructions only apply to Android Enterprise fully managed devices.

When a Google account is set up on a device, the account credentials are required to unlock the device after it was reset to its factory settings.

Android Enterprise fully managed devices aren’t secured by FRP by default because there’s no

Google account set up on the device. To use FRP for these devices, configure one or more Google accounts to be assigned to all of your devices. When a device is reset with FRP turned on, it can only be unlocked by one of these accounts.

When you have configured FRP, devices are protected as follows:

• Local reset:

When the device is reset in the Settings app or by using the device hardware buttons, FRP is turned on by default. To change this behavior for individual devices, use the Set Factory Reset

Protection device action.

• Remote reset:

Sophos Mobile

When the device is reset remotely in Sophos Mobile Admin, FRP is turned off by default. To perform a remote reset with FRP turned on, select Turn on Factory Reset Protection in the wipe confirmation dialog.

19.9.1 Configure Android Factory Reset Protection

Restriction

These instructions only apply to Android Enterprise fully managed devices.

Factory Reset Protection (FRP) is an Android security feature that ensures a device can only be reset to its factory settings when the Google account credentials are known.

You can configure Google accounts to unlock any Android Enterprise fully managed device that was reset with FRP turned on.

Prepare your Google accounts:

1. Create one or more Google accounts you want to use for FRP, or use existing accounts.

Warning

Make sure you share the account credentials with your organization. These are required to unlock a device that was reset to its factory settings with FRP turned on.

2. Get the internal Google IDs of your accounts.

a) Go to https://accounts.google.com/Login b) Sign in with the Google account you want to use for FRP. If you’re already signed in with a different account, sign out first.

c) Go to https://developers.google.com/people/api/rest/v1/people/get d) In the Try this API section, enter people/me in the resourceName field and names in the

personFields field.

e) Select Execute.

This calls the Google API.

In the response, the internal Google ID is the 21-digit number in a line like the following:

"resourceName": "people/123456789012345678901"

Configure your Google accounts in Sophos Mobile Admin:

3. On the menu sidebar, under SETTINGS, select Setup > Android setup and then the Android

Enterprise tab.

4. Under Factory Reset Protection, select Use FRP.

5. In Google+ IDs, enter the internal Google IDs of the accounts you want to use for FRP.

6. Select Save.

FRP is turned on for all your Android Enterprise fully managed devices. This happens the next time a device synchronizes with the Sophos Mobile server.

Sophos Mobile

328

CAUTION

If the internal Google IDs you enter in Sophos Mobile Admin are invalid, or if you forget the credentials of the Google accounts, devices become unusable when you reset them to their factory settings with FRP turned on.

19.10 Managed Google Play apps

Managed Google Play is the app store for Android Enterprise devices.

Users can install the following type of apps from managed Google Play:

• Public apps you’ve approved for your organization

• Website shortcuts (web apps) you’ve created

• Private apps

Related tasks

Approve managed Google Play app

(page 328)

To make an app available to your users, you must approve it.

Add web app

(page 331)

You can add website shortcuts as web apps to managed Google Play.

Add private app (page 332)

You can add private apps to managed Google Play.

19.10.1 Approve managed Google Play app

To make an app available to your users, you must approve it.

To approve an app:

1. On the menu sidebar, under CONFIGURE, select Apps > Android.

2. On the Approved apps page, select Open Google Play.

You might have to select Approved apps to open the Approved apps page.

3. In the Managed Google Play window, go to the app and select Approve.

4. If the app requires permissions, accept these on behalf of your organization.

5. Close the Managed Google Play window.

6. Select Retrieve app list from Google to synchronize the changes you’ve made in managed

Google Play.

7. Wait for a few seconds and then re-open the page.

After synchronization is completed, the app appears in the list.

8. Select the app.

9. Configure the app settings as required.

You can configure up to 30 categories per page and up to 100 apps per category.

10. Select Save.

11. Select Send app settings to Google to make the changes available to your users.

After the data is synchronized to the Google server, the app is available through the managed Google

Play Store app.

Sophos Mobile

For the following tasks, visit the managed Google Play website:

• Accepting additional permissions an app update requires.

• Purchasing licenses for paid apps.

Related reference

Settings for managed Google Play apps (page 330)

This section lists the settings for managed Google Play apps you’ve approved for your organization.

Related information

Managed Google Play website (external link)

Managed Google Play help (external link)

19.10.2 Unapprove managed Google Play app

Prerequisite: You’ve removed the app from any Android task bundle.

1. On the menu sidebar, under CONFIGURE, select Apps > Android.

2. On the Approved apps page, click the blue triangle next to the app you want to unapprove and then click Show.

You might have to select Approved apps to open the Approved apps page.

3. Click Unapprove.

Tip

You can also unapprove apps in managed Google Play.

19.10.3 Edit managed Google Play app

You can edit the location of an app and configure it.

You can set the page and category of an app in managed Google Play. Some apps allow you to configure more settings.

Prerequisite: You’ve approved the app in managed Google Play.

To edit an app:

1. On the menu sidebar, under CONFIGURE, select Apps > Android.

2. On the Approved apps page, select the app you want to edit.

You might have to select Approved apps to open the Approved apps page.

3. Configure the app settings as required.

You can configure up to 30 categories per page and up to 100 apps per category.

4. Select Save.

5. Select Send app settings to Google to make the changes available to your users.

Related concepts

Layout of managed Google Play (page 334)

Related tasks

Approve managed Google Play app

(page 328)

Sophos Mobile

To make an app available to your users, you must approve it.

Related reference

Settings for managed Google Play apps (page 330)

This section lists the settings for managed Google Play apps you’ve approved for your organization.

19.10.4 Settings for managed Google Play apps

This section lists the settings for managed Google Play apps you’ve approved for your organization.

Setting/Field

Title

Product ID

Pricing

Distribution type

Managed Google Play URL, Google Play

URL

Page

Description

The external app name as displayed in managed Google Play.

The internal app name.

The pricing type:

• Free

• Free with in-app purchases

• Paid

• Public (Google-hosted): The app is available to the general public in managed

Google Play.

• Private (Google-hosted): The app is developed by you and only available to users within your Managed Google Domain.

The APK file was uploaded to managed

Google Play.

• Private (self-hosted): Like Private

(Google-hosted), but the APK file is installed from your local server. Managed

Google Play is only used to manage the distribution.

The web address of the app in managed

Google Play and Google Play.

Click the link to open that page in a new browser window.

The page on which the app will appear in the users’ Google Play Store app.

The values are pre-configured by Sophos

Mobile and cannot be changed.

Setting/Field

App category

Licenses

Use managed configuration

Managed configuration

Sophos Mobile

Description

The name of a category under which the app will appear in the users’ Google Play Store app.

When you start to type, a list of matching categories is displayed. If you enter a category that is not available, it is created.

You can configure up to 30 categories per page and up to 100 apps per category.

Click Show next to Licenses to view or edit the number of used and remaining licenses for the app, and the users that have a license assigned.

This setting is only available for paid apps.

Select this to make the managed configuration available to your users.

This takes effect the next time you send app settings to Google.

Select Managed configuration to view or edit app-specific settings.

For information on the available settings, see the documentation provided by the app developer.

This setting is only available if the app offers managed configuration.

Tip

You can use the placeholders %_USERNAME_% and %_EMAILADDRESS_% which are replaced by the actual user name and email address.

19.10.5 Add web app

You can add website shortcuts as web apps to managed Google Play.

A web app is an Android app that you create using a start URL, an icon, and a title. When a user opens a web app, the start URL opens in Chrome. The user can then navigate to other URLs.

You can configure if the Chrome address bar and the device’s navigation buttons are visible.

To add a web app:

1. On the menu sidebar, under CONFIGURE, select Apps > Android.

2. On the Approved apps page, select Open Google Play.

You might have to select Approved apps to open the Approved apps page.

3. In the Managed Google Play window, select Web apps from the sidebar.

4. Select the Plus icon and then configure the app settings.

5. Select Create.

Sophos Mobile

It can take up to 10 minutes before the app is available in managed Google Play.

6. Close the Managed Google Play window.

7. Select Retrieve app list from Google to synchronize the changes you’ve made in managed

Google Play.

8. Wait for a few seconds and then re-open the page.

After synchronization is completed, the app appears in the list.

9. Select the app.

10. On the Edit approved app page, configure the page and location of the app in your users’ Google

Play Store app.

You can configure up to 30 categories per page and up to 100 apps per category.

11. Select Save.

12. Select Send app settings to Google to make the changes available to your users.

19.10.6 Add private app

You can add private apps to managed Google Play.

A private app is an Android app your organization has developed. When you add a private app to managed Google Play, it’s only available to users in your organization.

Warning

When you add a private app, you can’t add it to another Google Play account. You also can’t publish it as a public app, even if you delete the private app later.

To add a private app:

1. On the menu sidebar, under CONFIGURE, select Apps > Android.

2. On the Approved apps page, select Open Google Play.

You might have to select Approved apps to open the Approved apps page.

3. In the Managed Google Play window, select Private apps from the sidebar.

4. Select the Plus icon and then configure the app settings.

5. Select Create.

It can take up to 10 minutes before the app is available in managed Google Play.

6. Close the Managed Google Play window.

7. Select Retrieve app list from Google to synchronize the changes you’ve made in managed

Google Play.

8. Wait for a few seconds and then re-open the page.

After synchronization is completed, the app appears in the list.

9. Select the app.

10. On the Edit approved app page, configure the page and location of the app in your users’ Google

Play Store app.

You can configure up to 30 categories per page and up to 100 apps per category.

11. Select Save.

12. Select Send app settings to Google to make the changes available to your users.

To learn more about private apps, see the Google help.

Sophos Mobile

Related information

Managed Google Play help: Publish and manage private apps

19.10.7 Install managed Google Play app

After you have approved a managed Google Play app and have assigned app licenses to your users, you can install the app to selected devices or device groups.

Note

Users can install approved apps through the managed Google Play Store app.

1. On the menu sidebar, under CONFIGURE, select Apps > Android.

2. On the Approved apps page, click the blue triangle next to the required app and then click Install.

You might have to select Approved apps to open the Approved apps page.

3. Select the devices on which you want to install the app. Do one of the following:

• Select individual devices.

• Click Select device groups and then select one or more device groups.

4. On the Set execution date page, set the date when the app will be installed:

• Select Now for an immediate execution.

• Select Date and then enter a date and a time for a scheduled execution.

5. Click Finish.

19.10.8 Uninstall a managed Google Play app

You can uninstall a managed Google Play app from selected devices or device groups.

1. On the menu sidebar, under CONFIGURE, select Apps > Android.

2. On the Approved apps page, click Uninstall.

You might have to select Approved apps to open the Approved apps page.

3. Select the devices from which you want to uninstall an app. Do one of the following:

• Select individual devices.

• Click Select device groups and then select one or more device groups.

4. On the Select app page, select the required app.

5. On the Set execution date page, set the date when the app will be uninstalled:

• Select Now for an immediate execution.

• Select Date and then enter a date and a time for a scheduled execution.

6. Click Finish.

A task to uninstall the app is sent to a Google service. Google then manages the removal of the app from the device. On the Task view page, the task is displayed with state successful after it has been sent to Google.

Sophos Mobile

Tip

19.10.9 Licenses for managed Google Play apps

For paid apps you’ve approved in managed Google Play, you must assign an app license to a user to make the app available to the user.

You configure the license assignment on the Edit approved app page. See

Edit managed Google

Play app (page 329).

Note

• You don’t need to assign a license for administrator-initiated app installations. When you install an app as described in

Install managed Google Play app (page 333), a license from your

pool of purchased licenses is automatically assigned to the relevant users.

• You don’t need to assign a license for free apps you’ve approved in managed Google Play.

Free apps are automatically available to all your users after you synchronize the app list from

Google to Sophos Mobile.

334

19.10.10 Layout of managed Google Play

You can define the location of managed Google Play apps in the users’ Play Store app.

The configurable layout elements are Pages and Categories.

• Pages are named, vertically scrollable views. Pages and their names are pre-defined by Sophos

Mobile.

• Categories are named, horizontally scrollable subsections of a page that you define. In the Google documentation, categories are also called clusters.

• Each category is specific to a certain page, and each app appears within a certain category.

• Pages that do not contain any apps are not displayed.

• You can configure up to 30 categories per page and up to 100 apps per category.

For each app, you define the page and, optionally, the category in which the app is displayed in the managed Google Play Store app on the users’ devices. By default, apps are placed on a page named Other.

You configure the store layout on the Edit approved app page. See

Edit managed Google Play app

(page 329).

19.10.11 Configurable apps

A managed Google Play app can offer a managed configuration. This feature is included by the app developer and allows you to configure custom settings for the app.

If an app supports managed configuration, a note This app offers managed configuration is displayed on the app’s page in managed Google Play.

Sophos Mobile

You configure the app settings on the Edit approved app page. See Edit managed Google Play app

(page 329).

Sophos Mobile

20 Mobile Threat Defense with Sophos

Intercept X for Mobile

Sophos Intercept X for Mobile is a Mobile Threat Defense (MTD) solution for your Android and iOS devices.

Note

This feature requires a license of type Mobile Advanced.

When you manage Sophos Intercept X for Mobile with Sophos Mobile, you can perform the following tasks:

• Assign a Mobile Threat Defense policy to the device to configure Sophos Intercept X for Mobile.

• Assign a compliance policy to the device to monitor its compliance status.

• On Android devices, perform a malware scan.

Tip

You can also manage Sophos Intercept X for Mobile on devices that are enrolled with third-party

Enterprise Mobility Management (EMM) software. The third-party EMM software must support custom app settings.

Related concepts

Configurations for Mobile Threat Defense policies for Android (page 149)

With a Mobile Threat Defense policy you configure Sophos Intercept X for Mobile when it’s enrolled with Sophos Mobile.

Configurations for Mobile Threat Defense policies for iOS (page 219)

With a Mobile Threat Defense policy you configure Sophos Intercept X for Mobile when it’s enrolled with Sophos Mobile.

Related tasks

Scan device

(page 56)

Use Sophos Intercept X for Mobile with third-party EMM software (page 338)

You can manage Sophos Intercept X for Mobile on devices enrolled with a third-party Enterprise

Mobility Management (EMM) program.

Related reference

Mobile Threat Defense compliance rules (page 337)

Sophos Mobile

You can configure compliance rules for devices on which Sophos Intercept X for Mobile is managed by

Sophos Mobile.

20.1 Mobile Threat Defense compliance rules

You can configure compliance rules for devices on which Sophos Intercept X for Mobile is managed by

Sophos Mobile.

Rule

Managed required

Root access allowed

Allow jailbreak

Minimum OS version

Maximum OS version

Maximum interval between

Intercept X for Mobile synchronizations

Maximum interval between

Intercept X for Mobile scans

Intercept X for Mobile permissions can be denied

Malware apps allowed

Suspicious apps allowed

PUAs allowed

Description

Define the action that will be executed when a device is no longer managed.

Select whether devices with root rights are allowed.

Select whether jailbroken devices are allowed.

Select the earliest operating system version required.

Select the latest operating system version allowed.

Platforms

Android iOS

The maximum allowed interval at which Sophos Intercept X for Mobile must synchronize with Sophos

Mobile.

The maximum allowed interval of malware scans.

Select whether the device becomes non-compliant if the user denials the app permissions for Sophos Intercept

X for Mobile.

Select whether malware apps detected by Sophos Intercept X for

Mobile are allowed.

Select whether suspicious apps detected by Sophos Intercept X for

Mobile are allowed.

Select whether Potentially Unwanted

Apps (PUAs) detected by Sophos

Intercept X for Mobile are allowed.

Android

Sophos Mobile

20.2 Use Sophos Intercept X for Mobile with thirdparty EMM software

You can manage Sophos Intercept X for Mobile on devices enrolled with a third-party Enterprise

Mobility Management (EMM) program.

In Sophos Mobile, you generate a connection code that contains the enrollment details.

In the third-party EMM program, you enter this connection code and other options in the managed configuration of Sophos Intercept X for Mobile. When the third-party EMM program installs the app, it automatically enrolls with Sophos Mobile.

Note

For Android, the device must be enrolled in Android Enterprise mode.

1. On the menu sidebar, under SETTINGS, select Setup > Sophos setup and then the Third-party

EMM tab.

2. Select Generate connection code.

The code contains the information required by Sophos Intercept X for Mobile to enroll with

Sophos Mobile.

3. Configure the following settings:

Setting

Owner

Description

Choose whether the devices are owned by your organization (Corporate) or not

(Personal).

Device group The Sophos Mobile device group devices are assigned to.

Mobile Threat Defense policy (Android) Optional: The Sophos Mobile policy for

Sophos Intercept X for Mobile on Android devices.

Mobile Threat Defense policy (iOS) Optional: The Sophos Mobile policy for

Sophos Intercept X for Mobile on iPhones and iPads.

4. Select Save.

5. Select Copy next to Connection code to copy the value to the clipboard.

You need the connection code to configure the third-party EMM program.

6. Add Sophos Intercept X for Mobile to the third-party EMM program.

7. In the third-party EMM program, edit the app’s managed configuration.

For the Android app, settings are given and you enter the values.

For the iOS app, you must enter each setting’s name, type (String or Boolean), and value.

Sophos Mobile

Table 1: Settings for the Sophos Intercept X for Mobile Android app

Setting

Email

Connection code

Device ID

Device name

EULA disabled

Connect to Intune

Description

Optional: The user’s email address you want to assign to the device in Sophos Mobile.

The connection code you copied from Sophos Mobile.

The unique device identifier used by the third-party EMM application. The value is used to link the device created in

Sophos Mobile with the device in the third-party EMM program.

Optional: The device name used by the third-party EMM program.

Optional: The End User License Agreement (EULA) is not displayed when the app starts.

Optional: The app automatically starts the Intune connection wizard.

Table 2: Settings for the Sophos Intercept X for Mobile iOS app

Setting email

(String) smcData

(String) deviceId

(String) deviceName

(String) macAddress

(String) eulaDisabled

(Boolean) startIntuneConnection

(Boolean)

Description

Optional: The user’s email address you want to assign to the device in Sophos Mobile.

The connection code you copied from Sophos Mobile.

The unique device identifier used by the third-party EMM application. The value is used to link the device created in

Sophos Mobile with the device in the third-party EMM program.

Optional: The device name used by the third-party EMM program.

Optional: The device’s MAC address. The value is used to identify the device when it connects to a Sophos Wi-Fi access point.

Required for Synchronized Security.

Optional: The End User License Agreement (EULA) is not displayed when the app starts.

Optional: The app automatically starts the Intune connection wizard.

Sophos Mobile

For details on how to edit the managed configuration, see the documentation of the third-party

EMM program.

Tip

If supported by your third-party EMM program, we recommend you use placeholders to specify the device and user properties.

8. Install Sophos Intercept X for Mobile through the third-party EMM program.

On the first start after installation, Sophos Intercept X for Mobile enrolls with Sophos Mobile. You can manage the app from the Devices page in Sophos Mobile Admin.

If required, you can revoke the connection code to block future app enrollments.

Sophos Mobile

21 Intune app protection

Intune is a Microsoft service to manage mobile devices and apps. Intune app protection lets you define app-level usage restrictions and assign them to your users.

Because Intune app protection is based on the user identity and doesn’t require device management to secure your corporate data, it’s suitable for Bring Your Own Device (BYOD) programs.

You can manage your Intune app protection policies in Sophos Mobile Admin.

Features and requirements

• Devices don’t need to be enrolled with Sophos Mobile.

• Intune app protection policies can be applied to the Office 365 apps, and to other apps that have been integrated with the Intune App SDK.

• Policies are only applied when users log in to an app with their corporate account. There are no usage restrictions when they log in with their private account.

• You must have an Azure Active Directory (AD) Premium subscription.

• Users must have an Intune license assigned to their Azure AD account.

• For the Microsoft Outlook app, users must have an Office 365 Exchange Online mailbox and license linked to their Azure AD account.

• For the Microsoft Word, Excel, and PowerPoint apps, users must have an Office 365 Business or

Enterprise license linked to their Azure AD account.

Related information

Microsoft Intune documentation (external link)

Microsoft Intune apps (external link)

21.1 Set up Microsoft Intune integration

To be able to manage your Intune app protection policies in Sophos Mobile Admin, you must register

Sophos Mobile as a Microsoft Azure application. We recommend you use the Microsoft Azure

registration.

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the

Microsoft Azure tab.

2. Click Microsoft Azure registration wizard.

The wizard guides you through the registration process in the Microsoft Azure portal and in Sophos

Mobile Admin: a) Create an application for Sophos Mobile in the Microsoft Azure portal.

b) Enter the application ID in Sophos Mobile.

c) Upload the Sophos Mobile server certificate to your application.

d) Grant your application the required permissions.

Sophos Mobile

The wizard also contains a page to configure federated authentication. Only follow the steps on that page if you want to use federated authentication with Azure Active Directory instead of internal or external user management. See

Federated authentication

(page 94).

When you’ve completed the setup procedure, there is a new entry Policies > Intune app protection in the menu sidebar of Sophos Mobile Admin.

21.2 Create Intune app protection policy

With an Intune app protection policy, you apply data restrictions based on the user identity. The restrictions are only applied when the app is used in a work context, i.e. when an assigned user opens an app using a corporate account.

You must create separate policies for Android and iOS apps.

1. On the menu sidebar, under CONFIGURE, click Policies > Intune app protection.

2. Confirm the dialog to be forwarded to a Microsoft page, and then log in with your Microsoft Azure administrator account.

This step is omitted if you’ve already logged in to Microsoft Azure during the current Sophos Mobile

Admin session.

3. On the Policies - Intune app protection page of Sophos Mobile Admin, click Add and then click

Android policy or iOS policy.

4. On the Edit policy page, enter the required settings.

See

Intune app protection policy settings (Android)

(page 343) and Intune app protection policy settings (iOS) (page 347).

5. Select Save.

You can view the policy in the Microsoft Azure portal. You might need to sign in again to the portal to refresh the information displayed.

After you’ve created the Intune app protection policy, assign it to apps and to users. See

Assign apps to an Intune app protection policy

(page 342) and Assign users to an Intune app protection policy (page 343).

21.3 Assign apps to an Intune app protection policy

An Intune app protection policy is only applied to the apps you assign it to.

1. On the menu sidebar, under CONFIGURE, click Policies > Intune app protection.

2. Confirm the dialog to be forwarded to a Microsoft page, and then log in with your Microsoft Azure administrator account.

This step is omitted if you’ve already logged in to Microsoft Azure during the current Sophos Mobile

Admin session.

3. On the Policies - Intune app protection page of Sophos Mobile Admin, click the blue triangle next to the policy you want to assign apps to, and then click Assign apps.

4. Select the apps you want to assign the policy to.

The list includes all Android or iOS apps you’ve added to your Microsoft Intune account in the

Microsoft Azure portal.

5. Select Save.

You can view the app assignment in the Microsoft Azure portal. You might need to sign in again to the portal to refresh the information displayed.

Sophos Mobile

21.4 Assign users to an Intune app protection policy

An Intune app protection policy is only applied to an app when it is used by an assigned user. You assign users not individually but by Azure Active Directory (AD) security groups.

1. On the menu sidebar, under CONFIGURE, click Policies > Intune app protection.

2. Confirm the dialog to be forwarded to a Microsoft page, and then log in with your Microsoft Azure administrator account.

This step is omitted if you’ve already logged in to Microsoft Azure during the current Sophos Mobile

Admin session.

3. On the Policies - Intune app protection page of Sophos Mobile Admin, click the blue triangle next to the policy you want to assign users to, and then click Assign user groups.

4. In the list of available Azure AD security groups, select the groups you want to include or exclude:

• Include: The policy applies to members of this group.

• Exclude: The policy doesn’t apply to members of this group, even if they are also members of an Include group.

• Not assigned: The policy doesn’t apply to members of this group, unless they are also members of an Include group.

5. Select Save.

You can view the user assignment in the Microsoft Azure portal. You might need to sign in again to the portal to refresh the information displayed.

Note

The policy only applies to users with an Intune license assigned to their Azure AD account. Other users in the selected security groups are not affected.

21.5 Intune app protection policy settings (Android)

With an Intune app protection policy you define restrictions for Intune-managed apps. This section describes the available settings for Android apps.

General settings

Setting/Field

Name

Description

Description

The name of the policy.

A short description of the policy.

Data relocation

Under Data relocation, you configure how data is allowed to enter or leave the app.

Sophos Mobile

Note

All settings apply to data users access when logged in with their corporate account.

Setting/Field

Prevent Android backups

Allow app to transfer data to other apps

Description

The app doesn’t use the Android backup service.

The apps this app can transfer data to:

Policy-managed apps: Only allow transfer to other apps managed by an Intune policy.

All apps: Allow transfer to any app.

No apps: Do not allow transfer to any app.

Note

• There might be apps and services to which data transfer is always allowed. For details, see the

Microsoft Intune documentation on data transfer exemption.

• Data transfer to an Android instant app is always blocked.

Allow app to receive data from other apps

Prevent “Save As”

Storage locations

The apps this app can receive data from:

Policy-managed apps: Only allow transfer from other apps managed by an Intune policy.

All apps: Allow transfer from any app.

No apps: Do not allow transfer from any app.

Note

• There might be apps and services from which data transfer is always allowed. For details, see the

Microsoft Intune documentation on data transfer exemption.

• Data transfer from an Android instant app is always blocked.

The Save-As option of the app is disabled.

If Prevent “Save As” is selected, select the locations where corporate data is stored.

Users can save to the selected locations. Other locations are blocked.

Sophos Mobile

Setting/Field

Restrict cut, copy, and paste with other apps

Restrict web content to display in the

Managed Browser

Encrypt app data

Disable contacts sync

Disable printing

Description

Select how cut, copy, and paste actions can be used with the app.

Blocked: Do not allow cut, copy, and paste actions between this app and other apps.

Policy-managed apps: Allow cut, copy, and paste actions between this app and other apps managed by an Intune policy.

Policy-managed with paste in: Allow cut or copy between this app and other apps managed by an

Intune policy. Allow data from any app to be pasted into this app.

All apps: No restrictions for cut, copy, and paste to and from this app.

Enforce web links in the app to be opened in the Intune

Managed Browser app.

Data is encrypted using an encryption scheme defined by Intune.

The app doesn’t save data to the Contacts app.

Printing is disabled in the app.

Access

Under Access, you configure how users can access the app when logged in with their corporate account.

Setting/Field

Require PIN for access

Description

A PIN is required to use the app.

Users are prompted to set a PIN the first time they log in with their corporate account.

Note

All Intune-managed Android apps share the same PIN.

Number of attempts before PIN reset

Forbid simple PIN

PIN length

The number of failed login attempts before the PIN is reset.

Users are not allowed to use simple PIN sequences such as 1234 or 1111.

The minimum number of digits in a PIN sequence.

Sophos Mobile

Setting/Field

Forbid fingerprint

Require corporate credentials for access

Block managed apps from running on rooted devices

Access requirements timeout

Description

Users can’t use fingerprint authentication instead of a

PIN for authentication.

Users must enter their corporate password instead of a

PIN.

This setting overrides the other PIN requirements.

On rooted devices, users can’t use the app with their corporate account.

The time in minutes before the access requirements

(set in this policy) are rechecked when the app is launched.

Note

After users have entered the PIN once, they may use other Intune-managed apps without having to enter the

PIN again, for the time period defined in this setting.

Offline grace period

Offline interval before app data is wiped

Block screen capture and Android

Assistant

Required minimum Android version

Recommended minimum Android version

The time in minutes that a device can be offline before the access requirements for the app are rechecked.

After this period is expired, the app requires the user to connect to the network and authenticate again.

The number of days that a device can be offline before the user must connect to the network and authenticate again.

If authentication fails, corporate app data is wiped.

Note

For the Microsoft Outlook app, wiping the app data also removes data saved to the Contacts app.

Users can’t take screen captures or use the Google

Assistant.

This also blurs the app picture in the list of recent apps.

The minimum Android version required to use the app.

Leave the field empty to ignore this setting.

The recommended minimum Android version to use the app.

If the device doesn’t meet this requirement, a notification is displayed which the user can dismiss.

Leave the field empty to ignore this setting.

Sophos Mobile

Setting/Field

Required minimum app version

Recommended minimum app version

Required minimum Android patch version

Recommended minimum Android patch version

Description

The minimum app version required to use the app.

Leave the field empty to ignore this setting.

The recommended minimum app version to use the app.

If the app on the device doesn’t meet this requirement, a notification is displayed which the user can dismiss.

Leave the field empty to ignore this setting.

The minimum Android security patch level required to use the app.

Enter the patch level date, using the format YYYY-MM-

DD .

Leave the field empty to ignore this setting.

The recommended minimum Android security patch level to use the app.

Enter the patch level date, using the format YYYY-MM-

DD .

If the device doesn’t meet this requirement, a notification is displayed which the user can dismiss.

Leave the field empty to ignore this setting.

21.6 Intune app protection policy settings (iOS)

With an Intune app protection policy you define restrictions for Intune-managed apps. This section describes the available settings for iOS apps.

General settings

Setting/Field

Name

Description

Description

The name of the policy.

A short description of the policy.

Data relocation

Under Data relocation, you configure how data is allowed to enter or leave the app.

Note

All settings apply to data users access when logged in with their corporate account.

Sophos Mobile

Setting/Field

Prevent iTunes and iCloud backups

Allow app to transfer data to other apps

Description

The app doesn’t back up data to iTunes or iCloud.

The apps this app can transfer data to:

Policy-managed apps: Only allow transfer to other apps managed by an Intune policy.

All apps: Allow transfer to any app.

No apps: Do not allow transfer to any app.

Note

• There might be apps and services to which data transfer is always allowed. For details, see the

Microsoft Intune documentation on data transfer exemption.

• Policy-managed apps and No apps also block Siri to search data within the app.

Allow app to receive data from other apps

The apps this app can receive data from:

Policy-managed apps: Only allow transfer from other apps managed by an Intune policy.

All apps: Allow transfer from any app.

No apps: Do not allow transfer from any app.

Note

• There might be apps and services from which data transfer is always allowed. For details, see the

Microsoft Intune documentation on data transfer exemption.

• Some apps ignore this setting and allow all incoming data.

Prevent “Save As”

Storage locations

The Save-As option of the app is disabled.

If Prevent “Save As” is selected, select the locations where corporate data is stored.

Users can save to the selected locations. Other locations are blocked.

Sophos Mobile

Setting/Field

Restrict cut, copy, and paste with other apps

Restrict web content to display in the

Managed Browser

Encrypt app data

Disable contacts sync

Disable printing

Description

Select how cut, copy, and paste actions can be used with the app.

Blocked: Do not allow cut, copy, and paste actions between this app and other apps.

Policy-managed apps: Allow cut, copy, and paste actions between this app and other apps managed by an Intune policy.

Policy-managed with paste in: Allow cut or copy between this app and other apps managed by an

Intune policy. Allow data from any app to be pasted into this app.

All apps: No restrictions for cut, copy, and paste to and from this app.

Enforce web links in the app to be opened in the Intune

Managed Browser app.

Select when data is encrypted. Data is encrypted using the device-level encryption scheme provided by iOS.

When device is locked: App data is encrypted when the device is locked.

When device is locked and there are open files:

App data is encrypted when the device is locked, except data of currently open files.

When device restart: App data is encrypted when the devices is restarted, until the device is unlocked for the first time.

Use device settings: App data is encrypted based on the device settings.

The app doesn’t save data to the Contacts app.

Printing is disabled in the app.

Access

Under Access, you configure how users can access the app when logged in with their corporate account.

Sophos Mobile

Setting/Field

Require PIN for access

Password type

Description

A PIN is required to use the app.

Users are prompted to set a PIN the first time they log in with their corporate account.

Note

All Intune-managed iOS apps of the same publisher share the same PIN.

The type of PIN users must define:

Numeric: PIN must only contain digits.

Passcode: PIN must contain at least one letter, special character, or symbol (as available on the iOS

English language keyboard).

Note

Some apps don’t support the Passcode type.

Number of attempts before PIN reset

Forbid simple PIN

PIN length

Forbid fingerprint

Forbid facial recognition

Require corporate credentials for access

Block managed apps from running on jailbroken devices

The number of failed login attempts before the PIN is reset.

Users are not allowed to use simple PIN sequences such as 1234 or 1111.

If Password type is set to Passcode, the PIN must contain at least one digit, one letter, and one special character or symbol.

The minimum number of characters in a PIN sequence.

Users can’t use Touch ID instead of a PIN for authentication.

Users can’t use Face ID instead of a PIN for authentication.

Users must enter their corporate password instead of a

PIN.

This setting overrides the other PIN requirements.

On jailbroken devices, users can’t use the app with their corporate account.

Sophos Mobile

Setting/Field

Access requirements timeout

Description

The time in minutes before the access requirements

(set in this policy) are rechecked when the app is launched.

Note

After users have entered the PIN once, they may use other Intune-managed apps of the same publisher without having to enter the PIN again, for the time period defined in this setting.

Offline grace period

Offline interval before app data is wiped

The time in minutes that a device can be offline before the access requirements for the app are rechecked.

After this period is expired, the app requires the user to connect to the network and authenticate again.

The number of days that a device can be offline before the user must connect to the network and authenticate again.

If authentication fails, corporate app data is wiped.

Note

For the Microsoft Outlook app, wiping the app data also removes data saved to the Contacts app.

Required minimum iOS version

Recommended minimum iOS version

Required minimum app version

Recommended minimum app version

Required minimum Intune app protection policy SDK version

The minimum iOS version required to use the app.

Leave the field empty to ignore this setting.

The recommended minimum iOS version to use the app.

If the device doesn’t meet this requirement, a notification is displayed which the user can dismiss.

Leave the field empty to ignore this setting.

The minimum app version required to use the app.

Leave the field empty to ignore this setting.

The recommended minimum app version to use the app.

If the app on the device doesn’t meet this requirement, a notification is displayed which the user can dismiss.

Leave the field empty to ignore this setting.

The minimum Intune app protection policy SDK version the app must have.

Leave the field empty to ignore this setting.

Sophos Mobile

22 Create administrators

1. On the menu sidebar, under SETTINGS, click Setup > Administrators to open the Show

administrators page, and then click Create administrator.

2. On the Edit administrator page, configure the account details for the administrator.

• When External LDAP directory is selected as the user directory for the customer, you can click Lookup user via LDAP to select an existing LDAP account.

• If you do not use an external user directory enter the relevant data for Login name, First

name, Last name, Email address and Password.

The password that you specify is a one-time password. When the administrator logs in for the first time they are prompted to change it.

Note

The Login name field must only contain letters (Latin alphabet), digits, spaces and characters

\!._-# .

3. In the Role list, select one of the available roles.

The role defines the type of access rights the new administrator will have to Sophos Mobile. See

User roles

(page 4).

4. Click Save to create the administrator account.

The new administrator is created and shown on the Show administrators page. Forward the user credentials (user, customer and one-time password) to the new user. The new user can log in to

Sophos Mobile Admin and is prompted to change the password.

23 Send message to devices

Note

These instructions don’t apply to Windows computers.

You can send a custom message to managed devices.

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed.

2. Select one or more devices, click Actions and then click Send message.

3. In the Enter message dialog, enter the message you want to send.

The message can contain up to 500 characters.

4. Click Finish.

Sophos Mobile

24 Sophos container

Note

This feature requires a license of type Mobile Advanced.

The Sophos container is a logical area on a device containing the Sophos Secure Workspace and

Sophos Secure Email apps when they are managed by Sophos Mobile.

The Sophos container is available on the following platforms:

• Android

• iOS

24.1 Configure Sophos container enrollment

Note

This feature requires a license of type Mobile Advanced.

To enroll devices with Sophos Mobile using the Sophos container enrollment type, you need to perform the following configuration steps. You need to do this for each platform (Android, iOS) for which you want to use Sophos container enrollment.

1. Create a container policy. See Configurations for Sophos container policies for Android

(page 137)

and Configurations for Sophos container policies for iOS (page 207).

2. Use this container policy in a task bundle.

The task bundle must contain at least an Enroll Sophos container task and an Assign policy task. See

Create task bundle (page 281).

3. Use this task bundle as an initial package for enrollments through the Self Service Portal:

In the Self Service Portal settings, in the Group settings tab, select that task bundle in the Initial

package - corporate devices or Initial package - personal devices field. See

Create Self

Service Portal configurations (page 27).

24.2 Mobile Advanced license

When you activate a Mobile Advanced license, you can use these additional features:

•

Manage the Sophos Secure Workspace and Sophos Secure Email apps. See Manage Sophos container apps

(page 355).

• For Android and iOS devices, manage Sophos Intercept X for Mobile. See

Mobile Threat

Defense with Sophos Intercept X for Mobile (page 336).

After you have received your license key you need to activate the license.

354

Activate a Mobile Advanced license for Sophos Mobile on Premise

For Sophos Mobile on Premise, licenses are managed by the super administrator in customer management. For further information, see the Sophos Mobile super administrator guide .

Sophos Mobile

Activate a Mobile Advanced license for Sophos Mobile as a Service

In Sophos Mobile Admin, go to Setup > Sophos setup > License and enter your license key in the

Advanced license key field.

24.3 Manage Sophos container apps

Note

This feature requires a license of type Mobile Advanced.

For better data separation on the managed devices, Sophos Mobile provides the Sophos container apps Sophos Secure Email and Sophos Secure Workspace:

• Sophos Secure Email is an app for Android and iOS devices that provides a secure container for managing your email, calendar and contacts.

• Sophos Secure Workspace is an app for Android and iOS devices that allows users to access encrypted files stored in the cloud. Files can be decrypted and viewed in a seamless way.

Encrypted files can be handed over by other apps and uploaded to one of the supported cloud storage providers. Alternatively, the documents can be stored locally within the app.

With Sophos Secure Workspace, you can read files encrypted by SafeGuard Cloud Storage or

SafeGuard Data Exchange. Both are modules of SafeGuard Enterprise or one of its different editions. They allow you to encrypt files using a local key. These local keys are derived from a passphrase that is entered by a user. You can only decrypt a file when you know the passphrase that was used to encrypt the file.

The Sophos container provides:

• Centrally defined password rules

• Password rules for all container apps

• Single-Sign-On for all container apps

• Sophos Secure Workspace document settings

• Sophos Secure Workspace browser settings

• Sophos Secure Email settings

You can manage the Sophos apps with Sophos Mobile as follows:

• You can configure settings for the Sophos container apps on all managed devices remotely and

centrally in Sophos Mobile. See Configurations for Sophos container policies for Android

(page

137) and Configurations for Sophos container policies for iOS (page 207).

• Using compliance policies, you can make sure that the Sophos container apps are installed on the devices.

• You can enable secure distribution of documents using the Corporate Documents storage provider.

See

Corporate documents

(page 315).

• You can enable corporate keyring synchronization between the Sophos Secure Workspace app and Sophos SafeGuard Enterprise. This makes the keys from a user's SafeGuard keyring available

in the Sophos Secure Workspace keyring. See Enable corporate keyring synchronization

(page

357).

Sophos Mobile

356

Note

In order to manage the Sophos container apps, they must be distributed using Sophos Mobile.

If users already have an unmanaged version of Sophos Secure Workspace installed on their devices, they must uninstall it first and then install the managed version.

For further information on Sophos Secure Workspace, see the Sophos Secure Workspace help.

24.4 Reset Sophos container password

Note

This feature requires a license of type Mobile Advanced.

Note

These instructions only apply to devices with a Sophos container policy.

You can reset the Sophos container password. This is useful, for example, when users forget their password. If you reset a Sophos container password, users will be asked to create a new container password.

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed.

2. Click the device for which you want to reset the Sophos container password.

The Show device page is displayed.

3. Click Actions.

The Actions menu is displayed.

4. Click Reset Sophos container password.

5. In the dialog box, click Yes to confirm the operation.

The Sophos container password is reset. The user has to enter a new Sophos container password.

24.5 Lock and unlock the Sophos container

Note

This feature requires a license of type Mobile Advanced.

Note

These instructions only apply to devices with a Sophos container policy.

You can lock or unlock the Sophos container, that is, set the access permissions for the Sophos container apps and for data within the Sophos container.

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device for which you want to lock or unlock the Sophos container and then click Show.

3. On the Show device page, click Actions > Set Sophos container access.

4. In the dialog box for setting the access permissions, select one of the following:

Sophos Mobile

• Deny: The Sophos container is locked. Users can no longer use it.

• Allow: The Sophos container is unlocked.

• Auto mode: The Sophos container is locked as long as the device violates a compliance rule for which Lock container is activated. This is the default behavior if you have not set an access permission.

5. Click Yes.

The device is triggered to synchronize with the Sophos Mobile server. On synchronization, the setting is applied to the device.

24.6 Corporate keyring synchronization

Corporate keyring synchronization adds the following features to the Sophos Secure Workspace app:

• The keys from a user's SafeGuard Enterprise keyring are available in the Sophos Secure

Workspace keyring (SSW keyring).

• Users of the app can then use the keys to decrypt and view documents, or encrypt documents.

• Users can continue to use local keys that were available in their SSW keyring when you enabled keyring synchronization.

• Users cannot create new local keys.

• For security reasons, the keys from the SafeGuard keyring are removed from a device when the

Sophos container is locked.

24.6.1 Enable corporate keyring synchronization

Prerequisites:

• You use Sophos SafeGuard Enterprise 8.0 or later.

• You have configured external user management for the Self Service Portal, using the same

Active Directory user database that is configured in SafeGuard Enterprise.

• Sophos Secure Workspace is managed by Sophos Mobile. This requires a Mobile Advanced license.

• Your Sophos Mobile server can connect to your SafeGuard Enterprise server via HTTPS.

To enable corporate keyring synchronization, you set up a connection between Sophos Mobile and

Sophos SafeGuard Enterprise as follows:

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the SGN tab.

2. Click the Certificate link to download the certificate of the Sophos Mobile server.

3. Open SafeGuard Management Center and go to Tools > Configuration Package Tool.

4. On the Servers tab, click Add, browse for the certificate file and then click OK. Do not change the value of the Server name field.

5. Optional: Select Recovery via mobile to enable the synchronization of BitLocker and FileVault recovery keys with the Sophos Secure Workspace app.

6. On the Managed client packages tab, configure the following settings:

• In the Configuration Package Name field, select Managed Client (Default).

• In the Primary Server field, select your SGN server.

Sophos Mobile

• In the Transport Encryption field, select SSL.

7. Click Create Configuration Package.

8. On the SGN tab of Sophos Mobile Admin, click Upload a file to upload the configuration package that you created in the SafeGuard Management Center to Sophos Mobile.

9. Click Save to save the SafeGuard integration settings.

25 Glossary

ad hoc provisioning profile customer enrollment

Enterprise App Store

Mobile Advanced license provisioning

Self Service Portal

Sophos Mobile client

Sophos Mobile console

Sophos Intercept X for Mobile

Sophos Secure Email

Sophos Secure Workspace

Sophos Mobile

A distribution provisioning profile you add to a self-developed iOS app. This allows you to install the app on designated devices without having to publish it to the App Store.

A customer represents a separate management area within Sophos Mobile. You can set up several customers and manage each customer’s devices independently. This is also known as

multitenancy.

The registration of a device with Sophos Mobile.

An app repository that is hosted on the Sophos

Mobile server. The administrator can use Sophos

Mobile Admin to add apps to the Enterprise App

Store. Users can then use the Sophos Mobile

Control app to install these apps onto their devices.

With a license of type Mobile Advanced you can manage Sophos Intercept X for Mobile, Sophos

Secure Workspace, and Sophos Secure Email.

The process of installing the Sophos Mobile

Control app on a device.

The web interface that allows users to enroll their own devices and carry out other tasks without having to contact the helpdesk.

The Sophos Mobile Control app that is installed onto devices managed by Sophos Mobile.

The web interface that you use to manage devices.

A security app for Android and iOS devices.

You can manage this app with Sophos Mobile, provided that a license of type Mobile Advanced is activated.

An app for Android and iOS devices that provides a secure container for managing your email, calendar and contacts. You can manage this app with Sophos Mobile, provided that a license of type Mobile Advanced is activated.

An app for Android and iOS devices that provides a secure workspace where you can browse, manage, edit, share, encrypt and decrypt documents from various storage providers or distributed by your company. You can manage this app with Sophos Mobile, provided that a license of type Mobile Advanced is activated.

359

Sophos Mobile task bundle

Team ID

You create a package to bundle several tasks into one transaction. You can bundle all tasks necessary to have a device fully enrolled and running.

Every iOS and macOS app is signed by a Team

ID. The Team ID is supplied by Apple and is unique to a specific development team.

Sophos Mobile

26 Support

You can find technical support for Sophos products in any of these ways:

• Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.

• Visit the Sophos support knowledge base at www.sophos.com/en-us/support.aspx

• Download the product documentation at www.sophos.com/en-us/support/documentation.aspx

• Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/ support-query.aspx

Sophos Mobile

27 Legal notices

Copyright © 2020 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos

Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

Sophos Mobile administrator help

product version: 9.5

Contents

1 About this help

2 About Sophos Mobile

Sophos Mobile

Sophos Intercept X for Mobile

Sophos Secure Workspace

Sophos Secure Email

3 About Sophos Mobile Admin

3.1 Dashboard

3.2 Table views

3.3 Prerequisites

3.4 User roles

3.5 Change your password

3.6 Password recovery

4 Key steps for managing devices with

Sophos Mobile

5 Reports

6 Tasks

6.1 Monitor tasks

6.1.1 View unfinished, failed and latest finished tasks

6.1.2 View task archive

6.1.3 Task states

7 Alerts

Acknowledge alerts

Set up email reports for alerts

Which events trigger alerts?

8 Setup

8.1 Configure personal settings

8.2 Configure password policies

8.3 Configure SMC app settings

8.4 Configure Email

8.5 Configure IT contact

8.6 Configure privacy settings

8.7 Configure iOS settings

8.8 Apple Push Notification service certificates

8.8.1 Create APNs certificate

8.8.2 Renew APNs certificate

8.8.3 Copy APNs certificate to another customer

8.8.4 Identify the correct APNs certificate for renewal

8.8.5 Check APNs connectivity of devices

8.9 Configure iOS AirPlay destinations

8.10 Android settings

8.10.1 Set Android management mode

8.10.2 Host Sophos apps on your web server

8.10.3 Configure the synchronization interval of the Sophos

Mobile Control app

8.10.4 Enable Baidu Cloud Push service

8.11 Register Samsung Knox license

8.12 Configure polling interval for Windows devices

8.13 Check your licenses

8.14 Simple Certificate Enrollment Protocol (SCEP)

8.14.1 Prerequisites

8.14.2 Configure SCEP

8.15 Create customer properties

8.16 Configure SSL/TLS certificates

8.17 Configure EAS proxy

8.18 Configure Network Access Control

8.19 Configure email server connection

8.20 Configure proxy server connection

8.21 Configure portal access

8.22 Configure file upload limits

8.23 Turn on audit logging

8.24 Create system messages

9 Configure Self Service Portal

9.1 Create Self Service Portal configurations

9.2 Create enrollment texts

9.3 Available Self Service Portal actions

10 Compliance policies

10.1 Create compliance policy

10.2 Available compliance rules

10.3 Assign a compliance policy to device groups

10.4 Check devices for compliance

11 Devices

11.1 Add devices

11.1.1 Add device

11.1.2 Import devices

11.2 Enroll devices

Enrollment types