Sophos Mobile is the EMM solution for businesses that want to spend less time and effort to manage and secure mobile devices. Manage mobile devices with the easy-to-use, web-based, unified

Sophos Central admin interface alongside endpoint, network, or server security from Sophos. Secure container apps and support for mobile OS containerization in iOS, Android enterprise, and Samsung

Knox ensure sensitive company data stays separated from personal information on the device.

With its best-in-class data protection, comprehensive security, value-for-money, and flexible management options, Sophos Mobile is the best way to allow the use of mobile devices for work, keeping users productive, business data safe and personal data private.

Sophos Mobile Security

Sophos Mobile Security protects your Android devices without compromising performance or battery life. Powered by leading Sophos anti-malware technology, Sophos Mobile Security offers an award-winning level of antimalware and antivirus protection together with Potentially Unwanted App detection, privacy and security advisors, loss and theft protection, web protection, and much more.

Sophos Secure Workspace

Sophos Secure Workspace is a containerized mobile content management app for iOS and Android that provides a secure way to protect, manage, and distribute business documents and web content.

Edit Office format documents without leaving the container environment to ensure encrypted content remains secure. Anti-phishing technology protects users from malicious links in documents and content.

When managed by Sophos Mobile, admins can easily restrict access to content based on device compliance rules. In combination with Sophos SafeGuard Encryption, Sophos Secure Workspace provides seamless exchange of encrypted files—stored locally or in the cloud—between Windows, macOS, iOS and Android users.

Sophos Secure Email

Sophos Secure Email is a fully featured, secure, and containerized email app for Android and iOS that lets you isolate business email, calendar and contacts from private data on a mobile device when managed by Sophos Mobile. All company information is protected with AES-256 encryption and access can easily be revoked based on device compliance rules. Sophos Secure Email also lets

IT provision business email securely and consistently across different devices and OS variations.

Sophos Mobile

3 About Sophos Mobile Admin

Sophos Mobile Admin is the central instrument for managing devices with Sophos Mobile. It is the web interface of the server used for device management. With the web portal you can implement a corporate policy for the use of devices and apply it to the devices that are enrolled with Sophos

Mobile.

In Sophos Mobile Admin you can:

• Configure the system, for example personal settings or platform-specific settings.

• Configure compliance policies and define actions to be taken if devices no longer comply with the

rules specified. See Compliance policies

(page 32).

• Enroll devices with Sophos Mobile. See

Add devices (page 40).

• Provision new devices. See

Enroll devices (page 41).

• Install apps on enrolled devices. See

Apps (page 281).

•

Define security policies for devices. See Profiles and policies (page 92).

• Create task bundles to bundle several tasks and transfer them to the devices in one transaction.

See

Task bundles

(page 269).

•

Configure settings for the Self Service Portal. See Configure Self Service Portal (page 27).

• Carry out administrative tasks on devices, for example reset the password of devices, lock or wipe

devices if they are lost or stolen, unenroll devices. See Manage devices

(page 50).

•

Create and view reports. See Reports (page 8).

3.1 Dashboard

Note

This section applies to the Dashboard page of regular administrators. For the super administrator, the Dashboard page is used to manage customers. See the Sophos Mobile super administrator guide .

The customizable Dashboard is the regular start page of Sophos Mobile and provides access to the most important information at a quick glance. It consists of several widgets providing information about:

• Devices, all or per group

• Compliance status by platform or for all devices

• Managed status by platform or for all devices

• The SSP registration status

• The managed platform versions

You can also add devices from the Dashboard. See

Use the Add device wizard

(page 43).

The following options are available to customize the Dashboard:

• To add a widget to the page, click Add widget.

• To remove a widget from the page, click the Close button in its header.

Sophos Mobile

• To reset the page to its default layout, click Restore default layout.

• To rearrange the widgets on the page, drag a widget header.

3.2 Table views

In Sophos Mobile Admin, many pages display information in a tabular form.

These tables have common controls that you can interact with.

Above the table:

• Use the Show or hide columns icon to configure which table columns are visible.

• Enter text in the Search all fields field to only display data rows that contain that text in any column.

In the table:

• Click a column header to sort the table rows by that property. Click again to revert the sort order.

• Click an entry name to perform the default action on that entry (usually Edit).

• Click the blue triangle next to an entry name to perform more actions on that entry.

Below the table:

• Use the navigation buttons to display a specific table page.

• Use the Export icon to export either the whole table or the current page to a Microsoft Excel file or a CSV file. If you have configured a row filter, only the currently visible rows are exported.

3.3 Prerequisites

Before using Sophos Mobile Admin:

• You need a computer connected to the internet and equipped with a web browser. For information on supported browsers and the relevant versions, see the Sophos Mobile release notes.

• The super administrator must have created a customer (a tenant whose devices are managed in

Sophos Mobile). For further information, see the Sophos Mobile super administrator guide .

Note

For Sophos Mobile as a Service, a customer is predefined. Super administrators are not supported for Sophos Mobile as a Service.

• You need a Sophos Mobile user account and the relevant credentials for logging in to Sophos

Mobile Admin. The credentials consist of customer, user and password.

3.4 User roles

Sophos Mobile administrators have different roles. The role affects what an administrator can do.

The available roles are:

Role

Administrator

Limited Administrator

Reporting

Content admin

Helpdesk

Read-only

App Group Administrator

Duo API

Sophos Mobile

Description

This role can perform all available actions.

This role can enroll and manage devices, but cannot specify essential settings and cannot manage other administrators.

This role can view the list of devices and is able to create reports. For example, an auditor or an employee who needs to document the settings in Sophos Mobile.

This role is intended for employees responsible for uploading, updating or removing documents. Usually this role is assigned to a person outside the IT department. The permissions are set to limit visibility and access only the content in the

Documents menu.

This role can perform actions for support purposes, including enrolling devices and installing apps. This role does not have access to critical functions, such as defining settings and creating, deleting or editing devices/device groups, packages and policies.

This role has read-only access to all settings that are available to the Administrator role.

This role can manage app groups. A typical user is an administrator that accesses the Sophos Mobile web service interface to create, update or read app groups.

This role is required for integration with the Duo Security authentication software. Administrators with the Duo API role can access the Sophos Mobile web service interface for requesting the management status of devices.

See Duo Security integration

(page 80).

Tip

Your Sophos Mobile product delivery includes the Role Editor. Role Editor lets you easily modify existing user roles or create your own custom roles. You can find it in the %MDM_HOME%\tools

\Wizard folder, where %MDM_HOME% is the Sophos Mobile installation folder.

For information on how to use the Role Editor, see Sophos knowledge base article 122066 or contact Sophos Support.

Related tasks

Create administrators (page 338)

3.5 Change your password

You can change your password any time after you have logged in to Sophos Mobile Admin:

Sophos Mobile

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Change

password tab.

2. Enter your old password, a new one and confirm it.

3. Click Save.

3.6 Password recovery

If you have forgotten your password for Sophos Mobile Admin, you can reset it.

1. In the Login dialog box of Sophos Mobile Admin, click Forgot password?

The Reset password dialog box is displayed.

2. Enter your account information and click Reset password.

You receive an email with a link for resetting your password.

3. Click the link.

The Change password dialog box is displayed.

4. Enter a new password, confirm it and click Change password.

Your password has been changed and you are logged in to Sophos Mobile Admin.

Sophos Mobile

4 Key steps for managing devices with

Sophos Mobile

Sophos Mobile offers a wide range of management functions depending on device types, security policies and specific requirements in your organization.

The key steps for managing devices with Sophos Mobile are:

•

Configure compliance policies for devices. See Compliance policies (page 32).

• Create device groups. See

Create device group (page 83).

Device groups are used to categorize devices. We recommend that you put devices into groups.

This helps you to manage them efficiently as you can carry out tasks on a group rather than on individual devices.

• Enroll and provision devices. See

Add devices

(page 40) and Enroll devices (page 41).

Devices can either be enrolled and provisioned by administrators in Sophos Mobile Admin or by device users in the Self Service Portal.

•

Set up policies for devices. See Profiles and policies (page 92).

• Create task bundles. See

Task bundles (page 269).

•

Configure the available features of the Self Service Portal. See Configure Self Service Portal (page

27).

• Apply new or updated policies to enrolled devices.

Sophos Mobile

5 Reports

You can create reports of the items managed by Sophos Mobile.

1. On the menu sidebar, under INFORM, click Reports, and then click the name of the required report.

2. In the Choose format dialog, click one of the available icons to select the output format:

•

Click to export the report to a Microsoft Excel file.

•

Click to export the report to a CSV file.

The report is saved to your computer.

Sophos Mobile

6 Tasks

The Task view page gives you an overview of all tasks you created and started and displays their current state.

You can monitor all your tasks and intervene in case of problems. For example, you can delete a task that cannot be completed but blocks the device.

To delete a task, click the Delete icon next to it.

You can filter tasks according to their type and state and sort them by device name, package name, creator and scheduled date.

6.1 Monitor tasks

In Sophos Mobile Admin, you can monitor all existing tasks for devices.

• The Tasks page shows all unfinished and failed tasks as well as the finished tasks of the last few days. The Task view page is refreshed automatically, so you can watch the states of the tasks evolve.

• The Task details page shows general information about a task from the Tasks page or the Task

archive page.

• The Task archive page shows all tasks.

6.1.1 View unfinished, failed and latest finished tasks

1. On the menu sidebar, under INFORM, click Tasks.

2. On the Task view page, the State column shows the task status, for example, Completely failed.

3. In the Refresh interval (in sec.) field, you can select how often the Task view page is to be refreshed.

4. To view further details about a task, click the Show magnifier icon next to the required task.

The Task details page is displayed. Besides general information on the task (for example, device name, package name and creator) it shows the states a specific task went through, including timestamps and error codes. If there are commands to be executed by the device, an additional

Details button is available on the Task details page.

5. If available, click Details to view the commands to be processed by the device.

If there was no error, the error code is 0 . If a command has failed, the error code is displayed. In most cases there is also a description of what may have caused the command to fail.

6. To return to the Task details page, click Back.

6.1.2 View task archive

1. On the menu sidebar, under INFORM, click Tasks.

2. On the Task view page, click Task archive.

The Task archive page is displayed. It shows all finished and failed tasks in the system.

3. On this page, you can:

• Click Reload to refresh the Task archive page.

Sophos Mobile

• Delete a task from the archive by clicking the Delete icon next to the relevant task.

• Select several tasks and click Delete selected to delete them from the archive.

To go back to the Task view page, click Tasks on the menu sidebar.

6.1.3 Task states

The following table provides an overview of the task states shown on the Task view and on the

Task archive pages.

Every state is associated with a color code that indicates the state category.

Color code State

Accepted

Description

Task has been created.

Will be retried Task will be retried later.

Started

In progress

Task has been started.

Execution of the task is being prepared.

Task bundle in progress Execution of the task bundle is being prepared.

Notified The Sophos Mobile Control app was notified.

Commands sent The Sophos Mobile Control app has received the package and/or the commands.

Result evaluation started The Sophos Mobile Control app has answered and the evaluation of the result has been started.

Result incomplete

Waiting for user interaction

Result evaluation showed that not all commands’ results have been received by now.

There is a pending user action on the device.

Waiting for task completion

Device is locked

An installation task was sent to the device, but it may take some time to complete.

Task waits for the device to become unlocked (iOS).

Sophos Mobile

Color code State

Successful

Description

Package has been installed or the commands have been successfully executed.

Note

For the initial provisioning of the Sophos Mobile

Control app the task must finish with the state

Installed.

Installed

Result evaluation failed

Task partly failed

Delayed

Failed (retry queued)

Task failed

Completely failed

Not started

Skipped

Unknown

The Sophos Mobile Control app has been installed successfully. The device is provisioned now.

Result evaluation could not be executed.

Not all commands of the task could be executed successfully.

Task will be restarted later.

Task has failed and will be retried later.

Task has failed and no further retries are queued.

Task has failed, and it is not possible to retry it.

Task is part of a task bundle and was not processed yet.

Task is not supported by device. Task bundle execution continues with the next task.

The server has no information about the task status.

Color code Category

Open

In progress

Success

Failure

Other

Sophos Mobile

7 Alerts

The Alerts page lists the alerts that require your attention.

For each alert, the list shows the event that caused the alert, when it occurred, and which user and device are affected.

The list also shows the severity of alerts:

Gray info sign for informational alerts

Orange warning sign for medium-priority alerts

Red warning sign for high-priority alerts

Acknowledge alerts

Select one or more alerts and then click Mark as acknowledged to remove the selected alerts from the list. To display acknowledged alerts, select Show acknowledged alerts in the drop-down list above the table.

Note

Acknowledging an alert does not resolve the event that triggered it.

Important

Alerts are automatically deleted from the Sophos Mobile database after 90 days, even if you have not acknowledged them.

Set up email reports for alerts

Sophos Mobile sends email reports for all alerts that have not been acknowledged yet. For

information on how to set up the list of recipients and the notification schedule, see Configure Email

(page 14).

Which events trigger alerts?

Alerts are created for the following events:

• Compliance violations for which you’ve turned on the Create alert action.

• Device lifecycle changes and important device actions.

• Upcoming expirations of licenses and certificates.

• Other events requiring your attention.

Sophos Mobile

8 Setup

In the Setup menu section you configure the general behavior of Sophos Mobile, the interaction with devices, and the interaction with external components like Google or Apple portals.

8.1 Configure personal settings

You can adjust the appearance of Sophos Mobile Admin to your personal preferences. For example, you can set the language, the time zone, or the visible device platforms.

Note

These settings only affect the administrator account you’re currently signed in with.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Personal tab.

2. Configure the following settings:

Option

Language

Description

The user interface language.

Time zone

Unit system

Lines per page in tables

Expert mode

The time zone in which dates are shown.

The unit system for lengths (Metric or Imperial).

Activated platforms

The maximum number of entries displayed per table page.

This setting turns on additional features:

• The Show device page includes the Custom properties tab with your custom device properties.

• The Show device page includes the Internal properties tab with additional properties the device reports.

• Several policy configuration pages include the Extra

settings section to configure optional settings.

The device platforms you want to view.

In Sophos Mobile Admin, only pages and settings relevant for the selected platforms are shown.

3. Click Save.

8.2 Configure password policies

To enforce password security, configure password policies for Sophos Mobile Admin users and the

Self Service Portal.

Sophos Mobile

Note

The password policies do not apply to users from an external LDAP directory.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Password

policies tab.

2. Under Rules, you can define password requirements, like a minimum number of lower-case, upper-case or numerical characters that a password must contain to be valid.

3. Under Settings, configure the following settings: a) Password change interval (days): Enter the number of days until a password expires

(between 1 and 730 ), or leave the field empty to disable password expiration.

b) Number of previous passwords which must not be reused: Select a value between 1 and

10 , or select -- to disable this restriction.

c) Maximum number of failed login attempts: Select the number of failed login attempts until the account gets locked (between 1 and 10 ), or select -- to allow an unlimited number of failed login attempts.

4. Click Save.

8.3 Configure SMC app settings

On the SMC app tab of the General settings page, you configure settings for the Sophos Mobile

Control app on Android, iOS and Windows Mobile devices.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the SMC app tab.

2. Configure the following settings:

Option

Disable unenrollment through app

Description

Remove the Unenroll button from the Sophos Mobile Control app to prevent users from unenrolling their device through the app.

Note

To completely prevent user-initiated unenrollment, also disable the Unenroll device option in the Self Service

Portal settings. See

Configure Self Service Portal settings

(page 27).

3. Click Save.

8.4 Configure Email

On the Email configuration tab, you configure settings for emails that are sent by Sophos Mobile.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Email

configuration tab.

2. In Language, select the email language.

3. In Originator name, enter the name that appears as email originator.

Sophos Mobile

4. Optional: Under Alert email settings, configure alert reports that are sent to administrators: a) In Severity, select the severity levels that are included in the report.

b) In Email recipients, specify the recipients by entering one or more valid email addresses.

c) In Email schedule, enter a time of the day when the report is sent out, and then click Add.

Repeat this to send out more than one report per day.

Note

Times are in the server time zone.

5. Click Save.

Related concepts

Alerts (page 12)

8.5 Configure IT contact

Provide your IT contact details so that users can get help with questions or problems.

The information you enter here is displayed in the Self Service Portal and on the users’ devices.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the IT contact tab.

2. Enter the contact information.

3. Click Save.

8.6 Configure privacy settings

You can turn off the following privacy-related settings in Sophos Mobile Admin:

Device location

When turned off, you can’t view the device location. Users can still view their device’s location in the Self Service Portal.

Installed apps

When turned off, you can’t view the apps installed on a device. The Installed apps tab in the device details is not displayed and the Apps

per device report is not available.

You can still view summary reports of installed apps for all devices.

To configure privacy settings:

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Privacy tab.

2. To turn off viewing device locations, click Forbid admins to locate devices.

3. To turn off displaying installed apps, click Hide installed apps.

Sophos Mobile

Note

Sophos Mobile records the following privacy-related events:

• An administrator requests a device location.

• A user requests a device location in the Self Service Portal.

• Viewing device locations in Sophos Mobile Admin is turned on or off.

• Viewing installed apps in Sophos Mobile Admin is turned on or off.

8.7 Configure iOS settings

On the iOS tab of the Apple setup page, you configure settings for iOS devices.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the iOS tab.

2. Configure the following settings:

Option

Activation Lock bypass

Synchronize device name

Description

Select Enable to be able to clear the Activation Lock on supervised devices.

When this option is selected, Sophos Mobile retrieves a bypass code when syncing with a supervised device that has Activation Lock enabled. If required, you can perform the Activation Lock bypass action from the device's Show

device page to clear Activation Lock when the device needs to be erased and re-deployed.

Activation Lock is an iOS security feature to prevent the reactivation of lost or stolen devices. Normally, you need the correct Apple ID and password to clear Activation Lock. With the Activation Lock bypass feature, you can clear Activation

Lock by providing the bypass code only.

Select Enable to manage iOS devices under the name that is configured on the device.

When this option is selected, the device name that Sophos

Mobile uses is set every time the device synchronizes with

Sophos Mobile.

When this option is deselected, you set the device name during device enrollment.

3. Click Save.

8.8 Apple Push Notification service certificates

To use the built-in Mobile Device Management (MDM) protocol of iOS and macOS devices, Sophos

Mobile must use the Apple Push Notification service (APNs) to trigger the devices.

Sophos Mobile manages APNs certificates per customer. You must create and upload the certificates for each customer that you use.

APNs certificates have a validity period of one year.

Sophos Mobile

8.8.1 Create APNs certificate

Prerequisite: You have not uploaded a certificate for the Apple Push Notification service (APNs) to

Sophos Mobile yet.

To renew an existing certificate, see Renew APNs certificate

(page 17).

Tip

You can use the same certificate for several customers. See

Copy APNs certificate to another customer (page 18).

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

2. Click APNs certificate wizard.

3. On the Mode page, click Create a new APNs certificate.

4. On the CSR page, click Download certificate signing request.

This saves the certificate signing request file apple.csr

to your local computer. The signing request file is specific to the current customer.

5. You need an Apple ID. Even if you already have an ID, we recommend that you create a new one for use with Sophos Mobile. On the Apple ID page, click Create Apple ID in the Apple portal.

This opens an Apple web page where you can create an Apple ID for your company.

Note

Store the credentials in a safe place where your colleagues can access them. Your company will need these credentials to renew the certificate each year.

6. In the wizard, enter your new Apple ID in the Apple ID field.

7. On the Certificate page, click Create certificate on the Apple portal.

This opens the Apple Push Certificates Portal.

8. Log in with your Apple ID and upload the certificate signing request file apple.csr

9. Download the .pem

APNs certificate file and save it to your computer.

10. On the Upload page, click Upload certificate and then browse for the .pem

file that you received from the Apple Push Certificates Portal.

11. Click Save.

Sophos Mobile reads the certificate and displays the certificate details on the APNs tab.

8.8.2 Renew APNs certificate

Prerequisite: You have uploaded a certificate for the Apple Push Notification service (APNs) to

Sophos Mobile that is about to be expire and needs to be renewed.

To create and upload a new certificate, see Create APNs certificate (page 17).

Important

In the Apple portal, it is important that you select the correct APNs certificate for renewal. If you renew the wrong certificate, you might need to re-enroll all iOS and macOS devices.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

Sophos Mobile

2. Click APNs certificate wizard.

3. On the Mode page, click Renew my APNs certificate.

4. On the CSR page, click Download certificate signing request.

This saves the certificate signing request file apple.csr

to your local computer. The signing request file is specific to the current customer.

5. On the Apple ID page, the Apple ID used to create the initial APNs certificate is displayed.

You need this ID to log into the Apple portal.

6. On the Certificate page, click Renew certificate on the Apple portal.

This opens the Apple Push Certificates Portal.

7. Log in with the Apple ID that was displayed in the wizard.

8. In the Apple Push Certificates Portal, click Renew next to your Sophos Mobile APNs certificate.

9. Upload the certificate signing request file apple.csr

you prepared earlier.

10. Download the .pem

APNs certificate file and save it to your computer.

11. On the Upload page, click Upload certificate and then browse for the .pem

file that you received from the Apple Push Certificates Portal.

12. Click Save.

Important

If the following message is shown, you are not renewing the correct certificate:

The topic of the new certificate does not correspond to the old one. If devices have been set up with the previous certificate, they have to be set up again. Do you really want to save your changes?

This message indicates that you are about to create a new APNs certificate with a different identifier. If you confirm the message, all existing iOS and macOS devices are not manageable any more and you have to re-enroll them.

For information on how to select the correct certificate, see Identify the correct APNs certificate for renewal (page 19).

8.8.3 Copy APNs certificate to another customer

You can copy a certificate for the Apple Push Notification service (APNs) to another customer within the same or a different installation of Sophos Mobile.

Important

If there already exists an APNs certificate at the target location, it is important that the Topic property of the certificate that you want to copy is identical to the Topic of the existing certificate.

If you copy the wrong certificate, you might need to re-enroll all iOS and macOS devices of the customer.

Download the certificate:

1. Log in to Sophos Mobile Admin as an administrator of the customer whose APNs certificate you want to copy.

2. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

3. Make a note of the Topic value that is displayed under APNs certificate.

4. Click Download certificate as PKCS #12 file.

5. In the confirmation dialog, the password for the certificate file is displayed. Make a note of that password and then click Download.

Sophos Mobile

This saves the certificate file apns_cert.p12

to your local computer.

Upload the certificate to a different customer:

6. Log in to Sophos Mobile Admin as an administrator of the customer to whom you want to upload the certificate.

7. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

8. If there already exists an APNs certificate, verify that the Topic value is identical to the value of the certificate you are about to copy.

9. Click APNs certificate wizard.

10. On the Mode page, click Upload an APNs certificate from another Sophos Mobile customer.

11. On the Apple ID page, enter the Apple ID used to create the APNs certificate you are about to upload.

12. On the Upload page, click Upload certificate and then browse for the apns_cert.p12

file you’ve downloaded from the other customer.

13. Enter the password and then click Apply.

14. Click Save.

8.8.4 Identify the correct APNs certificate for renewal

When you renew your Apple Push Notification service (APNs) certificate for the Sophos Mobile

server as described in Renew APNs certificate (page 17), it is important that on the Apple portal

you select the correct APNs certificate for renewal.

This section describes how to identify the APNs certificate that is currently uploaded to the Sophos

Mobile server.

Retrieve the certificate identifier:

1. Log in to Sophos Mobile Admin with an administrator account for the customer whose APNs certificate needs to be renewed.

2. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

3. Make a note of the Topic value that is displayed under APNs certificate.

Identify the certificate:

4. Use your web browser to open the URL of the Apple Push Certificates Portal, https:// identity.apple.com/pushcert/ .

If you are experiencing issues with certain features of the Apple portal when using Microsoft

Internet Explorer, we recommend that you use the latest version of the Firefox, Opera, Chrome or

Safari browser instead.

5. Log in with the Apple ID that you used for the creation of the initial APNs certificate.

In the list of APNs certificates, click the Certificate Info icon next to a certificate entry.

This displays the certificate details.

7. In the Subject DN field, locate the value that follows the string UID= . If this matches the identifier that you determined in Sophos Mobile Admin, you have identified the correct certificate.

8.8.5 Check APNs connectivity of devices

Users of the Sophos Mobile Control app for iOS can check if their devices are able to connect to the

Apple Push Notification service (APNs) server.

1. In the Sophos Mobile Control app, tap the Information icon to open the About screen.

2. Tap Check APNs.

Sophos Mobile

The app tries to connect to the Apple APNs server. The expected server response time is 5 seconds or less.

Check your firewall settings if the APNs server can’t be reached. For a list of required connections see the Sophos Mobile server deployment guide .

8.9 Configure iOS AirPlay destinations

With Sophos Mobile you can remotely trigger AirPlay mirroring between an iOS device and predefined AirPlay destinations (for example AppleTV).

Note

AirPlay only works for devices within the same network.

You can define destinations for AirPlay mirroring.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the iOS

AirPlay tab.

2. In the AirPlay destinations section, click Create AirPlay destination.

The AirPlay destination page is displayed.

3. Enter the device name and, optionally, the MAC address of the AirPlay destination device. If required, enter the password of the device.

4. Click Apply.

The device is shown under AirPlay destinations in the iOS AirPlay tab of the Apple setup page.

5. Click Save.

You can trigger AirPlay mirroring between an iOS device and this destination by clicking Request

AirPlay mirroring from the Actions menu on the Show device page for the relevant device.

8.10 Android settings

On the Android tab of the Android setup page, you configure settings for Android devices:

•

Set Android management mode (page 20)

•

Enable Baidu Cloud Push service (page 22)

•

Host Sophos apps on your web server

(page 21).

•

Configure the synchronization interval of the Sophos Mobile Control app (page 21).

8.11 Set Android management mode

For Android devices, you can choose between the Device administrator and Android enterprise management modes.

Device administrator

Android enterprise

Sophos Mobile Control is a device administrator and uses Android mobile device management

(MDM) to manage a device.

Sophos Mobile Control is the device or profile owner and uses Android enterprise to manage a device or a work area on the device.

Sophos Mobile

We recommend you use Android enterprise.

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the Android tab.

2. In Management mode, select the management mode for Android devices.

3. Click Save.

This setting affects which policy types are available in the user interface.

If you’ve selected the Android enterprise mode, you must set up Android enterprise for your organization before you can enroll devices. See

Set up Android enterprise - Overview (page 306).

8.12 Host Sophos apps on your web server

You can host the Sophos apps that users install during enrollment on an internal web server instead of Google Play.

Important

• This option introduces a security risk. When you host the Sophos apps on an internal web server, you must allow app installations from outside Google Play in general.

• Make sure the latest app versions are installed on the mobile devices. Regularly upload new versions from the Sophos Product Downloads and Updates web page to your web server and then use a task bundle to install them onto the devices.

1. Sign in to Sophos Mobile Admin with a super administrator account.

2. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the Android tab.

3. Under Select installation source, select Hosted APK file.

4. Enter the URL of the Sophos Mobile Control app in URL of the SMC APK file.

For example, if you have copied the APK file to an smc subdirectory below the deployment directory of your web server, enter this URL: <web_server_address>/smc/smc.apk

The devices must be able to access the URL.

5. Likewise, enter the URL of the Sophos Mobile Security app in URL of the SMSec APK file.

This requires a Mobile Advanced license.

6. Click Save.

8.13 Configure the synchronization interval of the

Sophos Mobile Control app

The Sophos Mobile Control app synchronizes with the Sophos Mobile server at these times:

• Immediately, when it needs to communicate device-side changes.

• On request, when it is triggered by the server through the push notification services Google

Cloud Messaging (GCM) and, optionally, Baidu Cloud Push.

• Time scheduled, every 24 hours by default.

If required, you can use a shorter interval for the time scheduled synchronization.

For Sophos Mobile on Premise, this is configured by the super administrator.

Sophos Mobile

Important

The default value of 24 hours is sufficient in most cases. We recommend that you only use a shorter interval if the push notification services do not work in your environment. Using shorter intervals impacts battery life and data consumption and causes higher server load.

To configure the synchronization interval that the Sophos Mobile Control app on Android devices uses:

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the Android tab.

2. Under SMC app sync interval, select a value between 15 minutes and 24 hours from the Sync

interval list.

3. Click Save.

8.14 Enable Baidu Cloud Push service

Sophos Mobile uses the Google Firebase Cloud Messaging (FCM) service to send push notifications to Android devices, to trigger them to contact the Sophos Mobile server. In China, FCM will likely not work. Therefore, Sophos Mobile can also use Baidu Cloud Push, which is a Chinese push notification service.

If you manage Android devices that are located in China, enable the Baidu Cloud Push service as follows:

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the Android tab.

2. In the Baidu Cloud Push service section, select Enable Baidu Cloud Push service.

3. Click Save.

When Baidu Cloud Push is enabled, Sophos Mobile sends all push notifications through FCM and through Baidu Cloud Push.

8.15 Register Samsung Knox license

If you have a Samsung Knox Premium license, you can manage the Knox container on your Samsung devices with Sophos Mobile.

To register a Samsung Knox Premium license key:

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the

Samsung Knox license tab.

2. Enter your Samsung Knox Premium license key.

You can enter a license key of type KPE Premium or KLM Workspace .

3. Click Save.

If you later decide not to use your Samsung Knox Premium license with Sophos Mobile, click

Remove to deregister the license key.

Sophos Mobile

8.16 Configure polling interval for Windows devices

For Windows devices, you can configure the polling interval at which the Windows MDM client contacts the Sophos Mobile server. Usually, the server contacts the client using push notifications.

Polling is used as a safety measure when the push notification service is not available.

Note

The default values are sufficient in most cases. Using shorter intervals impacts battery life and data consumption and causes higher server load.

1. On the menu sidebar, under SETTINGS, click Setup > Microsoft setup, and then click the

Windows tab.

2. Select polling intervals for the different Windows operating systems. You can configure individual settings for:

• Windows 10 Mobile and Windows Phone 8.1 devices

• Windows 10 computers

3. Click Save.

8.17 Check your licenses

Sophos Mobile uses a user-based license scheme. One user license is valid for all devices assigned to that user. Devices that are not assigned to a user require one license each.

On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the License tab.

The following information is displayed:

• Maximum number of licenses: Maximum number of device users (and unassigned devices) that can be managed.

If the super administrator did not set a quota for the customer, the number of licenses is limited by the overall number for the Sophos Mobile server.

• Used licenses: Number of licenses in use.

• Valid until: The license expiration date.

• Advanced license: The super administrator has activated a Mobile Advanced license for the customer.

If you have any questions or concerns regarding the displayed license information, contact your

Sophos sales representative.

8.18 Simple Certificate Enrollment Protocol (SCEP)

With Sophos Mobile, you can distribute certificates to devices using the Simple Certificate

Enrollment Protocol (SCEP).

You define the settings required for devices in an SCEP configuration of a device profile (Android and iOS) or a policy (Windows Mobile).

Sophos Mobile

8.18.1 Prerequisites

In order to use the Simple Certificate Enrollment Protocol, the following prerequisites must be fulfilled:

• An SCEP-enabled Windows CA exists in the environment.

• Login credentials for a user who can create a challenge code are available.

• The Sophos Mobile server has http or https access to the following sites:

— https://YOUR-SCEP-SERVER/CertSrv/MSCEP_ADMIN

— https://YOUR-SCEP-SERVER/CertSrv/MSCEP

8.18.2 Configure SCEP

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the SCEP tab.

2. Specify the following: a) In the SCEP server URL field, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP.

b) In the Challenge URL field, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP_ADMIN.

Note

If you use a Windows 2003 server as the SCEP server, enter https://YOUR-SCEP-

SERVER/CertSrv/MSCEP.

24 c) In the User and Password fields, enter the user credentials of the user who can create a challenge code.

Note

In the User field, enter a user who has the necessary rights to enroll certificates. Use the logon format: username@domain d) In the Challenge characters field, select the character types that are used for the challenge password.

e) In the Challenge length field, accept the default length.

f) Optional: Clear the Use HTTP proxy option if you want Sophos Mobile to bypass the HTTP proxy when connecting to the SCEP server. This option is only available if the HTTP proxy is enabled.

For Sophos Mobile on Premise, the super administrator can configure an HTTP proxy that

Sophos Mobile uses for outbound HTTP and SSL/TLS connections. See the Sophos Mobile super administrator guide .

For Sophos Mobile as a Service, the HTTP proxy is always enabled.

3. Click Save.

Sophos Mobile tests the connection to your SCEP server.

To deploy a profile using SCEP, add a SCEP configuration to an Android or iOS device profile or to a

Windows Mobile policy.

Sophos Mobile

Tip

In the profile or policy, you can configure an interval after which the device automatically requests a certificate renewal.

8.19 Create customer properties

You can create customer-level properties.

When you create a property with name my property , you can refer to the value of the property by using the placeholder %_CUSTPROP(my property)_% . For example, you can use this to refer to a domain that is specific to the customer.

For details on placeholders, see

Placeholders in profiles and policies

(page 97).

To create a customer property:

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the

Customer properties tab.

2. Click Add customer property.

3. Enter a name and a value for the customer property.

4. Click Apply.

5. Click Save.

The customer property is added to the Sophos Mobile customer.

8.20 Configure SSL/TLS certificates

On the SSL/TLS tab of the Sophos setup page, you configure SSL/TLS certificates for the secure connections between the Sophos Mobile server and the clients.

For details, see the Sophos Mobile super administrator guide .

8.21 Configure EAS proxy

On the EAS proxy tab of the Sophos setup page, you configure the EAS proxy server that is used to filter email traffic between the managed devices and your email server.

For details, see the Sophos Mobile super administrator guide .

8.22 Configure Network Access Control

On the Network Access Control tab of the Sophos setup page, you configure the connection to a

Network Access Control (NAC) system.

For details, see the Sophos Mobile super administrator guide .

Sophos Mobile

8.23 Configure email server connection

On the SMTP tab of the Sophos setup page, you configure the connection to an SMTP email server.

For details, see the Sophos Mobile super administrator guide .

8.24 Configure proxy server connection

On the HTTP proxy tab of the Sophos setup page, you configure the connection to a proxy server

Sophos Mobile uses for HTTP and SSL/TLS connections.

For details, see the Sophos Mobile super administrator guide .

8.25 Configure portal access

On the Web portals tab of the Sophos setup page, you configure the access to Sophos Mobile

Admin and to the Self Service Portal.

For details, see the Sophos Mobile super administrator guide .

8.26 Configure file upload limits

On the File uploads tab of the Sophos setup page, you configure file size limits for uploaded apps and documents.

For details, see the Sophos Mobile super administrator guide .

8.27 Turn on audit logging

On the Audit logging tab of the Sophos setup page, you turn on the logging of all actions users perform in Sophos Mobile Admin.

For details, see the Sophos Mobile super administrator guide .

8.28 Create system messages

On the System messages tab of the Sophos setup page, you create system messages that are displayed on the sign-in pages of Sophos Mobile Admin and the Self Service Portal.

For details, see the Sophos Mobile super administrator guide .

Sophos Mobile

9 Configure Self Service Portal

With the Self Service Portal you can reduce IT efforts by allowing users to enroll devices on their own and carry out other tasks without having to contact the helpdesk.

With a Self Service Portal configuration you define the following:

• The user groups allowed to use the Self Service Portal.

• The types of devices users can enroll.

• The device actions users can perform.

The Self Service Portal is available for the following platforms:

• Android

• iOS

• macOS

• Windows Mobile

• Windows

9.1 Configure Self Service Portal settings

Important

Because of the complexity of the Self Service Portal settings configuration, we recommend that you test device enrollment for different user groups before you roll out the settings to your actual users.

1. On the menu sidebar, under SETTINGS, click Setup > Self Service Portal.

2. Click Enrollment texts and then add a terms of use text and a post-enrollment text.

When you assign these texts to your Self Service Portal configuration, they are displayed before

and after the enrollment, respectively. For details, see Create enrollment texts

(page 29).

3. On the Self Service Portal configurations page, click Add to create a configuration.

You can create several configurations and assign these to different user groups.

4. Configure the following settings:

Option

Name

Description

The name of the configuration.

In the Self Service Portal, users select a configuration by this name.

User groups

Maximum number of devices

Click Add and then enter a user group. The configuration is applied to all members of that group.

You can add more than one user group to a configuration, but you can’t add the same user group to different configurations.

The maximum number of devices a user can enroll in the Self

Service Portal.

Sophos Mobile

Option

Actions

Description

Click Show and then select the management actions a user can perform in the Self Service Portal.

For details of actions supported by a device platform, see

Available Self Service Portal actions (page 29).

5. Click Add and then click the device platform you want to configure.

6. In the Configure platform settings dialog, configure the following settings:

Option

Display name

Description

The name of the platform settings.

In the Self Service Portal, users select an enrollment type by this name.

Description A description of the platform settings.

This description is displayed in the Self Service Portal next to the name.

Owner The owner mode (corporate or personal) of devices enrolled with this configuration.

The device group the device is added to.

Device group

Enrollment package

Terms of use

The task bundle (for Android, iOS, and macOS) or policy (for

Windows and Windows Mobile) sent to the device.

The text to be displayed in the Self Service Portal before the enrollment.

Leave this field empty to display no text.

Users must agree to the text to proceed with the enrollment.

Post-enrollment text The text to be displayed in the Self Service Portal after the enrollment.

Leave this field empty to display no text.

7. Click Apply to add the platform settings to the Self Service Portal configuration.

8. If required, configure additional platforms.

For each platform, you can configure different settings for corporate and for personal devices.

9. On the Edit Self Service Portal configuration page, click Save.

If required, add more Self Service Portal settings for other user groups.

On the Self Service Portal configurations page, you can use the arrow icons next to a configuration to change its priority. If Self Service Portal users match more than one configuration

(because they are a member of several groups), the configuration with the highest priority is used.

There always is a Default configuration. This configuration has the lowest priority, so that it is only used when no other configuration matches a user.

Sophos Mobile

9.2 Create enrollment texts

A Self Service Portal configuration can include a terms of use text and a post-enrollment text that are displayed before and after the enrollment, respectively. You create these texts separate from the Self

Service Portal configuration and then assign them as required.

1. On the menu sidebar, under SETTINGS, click Setup > Self Service Portal.

2. Click Enrollment texts and then click the type of text to create:

• Terms of use: A mobile policy, disclaimer or agreement text that is displayed before the enrollment. Users must agree to the text to proceed with the enrollment.

• Post-enrollment text: Text to be displayed after the enrollment, for example a description of post-enrollment tasks the user must perform.

3. On the Edit enrollment text page, enter a name for the text and the text itself.

You may use HTML markup to format the text.

4. Click Save.

When you configure a Self Service Portal setting, you can select one terms of use text and one postenrollment text for every type of enrollment.

9.3 Available Self Service Portal actions

Self Service Portal actions let users manage their devices. You set the available actions in the Self

Service Portal configuration.

Action

Locate device

Lock device

Reconfigure device

Description

Locate a device if it’s lost or stolen.

Lock a device if it’s lost or stolen.

Reconfigure the Sophos Mobile Control app, for example if the user uninstalled it accidentally.

Platforms

Android iOS

Windows Mobile

Windows

Android iOS macOS

Windows Mobile

Android iOS macOS

Windows Mobile

Windows

Sophos Mobile

Action

Show compliance violations

Refresh data

Description

For non-compliant devices, show violation details.

Synchronize a device with the Sophos Mobile server.

Depending on your compliance policy, devices might become non-compliant when they don’t synchronize regularly, for example when they are switched off for a long time. If this happens, users can perform this action to make the device compliant again.

Platforms

Android iOS macOS

Windows Mobile

Windows

Android iOS macOS

Windows Mobile

Windows

Note

This function is not available for devices on which Sophos Mobile only manages the Sophos container.

Reset password

Wipe

Wipe Android work profile

Reset the lock screen password.

For Android and iOS devices, Sophos Mobile sets a temporary password. After the user has unlocked the device, they must set a new password.

For Android enterprise devices in profile owner mode, the work profile’s password is reset.

For iOS devices, Sophos Mobile deletes the password. The user must set a new password within 60 minutes.

Reset a device to its factory settings if it’s lost or stolen.

All data on the device is deleted.

Android iOS

Windows Mobile

Android iOS macOS

Windows Mobile

Windows

Remove the work profile from a device. This also unenrolls the device from Sophos Mobile.

Android

Sophos Mobile

Action

Unenroll device

Delete unmanaged device

Reset App Protection password

Reset Sophos container password

Reconfigure the SMC app

Managed Lost Mode

Play Lost Mode sound

Description

Unenroll a device from Sophos Mobile.

Delete a device from Sophos Mobile.

Reset the App Protection password.

Users must enter this password to use apps you’ve defined as protected.

Reset the Sophos container password.

Users must enter this password to use the

Sophos container apps Sophos Secure Email and Sophos Secure Workspace.

Reconfigure an already installed Sophos

Mobile Control app.

Android iOS

Turn Managed Lost Mode on or off.

Play a sound on a device in Managed Lost

Mode.

Platforms

Android iOS macOS

Windows Mobile

Windows

Android iOS macOS

Windows Mobile

Windows

Android iOS

Windows Mobile iOS iOS

Sophos Mobile

10 Compliance policies

With compliance policies you can:

• Allow, forbid or enforce certain features of a device.

• Define actions that are executed when a compliance rule is violated.

You can create different compliance policies and assign them to device groups. This allows you to apply different levels of security to your managed devices.

Tip

If you are planning to manage both corporate and private devices, we recommend that you define separate compliance policies for at least these two device types.

10.1 Create compliance policy

1. On the menu sidebar, under CONFIGURE, click Compliance policies.

2. On the Compliance policies page, click Create compliance policy, and then select the template the policy will be based on:

• Default template: A selection of compliance rules, with no actions defined.

• PCI template, HIPAA template: Compliance rules and actions based on the HIPAA and the

PCI DSS security standard, respectively.

Your choice of template doesn’t restrict your subsequent configuration options.

3. Enter a name and, optionally, a description for the compliance policy.

Repeat the following steps for all required platforms.

4. Make sure that the Enable platform check box on each tab is selected.

If this check box is not selected, devices of that platform are not checked for compliance.

5. Under Rule, configure the compliance rules for the particular platform.

Note

Each compliance rule has a fixed severity level (high, medium, low) that is depicted by a blue icon. The severity helps you to assess the importance of each rule and the actions you should implement when it is violated.

Note

For devices where Sophos Mobile manages the Sophos container instead of the whole device, only a subset of compliance rules is applicable. In Highlight rules, select a management type to highlight the rules that are relevant.

6. Under If rule is violated, define the actions that will be taken when a rule is violated:

Option

Deny email

Description

Forbid email access.

Option

Lock container

Deny network

Create alert

Transfer task bundle

Sophos Mobile

Description

This action can only be taken if the super administrator has configured a connection to the internal or to the standalone

EAS proxy. See the Sophos Mobile super administrator guide .

This action is only available for Android, iOS, Windows and

Windows Mobile devices.

Disable the Sophos Secure Workspace and Secure Email apps.

This affects document, email and web access that is managed by these apps.

This action can only be taken when you have activated a

Mobile Advanced license.

This action is only available for Android and iOS devices.

Forbid network access.

This action can only be taken if the super administrator has configured Network Access Control. See the Sophos Mobile super administrator guide .

This action is not available for devices where Sophos Mobile only manages the Sophos container.

Trigger an alert.

The alerts are displayed on the Alerts page.

Transfer a specific task bundle to the device.

Select a task bundle from the list, or select None to transfer no task bundle when the compliance rule is violated.

This action is only available for Android, iOS, macOS and

Windows devices.

Important

When used incorrectly, task bundles may misconfigure or even wipe devices. To assign the correct task bundles to compliance rules, an in-depth knowledge of the system is required.

Note

When a device in Android enterprise device owner mode becomes non-compliant, all apps are disabled.

7. When you have made the settings for all required platforms, click Save to save the compliance policy under the name that you specified.

Sophos Mobile

10.2 Available compliance rules

This section lists the compliance rules that you can select for the individual platforms.

Rule

Managed required

Minimum SMC version

Root access allowed

Description

Define the action that will be executed when a device is no longer managed.

Enter the minimum Sophos Mobile

Control app version that has to be installed onto the device.

Select whether devices with root rights are allowed.

Platforms

Android

Android Things iOS macOS

Windows Mobile

Windows

Windows IoT

Android

Android Things iOS

Windows Mobile

Android

Note

For Sony devices with Enterprise API version 4 or above and for Samsung devices with Knox version 5.5 or below, this includes all devices that are classified insecure by the MDM API, for example because the bootloader is unlocked.

Google SafetyNet compatibility required

Apps from unknown sources allowed

Android Debug Bridge (ADB) allowed

The device must pass the

Compatibility Test Suite (CTS), a

Google SafetyNet test for Android compatibility.

Select whether apps from unknown sources are allowed.

This rule only affects devices with

Android 7.x or earlier. With Android

8, the system setting to restrict app installation sources was removed.

Select whether ADB (Android Debug

Bridge) is allowed.

Android

Rule

Allow jailbreak

Screen lock required

Minimum OS version

Maximum OS version

Mandatory OS updates

Sophos Mobile

Description

Select whether jailbroken devices are allowed.

Select whether a device password or other screen lock mechanism (like pattern or PIN) is required.

For Android, this includes the display lock types Pattern, PIN and

Password, but not Swipe.

Windows Mobile devices that have no password policy assigned are always reported as non-compliant. This is a

Windows limitation.

Select the earliest operating system version required.

Platforms iOS

Android iOS

Windows Mobile

Windows

Select the latest operating system version allowed.

Android

Android Things iOS macOS

Windows Mobile

Windows

Windows IoT

Android

Android Things iOS macOS

Windows Mobile

Windows

Windows IoT iOS Select if devices must have the latest available or the latest required update installed.

Some iOS updates are classified as required by Apple. The latest available update might be newer than the latest required update.

Sophos Mobile

Rule

Maximum synchronization gap

Maximum SMC synchronization gap

Maximum SMSec synchronization gap

Maximum SMSec scan gap

Denial of SMSec permissions allowed

Malware apps allowed

Suspicious apps allowed

PUAs allowed

Description

The maximum allowed gap between device synchronization events.

The maximum allowed gap between

Sophos Mobile Control app synchronization events.

The maximum allowed gap between

Sophos Mobile Security app synchronization events.

Android iOS

The maximum allowed gap between malware scans performed by the

Sophos Mobile Security app.

Android

Sophos Mobile Security needs permissions on the device to work properly. The user has to grant these permissions when the app is installed.

Select whether a denial of the required permissions results in a compliance violation.

Select whether malware apps that have been detected by Sophos

Mobile Security are allowed.

Android

Select whether suspicious apps that have been detected by Sophos

Mobile Security are allowed.

Select whether Potentially Unwanted

Apps (PUAs) that have been detected by Sophos Mobile Security are allowed.

Android

Platforms

Android

Android Things iOS macOS

Windows Mobile

Windows

Windows IoT iOS

Windows Mobile

Rule

Encryption required

Third-party profiles allowed

Data roaming allowed

Container configured

Locate permission required

Denial of SMC permissions allowed

App is able to locate

Sophos Mobile

Description

Select whether encryption is required for devices.

Users must additionally enable the

Require PIN to start device or

Require Password to start device setting when they set a screen lock.

See Sophos knowledge base article

123947 .

For macOS, this setting applies to

FileVault full-disk encryption.

For Windows Mobile, a violation is only reported if the restriction Forbid

unencrypted device is set as well.

This is a Windows limitation.

This rule is not available for iOS because iPhones and iPads are always encrypted.

Configuration profiles not managed by Sophos Mobile are allowed.

Data roaming is allowed.

Platforms

Android macOS

Windows Mobile

Windows iOS

A container must be set up and enabled on the device. This can be a

Sophos container, a Samsung Knox container, or an Android work profile.

This setting refers to the Locate function. Select whether the user has to allow the Sophos Mobile Control app at installation time to retrieve location data in order to be compliant.

The Sophos Mobile Control app needs permissions on the device to work properly. The user has to grant these permissions when the app is installed.

Select whether a denial of the required permissions results in a compliance violation.

Location services must be turned on and the Sophos Mobile Control app must be allowed to use them.

For Windows Mobile, this rule only affects Windows Phone 8.1 devices.

Android iOS

Android

Android iOS

Windows Mobile

Sophos Mobile

Rule

Firewall required

System Integrity Protection required

Security updates required

Allowed apps / Forbidden apps

Mandatory apps

Unmanaged non-store apps allowed

Description

The macOS firewall must be turned on.

System Integrity Protection must be turned on.

Note

System Integrity Protection is a macOS security feature that limits the actions the root user can perform.

System Integrity Protection can be configured when the Mac starts up from macOS Recovery.

Platforms macOS macOS

Automatic installation of macOS security updates must be turned on.

You can specify either Allowed

apps or Forbidden apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list. For information on creating app groups, see

App groups (page 300).

If you specify Allowed apps, only the listed apps are allowed. If other apps are detected the device will no longer be compliant.

macOS

Android iOS macOS

Note

Android system apps are automatically allowed.

If you specify Forbidden apps, the device will no longer be compliant if these apps are detected.

Specify apps that must be installed.

Select the app group containing the mandatory apps from the list. For information on creating app groups, see

App groups (page 300).

Apps installed manually through an

IPA file are allowed.

These are self-developed apps signed with an

ad hoc provisioning profile

Android iOS macOS

Windows iOS

Sophos Mobile

Rule

Web Filtering turned on

Windows Defender must be turned on

Clean status from Windows

Defender required

Up-to-date Windows Defender definitions required

Description

The Web Filtering feature of the

Sophos Mobile Security app must be turned on.

The Windows Defender setting real-

time protection must be turned on.

Device is not compliant when

Windows Defender shows alerts.

Windows Defender must use the latest spyware definitions.

Platforms iOS

Windows

10.3 Assign a compliance policy to device groups

1. On the menu sidebar, under MANAGE, click Device groups.

The Device groups page is displayed.

2. Click the device group you want to assign a compliance policy to.

There is always a Default device group available. For information on how to create your own

device groups, see Create device group

(page 83).

3. Under Compliance policies, select the compliance policies you want to apply to corporate and to personal devices.

4. Click Save.

The selected compliance policies are shown on the Device groups page for the relevant device group under Compliance policy (corporate) and Compliance policy (personal).

10.4 Check devices for compliance

After you have configured compliance policies, you can check if enrolled devices comply with these policies.

1. On the menu sidebar, under CONFIGURE, click Compliance policies.

2. Click Check now.

All enrolled devices are checked for compliance. The specified actions are carried out.

Note

When a device in Android enterprise device owner mode becomes non-compliant, all apps are disabled.

Sophos Mobile

11 Devices

11.1 Add devices

Devices can be added to Sophos Mobile in the following ways:

•

Add devices manually. See Add device

(page 40).

• Import devices from a CSV file. See

Import devices

(page 41).

• Use the Add device wizard to add a device to Sophos Mobile, assign it to a user, enroll it, and

transfer an enrollment task bundle. See Use the Add device wizard (page 43).

• Enable users to enroll devices on their own in the Self Service Portal. See

Configure Self

Service Portal

(page 27). This portal reduces IT effort by allowing users to carry out tasks without contacting the helpdesk. The devices are provisioned by executing defined task bundles. See

Task bundles (page 269).

We recommend that you use device groups to group devices for easier administration. See

Device groups

(page 83).

11.1.1 Add device

We recommend that you create one or more device groups before adding your first device to Sophos

Mobile. You can then assign each device to a device group, to simplify device management. See

Create device group (page 83).

To add a new device to Sophos Mobile:

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed.

2. Click Add and then select the platform from the Add device manually menu section.

The Edit device page is displayed.

3. On the Edit device page, enter the following device details: a) In the Name field, enter a unique name for the new device.

b) In the Description field, enter a description for the new device.

c) Under Owner, select Corporate or Personal.

d) In the Email address field enter an email address.

e) In the Phone number field, enter the phone number of the new device. Enter the phone number in international format, for example +491701234567 .

f) Under Device group, select the device group the device is to be assigned to.

For information on how to create device groups, see

Create device group (page 83).

To assign a user to the device, click the Edit user assignment icon next to the User field and

then click Assign user to device. For further information, see Assign a user to a device (page

55).

5. To add custom properties to the device, go to the Custom properties tab and click Add custom

property. For further information, see Add custom device property

(page 63).

6. After you have specified all relevant device details, click Save.

Sophos Mobile

The new device is added to Sophos Mobile and displayed on the Devices page under MANAGE.

You can now provision and manage the device.

Note

For iOS devices, when you have configured Sophos Mobile to synchronize the device name

with the device as described in Configure iOS settings (page 16), the name you entered in the

Name field is replaced by the name set during synchronization.

11.1.2 Import devices

You can add new devices by importing them from a CSV file.

You can import up to 500 devices.

Users and device groups must already be available in Sophos Mobile.

The CSV file must have the following specification:

• The first row is treated as a header and is not imported.

• Values must be separated by semicolon, not by comma.

• All rows must have the correct number of semicolon characters, even if you leave out optional values.

• The file extension must be .csv

• To ensure that non-English characters are imported correctly, the file must be UTF-8 encoded.

Tip

On the Import devices page, click Example CSV to download a sample file.

To import devices from a CSV file:

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click Add > Import devices.

3. On the Import devices page, click Upload a file and then navigate to the CSV file that you have prepared.

The entries are read in from the file and are displayed.

4. If the data is not formatted correctly or is inconsistent, the file as a whole cannot be imported. In this case, follow the error messages that are displayed next to the relevant entries, correct the content of the CSV file accordingly and upload it again.

5. Click Finish to create the devices.

The devices listed in the CSV file are imported and displayed on the Devices page. You can now enroll and configure the devices.

11.2 Enroll devices

After you have added new devices in Sophos Mobile Admin, they must be enrolled with Sophos

Mobile.

Sophos Mobile

Enrollment types

Sophos Mobile supports two enrollment types:

Device enrollment

Sophos container enrollment

This enrollment type provides full Mobile Device

Management (MDM) capabilities. Sophos Mobile is able to manage the whole device.

Sophos Mobile only manages the Sophos container on the device, but not the device itself.

The Sophos container is available for Android and iOS.

Sophos container enrollment is useful in the following situations:

• You want to manage Bring Your Own Device

(BYOD) scenarios. With Sophos container enrollment, your organization can only see very limited device information, and no personal apps or data.

• Your devices are managed by a non-Sophos

MDM software, but you also want to use features provided by the Sophos container, for example corporate keyring synchronization with Sophos SafeGuard Enterprise.

• Your devices are managed by a non-Sophos

MDM software, but you want to configure additional email accounts. For example when you are a consultant company and your employees need to access your customers'

Exchange servers.

Enrollment methods

The following options are available to enroll devices:

• You can enroll individual, unmanaged devices using the Devices function. For further information,

see Enroll individual devices

(page 43).

• You can use the Add device wizard to add a device to Sophos Mobile, assign it to a user, enroll

it, and transfer an enrollment task bundle. See Use the Add device wizard (page 43).

Note

If required, you can use the Add device wizard or the auto-enrollment method to enroll iOS devices without Apple ID. This can be useful, for example to preconfigure the device before handing it over to a user. See

Enroll iOS devices without Apple ID (page 46).

Sophos Mobile

Recommendations

To enroll and configure multiple devices efficiently, the following methods are recommended:

• You can bundle the tasks necessary to enroll devices, apply required policies and install required apps (for example, managed apps for iOS devices). See

Task bundles (page 269).

• You can enable users to enroll devices in the Self Service Portal. To do so, include a task bundle for enrollment when configuring the settings for Self Service Portal use. For further information on how to select the task bundle in the Self Service Portal settings, see

Configure Self Service Portal settings (page 27).

11.2.1 Enroll individual devices

1. On the menu sidebar, under MANAGE, click Devices and then click the device that you want to enroll.

2. On the Show device page, select an enrollment type:

• To enroll the device with Sophos Mobile, click Actions > Enroll.

• To enroll the Sophos container, click Actions > Enroll Sophos container.

3. For Sophos container enrollment, select a task bundle or policy.

The enrollment task is started and displayed on the Task view page. An email with enrollment instructions is sent to the user.

Important

In iOS 12.2 or later, you must go to the Settings app to install the configuration profile you’ve downloaded. If you don’t install the profile within 8 minutes, it will be deleted and you must start over.

This restriction doesn’t apply to devices you assign to Sophos Mobile using the Apple Device

Enrollment Program (DEP) or Apple Configurator.

Note

On Macs, the enrollment must be performed by the user that will be managed by Sophos Mobile.

To install the enrollment profile, the user must enter an administrator password.

11.2.2 Use the Add device wizard

You can easily enroll new devices with the Add device wizard. It provides a workflow that combines the following tasks:

• Add a new device to Sophos Mobile.

• Optional: Assign a user to the device.

• Enroll the device.

• Optional: Transfer a task bundle to the device.

1. On the menu sidebar, under MANAGE, click Devices, and then click Add > Add device wizard.

Sophos Mobile

Tip

Alternatively, you can start the wizard from the Dashboard page by clicking the Add device widget.

2. On the User page, either enter search criteria to look up a user the device will be assigned to, or select Skip user assignment to enroll a device that will not be assigned to a user yet.

3. On the User selection page, select the required user from the list of users matching your search criteria.

4. On the Device details page, configure the following settings:

Option

Platform

Name

Description

Phone number

Email address

Description

The device platform.

You can only select a platform that is enabled for the customer that you logged in to.

A unique name under which the device will be managed by

Sophos Mobile.

An optional description of the device.

An optional phone number. Enter the number in international format, for example +491701234567 .

The email address to which the enrollment instructions are sent.

If user management is configured for the customer, this is the email address of the user assigned to the device.

If no user management is configured, enter an email address here.

Owner

Device group

Select the device owner type: either Corporate or Personal.

Select the device group the device will be assigned to. If you have not created a device group yet, you can select the device group Default, which is always available.

5. On the Enrollment type page, select whether you want to enroll the device or only the Sophos container.

See Configure Sophos container enrollment (page 340).

6. Select a task bundle or policy that is transferred to the device. Or select Only enroll device to enroll the device without transferring a task bundle.

7. On the Enrollment page, follow the instructions to complete the enrollment process.

Important

This restriction doesn’t apply to devices you assign to Sophos Mobile using the Apple Device

Enrollment Program (DEP) or Apple Configurator.

Sophos Mobile

Note

On Macs, the enrollment must be performed by the user that will be managed by Sophos

Mobile. To install the enrollment profile, the user must enter an administrator password.

8. When enrollment has been completed successfully, click Finish.

Note

• When you have made all the selections, you can close the wizard without having to wait for the

Finish button to appear. An enrollment task is created and processed in the background.

• If you have selected a task bundle to be transferred to the device after enrollment, you can

monitor the task status on the Task view page. See View unfinished, failed and latest finished tasks (page 9).

• For iOS devices, when you have configured Sophos Mobile to synchronize the device name with the device as described in

Configure iOS settings

(page 16), the name you entered in the

Name field is ignored and the name that is configured on the device is used instead.

11.2.3 Auto-enroll iOS devices

You can configure iOS devices to auto-enroll with Sophos Mobile during device activation. To do so, you use Apple Configurator 2 to assign devices to the Sophos Mobile MDM server. When the users switch on their devices for the first time, the iOS setup assistant starts. During setup, the devices are automatically enrolled with Sophos Mobile.

Note

For a detailed description of Apple Configurator 2, see the Apple Configurator 2 user guide

(external link) .

To configure auto-enrollment of iOS devices with Sophos Mobile:

1. As a one-time step to prepare auto-enrollment, create a device group that will be assigned to devices during auto-enrollment with Sophos Mobile. In the device group properties, select the

Enable iOS auto-enrollment option. See

Create device group

(page 83).

2. Make a note of the URL that is displayed in the Auto-enrollment URL field of the device group.

You need this URL when you configure devices with Apple Configurator 2.

3. Connect the iOS device you want to auto-enroll to an USB port of a Mac with Apple Configurator 2 installed.

4. In Apple Configurator 2, use the Prepare Assistant to set up the device configuration.

5. Select Manual Enrollment and then enter the auto-enrollment URL of the device group.

6. Follow the further steps of the Prepare Assistant. You can optionally configure the following aspects of the device activation:

• Enable device supervision mode.

• Configure host computers to which the device is allowed to connect with, using USB ports.

• For supervised devices, generate or choose a "supervision identity".

• Disable configuration steps of the iOS setup assistant.

After you have completed the configuration, hand over the device to the user. When the user switches on the device for the first time, the iOS setup and the enrollment with Sophos Mobile are performed as configured.

Sophos Mobile

Tip

By default, Sophos Mobile manages auto-enrolled devices under a name that is composed from the device ID and the device type. Alternatively, Sophos Mobile can use the name that is

configured on the device. See the Synchronize device name option in Configure iOS settings

(page 16).

11.2.4 Enroll iOS devices without Apple ID

You can enroll an iOS device with Sophos Mobile without having to associate the device with an

Apple ID first. This can be useful for example to preconfigure the device before handing it over to a user.

The standard enrollment method includes the installation of the Sophos Mobile Control app onto the device. Because the app is installed from the App Store and an Apple ID is required to access the

App Store, you need to associate the device with the ID before starting the enrollment.

Alternatively, you can enroll an iOS device without installing the Sophos Mobile Control app, so there is no need to associate the device with an Apple ID. This is provided by:

• The auto-enrollment method. See

Auto-enroll iOS devices

(page 45).

• The Add device wizard. See

Use the Add device wizard

(page 43).

In the wizard, do as follows:

1. On the Enrollment page, select the Enrollment without Apple ID tab.

2. Use the device's web browser to open the enrollment URL. This opens a Sophos Mobile enrollment form.

3. In that form, enter the token and then click Enroll.

4. Follow the instructions on the device to install the enrollment task bundle.

Important

This restriction doesn’t apply to devices you assign to Sophos Mobile using the Apple Device

Enrollment Program (DEP) or Apple Configurator.

11.2.5 Enroll Android enterprise devices

For Android enterprise, devices are usually enrolled in the Self Service Portal. If you’ve set up

Android enterprise in Sophos Mobile for the Managed Google Play Account scenario, you can also enroll devices with the Add device wizard.

Prerequisites:

• You’ve set up Android enterprise for the Managed Google Play Account scenario. See

Set up

Android enterprise (Managed Google Play Account scenario)

(page 306).

• You have created an enrollment task bundle.

Sophos Mobile

Depending on the type of policy the task bundle installs, the device is enrolled in Android enterprise device owner or profile owner mode. See

Configure Android enterprise device enrollment

(page 311).

To enroll a device in Android enterprise mode:

1. On the menu sidebar, under MANAGE, click Devices, and then click Add > Add device wizard.

2. Use the Add device wizard as described in

Use the Add device wizard

(page 43) to start the enrollment. For an Android enterprise device, do as follows: a) On the User page, select Search for user and then enter search criteria to look up the user the device shall be assigned to.

b) On the User selection page, select the required user from the list of users matching your search criteria.

c) On the Device details page, in the Platform field, select Android.

d) On the Enrollment type page, select your enrollment task bundle for Android enterprise.

Note

On devices enrolled in Android enterprise device owner mode, only the following apps are available:

• Settings

• Phone

• Play Store

• Sophos Mobile Control

• Camera (if you’ve turned on Allow camera in the Restrictions configuration)

11.2.6 Mass-enroll Android enterprise devices

With the Sophos NFC Provisioning app you mass-enroll corporate-owned Android devices with

Sophos Mobile. You install the Sophos NFC Provisioning app on one device ( Master device ) and then transfer the enrollment settings through NFC to the devices to enroll. The devices are enrolled with Sophos Mobile in Android enterprise device owner mode.

Prerequisites:

• You’ve set up Android enterprise for the Managed Google Play Account scenario. See

Set up

Android enterprise (Managed Google Play Account scenario)

(page 306).

• The master device has NFC.

• The devices you want to enroll are new or reset to factory settings and have NFC.

1. Install the Sophos NFC Provisioning app from Google Play onto the master device.

2. In the Sophos NFC Provisioning app, configure the following settings:

• Connection details of your corporate Wi-Fi network.

• Time zone and language for the new devices.

• Optional: The URL of the Self Service Portal.

• Optional: Skip device encryption.

• Optional: Skip vendor-specific setup.

• Optional: Enable system apps.

Sophos Mobile

If you turn this on, all apps pre-installed by the manufacturer are enabled.

If you turn this off, only these apps are enabled: Google Play Store, Contacts, Messages,

Phone. Google recommends this for devices enrolled in Android enterprise device owner mode.

3. Tap Ready for transfer and then hold the master device and the device to enroll back to back with the NFC sensors aligned.

The device is set up and enrolled with Sophos Mobile.

To enroll additional devices, tap Ready for transfer again.

11.2.7 Enroll Android Things device

To enroll an Android Things device with Sophos Mobile, you flash it with a custom Android Things image. You use the same image for all devices you enroll with Sophos Mobile.

Prerequisite: You’ve set up a computer that is connected to your local IP network and has the

Android Debug Bridge command-line tool ( adb ) installed.

adb is part of the Android SDK Platform Tools package. This package can either be installed as part of the Android SDK or as a standalone package. For details, see the Google Android Debug Bridge documentation.

To enroll an Android Things device with Sophos Mobile:

1. On the menu sidebar, under MANAGE, click Devices, and then click Add > Add device wizard.

2. Use the Add device wizard as described in

Use the Add device wizard

(page 43) to start the enrollment. For an Android Things device, do as follows: a) On the Device details wizard page, in the Platform field, select Android Things.

b) On the Enrollment wizard page, click Open the Sophos Mobile download area, and then download the APK file of the latest SMC Android Things app from there.

3. Open the Google Android Things Console.

4. Create an Android Things product and a build configuration as described in the Google Android

Things Console documentation.

On the Select apps page of the Android Things Console, add the APK file of the SMC Android

Things app.

5. After having completed the build configuration, download your Android Things image.

6. Flash the device with the image.

7. If you haven’t done so already, connect the device to your local IP network via Ethernet or Wi-Fi.

8. On the computer that has adb installed, connect to the device: adb connect <ip-address>

Replace <ip-address> with the device’s IP address.

9. Configure the SMC Android Things app, using the command shown in the Add device wizard or in the instructions email: adb shell am start -d "<configuration-parameters>"

Note

You might receive a system message Warning: Activity not started, its current task has been brought to the front . This can be ignored.

Sophos Mobile

The SMC Android Things app on the device connects to your Sophos Mobile server. After the enrollment process has completed, the device is shown with status Managed in Sophos Mobile.

Related information

Google Android Things Console (external link)

Google Android Things Console documentation (external link)

Google Android Debug Bridge (adb) documentation (external link)

11.2.8 Enroll Windows IoT device

This section describes how to enroll a Windows IoT device using the Add device wizard.

Prerequisites:

• You have flashed Windows 10 IoT Core onto the device that you want to enroll.

• You have connected the device to your local IP network through Ethernet or Wi-Fi.

To enroll the Windows IoT device with Sophos Mobile:

1. On the menu sidebar, under MANAGE, click Devices, and then click Add > Add device wizard.

2. Use the Add device wizard as described in

Use the Add device wizard

(page 43) to start the enrollment. For a Windows IoT device, do as follows: a) On the Device details wizard page, in the Platform field, select Windows IoT.

b) On the Enrollment wizard page, click Download provisioning package to download a .ppkg

file with the provisioning package for Sophos Mobile. This link is also available from the instructions email.

3. On a Windows computer that is connected to the same local network as the Windows IoT device, use File Explorer to connect to the device.

In the File Explorer address bar, enter the following address, where <ip-address> is the IP address of the device:

\\<ip-address>\c$

Enter your administrator user name and password for the device if prompted.

4. Copy the .ppkg file that you downloaded from the Add device wizard to the C:\Windows

\Provisioning\Packages folder on the device.

Note

There must only be one .ppkg file in that folder.

5. Reboot the device.

After reboot, the Windows IoT device executes the provisioning package and connects to your Sophos

Mobile server. After the enrollment process has completed, the device is shown with status Managed in Sophos Mobile.

Important

On the Show device page, don’t perform the device actions Set to “Not managed” or Delete before you have unenrolled the device. If you do so, you have to wipe the device before you can enroll it again. To wipe it, you need to re-flash a Windows 10 IoT Core image onto the device.

Sophos Mobile

11.3 Unenroll devices

You can unenroll devices that will no longer be used, for example when a user gets a new device.

This is useful if you have limited the number of devices a user can enroll in the Self Service Portal.

1. On the menu sidebar, under MANAGE, click Devices.

2. Select the desired device, click Actions and then click Unenroll.

A message is displayed prompting you to confirm that you want to unenroll the device.

Note

It is possible to select several devices for unenrollment.

3. Click Yes.

The device is unenrolled. This results in the following:

• Android devices:

— The Sophos Mobile Control device administrator is disabled.

— The server login data and all other data received are removed.

— The container apps (Sophos Secure Workspace and Sophos Secure Email) and the Sophos

Mobile Security app are reset.

• iOS devices:

— All profiles are removed.

— All managed apps are uninstalled.

— All certificates received through Mobile Device Management are removed.

— The container apps (Sophos Secure Workspace and Sophos Secure Email) are reset.

• Macs:

— All policies are removed.

— All certificates received through Mobile Device Management are removed.

Note

• When users disable the Sophos Mobile Control device administrator on Android devices, the

Sophos Mobile Control app unenrolls the device.

• For Android enterprise devices enrolled in device owner mode, there’s no dedicated unenroll action. To unenroll such a device, wipe it.

• If you’ve set up Android enterprise for the Managed Google Play Account scenario, users can only enroll a limited number of devices. In some situations, the Google account might remain on the device after unenrollment and the device still counts as enrolled. If this happens, manually remove the Google account from the device.

11.4 Manage devices

On the menu sidebar, under MANAGE > Devices and Device groups, you can keep track of devices and device groups and carry out a number of administrative tasks.

Sophos Mobile

After adding devices to Sophos Mobile you can, for example:

• View and edit device details.

• Allow or forbid email access for devices.

• Lock or unlock devices remotely.

• Reset device passwords.

• Wipe the device remotely in case of loss or theft.

• Decommission devices (Android and iOS).

• Delete devices.

11.4.1 View devices

1. On the menu sidebar, under MANAGE, click Devices.

2. Go to the required device and click its name.

The Show device page is displayed for the selected device.

Tip

On the Devices page you can display additional information by pointing to certain elements:

• Point to the "Not managed" icon of a device to display the actual status like Unenrolled or

Checked out.

• Point to the "Not compliant" icon of a device to display the severity level (high, medium, low).

11.4.2 The Show device page

On the Show device page, all relevant information for an individual device is displayed.

In the upper part of the page, you can see the most important device information at a glance.

In the lower part of the page, detailed device information is displayed on several tabs. The tabs and information shown depend on the device platform.

From the Show device page, you can directly switch to the Edit device page. To edit the device you are viewing, click Edit.

Status

Shows essential device information like management type, management status, and compliance status.

Profiles

Shows the profiles (including provisioning profiles) installed on the device.

The tab also contains commands to install profiles onto the device or to remove them.

Sophos Mobile

Note iOS device profiles that only contain the following configurations don’t appear on the Profiles tab:

• Roaming/Hotspot

• Wallpaper

These configurations are not installed as a profile onto the device. They only set settings that the user may change at a later time.

Tip

The search field of the table lets you search by profile IDs, even though the ID is not displayed in the table.

Policies

Shows the policies assigned to the device and lets you assign more policies.

Device properties

Shows device properties, for example, properties for model, model name, OS version, and if the device is rooted (Android) or jailbroken (iOS).

Custom properties

Shows custom device properties. These are the properties that you can create yourself. Custom device properties can, for example, be used in placeholders if no Active Directory connection is available. When you edit a device, you can also add user-specific information here.

Internal properties

Shows internal device properties, for example, ActiveSync traffic allowed, IMEI.

Compliance violations

This tab is only displayed for non-compliant devices. It shows the compliance violations of the device and the actions taken because of the violation.

For the configuration of these actions, see

Create compliance policy

(page 32).

Installed apps

Shows the software installed onto the device. Different information is displayed for each platform.

The Size column shows the disk space usage of an app itself. The Data column shows the additional disk space that an app uses for user data, configurations, and so on.

With the Install app button, you can install software onto the device. You can also uninstall apps from the device by clicking the Delete icon next to the relevant app.

Sophos Mobile

Note

• For devices where Sophos Mobile only manages the Sophos container, apps outside the

Sophos container are not listed. This includes apps that the user has installed from the

Enterprise App Store.

• For iOS, apps marked as Managed can be silently uninstalled. See

Managed apps for iOS

(page 292).

• For Macs, apps from all user accounts are listed.

• For Windows, you can only uninstall apps that have been installed by Sophos Mobile. If you try to uninstall an app installed by the user, the task fails.

• You can disable the Installed apps tab. See

Configure privacy settings

(page 15).

System apps

Shows Android system apps on the device.

Note

System apps cannot be removed from the device.

Knox apps

This tab shows the apps that the user has installed in the Samsung Knox container.

Knox system apps

This tab shows the system apps that are installed in the Samsung Knox container.

Scan results

This tab shows the results of the last Sophos Mobile Security scan performed on the device.

The tab is only available if the Sophos Mobile Security app is managed by Sophos Mobile. See

Manage Sophos Mobile Security

(page 334).

Certificates

Shows the certificates in use on the device.

For Macs, device certificates are listed but user certificates are not.

For Windows computers, certificates installed in the user store are listed but not those installed in the device store.

Tip

In the table, point to the Subject or Issuer value to display the certificate details.

Sophos Mobile

Tasks

This tab shows all unfinished and failed tasks for the device as well as the finished tasks of the last few days. You can also view these tasks, together with the tasks for all other devices, on the Task

view page. See

Monitor tasks (page 9).

11.4.3 Use smart groups

Smart groups are dynamic sets of devices based on filter criteria you define. For example, you could define a smart group All corporate Android devices created within the last 3 months.

To define a smart group:

1. On the Devices page, click Extended filter above the device list.

2. Set the filter criteria.

3. Enter a name for the smart group in Smart group and click Create.

4. Do one of the following:

• To apply the smart group to the device list, click Filter.

• To close the filter window without applying the smart group, click Reset.

5. To apply the smart group later, click Smart groups above the device list and then select an entry.

Tip

• When a smart group or extended filter is active, the filter icon in the table header changes its color from blue to green.

• Remember to reset a filter when it is no longer needed. Otherwise, lists or reports may not include the results you expect.

Other smart groups actions:

• To cancel a smart group, i.e. to display all devices again, click Extended filter and then click

Reset.

• To delete a smart group, click Smart groups and then click the trashcan icon next to the smart group you want to delete.

• To edit a smart group, first apply it, then click Extended filter and make the required changes, then click Create.

• To apply an ad-hoc filter without creating a smart group, click Extended filter, set the filter criteria and then click Filter.

11.4.4 Edit devices

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the blue triangle next to the required device and then click Edit.

3. Make the necessary changes.

4. Click Save.

Sophos Mobile

11.4.5 Assign a user to a device

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the required device and then click Edit.

On the Edit device page, click the Edit user assignment icon next to the User field and then click the relevant entry from the selection list:

• To assign a user to a device that has no user assigned to it yet, click Assign user to device.

• To assign a different user to a device that already has a user assigned to it, click Reassign

user to device.

• To reload the user list from the LDAP directory, click Update user list.

4. On the Enter user search parameters page of the assignment dialog, enter search strings in one or more fields to look up a user the device will be assigned to. For example, enter the user name or part of it.

5. On the Select user page, select the user and then click Apply.

6. On the Edit device page, click Save.

11.4.6 Deassign a user from a device

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the required device and then click Edit.

On the Edit device page, click the Edit user assignment icon next to the User field and then click Deassign user from device.

4. In the confirmation dialog, click Yes.

5. Click Save.

11.4.7 Configure network access

Before you can configure network access for a device, Network Access Control (NAC) must be enabled in Sophos Mobile.

For Sophos Mobile on Premise, NAC is enabled by the super administrator. See the Sophos Mobile super administrator guide .

For Sophos Mobile as a Service, NAC is always enabled.

There are two options to configure network access for a device:

1. Allow or deny network access unconditionally.

2. Disable network access when the device violates a compliance rule, enable network access otherwise.

Note

Sophos Mobile does not control the network access by itself. Instead, it provides a Deny

network status that can be used by external NAC software like Sophos UTM to block network communication.

Sophos Mobile

Note

Network Access Control is not possible for Macs connected via Ethernet. Sophos Mobile can only retrieve the MAC address of a Mac’s Wi-Fi network adapter, not that of its Ethernet adapter.

Because devices are identified by their MAC address, a Mac connected to the network via its

Ethernet port is treated as an unknown device when your external NAC software asks Sophos

Mobile for the device’s network status.

To configure network access for a device:

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, select the devices for which you want to set the network access mode.

3. Click Actions, and then click Set network access.

4. Select the network access mode:

• Allow: Network access for the selected devices is allowed.

• Deny: Network access for the selected devices is denied.

• Auto mode: Network access for the selected devices is based on the compliance status of the devices.

5. Click Yes to save the changes.

Note

You can’t deny network access for devices where Sophos Mobile only manages the Sophos container.

For information on how to configure network access in compliance rules, see Create compliance policy

(page 32).

11.4.8 Scan device

Note

This feature requires a license of type Mobile Advanced.

You can perform device scans on Android devices on which Sophos Mobile manages the Sophos

Mobile Security app.

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the device you want to scan.

3. On the Show device page, click Actions > Trigger SMSec scan.

A task to perform a device scan is created and transferred to the Sophos Mobile Security app.

You can view the scan results on the Scan results tab of the Show device page. Click a threat name to display additional information from SophosLabs.

To scan several devices, create a task bundle with a Trigger SMSec scan task and transfer it to the required devices or device groups.

11.4.9 Lock device

You can remotely lock a device that is managed by Sophos Mobile. This activates the screen lock.

Sophos Mobile

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device that you want to lock or unlock and then click Show.

3. On the Show device page, click Actions > Lock.

4. For macOS: Set a 6-digit PIN code that must be entered on the Mac to unlock it.

5. For some device types, you can optionally enter a message that is displayed on the lock screen.

A task to activate the lock screen is created and transferred to the device.

• For all platforms except for macOS: The user must enter the device password (or the PIN or pattern, if configured) to unlock the device.

• For macOS: The Mac restarts. The user must enter the PIN code you set to unlock the device.

Note

Even for devices where Sophos Mobile only manages the Android work profile, the Lock action locks the device, not just the work profile.

Note

You can’t lock devices where Sophos Mobile only manages the Sophos container.

Note

You can’t wipe a Mac that has been locked remotely.

Tip

In Sophos Mobile Admin, the macOS system lock PIN is displayed on the device page under

Device properties > Unlock passcode and on the Task details page under Lock PIN.

11.4.10 Reset device password

You can remotely reset the password of the following devices:

• Android devices with Android 6.x or earlier

• Android enterprise devices

• iOS devices

• Windows Mobile devices

However, you can’t reset the password of the following devices:

• Devices where Sophos Mobile only manages the Sophos container.

• Devices where only the Sophos Mobile Security app is enrolled with Sophos Mobile.

• Android enterprise devices with Android 8.x or later, if the user has not confirmed the device password.

On some devices, the user sets the password during the initial setup before the Sophos Mobile

Control app is installed. In this case, the Sophos Mobile Control app asks the user to confirm the password at every synchronization. As long as the user hasn’t confirmed the password, you can’t reset the password remotely.

To reset the password of a device:

1. On the menu sidebar, under MANAGE, click Devices.

Sophos Mobile

2. Click the device for which you want to reset the password.

3. On the Show device page, click Actions > Reset password.

4. If a one-time unlock password is displayed in the confirmation dialog, communicate it to the user.

For Android and Windows Mobile, the user must unlock the device with the one-time password and then create a new password.

For iOS, the password is removed and the device is unlocked.

11.4.11 View device location

Important

For privacy reasons, all events related to device location are recorded and can be inspected later.

Note

You can turn off viewing device locations in Sophos Mobile Admin. See Configure privacy settings

(page 15).

You can view the location of an Android or iOS device in Google Maps, provided the conditions listed below are met.

Android devices:

• The Sophos Mobile Control app is running.

• Location services are turned on.

• For Android enterprise devices in profile owner mode: Location services for the work profile are turned on.

• The Sophos Mobile Control app has the Location permission.

iOS devices:

• The Sophos Mobile Control app is running.

• Location Services are turned on and are allowed for the Sophos Mobile Control app.

• You can always view the location of devices in Managed Lost Mode.

Tip

Use the Locate permission required compliance rule to ensure the Sophos Mobile Control app can get the device’s location. See

Available compliance rules

(page 34).

To view the location of a device:

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the device you want to locate.

3. Click Actions > Show location.

If Show location is not available, check that the Sophos Mobile Control app can get the device’s location.

4. Enter a reason for the request and then click Yes.

A task to get the device location is created and transferred to the device.

5. When the task is completed, click Actions > Show location > Show location to view the device location in Google Maps.

Sophos Mobile

11.4.12 Wipe device

You can remotely wipe a device that is managed by Sophos Mobile. This resets the device to its factory settings.

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device that you want to wipe and then click

Show.

3. On the Show device page, click Actions > Wipe.

4. For some device types, you have to configure additional settings: a) For Android devices enrolled in Android enterprise device owner mode, turn on Factory Reset

Protection, if required. See Android Factory Reset Protection

(page 315).

Important

If the Google accounts you configured for Factory Reset Protection are invalid, or if you don’t know the account credentials, the device becomes unusable after the wipe.

b) For iOS devices, configure these settings in the confirmation dialog:

• Preserve data plan: If a cellular data plan is available on the device, it is preserved after the factory reset.

• Forbid Quick Start: For the first device start after the factory reset, skip the Quick Start step in the Setup Assistant that allows the user to transfer content from another iPhone.

c) For Macs, set a 6-digit PIN that must be entered on the Mac to unlock it.

5. Click Yes in the confirmation dialog.

A task to wipe the device is created and transferred to the device.

Note

You can’t wipe the following devices:

• Devices where Sophos Mobile only manages the Sophos container.

• Android enterprise devices in profile owner mode.

• Android Things or Windows IoT devices.

• Macs you’ve locked remotely.

Tip

In Sophos Mobile Admin, the macOS system lock PIN is displayed on the device page under

Device properties > Unlock passcode and on the Task details page under Lock PIN.

11.4.13 Turn Android Factory Reset Protection on or off

Note

This section applies to devices enrolled with Sophos Mobile in Android enterprise device owner mode.

Sophos Mobile

When you configure Factory Reset Protection (FRP) for devices enrolled with Sophos Mobile in

Android enterprise device owner mode, it is turned on by default. If you are sure a device is not lost or stolen, you can turn off FRP to simplify the setup procedure.

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the device for which you want to set the FRP status.

3. On the Show device page, click Actions > Set Factory Reset Protection.

4. Select Turn on FRP or Turn off FRP.

When FRP is turned on, the device must be unlocked after a factory reset with one of the Google accounts you’ve configured for FRP.

For details on FRP, see

Android Factory Reset Protection (page 315).

Important

If you’ve misconfigured FRP, the device becomes unusable when it’s reset with FRP turned on.

Tip

You can check the FRP status of a device on the Status tab of the Show device page.

11.4.14 Configure telecom expense management

With telecom expense management (TEM) you monitor cellular data usage of individual devices.

This feature is available for Android 6.0 and later and for iOS.

Note

You can’t configure telecom expense management for Android enterprise devices in profile owner mode.

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, select the devices for which you want to configure telecom expense management.

Note

Only select devices with the same cellular data plan.

3. Click Actions > Configure telecom expense management.

4. Configure the following settings:

Option

Turn on monitoring

Description

If selected, monitoring cellular data usage is turned on for the selected devices.

The data volume in MB of your cellular data plan.

Data volume of plan

Alert threshold

Usage cycle reset date

A data volume threshold in MB. When the used data volume for a device exceeds this value, an alert is created.

A value between 1 and 31 to specify the day of the month when the data usage value is reset.

Sophos Mobile

Option Description

Note

If a month has fewer days than the value entered, the data usage value is reset on the last day of the month.

5. Click Save to apply the settings to the selected devices.

Cellular data usage is reported by a device every time it syncs with the Sophos Mobile server.

To view the current data usage of a device, open the device’s Show device page and then click

Actions > Configure telecom expense management.

Important

The reported data usage might deviate from the values charged by your telecom provider. Data traffic caused by installed apps is reported, but not system updates, system app updates, or similar.

Tip

Use the Cellular data usage report to view the data usage for all devices that have telecom

expense management turned on. See Reports (page 8).

Note

• The data usage value is reset at these times:

— Regularly every month at the end of the day you configured.

— When you turn off telecom expense management for the device.

— When the device is unenrolled from Sophos Mobile.

• For iOS, data usage is not reported when the Sophos Mobile Control app is closed, e.g. when the user has not started the app after restarting the device.

11.4.15 Update the iOS software

You can update the iOS software for the following device types:

• Supervised devices

• Supervised Apple DEP devices

Note

This section describes how to update the iOS software for a single device. To update the iOS software for a device group, use a task bundle with an Install latest iOS update task. See

Available iOS task types (page 273).

To update the iOS software on a device:

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device and then click Show.

3. On the Show device page, click Actions > Show available updates.

Sophos Mobile

A list of iOS updates that are available for the device is displayed. Updates labeled Critical are critical security updates as classified by Apple.

4. To install the latest available update, click Install latest available update.

A task to update the iOS software is created and transferred to the device.

Tip

• To check the update status of a single iOS device, open the device’s Show device page. A warning sign is displayed next to Operating system if the device does not have the latest available iOS version installed.

• To check the update status of all iOS devices, go to the OsUpdateAvailable column of the

Devices report.

11.4.16 Configure iOS Managed Lost Mode

You can put a supervised iOS device into Managed Lost Mode. The device can’t be used until

Managed Lost Mode is turned off again in Sophos Mobile.

In Managed Lost Mode, the only actions available on the device are:

• Dial a phone number you have configured.

• Make an emergency call.

Note

• Managed Lost Mode is a different lock mode from Lost Mode, which a user can turn on in iCloud. When you turn on Managed Lost Mode in Sophos Mobile, the device can’t be unlocked in iCloud.

• Locating the device is more reliable in Managed Lost Mode than in standard lock mode. The device location is reported by iOS system functionality which does not require the Sophos

Mobile Control app to be active.

To turn on Managed Lost Mode:

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device that you want to put into Managed

Lost Mode and then click Show.

3. On the Show device page, click Actions > Turn on Managed Lost Mode.

4. Configure the following settings:

Option

Lock screen message

Description

Text that is displayed on the lock screen.

Phone number A phone number that can be dialed from the lock screen.

Footer Footnote text that is displayed at the bottom of the lock screen.

If you don’t configure a footnote, a standard note to contact an administrator is displayed.

A task to turn on Managed Lost Mode is created and transferred to the device. Managed Lost Mode is turned on immediately after the device has received the task.

Sophos Mobile

When a device is in Managed Lost Mode, you can perform the following actions on the Show device page:

• To locate the device, use Actions > Locate.

• To play a sound on the device, use Actions > Play Lost Mode sound.

• To turn off Managed Lost Mode, use Actions > Turn off Managed Lost Mode.

Tip

To find out if Managed Lost Mode is turned on, check the device property

IsMDMLostModeEnabled.

11.5 Custom device properties

In addition to the properties reported by a device itself, you can add custom properties to the device.

When you add a property with name my property , you can refer to the value of the property by using the placeholder %_DEVPROP(my property)_% . For details on placeholders, see

Placeholders in profiles and policies (page 97).

You can add custom properties to a device in the following ways:

• You add custom properties to an individual device. See

Add custom device property (page

63).

• You create default properties that are assigned to devices as custom properties when the

devices are created. See Create default device property

(page 64).

11.5.1 Add custom device property

In addition to the properties reported by a device itself, you can add custom properties to the device.

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the blue triangle next to the required device and then click Edit.

3. On the Edit device page, go to the Custom properties tab and click Add custom property.

If the Custom properties tab is not available, check that the Expert mode system setting is turned on (under Setup > General > Personal).

4. Enter a name and a value for the property.

5. Click Apply.

6. Click Save.

The custom property is added to the device.

Note

You can’t have a custom device property with the same name as a standard device property.

Sophos Mobile

11.5.2 Create default device property

You can create default properties that are assigned to devices as custom properties when the devices are created.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Default device

properties tab.

2. Click Add custom property.

3. Enter a name and a value for the property.

4. Click Apply.

5. Click Save.

Note

You can’t have a custom device property with the same name as a standard device property.

Note

If the same default property is defined for the customer and for the super administrator customer, the value defined for the customer is used.

11.6 Zero-touch enrollment

With Android zero-touch enrollment, you can enroll corporate-owned Android devices in bulk. Zerotouch enabled devices automatically enroll with your Sophos Mobile server when the users turn them on.

Requirements

• You have an account for the Google zero-touch enrollment portal. Usually, the device reseller creates the account for you when you purchase your first devices.

• You’ve set up Android enterprise in Sophos Mobile for the Managed Google Play Account scenario.

See

Set up Android enterprise (Managed Google Play Account scenario) (page 306).

Configuration steps

To use zero-touch enrollment, perform the following steps:

1. Turn on zero-touch enrollment in Sophos Mobile Admin and configure enrollment details. See

Set up zero-touch enrollment (page 65).

2. Create a configuration for Sophos Mobile in the Google zero-touch enrollment portal. See

Create zero-touch configuration (page 65).

3. Purchase zero-touch enabled Android devices from a Google-approved enterprise reseller.

4. Assign the zero-touch configuration for Sophos Mobile to the devices. See

Deploy zero-touch devices (page 66).

Sophos Mobile

Related information

Google zero-touch enrollment website (external link)

Google zero-touch enrollment help (external link)

11.6.1 Set up zero-touch enrollment

To set up zero-touch enrollment in Sophos Mobile Admin, you configure the settings applied to zerotouch enabled Android devices (“zero-touch devices”) when they enroll with your Sophos Mobile server.

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the Zero-

touch tab.

2. Click Use zero-touch enrollment.

3. Under Zero-touch configuration settings, click DPC extras to configure settings applied to the device:

• Language: The language of the Android user interface.

• Time zone: The time zone set on the device.

• Enable system apps: By default, system apps with a launcher icon are disabled when a device is set up in Android enterprise device owner mode. Select this setting to keep all system apps enabled.

Based on your settings, Sophos Mobile creates a configuration code you must enter in the Google zero-touch enrollment portal.

4. Under Enrollment settings, configure the enrollment of zero-touch devices with Sophos Mobile:

• Device group: The device group zero-touch devices are assigned to.

• Task bundle: The task bundle transferred to the device. The list shows task bundles that don’t have an Enroll task.

5. Click Save to save the enrollment settings.

To complete the zero-touch enrollment setup, create a configuration for Sophos Mobile in the Google zero-touch enrollment portal.

11.6.2 Create zero-touch configuration

A zero-touch configuration contains information devices need to enroll with your Sophos Mobile server.

You create this configuration in the Google zero-touch enrollment portal.

This procedure assumes that you’ve set up Android zero-touch enrollment in Sophos Mobile Admin as described in

Set up zero-touch enrollment

(page 65).

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the Zero-

touch tab.

2. Click Copy next to DPC extras to copy the configuration code to the clipboard.

3. Open the Google zero-touch enrollment portal in a new browser window.

4. Create a new configuration for Sophos Mobile:

• In EMM DPC, select Sophos Mobile Control.

• In DPC extras, enter the configuration code you’ve copied to the clipboard.

5. Optionally, select the configuration as default configuration to apply it automatically to all new devices.

Sophos Mobile

Related information

Google zero-touch enrollment portal (external link)

Google zero-touch enrollment help (external link)

11.6.3 Deploy zero-touch devices

To have a zero-touch enabled Android device (“zero-touch device”) enroll with your Sophos Mobile server, you assign it the Sophos Mobile configuration.

1. Check that the devices you want to deploy are registered in the Google zero-touch enrollment portal.

Usually, the reseller registers the devices for you.

2. In the Google zero-touch enrollment portal, assign the Sophos Mobile configuration to the devices.

Alternatively, select the Sophos Mobile configuration as default configuration to assign it to new devices automatically.

3. Distribute the devices to your users.

Users must have a Sophos Mobile user account.

When a user turns the device on for the first time, the Android setup assistant starts. After the device has connected to the internet, it enrolls with Sophos Mobile in Android enterprise device owner mode.

Note

If a device is already set up when you register it in the Google zero-touch enrollment portal, it’s reset to its factory settings.

11.6.4 Turn off zero-touch enrollment

To turn off automatic enrollment of zero-touch enabled Android devices (“zero-touch devices”) with

Sophos Mobile:

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the Zero-

touch tab.

2. Click Revoke zero-touch configuration.

Zero-touch devices still connect to your Sophos Mobile server to enroll, but the server refuses the request.

To completely disconnect Sophos Mobile from zero-touch enrollment, delete the configuration for

Sophos Mobile in the Google zero-touch enrollment portal.

11.7 Knox Mobile Enrollment

With Samsung Knox Mobile Enrollment (KME), you can enroll corporate-owned Samsung devices with Sophos Mobile in bulk. Knox Mobile Enrollment enabled devices automatically enroll with your

Sophos Mobile server when the users turn them on.

Requirements

• You have a Samsung account.

Sophos Mobile

• You have an account for the Samsung Knox portal.

• The devices you want to enroll have Knox 2.4 or later, depending on the enrollment scenario you want to use. For example, Knox 2.8 or later is required for enrollment in Android enterprise device owner mode.

• For enrollment in Android enterprise mode, you’ve set up Android enterprise in Sophos Mobile for the Managed Google Play Account scenario. See

Set up Android enterprise (Managed Google Play

Account scenario)

(page 306).

Configuration steps

To use Knox Mobile Enrollment, perform the following steps:

1. Turn on Knox Mobile Enrollment in Sophos Mobile Admin and configure enrollment details. See

Set up Knox Mobile Enrollment (page 67).

2. Create a profile for Sophos Mobile in the Samsung Knox Mobile Enrollment console. See Create

KME profile (page 68).

3. Purchase Knox Mobile Enrollment enabled devices.

4. Assign the KME profile for Sophos Mobile to the devices. See Deploy KME devices (page

68).

Related information

Samsung Knox Mobile Enrollment website (external link)

Samsung Knox Mobile Enrollment User Guide (external link)

11.7.1 Set up Knox Mobile Enrollment

To set up Samsung Knox Mobile Enrollment (KME) in Sophos Mobile Admin, you configure the settings applied to KME devices when they enroll with your Sophos Mobile server.

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the

Samsung KME tab.

2. Click Use Knox Mobile Enrollment.

3. Under Enrollment settings, configure the enrollment of KME devices with Sophos Mobile:

• Device group: The device group KME devices are assigned to.

• Task bundle (Android): The task bundle transferred to the device when enrolled as a standard Android device.

• Task bundle (Android enterprise device owner): The task bundle transferred to the device when enrolled in Android enterprise device owner mode.

The lists show task bundles that don’t have an Enroll task.

You configure the enrollment mode in the MDM enrollment profile in the Samsung Knox

Mobile Enrollment console.

• User authentication: When selected, the user must enter their Sophos Mobile credentials during the device setup. The user is assigned to the device in Sophos Mobile.

When cleared, the device enrolls with Sophos Mobile without user assignment.

4. Click Save to save the enrollment settings.

To complete the Knox Mobile Enrollment setup, create an MDM profile for Sophos Mobile in the

Samsung Knox Mobile Enrollment console.

Sophos Mobile

11.7.2 Create KME profile

A Knox Mobile Enrollment (KME) profile contains information devices need to enroll with your Sophos

Mobile server. You create this profile in the Samsung Knox Mobile Enrollment console.

This procedure assumes that you’ve set up Samsung Knox Mobile Enrollment in Sophos Mobile

Admin as described in Set up Knox Mobile Enrollment

(page 67).

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the

Samsung KME tab.

2. Open the Samsung Knox portal in a new browser window and navigate to the Knox Mobile

Enrollment console.

3. In the Knox Mobile Enrollment console, create an MDM profile for Sophos Mobile.

If you want to use standard Android enrollment as well as Android enterprise device owner enrollment, create two profiles and turn on the device owner option for one of the profiles.

4. Configure the profile using the values shown in Sophos Mobile Admin under MDM profile

configuration.

Click Copy next to a field in Sophos Mobile Admin to copy the value to the clipboard.

There are more profile settings you can configure. See the Samsung Knox Mobile Enrollment

User Guide for details.

5. Save the profile.

Related information

Samsung Knox Mobile Enrollment console (external link)

Samsung Knox Mobile Enrollment User Guide (external link)

11.7.3 Deploy KME devices

To have a Knox Mobile Enrollment enabled device (“KME device”) enroll with your Sophos Mobile server, you assign it the Sophos Mobile profile.

1. In the Knox Mobile Enrollment console, assign the Sophos Mobile profile to the devices.

If the devices are not shown in the Knox Mobile Enrollment console, contact your reseller.

2. Distribute the devices to your users.

If you’ve selected User authentication in the KME enrollment settings in Sophos Mobile Admin, users must have a Sophos Mobile user account.

When a user turns the device on for the first time, a Knox Mobile Enrollment setup wizard starts.

After the device has connected to the internet, it enrolls with Sophos Mobile.

Note

Depending on the enrollment mode you’ve configured in the Sophos Mobile profile in the Knox

Mobile Enrollment console, the device enrolls either in Android enterprise device owner mode or as a standard Android device.

Sophos Mobile

11.7.4 Turn off Knox Mobile Enrollment

To turn off automatic enrollment of Knox Mobile Enrollment enabled devices (“KME devices”) with

Sophos Mobile:

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the

Samsung KME tab.

2. Click Revoke KME configuration.

KME devices still connect to your Sophos Mobile server to enroll, but the server refuses the request.

To completely disconnect Sophos Mobile from Knox Mobile Enrollment, delete the profile for Sophos

Mobile in the Samsung Knox Mobile Enrollment console.

11.8 Apple DEP

With the Apple Device Enrollment Program (DEP), you can purchase iPhones, iPads, and Macs in volume for distribution within your company. DEP simplifies the deployment of mobile devices by providing the following features:

• Configurable activation process.

• Wireless enabling of supervision mode.

• Over-the-air configuration.

• Automatic enrollment of devices with Sophos Mobile during device activation.

Tip

For detailed information on DEP, visit the Apple DEP website at http://www.apple.com/business/ dep/ .

Preparation steps

To prepare the management of DEP devices with Sophos Mobile, perform the following one-time steps:

1. In the Apple DEP web portal, create a virtual MDM server and link it to Sophos Mobile. See Set up Apple DEP

(page 70).

2. In Sophos Mobile, create one or more DEP profiles that control various device attributes specific to DEP. With the DEP profile, you can also customize the setup assistant that starts when a

device is switched on for the first time. See Create DEP profile (page 71).

Deployment steps

When you purchase DEP devices, the typical deployment process includes the following steps:

1. Purchase the devices from Apple or an approved DEP vendor.

2. In the Apple DEP web portal, assign the devices to the Sophos Mobile MDM server. For this and the next step, see

Deploy DEP devices

(page 72).

3. In Sophos Mobile Admin, assign a DEP profile to the devices.

Sophos Mobile

4. Distribute the devices to your users.

5. When the users switch on their devices for the first time, the customized setup assistant starts.

During setup, the devices are enrolled with Sophos Mobile and the user is assigned to the device.

6. If required, you can transfer additional task bundles to the devices to complete the provisioning.

11.8.1 Set up Apple DEP

Prerequisite: You have enrolled in the Apple Device Enrollment Program (DEP) and set up an administrator account for the Apple DEP web portal.

Note

For detailed information on enrolling in DEP, visit the Apple DEP website at http://www.apple.com/ business/dep/ or see the Apple Deployment Programs help .

Tip

If you have already enrolled in the Apple Volume Purchase Program (VPP), you can use the same

Apple ID for DEP.

To use Apple DEP with Sophos Mobile, you need to create a virtual MDM server in the Apple DEP web portal and link it to the Sophos Mobile server. This includes a verification process to establish a secure connection between Sophos Mobile and the Apple DEP web service.

To set up a virtual MDM server for Sophos Mobile:

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple DEP tab.

2. Click Download public key to download the Sophos Mobile public key file for Apple DEP.

The file is saved to your local computer, using the download settings of your web browser.

3. Open the Apple DEP web portal at https://deploy.apple.com

in a new browser window.

You can do this by clicking the Apple DEP web portal link in Sophos Mobile.

4. Log in to the Apple DEP web portal with your company Apple ID.

5. In the portal, go to Device Enrollment Program > Manage Servers, and then click Add MDM

Server.

6. Enter a name for MDM server, for example Sophos Mobile .

7. In the next step, upload the public key file that you downloaded from Sophos Mobile.

8. In the next step, download the server token.

At this point, you may log out from the Apple DEP web portal.

9. On the Apple DEP tab of Sophos Mobile, click Upload a file and select the server token that you downloaded from the Apple DEP web portal.

The details of your virtual MDM server are displayed.

10. Click Save to save your changes.

The DEP server token is valid for one year.

Important

When you create a new server token in the Apple DEP web portal, you must use the same

Apple ID that you used for the creation of the initial token.

Sophos Mobile

11.8.2 Reset Apple DEP

Reset the Apple DEP information stored in Sophos Mobile to remove your Apple DEP token from

Sophos Mobile, for example because you’ve uploaded the wrong token.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple DEP tab.

2. Click Reset DEP.

The Apple DEP token, all Apple DEP devices, and all Apple DEP profiles are deleted from Sophos

Mobile.

To stop managing your Apple DEP devices with Sophos Mobile, go to the Apple DEP web portal and remove Sophos Mobile as MDM server.

11.8.3 Create DEP profile

You need to set up the Apple Device Enrollment Program (DEP) before you can create DEP profiles.

See Set up Apple DEP

(page 70).

A DEP profile is assigned to a DEP device and provides information to the Apple server when the device is activated. This information includes:

• The MDM server (that is the Sophos Mobile server) assigned to manage the device.

• Configuration options for the enrollment with Sophos Mobile.

• A list of hosts that the device is allowed to pair with.

• Customization options for the setup assistant that starts when the device is switched on for the first time.

If required, you can create several DEP profiles to use different setup and enrollment settings for your DEP devices.

To create a DEP profile:

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple DEP

profiles tab.

2. Click Add.

3. In the Edit DEP profile dialog, enter the required settings.

4. To assign the profile to all new DEP devices to which no profile has been manually assigned to, select it in the Default DEP profile assigned to new devices list.

When you select None, you have to manually assign a DEP profile to new DEP devices as

described in Deploy DEP devices (page 72). Otherwise, DEP devices will not be enrolled with

Sophos Mobile when they are activated.

5. Click Save to save your changes.

Related reference

DEP profile settings (iOS)

(page 75)

DEP profile settings (macOS)

(page 78)

Sophos Mobile

11.8.4 Deploy DEP devices

Perform this procedure to connect your devices to Apple DEP and to enroll them with Sophos

Mobile.

You can manage devices that you have purchased from Apple or from an approved DEP vendor.

Before you can connect devices to Apple DEP, you need to configure the device vendor in the Apple

DEP portal.

Note

In a typical DEP workflow, you perform this procedure before handing over the devices to your users for activation and usage.

Note

For a detailed description of the Apple DEP portal, see the Apple Deployment Programs help .

To assign your devices to Sophos Mobile and to assign a DEP profile to them:

1. Open the web portal for the Apple deployment programs at https://deploy.apple.com

in your web browser and then log in with your company Apple ID.

2. In the portal, go to Device Enrollment Program > Manage Devices.

3. Under Choose Devices By, select your new devices by serial number, by order number, or upload a CSV file containing the serial numbers of your devices.

Note

If you have purchased your devices from a reseller, they are available in the DEP portal within

24 hours after the reseller posts your order to Apple.

4. Under Choose Action, select Assign to Server and then select the virtual MDM server that you have set up for Sophos Mobile as described in

Set up Apple DEP (page 70).

5. Click OK to perform the assignment.

At this point, you may log out from the Apple DEP web portal.

You may skip the remaining steps if you have configured a default DEP profile as described in Create

DEP profile

(page 71).

6. Sign in to Sophos Mobile Admin with an administrator account for the customer for which you want to manage the DEP devices.

7. On the menu sidebar, under MANAGE, click Devices and then click Apple DEP.

The Apple DEP devices page lists all devices that you have assigned to Sophos Mobile in the

Apple DEP web portal.

8. If the devices that you just assigned to Sophos Mobile do not appear in the list, click Synchronize

with Apple DEP portal.

Note

To limit the load on the Apple DEP server, repeated synchronization is possible only after a short queue time.

9. Select the new devices and then click Actions > Assign profile.

Sophos Mobile

10. In the confirmation dialog, select the DEP profile you want to assign to the devices and then click

OK.

When the purchased devices arrive at your company, you can hand them over to your users. No further configuration is required. When the users switch on their devices for the first time, the iOS setup and the enrollment with Sophos Mobile are performed as configured in the assigned DEP profile.

If you have selected the Assign user to device profile option as described in

Create DEP profile

(page 71), the users are automatically assigned to their device.

11.8.5 Manage DEP devices

DEP devices are managed in Sophos Mobile just as non-DEP devices are. See Manage devices

(page 50).

Specifically to DEP, you can assign a DEP profile to a device. The DEP profile provides information

to the Apple server when the device is activated. See Create DEP profile

(page 71).

Note

The DEP profile that is displayed in Sophos Mobile might be different to the profile that is actually used on the device. If you change the assignment after the device was activated, the device continues to use the previously assigned profile until it is wiped and activated again.

To change the DEP profile of a device:

1. On the menu sidebar, under MANAGE, click Devices and then click Apple DEP.

The Apple DEP devices page lists all devices that you have assigned to Sophos Mobile on the

Apple DEP web portal.

2. Click Synchronize with Apple DEP portal to update the DEP information.

3. Select the devices to which you want to assign a different DEP profile.

4. Click Actions and then click the required action:

• Assign profile: Select the DEP profile that will be assigned to the devices when they are activated the next time.

• Deassign profile: Assign no DEP profile when the devices are activated the next time.

The new profile assignment is displayed on the Apple DEP devices page. The changes are applied to the devices after they are wiped and activated again.

11.8.6 Add iOS DEP device manually

You can manually register an iPhone or iPad for the Apple Device Enrollment Program (DEP). Use this for example if you haven’t purchased the device directly from Apple or from an approved DEP vendor.

Important

The device is reset to its factory settings.

1. Connect the device to a USB port of a Mac with Apple Configurator 2.5 or later installed.

2. In Apple Configurator, go to File > New Profile > Wi-Fi to create a network profile for your Wi-Fi connection.

The device requires this profile to connect to the Apple DEP registration server.

Sophos Mobile

3. Go to Preferences > Organization and click the Plus button to create an organization entry.

Use the Apple ID and password of your Apple DEP account. Also, select to generate a new supervision identity.

4. Go to Preferences > Servers and click the Plus button to create a server entry.

Note

You may enter any value in Enrollment URL. Apple Configurator doesn’t use the value when registering DEP devices.

5. Select the device and then select Prepare.

6. Select Manual Configuration and follow the wizard pages to prepare the device.

• Select the server and the network profile you created earlier.

• Skip the configuration of the iOS setup assistant. You configure this in the Sophos Mobile DEP profile.

7. Wait until the preparation procedure is finished. Do not turn off the device at this stage.

When the device is registered, you can select it in the Apple DEP portal by its serial number.

Before you can hand over the device to a user, enroll it with Sophos Mobile as described in Deploy

DEP devices

(page 72).

Related information

Apple Configurator 2 user guide - Prepare devices manually (external link)

11.8.7 Configure supervision hosts

You can configure supervision hosts for your iOS DEP devices. A supervision host is allowed to pair with an iOS DEP device even if you block USB pairing in general.

Only Macs can be supervision hosts.

To make a Mac a supervision host, upload its supervision identity certificate to the iOS DEP profile in

Sophos Mobile.

1. On the Mac, create a new organization in Apple Configurator or use an existing organization.

2. Open the Keychain Access app.

3. Under My certificates, export the organization’s certificate.

There’s one certificate for each organization you’ve configured in Apple Configurator.

In the export dialog, make sure the certificate is exported in CER format (.cer file name extension).

4. In your iOS DEP profile in Sophos Mobile, go to the USB pairing tab and configure the following settings: a) Clear the Allow USB pairing with all hosts check box.

b) Click Upload host certificate to upload the certificate file.

5. Optional: To make another Mac a supervision host, do one of the following:

• Upload another certificate to the iOS DEP profile.

• Share the organization between the Macs by doing the following:

Export the organization from Apple Configurator on the first Mac and import it on the second

Mac.

Sophos Mobile

• Share the supervision identity between the Macs by doing the following:

On the first Mac, export the supervision identity from Apple Configurator in PKCS #12 format

(.p12 file name extension). On the second Mac, open the .p12 file with the Keychain Access app.

Related tasks

Create DEP profile (page 71)

Related reference

DEP profile settings (iOS)

(page 75)

Related information

Apple Configurator 2 user guide - Organization preferences (external link)

11.8.8 DEP profile settings (iOS)

General settings

Setting/Field

Name

Description

Device group

Task bundle

Description

The name of the DEP profile.

An optional description of the DEP profile.

A device group that will be assigned to devices when they are enrolled with Sophos Mobile.

For information on device groups, see

Device groups

(page 83).

Note

To simplify device management, we recommend that you use a separate device group for DEP devices.

A task bundle that will be transferred onto the devices when they are enrolled with Sophos Mobile.

The list includes all task bundles that contain no enrollment task.

For information on task bundles, see Task bundles

(page 269).

Enrollment

Setting/Field

Supervise device

Description

Supervision mode is enabled.

Sophos Mobile

Setting/Field

User can remove MDM profile

Install SMC app

User can skip MDM profile assignment

Assign user to device

Description

The user is able to remove the Sophos Mobile enrollment profile through the iOS user interface.

This option can only be deselected for supervised devices.

Install the Sophos Mobile Control app onto the device.

If you enable this option, you must also disable the

Apple ID option on the iOS setup tab to make sure that Sophos Mobile can install the app from the App

Store.

Note

Alternatively, if you are enrolled in the Apple Volume

Purchase Program (VPP), the Sophos Mobile app can be installed as a VPP app, even if the device is not associated with an Apple ID. Devices must be in status

managed. See Automatically assign VPP apps

(page

297).

The user is able to skip the setup step that applies the Sophos

Mobile enrollment profile.

During the enrollment process with Sophos Mobile, users are asked for their Self Service Portal credentials and then assigned to the device.

Use this option to auto-assign a user to the device.

iOS setup

On the iOS setup tab, you disable configuration steps of the setup assistant that starts when the device is switched on for the first time.

Note

These settings only affect the iOS setup. If you disable a configuration step, the user is still able to enable the relevant option later. To completely disable a feature, use a Restrictions configuration.

See

Restrictions configuration (iOS device profile) (page 167).

Setting/Field

Restore from backup

Disable “Move Data from Android”

Diagnostics

Location services

Siri

Description

Skip restoring data from an iCloud or iTunes backup, or transferring data from an Android device.

The option to transfer data from an Android device is not available.

Skip configuring diagnostics. Diagnostic and usage data are not sent to Apple.

Skip configuring location services. Location services are turned off.

Skip configuring Siri. Siri is turned off.

Setting/Field

Display Zoom

Keyboard layout

Apple ID

Apple Pay

Touch ID

Passcode

Terms and Conditions

Watch migration

Home button feedback

Support information

Setting/Field

Department

Phone number

Email

Sophos Mobile

Description

Skip configuring Display Zoom, i.e. a zoomed view providing larger icons, text and buttons.

Skip configuring the keyboard layout.

Skip configuring an Apple ID. The user cannot log in with their

Apple ID to access Apple services.

Skip configuring Apple Pay. The user cannot add credit or debit card information for paying in stores or within apps using Apple

Pay.

Skip configuring Touch ID. The user cannot set up a fingerprint in place of a passcode.

Skip creating a passcode to unlock the device.

Skip displaying the Terms and Conditions page.

Skip restoring Apple Watch data from an iCloud or iTunes backup.

For iPhone 7 and later, skip configuring the Home button feedback, i.e. the level of tactile feedback when clicking the virtual Home button.

Description

The department or location name associated with the profile.

This name is included in the information that the user can access by clicking About Configuration during device setup.

The support phone number for your company.

This field is pre-populated with the phone number from the technical support contact details. See

Configure IT contact (page 15).

Note

The phone number is stored internally in the DEP profile but is not available to the device user.

The support email address for your company.

This field is pre-populated with the email address from the technical support contact details. See

Configure IT contact (page 15).

Note

The email address is stored internally in the DEP profile but is not available to the device user.

Sophos Mobile

USB pairing

On the USB pairing tab, you can restrict the USB pairing of iOS DEP devices to selected Macs.

USB pairing is required to connect the device to iTunes or Apple Configurator.

Setting/Field

Allow USB pairing with all hosts

Upload host certificate

Description

If you select the check box, you can pair the device with any computer.

If you clear the check box, you can only pair the device with Macs that are supervision hosts. You can’t pair the device with Windows computers.

Upload a supervision identity certificate.

This makes a Mac containing the certificate in its keychain a supervision host. See

Configure supervision hosts

(page 74).

You can upload several certificates.

Note

If you clear Allow USB pairing with all hosts and don’t upload a certificate, you can’t connect the device to iTunes or Apple Configurator.

Related tasks

Create DEP profile (page 71)

11.8.9 DEP profile settings (macOS)

General settings

Setting/Field

Name

Description

Device group

Description

The name of the DEP profile.

An optional description of the DEP profile.

A device group that will be assigned to devices when they are enrolled with Sophos Mobile.

For information on device groups, see

Device groups

(page 83).

Note

To simplify device management, we recommend that you use a separate device group for DEP devices.

Setting/Field

Task bundle

Sophos Mobile

Description

A task bundle that will be transferred onto the devices when they are enrolled with Sophos Mobile.

The list includes all task bundles that contain no enrollment task.

For information on task bundles, see Task bundles

(page 269).

Enrollment

Setting/Field

User can skip MDM profile assignment

Assign user to device

Description

The user is able to skip the setup step that applies the Sophos

Mobile enrollment profile.

During the enrollment process with Sophos Mobile, users are asked for their Self Service Portal credentials and then assigned to the device.

Use this option to auto-assign a user to the device.

macOS setup

On the macOS setup tab, you disable configuration steps of the setup assistant that starts when the device is switched on for the first time.

Note

These settings only affect the macOS setup. If you disable a configuration step, the user is still able to enable the relevant option later. To completely disable a feature, use a Restrictions

configuration. See Restrictions configuration (macOS device policy) (page 211) and

Restrictions configuration (macOS user policy) (page 227).

Setting/Field

Restore from backup

Apple ID iCloud Analytics

Location services

Terms and Conditions

Registration

Diagnostics

Description

Skip restoring data from an iCloud or iTunes backup, or transferring data from an Android device.

Skip configuring an Apple ID. The user cannot log in with their

Apple ID to access Apple services.

Skip configuring iCloud Analytics. Diagnostic and usage data from the iCloud account is not sent to Apple.

Skip configuring location services. Location services are turned off.

Skip displaying the Terms and Conditions page.

Skip creating a computer account.

Skip configuring diagnostics. Diagnostic and usage data are not sent to Apple.

Sophos Mobile

Setting/Field

FileVault disk encryption

Siri

Support information

Setting/Field

Department

Description

Skip configuring FileVault disk encryption. FileVault is turned off.

Skip configuring Siri. Siri is turned off.

Phone number

Email

Description

The department or location name associated with the profile.

This name is included in the information that the user can access by clicking About Configuration during device setup.

The support phone number for your company.

This field is pre-populated with the phone number from the technical support contact details. See

Configure IT contact (page 15).

Note

The phone number is stored internally in the DEP profile but is not available to the device user.

The support email address for your company.

This field is pre-populated with the email address from the technical support contact details. See

Configure IT contact (page 15).

Note

The email address is stored internally in the DEP profile but is not available to the device user.

Related tasks

Create DEP profile (page 71)

11.9 Duo Security integration

You can connect Sophos Mobile with the Duo Security authentication software. This allows Duo

Security to identify trusted devices by their Sophos Mobile management status.

To determine the trust status of a device, Duo Security uses different approaches for Android and iOS:

• For Android devices, Duo Security retrieves the trust status through the Sophos Mobile web service interface.

• For iOS devices, Duo Security determines the trust status by the existence of a certain certificate on the device.

Sophos Mobile

Note

For more information on trusted devices, see the Duo Security documentation.

11.9.1 Configure Duo Security integration for Android devices

Perform the following steps to let Duo Security determine the trust status of your Android devices.

1. In Sophos Mobile, create an administrator with role Duo API.

2. In the Duo Admin Panel, enter the user name and password of that administrator.

See the Duo Security documentation for details.

To determine the trust status of an Android device, the Duo Mobile Android app reports the device

ID to the Duo Security server. The Duo Security server then retrieves the device status through the

Sophos Mobile web service interface and classifies managed devices as trusted.

Related concepts

User roles (page 4)

Related tasks

Create administrators (page 338)

11.9.2 Configure Duo Security integration for iOS devices

Perform the following steps to let Duo Security determine the trust status of your iOS devices.

1. Configure the connection to the Duo certificate server: a) On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the Duo

Security tab.

b) Enter the settings provided by Duo Security.

2. Add a Duo device certificate configuration to the iOS device profile you are using for your iOS devices.

3. Update the iOS device profile on the devices.

This installs a Duo device certificate on the devices. The Duo Mobile iOS app detects the certificate and classifies the devices as trusted.

Related reference

Duo device certificate (iOS device profile) (page 196)

Sophos Mobile

11.10 TeamViewer remote control

TeamViewer is a third-party remote control tool. TeamViewer integration allows you to launch a remote control session with a managed Android or iOS device from within Sophos Mobile without having to use a session ID or password.

11.10.1 Set up TeamViewer integration

To launch TeamViewer sessions from within Sophos Mobile, you must create a TeamViewer application and link it to Sophos Mobile.

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the

TeamViewer tab.

2. Click TeamViewer configuration wizard.

The wizard guides you through the setup process: a) Create a TeamViewer account.

b) Create an application in the TeamViewer Management Console and link it to Sophos Mobile.

3. Install the TeamViewer software: a) Go to the computer on which you sign in to Sophos Mobile. Install the TeamViewer Windows client from the TeamViewer website.

b) On the devices you want to control, install the TeamViewer QuickSupport app from Google

Play or from the App Store.

When you’ve set up TeamViewer integration, the Request remote control device action is available.

Related information

TeamViewer website (external link)

TeamViewer Management Console (external link)

11.10.2 Launch TeamViewer session

Note

You need a TeamViewer license and the license add-on for mobile device support.

Sophos Mobile supports TeamViewer sessions with Android and iOS devices.

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the device you want to control.

3. On the Show device page, click Actions > Request remote control.

This starts a TeamViewer session on your computer and on the selected device. After the user acknowledges the connection, you can control the device.

Sophos Mobile

12 Device groups

Device groups are used to categorize devices. They help you to manage devices efficiently as you can carry out tasks on a group rather than on individual devices.

A device always belongs to exactly one device group. You assign a device to a device group when you add it to Sophos Mobile.

Tip

Only group devices with the same operating system. This makes it easier to use groups for installations and other operating system specific tasks.

12.1 Create device group

1. On the menu sidebar, under MANAGE, click Device groups, and then click Create device group.

2. On the Edit device group page, enter a name and a description for the new device group.

3. Under Compliance policies, select the compliance policies that are applied to corporate and to personal devices.

4. Click Save.

Note

The device group settings contain the Enable iOS auto-enrollment option. This option allows you to enroll iOS devices with the Apple Configurator. See

Auto-enroll iOS devices

(page 45).

The new device group is created and shown on the Device groups page.

12.2 Delete device groups

1. On the menu sidebar, under MANAGE, click Device groups.

2. On the Device groups page, click the blue triangle next to the device group that you want to delete, and then click Delete.

3. In the confirmation dialog, select one of the remaining device groups to which devices from the current device group will be re-assigned.

This selection is not available when there are no devices assigned to the current device group.

4. Click Yes to delete the device group.

Note

When there is only one device group left and there are devices assigned to it, you cannot delete this device group.

Sophos Mobile

13 Users

On the People page, you manage your Sophos Mobile user accounts.

User management

When you set up a customer in Sophos Mobile, you can choose between the following types of user management:

Internal user management

External user management

Federated authentication

You create user accounts in Sophos Mobile.

You create user accounts in an LDAP directory

(for example Active Directory) and then connect the LDAP directory to Sophos Mobile. See

Configure external directory connection (page

86).

You create user accounts in Azure Active

Directory (Azure AD). When users sign in to the

Self Service Portal, they authenticate with Azure

AD. See

Configure federated authentication (page

88).

User details

For internal user management, the People page shows the users you’ve added to Sophos Mobile.

For external user management and for federated authentication, the People page only shows users relevant for Sophos Mobile:

• Users assigned to a Sophos Mobile managed device.

• Users assigned to an Apple Volume Purchase Program (VPP) app.

Click a user’s name to view the account details.

Import users

For internal user management, you can import users from a CSV file. See

Import users

(page

90).

User groups

With user groups you control Self Service Portal access and available enrollment options. To create a Self Service Portal configuration for certain users only, add them to a user group and assign that

group to the Self Service Portal configuration. See Configure Self Service Portal (page 27).

For internal user management, you add users to groups in Sophos Mobile Admin. See Create user groups

(page 91).

For external user management, Sophos Mobile uses the groups defined in your LDAP directory.

For federated authentication, Sophos Mobile uses the groups defined in Azure AD.

Sophos Mobile

13.1 Configure Self Service Portal user management

Note

For Sophos Mobile on Premise, user management for the Self Service Portal is configured by the super administrator when a customer is created. See the Sophos Mobile super administrator guide .

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the User

setup tab.

2. Under Device assignment, select what happens when you delete a user that is assigned to a device:

Option

Unassign user from device

Unenroll and delete device

Unenroll device

Description

The user assignment is removed. The device status is not changed.

The device is unenrolled from Sophos Mobile and deleted.

The device is unenrolled from Sophos Mobile.

The device status is changed to Unenrolled.

This setting is not available when you use external user management.

3. Under User management mode, select how Sophos Mobile manages user accounts:

Option

None. No SSP, user-specific profiles, or

LDAP administrators available.

Internal directory

External LDAP directory

Azure AD federated authentication

Description

User management is turned off. You can’t assign users to devices and you can’t use the

Self Service Portal.

You create user accounts and user groups in

Sophos Mobile.

Sophos Mobile uses user accounts and user groups from an LDAP directory.

You create user accounts and user groups in Azure Active Directory (Azure AD). When users sign in to the Self Service Portal, they authenticate with Azure AD.

See Configure federated authentication

(page

88).

4. For external user management, click Configure external LDAP to configure the connection to your

LDAP directory.

See

Configure external directory connection (page 86).

5. Click Save.

After you’ve set the user management mode, you can’t switch directly to a different mode. Instead, select None. No SSP, user-specific profiles, or LDAP administrators available. to make all options available again.

Sophos Mobile

Note

You can’t change the user management mode in the following situations:

• There are users assigned to devices.

• There are Apple Volume Purchase Program (VPP) licenses assigned to users.

13.2 Configure external directory connection

To manage user accounts for Sophos Mobile Admin and the Self Service Portal in an external LDAP user directory, you must configure the connection to your LDAP server.

Sophos Mobile can connect to the following LDAP servers:

• Active Directory

• Google Cloud Directory

• IBM Domino

• NetIQ eDirectory

• Red Hat Directory Server

• Zimbra

For supported versions, see the Sophos Mobile 9 release notes .

Note

There is no synchronization between the LDAP directory and Sophos Mobile. Sophos Mobile only accesses the LDAP directory to look up user information. Changes to an LDAP user account are not implemented on the Sophos Mobile database, and vice versa.

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the User

setup tab.

2. Select External LDAP directory.

3. Click Configure external LDAP.

Configuration depends on the LDAP server type. The following instructions apply to Active Directory.

4. On the Server details page, configure the following settings: a) In the LDAP type field, select the LDAP server type.

b) In the Primary URL field, enter the IP address or name of the primary directory server.

Select SSL/TLS to secure the server connection by SSL or TLS (depending on what the server supports).

c) Optional: In the Secondary URL field, enter the IP address or name of a directory server

Sophos Mobile uses as fallback in case the primary server isn’t available.

d) In the User and Password fields, enter the credentials Sophos Mobile uses to authenticate with the LDAP server.

Use one of the following formats:

• <domain>\<user name>

• <user name>@<domain>.<domain code>

Sophos Mobile

Note

For security reasons, we recommend you select an account with no write permissions for the directory.

5. On the Search base page, enter the distinguished name (DN) of the search base object.

The search base object defines the location in the directory from which the LDAP search begins.

6. On the Search fields page, configure the attributes of the directory service that contain the user properties Sophos Mobile uses.

Select the attribute names from the list or enter them manually.

Use the following mappings for Active Directory:

Property in Sophos Mobile

User name

First name

Last name

Attribute in Active Directory sAMAccountName givenName sn

Email mail

7. On the SSP configuration page, specify the users that are allowed to log in to the Self Service

Portal. Enter the relevant information in the LDAP directory group field, using one of the following options:

• If you enter the name of a group that is defined on the directory server, all members of that group are allowed to log in to the Self Service Portal. After you have entered the group name, click Test group to resolve the group name into a Distinguished Name (DN).

• If you leave the field empty, no users from the directory server are allowed to log in to the Self

Service Portal. Use this option if you want to enable external user management for Sophos

Mobile Admin but not for the Self Service Portal.

Note

The group you specify here is not related to the user group you define on the Group settings tab of the Self Service Portal page. With those settings, you define task bundles, Sophos

Mobile group membership and available device platforms for each user group.

8. Click Apply.

9. On the User setup tab, click Save.

Related information

How to connect a Sophos Mobile 8.0 server with an Azure Active Directory (Sophos knowledge base article 128081)

Connecting Sophos Mobile to Google Cloud Identity / Google Cloud Directory using Secure LDAP

(Sophos knowledge base article 132870)

13.3 Federated authentication

Federated authentication with Azure Active Directory (Azure AD) is an alternative user management mode to internal and external (LDAP) user management.

Sophos Mobile

When users sign in to the Self Service Portal, there is a fundamental difference between external user management and federated authentication:

• With external user management, users authenticate with Sophos Mobile using their LDAP credentials.

• With federated authentication, users authenticate directly with Azure AD.

This has the following advantages:

• Azure AD supports modern sign-in features such as multi-factor authentication, smart card authentication, or certificate-based authentication.

• Cross-platform single sign-on: Users only sign in once to access the Self Service Portal and other applications and resources you’ve configured for Azure AD authentication.

• You don’t need to open ports 389 (LDAP) or 636 (LDAPS) for the communication between Sophos

Mobile and your LDAP server.

13.3.1 Configure federated authentication

To use federated authentication with Azure Active Directory (Azure AD), you must register Sophos

Mobile as a Microsoft Azure application.

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the

Microsoft Azure tab.

2. Click Microsoft Azure registration wizard.

The wizard guides you through the registration process in the Microsoft Azure portal and in Sophos

Mobile Admin: a) Create an application for Sophos Mobile in the Microsoft Azure portal.

b) Enter the application ID in Sophos Mobile.

c) Upload the Sophos Mobile server certificate to your application.

d) Register a reply URL for Sophos Mobile. Azure forwards users to this Sophos Mobile page after they’ve authenticated with Azure AD.

e) Grant your application the required permissions.

3. On the Sophos setup page, click the User setup tab.

4. Select Azure AD federated authentication as user management mode.

If federated authentication is not available, switch to None. No SSP, user-specific profiles, or

LDAP administrators available. first.

Note

You can use the application for Sophos Mobile you’ve created in the Azure portal also for Intune app protection. Note that Intune app protection has additional licensing requirements. See

Intune app protection

(page 323).

Sophos Mobile

13.3.2 Set a default customer for the Self Service Portal

As super administrator, you can set a default customer that is automatically selected when users access the Self Service Portal.

In Sophos Mobile you can set up several customers to manage different areas of your organization independently of each other. When users access the Self Service Portal, they have to select their customer before they enter their credentials.

You can simplify the sign-in experience by setting a default customer. While this is possible for all user management modes, it’s particularly useful for federated authentication: Users don’t see a signin page at all if they’ve already authenticated with Azure Active Directory (Azure AD).

To set a default customer for the Self Service Portal:

1. Sign in to Sophos Mobile Admin with a super administrator account.

2. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the Web

portals tab.

3. Under Self Service Portal, select Default customer and select a customer from the list.

4. Optional: Turn off Visible and editable to skip the sign-in page if the user has already authenticated with Azure AD.

Note

If you turn this off, only users of the default customer can access the Self Service Portal.

5. Click Save.

13.4 Configure LDAP connection

If you’ve set up federated authentication you can configure an LDAP connection between Sophos

Mobile and Azure Active Directory (Azure AD). You must do this if you want to use Apple DEP, Google zero-touch, or Samsung KME.

The following devices enroll automatically with Sophos Mobile when users set them up:

• iPhones, iPads, and Macs registered for the Apple device enrollment program (DEP)

• Android devices registered for Google zero-touch enrollment

• Samsung Android devices registered for Knox Mobile Enrollment (KME)

During the enrollment process, Sophos Mobile connects to Azure AD to authenticate the user.

To configure an LDAP connection:

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the LDAP

connection tab.

2. Click Configure external LDAP.

3. On the Server details page, configure the following settings: a) In the Primary URL field, enter the IP address or name of the primary directory server.

The server must support LDAPS (LDAP over SSL/TLS).

b) Optional: In the Secondary URL field, enter the IP address or name of a directory server

Sophos Mobile uses as fallback in case the primary server isn’t available.

Sophos Mobile c) In the User and Password fields, enter the credentials Sophos Mobile uses to authenticate with the LDAP server.

Use one of the following formats:

• <domain>\<user name>

• <user name>@<domain>.<domain code>

Note

For security reasons, we recommend you select an account with no write permissions for the directory.

4. On the Search base page, enter the distinguished name (DN) of the search base object.

The search base object defines the location in the directory from which the LDAP search begins.

5. Click Apply.

13.5 Create users

1. On the menu sidebar, under MANAGE, click People.

2. Click Create user.

3. On the Edit user page, select the Send registration email check box.

4. Enter the account details.

The User name field must only contain letters (Latin alphabet), digits, spaces and the characters

\!._-# .

5. Click Save.

A registration email is sent to the new user.

If you click the blue triangle next to the required user, you can view the user details (Show), Edit or

Delete the user.

Note

If you click a user name, the Edit user page is displayed. This page contains the Resend

registration email button, which you can use to send the email again if the user did not receive or lost the initial email.

13.6 Import users

You can add users by importing them from a CSV file.

You can import up to 500 users.

If you specify a group that doesn’t exist, Sophos Mobile creates it.

The CSV file must have the following specification:

• The first row is treated as a header and is not imported.

• Values must be separated by semicolon, not by comma.

• All rows must have the correct number of semicolon characters, even if you leave out optional values.

Sophos Mobile

• The file extension must be .csv

• To ensure that non-English characters are imported correctly, the file must be UTF-8 encoded.

Tip

On the Import users page, click Example CSV to download a sample file.

To import users from a CSV file:

1. On the menu sidebar, under MANAGE, click People.

2. Click Import users.

3. On the Import users page, select Send registration emails.

4. Click Upload a file and then navigate to the CSV file you have prepared.

The entries are read in from the file and are displayed.

5. If the data is not formatted correctly or is inconsistent, the file as a whole cannot be imported. In this case, follow the error messages that are displayed next to the relevant entries, correct the content of the CSV file accordingly and upload it again.

6. Click Finish to create the user accounts.

The users are imported and displayed on the People page. They receive emails with their login credentials for the Self Service Portal.

13.7 Create user groups

With user groups you control Self Service Portal access and available enrollment options.

Note

If you manage your user accounts in an external LDAP directory, create your user groups there.

If you use federated authentication, create your user groups in Azure Active Directory.

To create a user group:

1. On the menu sidebar, under MANAGE, click People.

2. Click Show user groups.

3. On the Show user groups page, click Create group.

4. Enter a name for the group.

5. Click Save.

After you’ve created a user group, you can add users to it.

When you assign the group to a Self Service Portal configuration, that configuration only applies to the group members. See

Configure Self Service Portal

(page 27).

Sophos Mobile

14 Profiles and policies

Profiles

Profiles are settings that you define and then install onto a device or device group.

To install a profile on one or more devices, Sophos Mobile creates a task and executes it at the specified time. When you update a profile, you must install it again for the changed configurations to take effect on the device.

The following profile types are available:

Configurations for Android device profiles

(page 100)

Configurations for Knox container profiles

(page 161)

Configurations for iOS device profiles (page 166)

Policies

Policies are settings that you define and then assign to a device or device group. You can only assign one policy of each type to one device.

If you assign a policy to a device, a sync is triggered and the settings take effect immediately.

Assigned policies are updated on the device each time a device connects to the Sophos Mobile server. So when you update a policy, you do not have to explicitly re-apply it to the device.

The following policy types are available:

Configurations for Android enterprise device policies (page 132)

Configurations for Android enterprise work profile policies

(page 118)

Configurations for Sophos container policies for Android

(page 146)

Configurations for Mobile Security policies for Android (page 157)

Configurations for Android Things policies (page 165)

Configurations for Sophos container policies for iOS

(page 196)

Configurations for Mobile Security policies for iOS

(page 207)

Configurations for macOS device policies

(page 209)

Configurations for macOS user policies

(page 226)

Configurations for Windows Mobile policies (page 244)

Configurations for Windows policies (page 254)

Configurations for Windows IoT policies

(page 265)

Sophos Mobile

14.1 Get started with device policies

The Policies startup wizard helps you create basic device policies for all platforms. You can enhance the policies later.

Note

Depending on the platform, you configure device settings either by a device profile (Android, iOS) or a device policy (macOS, Windows, Windows Mobile). For simplicity, this section uses the term

policy for both profiles and policies.

For the differences between profiles and policies, see Profiles and policies

(page 92).

1. On the dashboard, click Policies startup wizard in the Getting started tasks widget.

Tip

If you don’t see the widget, click Add widget > Getting started.

2. On the Platforms page, select the device platforms for which you want to create a policy.

3. For Android, you can select a management mode.

This setting affects which policy types are available. We recommend you use the Android

enterprise mode.

4. On the Policies page, configure the following settings: a) Enter a name for the policy.

For each platform, a policy with this name is created.

b) Select the areas the policy manages.

If you clear a check box, the corresponding wizard page is skipped. You can configure the skipped areas (and more) later.

5. On the Passwords page, configure requirements for the device password.

6. On the Restrictions page, configure restrictions applied to devices, like turning off the camera or other device features that could be a security risk.

7. On the Wi-Fi page, configure the connection to your corporate Wi-Fi network.

If your Wi-Fi network uses a different security type than WPA/WPA2 PSK, you can change that setting later.

8. On the Email page, configure the connection to your corporate Microsoft Exchange email server.

The placeholders %_USERNAME_% and %_EMAILADDRESS_% are replaced by the name and the email address of the user assigned to the device.

9. Click Finish.

For each platform you’ve selected, the wizard creates a policy.

To view the policy, click Profiles, policies in the menu sidebar and then click the device platform.

To change the areas managed, click the policy’s name and then click Add configuration.

If you’ve selected the Android enterprise mode, you must set up Android enterprise for your organization before you can enroll devices. See

Set up Android enterprise - Overview (page 306).

Sophos Mobile

14.2 Create profile or policy

Profiles and policies are made up of one or more configurations. By adding configurations, you define the scope of the profile or policy, that is, the areas that are managed on the devices.

1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click the platform for which you want to create the profile or policy.

2. On the Profiles and policies page, click Create. If there is more than one profile or policy type available for a platform, Create opens a menu from which you can select the required type.

For a list of available profile and policy types, see Profiles and policies

(page 92).

3. Enter a name and a description.

4. For iOS and macOS device profiles, enter your organization name.

5. For Sophos container policies, a General configuration is mandatory and is automatically added to the policy. On the Edit policy page, click General to open the configuration and make the required changes.

6. For Android enterprise policies, a Restrictions configuration is mandatory and is automatically added to the policy. On the Edit policy page, click Restrictions to open the configuration and make the required changes.

7. For Mobile Security policies, a Network configuration is mandatory and is automatically added to the policy. On the Edit policy page, click Network to open the configuration and make the required changes.

8. To add more configurations to the profile or policy, click Add configuration and then select the configuration you want to add.

Note

The configurations supported may depend on the version of the operating system or on other device features. The requirements are indicated by a blue label.

9. In the settings page of the configuration, enter the required settings.

10. Optional: Repeat the previous steps to add more configurations.

11. If you’ve added a SCEP or Duo device certificate configuration, optionally select a renewal interval in SCEP renewal interval.

The device automatically requests a certificate renewal after the interval you’ve selected, calculated from when the profile or policy was assigned to the device. The same interval is used for all SCEP and Duo device certificate configurations in the profile or policy.

12. After you have added all required configurations, click Save.

The profile or policy is created. For information on how to apply the profile or policy to devices, see

Install a profile onto devices (page 98) or

Assign a policy to devices

(page 99).

Tip

When you update a profile, you can easily re-install it onto all devices on which it is installed: On the Profiles and policies page, click the blue triangle next to the profile and then click Update

devices.

When you update a policy, it is automatically updated on all devices to which the policy is assigned.

Sophos Mobile

14.3 Import iOS device profiles created with Apple

Configurator

You can import profiles created with Apple Configurator into Sophos Mobile.

Apple Configurator can be downloaded from the App Store.

Note

You import device profiles with the same procedure as provisioning profiles for your selfdeveloped iOS apps. When you upload a profile file, Sophos Mobile analyzes its content in order to distinguish between the two profile types.

1. After you have created a profile in Apple Configurator, export it (unencrypted and unsigned) and save it on your computer.

2. On the menu sidebar, under CONFIGURE, click Profiles, policies > iOS.

3. On the Profiles and policies page, click Create > Import profile.

The Edit profile page is displayed.

4. Enter a name and a description for the new profile in the relevant fields.

5. Click Upload a file and navigate to the file you have saved on your computer, select it and click

Open.

6. Click Save.

The profile is created. It can be installed onto devices. See Install a profile onto devices

(page 98).

14.4 Import provisioning profiles for iOS apps

When you develop your own iOS apps, you create provisioning profiles so that your apps can be installed from an IPA file instead of the App Store. You can upload these provisioning profiles to the

Sophos Mobile server to subsequently distribute them to your devices.

For details on provisioning profiles, see the iOS Developer Library.

Note

You import provisioning profiles with the same procedure as device profiles created with Apple

Configurator. When you upload a profile file, Sophos Mobile analyzes its content in order to distinguish between the two profile types.

1. After you have generated a provisioning profile in your iOS development environment, save it on your computer.

2. On the menu sidebar, under CONFIGURE, click Profiles, policies > iOS.

3. On the Profiles and policies page, click Create > Import profile.

The Edit profile page is displayed.

4. Enter a name and a description for the new profile in the relevant fields.

5. Click Upload a file and navigate to the file you have saved on your computer, select it and click

Open.

6. Click Save.

The profile is created. It can be installed onto devices. See Install a profile onto devices

(page 98).

Sophos Mobile

14.5 About macOS policies

For Macs there are two types of policies:

• Device policy: When you assign a device policy to a Mac, the settings apply to all users that log in to the Mac, whether they are managed by Sophos Mobile or not.

• User policy: When you assign a user policy to a Mac, the settings apply to all managed users that log in to the Mac.

Managed users are:

• The local user that has enrolled the Mac with Sophos Mobile.

• All network users that are known to Sophos Mobile, i.e. users from the external LDAP directory you have configured for the Self Service Portal.

About device and user policies

• In addition to the enrollment policy (which is a device policy) you can assign one device policy and one user policy to a Mac.

• If there are conflicting configurations in a device policy and a user policy assigned to the same

Mac, the more restrictive configuration is applied.

• On the Mac, the assigned policies are listed under System Preferences > Profiles.

• When you update a device policy, the changes take effect the next time the device syncs.

• When you update a user policy, the changes take effect the next time a user logs in to the Mac.

• Users may remove the user policy from the Mac but it is automatically re-assigned the next time the user logs in.

• Users can’t remove the device policy.

• When a user removes the enrollment policy, the Mac is unenrolled from Sophos Mobile. This requires administrator privileges.

Related concepts

Configurations for macOS device policies (page 209)

Configurations for macOS user policies (page 226)

14.6 Windows password complexity rules

Password complexity rules (for example length, number of uppercase and lowercase letters) for

Windows computers are fixed and cannot be set by a Sophos Mobile policy. Different rules apply for local and for Microsoft accounts.

Local accounts

• Password must not contain the user's account name or more than two consecutive characters from the user's full name.

• Password must be six or more characters long.

Sophos Mobile

• Password must contain characters from three of the following four categories:

— Uppercase characters A-Z (Latin alphabet)

— Lowercase characters a-z (Latin alphabet)

— Digits 0-9

— Special characters (!, $, #, %, etc.)

Microsoft accounts

• Password must be eight or more characters long.

• Password must contain characters from two of the following four categories:

— Uppercase characters A-Z (Latin alphabet)

— Lowercase characters a-z (Latin alphabet)

— Digits 0-9

— Special characters (!, $, #, %, etc.)

14.7 Samsung Knox support

You can manage your Samsung Knox devices with Sophos Mobile.

To activate Samsung Knox support, you must register a Samsung Knox Premium license key with

Sophos Mobile. See

To configure the Knox container of Samsung devices, see

Configurations for Knox container profiles

(page 161).

To install apps in a Samsung Knox container, see

Add app

(page 281).

To manage your Samsung Knox devices you can create task bundles for the following actions:

• Knox container: lock

• Knox container: unlock

• Knox container: reset password

• Knox container: remove (removes the container and all related configuration from the device)

To create a task bundle for a Samsung Knox device, see Create task bundle (page 269).

14.8 Placeholders in profiles and policies

Profiles and policies may contain placeholders which are replaced by actual data at the time of task execution.

The following placeholders can be used:

• Placeholders for user data:

— %_EMAILADDRESS_%

— %_USERNAME_%

• Placeholders for device properties:

Sophos Mobile

— %_DEVPROP(property name)_% property name can be either a standard property or a custom property of the device. See

Custom device properties (page 63).

• Placeholders for customer properties:

— %_CUSTPROP(property name)_%

See

Create customer properties (page 25).

For macOS, user data is replaced as follows:

• For the local Mac user, the data of the Sophos Mobile user assigned to the device is used.

• For network users, the data of the LDAP user account is used.

14.9 Install a profile onto devices

1. On the menu sidebar, under CONFIGURE, click Profiles, policies and then click one of the device platforms that support profiles:

• Android

• iOS

The Profiles and policies page for the selected platform is displayed.

2. Click the blue triangle next to the profile to be installed and then click Install.

The Select devices page is displayed.

3. On this page, you can:

• Select individual devices onto which you want to install the profile.

• Click Select device groups and select one or several device groups.

4. After you have made your selection, click Next.

The Set execution date page is displayed.

5. Under Scheduled date, select Now or specify a date and time for the execution of the task.

6. Click Finish.

The Task view page is shown.

The profile is installed onto the selected devices at the specified date and time.

Tip

You can also install a profile by using one of the following options:

• To update a profile on all devices on which the profile is installed: On the Profiles and

policies page, click the blue triangle next to the profile and then click Update devices.

• To install a profile on a single device: On the device’s Show device page, select the Profiles tab and click Install profile.

• To install a profile on several devices: On the Devices page, select the required devices and then click Actions > Install profile.

• To install a profile on one or more devices as part of a task bundle: Add an Install profile task to the task bundle and transfer it to the required devices or device groups.

Sophos Mobile

14.10 Assign a policy to devices

1. On the menu sidebar, under CONFIGURE, click Profiles, policies, and then click a device platform.

2. Click the blue triangle next to a policy and then click Assign.

3. On the Select devices page, you can:

• Select individual devices you want to assign the policy to.

• Click Select device groups and select one or several device groups for assigning the policy.

4. Click Finish.

The policy is assigned to the selected devices.

Note

Sophos Mobile can’t remove policies from devices. To disable a policy, replace it by an empty policy.

Tip

You can also assign a policy by using one of the following options:

• To assign a policy to a single device: On the device’s Show device page, select the Policies tab and click Assign policy.

• To assign a policy to several devices: On the Devices page, select the required devices and then click Actions > Install profile or assign policy.

• To assign a policy to one or more devices as part of a task bundle: Add an Install profile or

assign policy task to the task bundle and transfer it to the required devices or device groups.

14.11 Uninstall profile

Use one of the following procedures to uninstall a profile from devices:

• To uninstall a profile from a single device: On the device's Show device page select the Profiles tab. Click the blue triangle next to the profile you want to remove and then click Uninstall.

• To uninstall a profile from all devices it’s installed on: On the Profiles and policies page for a platform, click the blue triangle next to the profile you want to remove and then click Uninstall.

• To uninstall a profile from selected devices: Create a task bundle with an Uninstall Profile task and transfer it to the required devices or device groups.

14.12 Download profiles and policies

You can download profiles and policies. This is useful, for example if you need to pass the settings on to Sophos Support.

1. On the menu sidebar, go to Profiles, policies and click a device platform.

2. Click the blue triangle next to a profile or policy and click Download.

The profile or policy is saved to your computer.

Sophos Mobile

100

14.13 Configurations for Android device profiles

With an Android device profile you configure various aspects of Android devices, like password policies, restrictions or Wi-Fi settings.

For information on how to create a device profile, see

Create profile or policy (page 94).

14.13.1 Password policies configuration (Android device profile)

With the Password policies configuration you define requirements for the display lock password.

Note

The settings supported may depend on the version of the operating system or on other device features. This is indicated by blue labels in Sophos Mobile Admin.

Password type

In the Password type list, select the type of password users are allowed to configure:

Setting/Field

Pattern, PIN or password

Simple password

PIN or password

Alphanumeric password

Complex password

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.

No additional restrictions are imposed.

Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Password screen lock. The password must contain both letters and digits.

You can define a minimum length. See the following table.

Users must set a Password screen lock.

The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.

If you select Simple password, PIN or password, Alphanumeric password or Complex

password, the following fields are displayed:

Sophos Mobile

Setting/Field Description

Minimum password length The minimum number of characters a password must contain.

Maximum idle time before password prompt The time after the device is locked if it has not been used. The device can be unlocked by entering the password.

Note

The device might impose a shorter time period than what you configure here.

Maximum password age in days

Maximum sign-in attempts

Password history

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

The device is wiped after this number of incorrect sign-in attempts.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

If you select Complex password, the following additional fields are displayed:

Setting/Field

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

Minimum number of non-alphabetic characters

Minimum number of digits

Minimum number of special characters

Description

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

The minimum number of non-alphabetic characters (for example & or !) a password must contain.

The minimum number of numerals a password must contain.

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

Sophos Mobile

Biometric authentication

Setting/Field

Allow fingerprint authentication

Allow iris authentication

Description

If supported by the device, the user can use fingerprint authentication to unlock the device.

If supported by the device, the user can use iris authentication to unlock the device.

102

14.13.2 Restrictions configuration (Android device profile)

With the Restrictions configuration you define restrictions for devices.

Security

Setting/Field

Force encryption

Force SD card encryption

Allow fast encryption

Allow factory reset

Allow "Developer options"

Allow safe mode

Allow USB debugging

Allow firmware recovery

Description

Users must encrypt their devices.

When the profile is installed onto a device, the user must encrypt the SD card.

Note

For some device types, users can choose to cancel the encryption. They will be reminded again on the next SD card mount.

Users can change the fast encryption options in the device settings.

Users can reset their devices to factory state.

Users can change the developer options.

Users can boot the device in safe mode.

Users can turn on USB debugging.

Note

For Sony devices with Enterprise API version 9 or above, clearing the Allow USB debugging check box makes all developer options unavailable.

All types of firmware updates (like over-the-air, download etc.) are allowed.

Setting/Field

Allow backup

Allow settings changes

Allow clipboard

Enable shared clipboard

Allow screen capture

Allow mock GPS locations

Allow over-the-air firmware updates

Allow audio recording

Allow video recording

Allow Activation Lock

Allow S Beam

Allow S Voice

Allow "Share via"

Sophos Mobile

Description

Users can create system backups.

If the check box is cleared, Google backup is turned off but other backup methods (for example Sophos Mobile backups) remain available.

Users can change device settings.

Note

You must turn this on for Samsung devices on which you want to configure a Knox container.

Users can copy any contents to the clipboard.

Allows users to copy clipboard content between apps.

If the check box is cleared, each app has an individual clipboard.

This setting is only available if you select Allow

clipboard.

Users can take a screenshot of the display.

Users can select a mock location app in the Android developer options.

Over-the-air firmware updates are allowed.

Users can perform audio recording.

Users can record videos.

If the check box is cleared, users can still take pictures and stream videos.

Users can change the Activation Lock options in the device settings.

Users can start the Samsung S Beam app.

Users can start the Samsung S Voice app.

The Share via feature is available.

Sophos Mobile

Accounts

Setting/Field

Allow multiple user accounts

Allow adding email accounts

Allow removal of the Google account

Allow auto-sync for Google accounts

Description

If the check box is cleared, multi-user support is turned off. Users or other apps cannot create additional user accounts.

If the check box is cleared, users cannot add email accounts.

This does not affect the account creation through a device profile.

If the check box is cleared, users cannot remove the

Google account from the device.

If the check box is cleared, Google accounts are not synchronized automatically. Users are still able to perform a manual sync from inside some apps like

Gmail.

Network and communication

Setting/Field

Allow airplane mode

Allow sync while roaming

Allow emergency calls only

Force manual sync during roaming

Force mobile data connection

Allow SMS

Allow mobile data connection while roaming

Allow voice calls while roaming

Description

If the check box is cleared, users cannot enable airplane mode.

If the check box is cleared, synchronization while roaming is turned off.

Only emergency calls are allowed. All other calls will be blocked.

Automatic data synchronization is turned off when the device is roaming. This affects all configured accounts, such as Google or Exchange.

Users cannot turn off cellular data.

If the check box is cleared, users cannot send text messages.

If the check box is cleared, mobile data connections while roaming are turned off.

If the check box is cleared, voice calls while roaming are turned off.

Setting/Field

Allow user mobile data limit

Allow VPN

Allow Wi-Fi Direct

Allow Android Beam

Allow Miracast policy

Allow Bluetooth

Allow Advanced Audio Distribution

Profile (A2DP)

Allow Audio/Video Remote Control

Profile (AVRCP)

Allow Hands-Free Profile (HFP)

Allow Headset Profile (HSP)

Allow Phone Book Access Profile

(PBAP)

Allow Serial Port Profile (SPP)

Allow NFC

Allow Wi-Fi

Sophos Mobile

Description

If the check box is cleared, users cannot set a mobile data limit.

If the check box is cleared, users cannot use VPN connections.

If the check box is cleared, data transfer through Wi-Fi

Direct is turned off.

If the check box is cleared, data transfer through

Android Beam is turned off. This includes the Samsung

S Beam app.

If the check box is cleared, data transfer through

Miracast is turned off.

If the check box is cleared, Bluetooth is turned off.

To allow individual Bluetooth profiles, first select the Allow Bluetooth check box and then select the profiles you want to allow.

If the Allow Bluetooth check box is cleared, the settings have no effect, i.e. all profiles are forbidden.

If the check box is cleared, NFC (near-field communication) is turned off.

If the check box is cleared, Wi-Fi is turned off.

Tethering

Setting/Field

Allow tethering

Description

If the check box is cleared, all tethering is turned off.

This includes tethering over Wi-Fi, USB and Bluetooth.

Note

If the check box is cleared, the settings Allow Wi-

Fi tethering, Allow USB tethering and Allow

Bluetooth tethering have no effect.

Sophos Mobile

Setting/Field

Allow Wi-Fi tethering

Allow USB tethering

Allow Bluetooth tethering

Allow configuring Wi-Fi tethering

Description

If the check box is cleared, Wi-Fi tethering (Wi-Fi

hotspot) is turned off.

If the check box is cleared, USB tethering is turned off.

If the check box is cleared, Bluetooth tethering is turned off.

The user can configure the settings of the Wi-Fi hotspot.

Hardware

Setting/Field

Allow camera

Allow camera on lock screen

Force GPS for location queries

Allow SD card

Allow moving apps to the SD card

Allow writing to unencrypted SD card

Allow microphone

Allow USB

Allow USB media player

Allow power saving mode

Description

If the check box is cleared, the camera is unavailable.

If the check box is cleared, the camera is unavailable when the screen is locked.

To allow the camera on the lock screen you must also select the Allow camera option.

GPS information is used for device location.

If the check box is cleared, SD cards cannot be used in devices.

If the check box is cleared, users cannot move apps from the internal storage to the SD card.

If the check box is cleared, it is not possible to write to unencrypted SD cards.

If the check box is cleared, the microphone is unavailable.

The USB mass storage mode and the USB media device mode (MTP) are available on the device.

If the check box is cleared, the Media Transfer

Protocol (MTP) is unavailable. Because Android uses

MTP for USB file transfer, any file transfer over USB is blocked.

If the check box is cleared, the device doesn’t enter power saving mode.

Setting/Field

Allow USB host storage

Sophos Mobile

Description

All external storage devices the user connects are mounted. This includes portable USB storage devices, external HD drives and SD card readers.

If the check box is cleared, external storage devices are not mounted.

Applications

Setting/Field

Allow app install

Allow app uninstall

Allow unsigned app install

Allow Play Store

Allow apps from unknown sources

Allow native browser

Allow app crash reports

Allow wallpaper change

Show caller info

Allow autofill in browser

Allow cookies in browser

Description

If the check box is cleared, users cannot install apps.

If the check box is cleared, users cannot uninstall apps.

If the check box is cleared, users can only install signed APK files.

If the check box is cleared, the Google Play Store app is unavailable.

If the check box is cleared, users can only install apps through the Google Play Store app.

If the check box is cleared, the native browser is unavailable. Third-party browser apps are not affected.

If the check box is cleared, apps cannot send crash reports.

If the check box is cleared, users cannot change the wallpaper.

If the check box is cleared, caller details are not displayed for incoming phone calls. All callers are displayed as “unknown”.

The user can enable autofill in the settings of the native Android browser. If enabled, web pages can provide suggestions when the user is filling in form data.

If the check box is cleared, autofill is turned off and the browser setting is unavailable.

The user can enable cookies in the settings of the native Android browser. If enabled, web pages can store cookies on the device.

If the check box is cleared, cookies are turned off and the browser setting is unavailable.

107

Sophos Mobile

Setting/Field

Allow JavaScript in browser

Allow pop-ups in browser

Description

The user can enable JavaScript in the settings of the native Android browser. If enabled, web pages can execute JavaScript code on the device.

If the check box is cleared, JavaScript is turned off and the browser setting is unavailable.

The user can enable pop-ups in the settings of the native Android browser. If enabled, web pages can open new browser windows.

If the check box is cleared, pop-ups are turned off and the browser setting is unavailable.

Allow changing date and time settings The user can change the date and time settings.

Allowed apps / Forbidden apps You can configure either Allowed apps or Forbidden

apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.

App installations initiated by the Sophos Mobile server are not restricted by this setting.

For information on creating app groups, see

App groups

(page 300).

14.13.3 Knox Premium restrictions configuration (Android device profile)

With the Knox Premium restrictions configuration you define restrictions for Samsung Knox devices.

These restrictions apply to the device, not to the Knox container.

Note

To enforce the Knox Premium restrictions, you must register a Samsung Knox Premium license with Sophos Mobile, and the device must support the Knox Premium SDK 2.x.

Option

Allow firmware auto update options

Enable ODE Trusted Boot verification

Description

The device automatically checks for firmware updates. Users cannot change this in the device settings.

The device decrypts the data partition on boot only if the binary and the kernel are official, i.e. if the device is not rooted.

If the check box is cleared, the device always decrypts the data partition on boot.

Sophos Mobile

Option

Prevent installation of another administrator app

Prevent activation of another administration app

Allow Common Criteria mode

Description

The installation of apps that require device administrator privileges is prevented. This does not affect apps that are installed by Sophos

Mobile.

The activation of device administrator privileges for apps is prevented.

The Common Criteria mode (CC mode) of the device is turned on, ensuring that the device meets the security requirements stated by the

Mobile Device Fundamentals Protection Profile

(MDFPP).

Note: CC mode is only used if the following additional requirements are met:

• Device encryption is turned on.

• Fast encryption is turned off.

• External storage encryption is turned on.

• The number of failed login attempts until device wipe is set.

• Certificate revocation is turned on.

• Password history is turned off.

14.13.4 Exchange account configuration (Android device profile)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server.

Setting/Field

Account name

Exchange server

Description

The account name.

The Exchange server address.

Note

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

Domain

User

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

Sophos Mobile

Setting/Field

Email address

Sender

Password

Synchronization period

Synchronization interval

SSL/TLS

Default account

Allow all certificates

Client certificate

Allow forwarding emails

Allow use of HTML format

Maximum attachment size in MB

Synchronize content types

Description

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

A sender name for this account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

The account is used as the default email account.

Allow all certificates in transfer processes from the email server.

The client certificate for the connection to the

Exchange server.

Allow forwarding of emails.

Allow the use of HTML format in emails.

The maximum size of a single email message (1,

3, 5, 10, Unlimited).

The content types to be synchronized.

Note

On devices with LG GATE, Samsung Knox, or Sony Enterprise API, the email app is configured automatically. On other Android devices, users receive a message to configure the email app. The configuration details are available in the Sophos Mobile Control app.

Sophos Mobile

Note

For Sony devices with Enterprise API version 6.x or below, it is important that the Exchange account information matches the user that is assigned to the device.

On these devices, the Sophos Mobile Control app is not able to send the ActiveSync ID to the

Sophos Mobile server. When the device contacts the EAS proxy for the first time, the ActiveSync

ID that the email client sends is not known to Sophos Mobile. To verify the account details, the EAS proxy searches for a device with an unknown ActiveSync ID and an assigned user that matches the user information supplied by the email client. If such a device is found, the ActiveSync ID is assigned to that device and the email request is passed on to the Exchange server. Otherwise, the request is rejected.

For details, see Sophos knowledge base article 121360 .

14.13.5 Wi-Fi configuration (Android device profile)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Security type

Phase 2 authorization

Identity

Anonymous identity

Description

The ID of the Wi-Fi network.

The security type of the Wi-Fi connection:

• None

• WEP

• WPA/WPA2 PSK

• EAP/PEAP

• EAP/TLS

• EAP/TTLS

The authentication method for phase 2 of the

EAP negotiation:

• None

• PAP

• CHAP

• MSCHAP

• MSCHAPv2

This field is available for EAP/PEAP and EAP/

TTLS connections.

The user identity.

This field is available for EAP connections.

The pseudonym identity sent unencrypted in phase 1 of the EAP negotiation.

This field is available for EAP connections.

Sophos Mobile

Setting/Field

Password

Identity certificate

Trusted certificate

Proxy server and port

Description

The password for the Wi-Fi network.

The identity certificate for the connection to the

Wi-Fi network.

The list includes all certificates from Client

certificate configurations of the current policy.

This field is available for EAP connections.

The root CA for the certificate of the EAP server.

The list includes all certificates from Root

certificate configurations of the current policy.

This field is available for EAP connections.

The name or IP address and the port number of a proxy server for the Wi-Fi connection.

14.13.6 App Protection configuration (Android device profile)

With the App Protection configuration you define password requirements for protecting apps.

With App Protection in use, users must create a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.

If App Protection is active on a device, the command Reset App Protection password is available in the Actions menu of the Show device page. The user can also reset the App Protection password in the Self Service Portal.

Setting/Field

Password complexity

Grace period in minutes

App group

Allow fingerprint authentication

Description

The minimum complexity requirements for the password to be defined by users.

After the grace period has expired, protected apps can only be unlocked by entering a password.

Select the app group containing the apps that are password protected.

For creating app groups, see

App groups

(page

300).

Users can use their fingerprint to unlock a protected app.

Sophos Mobile

14.13.7 App Control configuration (Android device profile)

With the App Control configuration you define apps that users are not allowed to start. For example, you can use this to block apps that have been pre-installed by the device manufacturer and cannot be uninstalled.

Setting/Field

App group

Description

Select the app group containing the blocked apps.

For information on creating app groups, see

App groups

(page 300).

14.13.8 App permissions configuration (Android)

With the App permissions configuration you configure what happens when an app requests a permission at runtime.

Setting/Field

App-specific runtime permissions

Description

You can grant or deny certain runtime permissions for individual apps. Click Add and then configure the settings for an app:

In the App ID field, enter the internal identifier of the app.

For each runtime permission, select the desired grant state:

• Selectable: The user can grant or deny the permission.

• Granted: Permission is granted and cannot be denied by the user.

• Denied: Permission is denied and cannot be granted by the user.

14.13.9 Kiosk mode configuration (Android device profile)

With the Kiosk mode configuration you define restrictions for devices to put them into a kiosk mode.

Click Select source and then do one of the following to specify an app that is started when the profile is transferred to a device:

• Select Custom and enter an app identifier.

• Select App list and then select an app from the App identifier list. The list contains all apps that

you have configured on the Apps page. See Add app

(page 281).

• Select No app to configure kiosk mode without specifying an app. The kiosk mode restrictions are applied to the device, but no app is started.

Under Options, deselect hardware and software features you want to disable in kiosk mode.

Sophos Mobile

When the profile is transferred to a device, the app that you specified is started. However, if you have not turn off any of the available hardware or software features, the user will be able to leave the app and use the device as normal. To set the device into a true kiosk mode, you must clear at least the Allow Home button and Allow task manager check boxes.

Note

• The app that you specify must be installed on the device. If it is not, the transfer tasks will remain in state Incomplete until the app is installed. To install the app, create a task bundle with an Install app task, for example, and transfer it to your devices.

• For Sony devices with Enterprise API version 9 or above, if you clear any of the Allow

volume up, Allow volume down or Allow volume mute check boxes, all volume buttons of the device are disabled.

14.13.10 Access Point Name configuration (Android device profile)

With the Access Point Name configuration you specify an Access Point Name (APN) configuration for mobile devices. APN configurations define how devices connect to a mobile network.

Important

We recommend that you ask your carrier for the required settings. If you select Use as default

APN and the settings are not correct, the device cannot access data through cellular networks.

Note

With the exception of the APN field, all settings are optional and should only be specified if required by your mobile network carrier.

Setting/Field

APN

User-friendly name

Proxy server and port

User name, User password

Server

MMSC

Description

The APN that the device quotes when it opens a connection with the carrier.

This must match an APN that the carrier accepts. Otherwise, the connection cannot be established.

An optional name that is displayed on the device in addition to the APN.

The address and port of the HTTP server that is used for web traffic.

A user name and password for connecting to the APN.

The WAP Gateway Server.

The Multimedia Messaging Service Center

(MMSC).

Sophos Mobile

Setting/Field

MMS proxy server and port

Mobile Country Code (MCC), Mobile Network

Code (MNC)

Description

The address and port of a HTTP server that is used for communication with the MMSC.

MCC and MNC for specifying the carrier.

The APN is only used for this carrier.

Authentication type

APN type

Bearer

Protocol

The authentication method for PPP connections.

The types of data connection that this APN is used for.

To use the APN for all data types, enter * or leave the field empty.

The Radio Access Technology (RAT) that the carrier uses.

The network protocol that is supported by the carrier.

Roaming protocol

Use as default APN

The network protocol that is supported by the carrier when in roaming mode.

If selected, devices will use this APN as default.

An error is raised when you try to select this option in more than one Access Point Name configuration.

14.13.11 VPN configuration (Android device profile)

With the VPN configuration you define VPN settings for network connections.

Setting/Field Description

Connection name The name of the connection shown on the device.

Server The host name or the IP address of the server.

Sophos Mobile

Setting/Field

Connection type

Description

The type of the VPN connection:

• L2TP/IPsec (PSK)

If you select this type, the fields User, Password and L2TP/IPsec

(PSK) are displayed. Enter the user and password. In the L2TP/IPsec

(PSK) field, enter the pre-shared key for authentication.

• L2TP/IPsec (certificate)

If you select this type, the fields Client certificate, Root certificate,

User and Password are displayed. In the fields Client certificate and

Root certificate, select the relevant certificates. In addition, enter the

User and the relevant Password.

• Cisco AnyConnect

If you select this type, you can upload XML files with an AnyConnect

VPN profile and/or an NVM (Network Visibility Module) profile. See the

Cisco AnyConnect administrator guide for information on these profiles.

14.13.12 Root certificate configuration (Android device profile)

With the Root certificate configuration you install a root certificate onto devices.

In the File field, select a PKCS #12 (.pfx) certificate file and click Upload a file. The name of the certificate is shown in the Certificate name field. Enter the password for the selected certificate.

Note

The certificate you upload here is only available for this profile. If you require certificates in other profiles or policies, you have to upload them again.

14.13.13 Client certificate configuration (Android device profile)

With the Client certificate configuration you install a client certificate onto devices.

Note

The certificate you upload here is only available for this profile. If you require certificates in other profiles or policies, you have to upload them again.

Sophos Mobile

14.13.14 SCEP configuration (Android device profile)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Note

You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Alias name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the

SCEP tab of the Sophos setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in profiles and policies (page

97).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified

URL of the CA server.

Sophos Mobile

Setting/Field

AD user logon name

Challenge

Root certificate

Key size

Use as digital signature

Use for encryption

Description

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the

SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current profile.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

14.14 Configurations for Android enterprise work profile policies

With an Android enterprise work profile policy you configure settings that are related to the work profile of a device. The policy can be applied to Android enterprise devices in profile owner mode.

For information on how to create an Android enterprise work profile policy, see

Create profile or policy (page 94).

14.14.1 “Password policies - Device” configuration (Android enterprise work profile policy)

With the Password policies - Device configuration you define requirements for the display lock password.

118

Password type

In the Password type list, select the type of password users are allowed to configure:

Sophos Mobile

Setting/Field

Pattern, PIN or password

Simple password

PIN or password

Alphanumeric password

Complex password

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.

No additional restrictions are imposed.

Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Password screen lock. The password must contain both letters and digits.

You can define a minimum length. See the following table.

Users must set a Password screen lock.

If you select Simple password, PIN or password, Alphanumeric password or Complex

password, the following fields are displayed:

Setting/Field

Minimum password length

Description

The minimum number of characters a password must contain.

Maximum idle time before password prompt The time after the device is locked if it has not been used. The device can be unlocked by entering the password.

Note

The device might impose a shorter time period than what you configure here.

Maximum password age in days

Maximum sign-in attempts

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

The device is wiped after this number of incorrect sign-in attempts.

Sophos Mobile

Setting/Field

Password history

Description

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

If you select Complex password, the following additional fields are displayed:

Setting/Field

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

Minimum number of non-alphabetic characters

Minimum number of digits

Minimum number of special characters

Description

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

The minimum number of non-alphabetic characters (for example & or !) a password must contain.

The minimum number of numerals a password must contain.

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

14.14.2 “Password policies - Work profile” configuration

(Android enterprise work profile policy)

With the Password policies - Work profile configuration you define requirements for the work profile password. The user must enter that password to open an app when the work profile is locked.

Note

The settings supported may depend on the version of the operating system or on other device features. This is indicated by blue labels in Sophos Mobile Admin.

Password type

In the Password type list, select the type of password users are allowed to configure:

Setting/Field

Pattern, PIN or password

Simple password

PIN or password

Alphanumeric password

Complex password

Weak biometric recognition

Sophos Mobile

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.

No additional restrictions are imposed.

Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Password screen lock. The password must contain both letters and digits.

You can define a minimum length. See the following table.

Users must set a Password screen lock.

Users are allowed to use weak biometric recognition methods, like face recognition, to unlock the work profile.

Note

Weak biometric recognition methods provide similar security as a 3-digit PIN.

This means that unauthorized unlocking might happen in 1 of 1000 attempts.

If you select Simple password, PIN or password, Alphanumeric password or Complex

password, the following fields are displayed:

Setting/Field

Minimum password length

Description

The minimum number of characters a password must contain.

Maximum idle time before password prompt The time after the work profile is locked if it has not been used. The profile can be unlocked by entering the password.

Note

The device might impose a shorter time period than what you configure here.

Sophos Mobile

Setting/Field

Maximum password age in days

Maximum sign-in attempts

Password history

Description

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

The work profile is deleted after this number of incorrect sign-in attempts.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

If you select Complex password, the following additional fields are displayed:

Setting/Field

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

Minimum number of non-alphabetic characters

Minimum number of digits

Minimum number of special characters

Description

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

The minimum number of non-alphabetic characters (for example & or !) a password must contain.

The minimum number of numerals a password must contain.

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

Sophos Mobile

14.14.3 Restrictions configuration (Android enterprise work profile policy)

With the Restrictions configuration you configure restrictions and related settings for Android work profiles.

Security

Setting/Field

Allow screen capture

Description

Users can capture the screen content of apps installed in the work profile.

Allow user to configure credentials

Allow work clipboard in personal apps Users can copy text from an app in the work profile and paste it into a personal app.

Pasting clipboard text from a personal app into an app in the work profile is always possible.

Allow Smart Lock

Users can install or remove certificates in the work profile.

Users can turn on the Android Smart Lock feature that automatically unlocks the device in certain situations.

Note

This setting affects the device lock. It is ignored if there is also a work profile lock configured.

Allow location sharing

Allow opening web links in personal apps

Allow debugging

Allow unlocking device by fingerprint

Allow work contact info for personal calls

Allow work contact info for Bluetooth devices

Apps in the work profile can access the device’s location features.

If the check box is cleared, apps in the work profile can’t access the device’s location features, even if the user has turned location sharing on.

Web links that the user taps in an app in the work profile can be opened by a personal browser app.

Users can turn on the debugging features in the

Android developer options.

Users can use the fingerprint sensor to unlock the device.

The personal phone app displays the caller’s name for incoming calls from work contacts.

Connected Bluetooth devices display the caller’s name for incoming personal calls from work contacts.

Sophos Mobile

Setting/Field

Allow searches of work contacts in personal profile

Description

The personal phone app includes results from work contacts when searching for caller’s names.

Accounts

Setting/Field

Allow managing accounts

Description

Users can add or remove accounts from the work profile, but not the Google account.

Network and communication

Setting/Field

Allow VPN

Allow Android Beam

Description

Users can use VPN connections for apps in the work profile.

Users can send data from apps in the work profile through Android Beam (data transfer through NFC).

Hardware

Setting/Field

Allow camera

Description

Apps in the work profile can access the camera.

Applications

Setting/Field

Allow app uninstall

Allow installing apps from unknown sources

Description

Users can uninstall apps from the work profile.

If the check box is cleared, users can only install apps in the work profile from Google Play, not from unknown sources or through Android Debug Bridge (ADB).

Sophos Mobile

Setting/Field Description

Allow managing apps If the check box is cleared, users can’t perform the following tasks for apps in the work profile:

• Uninstall apps

• Disable apps

• Stop apps

• Clear app cache

• Clear app data

• Clear setting Open by default

Allow disabling Google security scans Users can turn off the Google security setting Scan

device for security threats.

The setting is available in the Settings app, under

Google > Security > Google Play Protect.

Short message A company-specific support message that is displayed to the user when functionality has been turned off.

Note

If you enter more than 200 characters, the message may be truncated.

Long message Additional text to complement the short message. The text is displayed when the user taps More details in screens that display the short message.

Note

This text is also displayed on the Android Device

administrator screen for the Sophos Mobile

Control app.

14.14.4 Exchange account configuration (Android enterprise work profile policy)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server. These settings are applied to the Gmail app in the work profile.

Setting/Field

Account name

Description

The account name.

Sophos Mobile

Setting/Field

Exchange server

Domain

User

Email address

Sender

Synchronization period

SSL/TLS

Allow all certificates

Client certificate

Description

The Exchange server address.

Note

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

Note

The password is entered by the user.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

A sender name for this account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

Allow all certificates in transfer processes from the email server.

The client certificate for the connection to the

Exchange server.

Sophos Mobile

14.14.5 Wi-Fi configuration (Android enterprise work profile policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Security type

Phase 2 authorization

Identity

Anonymous identity

Password

Identity certificate

Description

The ID of the Wi-Fi network.

The security type of the Wi-Fi connection:

• None

• WEP

• WPA/WPA2 PSK

• EAP/PEAP

• EAP/TLS

• EAP/TTLS

The authentication method for phase 2 of the

EAP negotiation:

• None

• PAP

• CHAP

• MSCHAP

• MSCHAPv2

This field is available for EAP/PEAP and EAP/

TTLS connections.

The user identity.

This field is available for EAP connections.

The pseudonym identity sent unencrypted in phase 1 of the EAP negotiation.

This field is available for EAP connections.

The password for the Wi-Fi network.

The identity certificate for the connection to the

Wi-Fi network.

The list includes all certificates from Client

certificate configurations of the current policy.

This field is available for EAP connections.

Sophos Mobile

Setting/Field

Trusted certificate

Description

The root CA for the certificate of the EAP server.

The list includes all certificates from Root

certificate configurations of the current policy.

This field is available for EAP connections.

14.14.6 App Protection configuration (Android enterprise work profile policy)

With the App Protection configuration you define password requirements for protecting managed

Google Play apps, i.e. apps installed in the work profile.

With App Protection in use, users must create a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.

Setting/Field

Password complexity

Grace period in minutes

App group

Allow fingerprint authentication

Description

The minimum complexity requirements for the password to be defined by users.

After the grace period has expired, protected apps can only be unlocked by entering a password.

Select the app group containing the apps that are password protected.

For creating app groups, see

App groups

(page

300).

Users can use their fingerprint to unlock a protected app.

Sophos Mobile

14.14.7 App Control configuration (Android enterprise work profile policy)

With the App Control configuration you define apps that users are not allowed to start.

Setting/Field

App group

Description

Select the app group containing the blocked apps.

For information on creating app groups, see

App groups

(page 300).

14.14.8 App permissions configuration (Android enterprise work profile policy)

With the App permissions configuration you configure what happens when a managed Google Play app requests a permission at runtime.

Setting/Field

Default response for runtime permission requests

App-specific runtime permissions

Description

The default response for future runtime permission requests:

• Prompt: Apps prompt the user to grant a permission.

• Auto-accept: All runtime permission requests are automatically granted.

• Auto-deny: All runtime permission requests are automatically denied.

The user cannot change the permissions later.

You can grant or deny certain runtime permissions for individual apps. Click Add and then configure the settings for an app:

In the App identifier field, enter the internal identifier of the app.

For each runtime permission, select the desired grant state:

• Selectable: The user can grant or deny the permission.

• Granted: Permission is granted and can’t be denied by the user.

• Denied: Permission is denied and can’t be granted by the user.

Sophos Mobile

14.14.9 VPN configuration (Android enterprise work profile policy)

With the VPN configuration you select a VPN client for Android enterprise devices.

Setting/Field

VPN client

Description

The identifier of the VPN app.

The VPN client must be a managed Google Play app already installed on the device.

You configure the VPN connection in the app’s managed configuration. See the app documentation for details.

14.14.10 Root certificate configuration (Android enterprise work profile policy)

With the Root certificate configuration you install a root certificate onto devices. This certificate is available to managed Google Play apps, i.e. to apps installed in the work profile.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

14.14.11 Client certificate configuration (Android enterprise work profile policy)

With the Client certificate configuration you install a client certificate onto devices. This certificate is available to managed Google Play apps, i.e. to apps installed in the work profile.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

Sophos Mobile

14.14.12 SCEP configuration (Android enterprise work profile policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP). These certificates are available to apps that are installed in the work profile.

Note

You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Alias name

Subject

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the

SCEP tab of the Sophos setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in profiles and policies (page

97).

Sophos Mobile

Setting/Field

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Root certificate

Key size

Use as digital signature

Use for encryption

Description

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified

URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the

SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current profile.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

14.15 Configurations for Android enterprise device policies

With an Android enterprise device policy you configure various aspects of Android devices, like password policies, restrictions or Wi-Fi settings. The policy can be applied to Android enterprise devices in device owner mode.

For information on how to create an Android enterprise device policy, see Create profile or policy

(page 94).

Sophos Mobile

14.15.1 “Password policies” configuration (Android enterprise device policy)

With the Password policies configuration you define requirements for the display lock password.

Password type

In the Password type list, select the type of password users are allowed to configure:

Setting/Field

Pattern, PIN or password

Simple password

PIN or password

Alphanumeric password

Complex password

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.

No additional restrictions are imposed.

Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Password screen lock. The password must contain both letters and digits.

You can define a minimum length. See the following table.

Users must set a Password screen lock.

If you select Simple password, PIN or password, Alphanumeric password or Complex

password, the following fields are displayed:

Setting/Field

Minimum password length

Description

The minimum number of characters a password must contain.

Sophos Mobile

Setting/Field Description

Maximum idle time before password prompt The time after the device is locked if it has not been used. The device can be unlocked by entering the password.

Note

The device might impose a shorter time period than what you configure here.

Maximum password age in days

Maximum sign-in attempts

Password history

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

The device is wiped after this number of incorrect sign-in attempts.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

If you select Complex password, the following additional fields are displayed:

Setting/Field

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

Minimum number of non-alphabetic characters

Minimum number of digits

Minimum number of special characters

Description

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

The minimum number of non-alphabetic characters (for example & or !) a password must contain.

The minimum number of numerals a password must contain.

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

Sophos Mobile

14.15.2 Restrictions configuration (Android enterprise device policy)

With the Restrictions configuration you define restrictions for devices.

Security

Setting/Field

Force encryption

Allow factory reset

Allow safe mode

Allow debugging

Allow screen capture

Allow user to configure credentials

Allow Smart Lock

Description

Users must encrypt their devices.

Users can reset the device to its factory settings.

Users can boot the device in safe mode.

Users can turn on the debugging features in the

Android developer options.

Users can take a screenshot of the display.

Users can install or remove certificates.

Users can turn on the Android Smart Lock feature that automatically unlocks the device in certain situations.

Note

This setting affects the device lock. It is ignored if there is also a work profile lock configured.

Allow location sharing

Allow unlocking device by fingerprint

Allow changing the account picture

Hide sensitive information on lock screen

Users can turn on location sharing.

Users can use the fingerprint sensor to unlock the device.

Users can change the photo used for their user account.

If notifications on the lock screen are turned on, sensitive notification content is hidden.

Sophos Mobile

Setting/Field

System update policy

Description

Select when system updates are installed:

• No policy: The user decides when to install system updates.

• Install automatically: System updates are installed automatically as soon as they are available.

• Install within maintenance window: System updates are installed automatically within a daily maintenance window.

Enter start and end time of the day.

• Postpone: System updates (except for security updates) are blocked for 30 days.

Accounts

Setting/Field

Allow managing accounts

Description

Users can add or remove accounts from the device, but not the

Google account.

Network and communication

Setting/Field

Allow SMS

Allow mobile data connection while roaming

Allow VPN

Allow Android Beam

Allow Bluetooth

Allow outgoing phone calls

Allow network reset

Enable Wi-Fi settings

Allow configuring cell broadcasts

Enable cellular networks settings

Description

If the check box is cleared, users cannot send text messages.

If the check box is cleared, mobile data connections while roaming are turned off.

If the check box is cleared, users cannot use VPN connections.

Users can send data from apps through Android Beam

(data transfer through NFC).

If the check box is cleared, Bluetooth is turned off.

Users can make phone calls.

Users can reset network settings to their defaults.

Users can change the Wi-Fi settings.

Users can turn cell broadcast (CB) messages on or off in their messaging app.

Users can change the cellular network settings.

Setting/Field

Enable tethering settings

Sophos Mobile

Description

Users can change the tethering and portable hotspot settings.

Hardware

Setting/Field

Allow camera

Allow microphone

Allow external media

Enable USB storage

Allow transfering files over USB

Description

If the check box is cleared, the camera is unavailable.

If the check box is cleared, the microphone is unavailable.

Users can connect external media like USB storage to the device.

Users can connect the device in USB Mass Storage mode (USB MSC) to a host computer, i.e. as an external hard drive.

If you clear the check box, users can still connect the device in Media Transfer mode (USB MTP) or Picture

Transfer mode (USB PTP) to transfer files.

Users can transfer files between the device and external USB storage.

Applications

Setting/Field

Allow app uninstall

Allow installing apps from unknown sources

Enable system apps

Allow wallpaper change

Description

Users can uninstall apps.

If the check box is cleared, users can only install apps from Google Play, not from unknown sources or through Android Debug Bridge (ADB).

If the check box is cleared, only these apps are enabled: Google Play Store, Contacts, Messages,

Phone. Google recommends this for devices enrolled in Android enterprise device owner mode.

If you select the check box, all apps pre-installed by the manufacturer are enabled.

If the check box is cleared, users cannot change the wallpaper.

Sophos Mobile

Setting/Field Description

Allow managing apps If the check box is cleared, users can’t perform the following tasks for apps:

• Uninstall apps

• Disable apps

• Stop apps

• Clear app cache

• Clear app data

• Clear setting Open by default

Allow disabling Google security scans Users can turn off the Google security setting Scan

device for security threats.

The setting is available in the Settings app, under

Google > Security > Google Play Protect.

Allow setting date and time

Short message

Users can set the date and time.

If the check box is cleared, network date and time is used.

A company-specific support message that is displayed to the user when functionality has been turned off.

Note

If you enter more than 200 characters, the message may be truncated.

Long message

Allowed accessibility services

Additional text to complement the short message. The text is displayed when the user taps More details in screens that display the short message.

Note

This text is also displayed on the Android Device

administrator screen for the Sophos Mobile

Control app.

Restrict the list of apps that can provide accessibility services:

• If you select All available apps, users can use all accessibility services.

• If you select Only system apps, users can only use accessibility services from system apps.

• If you select an app group, users can only use accessibility services from apps within that group, and from system apps.

Sophos Mobile

14.15.3 Exchange account configuration (Android enterprise device policy)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server.

Setting/Field

Account name

Exchange server

Description

The account name.

The Exchange server address.

Note

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

Domain

User

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

Note

The password is entered by the user.

Email address

Sender

Synchronization period

SSL/TLS

Allow all certificates

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

A sender name for this account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

Allow all certificates in transfer processes from the email server.

Sophos Mobile

Setting/Field

Client certificate

Description

The client certificate for the connection to the

Exchange server.

140

14.15.4 Wi-Fi configuration (Android enterprise device policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Security type

Phase 2 authorization

Identity

Anonymous identity

Password

Identity certificate

Description

The ID of the Wi-Fi network.

The security type of the Wi-Fi connection:

• None

• WEP

• WPA/WPA2 PSK

• EAP/PEAP

• EAP/TLS

• EAP/TTLS

The authentication method for phase 2 of the

EAP negotiation:

• None

• PAP

• CHAP

• MSCHAP

• MSCHAPv2

This field is available for EAP/PEAP and EAP/

TTLS connections.

The user identity.

This field is available for EAP connections.

The pseudonym identity sent unencrypted in phase 1 of the EAP negotiation.

This field is available for EAP connections.

The password for the Wi-Fi network.

The identity certificate for the connection to the

Wi-Fi network.

The list includes all certificates from Client

certificate configurations of the current policy.

This field is available for EAP connections.

Setting/Field

Trusted certificate

Sophos Mobile

Description

The root CA for the certificate of the EAP server.

The list includes all certificates from Root

certificate configurations of the current policy.

This field is available for EAP connections.

14.15.5 App Protection configuration (Android enterprise device policy)

With the App Protection configuration you define password requirements for protecting managed

Google Play apps.

With App Protection in use, users must create a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.

Setting/Field

Password complexity

Grace period in minutes

App group

Allow fingerprint authentication

Description

The minimum complexity requirements for the password to be defined by users.

After the grace period has expired, protected apps can only be unlocked by entering a password.

Select the app group containing the apps that are password protected.

For creating app groups, see

App groups

(page

300).

Users can use their fingerprint to unlock a protected app.

Sophos Mobile

14.15.6 App Control configuration (Android enterprise device policy)

Setting/Field

App group

Description

Select the app group containing the blocked apps.

For information on creating app groups, see

App groups

(page 300).

14.15.7 App permissions configuration (Android enterprise device policy)

With the App permissions configuration you configure what happens when an app requests a permission at runtime.

Setting/Field

Default response for runtime permission requests

App-specific runtime permissions

Description

The default response for future runtime permission requests:

• Prompt: Apps prompt the user to grant a permission.

• Auto-accept: All runtime permission requests are automatically granted.

• Auto-deny: All runtime permission requests are automatically denied.

The user cannot change the permissions later.

You can grant or deny certain runtime permissions for individual apps. Click Add and then configure the settings for an app:

In the App identifier field, enter the internal identifier of the app.

For each runtime permission, select the desired grant state:

• Selectable: The user can grant or deny the permission.

• Granted: Permission is granted and can’t be denied by the user.

• Denied: Permission is denied and can’t be granted by the user.

Sophos Mobile

14.15.8 Kiosk mode configuration (Android enterprise device policy)

With the Kiosk mode configuration you define restrictions for devices to put them into a kiosk mode.

Setting/Field

Select source

App ID

App group

Allow volume change

Turn off screen lock

Stay on while charging

Description

• None: Allow all apps. The kiosk mode restrictions are applied to the device, but the user can start any app available on the device.

• Custom, App list : Lock a single app to the screen.

• App group: Allow multiple apps to appear on the screen.

The app available in kiosk mode.

Depending on your selection in Select source, either specify the app by its identifier, or select it from the list of available apps.

The apps available in kiosk mode.

Select one of the configured app groups.

If the check box is cleared, the device’s volume buttons are disabled.

The device screen is never locked.

The device screen stays on while the device is connected to a power supply.

14.15.9 Global HTTP proxy configuration (Android enterprise device policy)

With the Global HTTP proxy configuration you define a corporate proxy server.

Setting/Field

Proxy

Server and port

PAC URL

Description

Select Manually to configure the connection details manually.

Select Automatic if you have a proxy auto-config (PAC) file.

The name (or the IP address) and the port number of the HTTP proxy.

The URL of the proxy auto-config (PAC) file.

Sophos Mobile

14.15.10 VPN configuration (Android enterprise device policy)

With the VPN configuration you select a VPN client for Android enterprise devices.

Setting/Field

VPN client

Description

The identifier of the VPN app.

The VPN client must be a managed Google Play app already installed on the device.

You configure the VPN connection in the app’s managed configuration. See the app documentation for details.

14.15.11 Root certificate configuration (Android enterprise device policy)

With the Root certificate configuration you install a root certificate onto devices.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

14.15.12 Client certificate configuration (Android enterprise device policy)

With the Client certificate configuration you install a client certificate onto devices.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

Sophos Mobile

14.15.13 SCEP configuration (Android enterprise device policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Note

You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Alias name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the

SCEP tab of the Sophos setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in profiles and policies (page

97).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified

URL of the CA server.

Sophos Mobile

Setting/Field

AD user logon name

Challenge

Root certificate

Key size

Use as digital signature

Use for encryption

Description

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the

SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current profile.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

14.16 Configurations for Sophos container policies for Android

With a Sophos container policy you configure settings that are related to the Sophos container apps

Sophos Secure Email and Sophos Secure Workspace.

For information on how to create a Sophos container policy, see

Create profile or policy (page

94).

Note

When you assign this policy to an Android enterprise device, this also installs the Sophos Secure

Workspace app. If the policy also contains a Work email configuration, the Sophos Secure Email app is also installed. You must have approved these apps in managed Google Play.

Sophos Mobile

14.16.1 General configuration (Android Sophos container policy)

With the General configuration you define settings that apply to all Sophos container apps, if applicable.

Setting/Field

Enable Sophos container password

Password complexity

Always hide characters in password entry fields

Password age in days

Failed logins until lock

Allow fingerprint

Description

Users must enter an additional password to be able to start a Sophos container app. The password has to be defined when the first container app is started after the configuration has been applied. This password applies to all container apps.

The required minimum complexity of the

Sophos container password. More secure passwords are always allowed. Passwords (a mix of numeric and alphanumeric characters) are always seen as more secure than PINs

(numeric characters only).

• Any: Sophos container passwords do not have restrictions.

• 4 digit PIN

• 6 digit PIN

• 4 char password

• 6 char password

• 8 char password

• 10 char password

Characters in password entry fields are not briefly displayed before they are masked.

The number of days that a password can be used before users are prompted to change it.

The number of failed login attempts that are tolerated before the container apps are locked.

Once they are locked an administrator needs to unlock the apps or, if allowed, users can use the

Self Service Portal to do so.

Users can use their fingerprint to unlock the app.

Sophos Mobile

Setting/Field

Grace period in minutes

Lock on device lock

Last server connect

Description

The period of time within which no Sophos container password must be entered when a container app comes to the foreground again.

The grace period applies to all container apps.

You can switch between the apps during the grace period without entering a password.

When the device is locked, the Sophos container is locked as well.

If the check box is cleared, the container is locked only after the grace period has expired.

The period of time within users can use a

Sophos container app without a connection to the Sophos Mobile server.

When a Sophos container app becomes active and does not have contact with the server within the defined period of time, a lock screen will be displayed. Users can only unlock the app by tapping Retry on the lock screen. The app will then try to connect to the server. If the connection can be established, the app will be unlocked. If not, access will be denied.

• On access: Server connection is always required and the app is locked when the server cannot be reached.

• 1 hour: Server connection is required when the app becomes active one hour or more after the last successful server connection.

• 3 hours

• 6 hours

• 12 hours

• 1 day

• 3 days

• None: No regular contact is required.

Sophos Mobile

Setting/Field

Offline starts without server connection

Description

In this field you define how often users can start one of the Sophos container apps without a server connection.

Note

This setting requires the Sophos container password feature to be turned on.

Root access allowed

A counter is incremented whenever users enter the Sophos container password. If the counter exceeds the defined number, the same lock screen as for the Last server connect setting will be displayed. The counter will be reset if a connection to the Sophos Mobile server is established.

• Unlimited: No server connection is required.

• 0: Starting the app without a server connection is not possible.

• 1: After one start of the app, a successful server connection is necessary.

• 3

• 5

• 10

• 20

Container apps are allowed to run on rooted devices.

App usage constraints

Here you can define constraints on using the Sophos container apps. Click Add to enter constraints.

Geo-fencing

Time-fencing

Lets you add latitude and longitude and a radius within which the Sophos container apps can be used.

Lets you specify a start and end time within which the Sophos container apps can be used.

Days of the week on which the apps can be used can be specified as well.

Sophos Mobile

Setting/Field

Wi-Fi fencing

Description

If you select Wi-Fi connection required, the

Sophos container is locked when there is no active Wi-Fi connection.

If you add Wi-Fi networks to the list, the

Sophos container is locked when the device is connected to a Wi-Fi network not listed.

Important

We recommend that you do not rely on Wi-Fi fencing as the only security mechanism because

Wi-Fi names can be spoofed very easily.

14.16.2 Corporate Email configuration (Android Sophos container policy)

With the Corporate Email configuration you define user settings for your Microsoft Exchange Server.

These settings are applied to the Sophos Secure Email app if it is installed in the Sophos container.

Setting/Field

Exchange server

Description

The Exchange server address.

Note

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

User

Email address

Domain

Support contact email

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The domain for this account.

The email address that will be used as the

"Contact Support" email address.

Export company names

Notification details

Deny copy to clipboard

Deny screenshots

Maximum email size

Allow viewing/sharing

Setting/Field

Export contacts to device

Sophos Mobile

Description

Users are allowed to export the Exchange contacts to the local device contacts, so that they can identify company contacts in incoming calls.

Sophos Secure Email keeps the information synchronized.

Note

The local contact information is automatically deleted in the following situations:

• When the Corporate Email configuration is removed from the

Sophos container policy (requires a restart of the Secure Email app).

• When the Sophos container is removed from the device.

• When the device is unenrolled from

Sophos Mobile.

The company name is included in the export of company contacts to the local device contacts.

When the check box is cleared, only name and phone number are exported.

Select the amount of information that is displayed in email notifications.

This setting also affects event reminders. If you select No notifications, event reminders are turned off. If you select any other value, event reminders are turned on and include time, location and title information.

Users cannot copy or cut texts from the Sophos

Secure Email app.

Users can’t take screenshots that show the

Sophos Secure Email app.

Email messages that are larger than the size you select (including attachments) are not retrieved from the Exchange server.

Users are allowed to view or share email attachments.

151

Sophos Mobile

Setting/Field

View attachments

Share attachments

Extra settings

Description

Select whether attachments can be viewed in all apps or only in the Sophos container apps

Sophos Secure Workspace and Sophos Secure

Email.

With all apps: Attachments can be shared with all apps that support the file format.

With container apps: Attachments are encrypted with a device key and can only be opened in Sophos Secure Workspace. The sharing action itself is not blocked.

Only configure these settings if instructed by

Sophos Support.

Note

If Sophos Secure Email isn’t installed, users receive a message to install it. When they start the app for the first time, it’s configured automatically.

14.16.3 Corporate Documents configuration (Android Sophos container policy)

With the Corporate Documents configuration you define settings for the Corporate Documents feature of the Sophos Secure Workspace app.

Configure storage providers

For each storage provider you can define the following settings separately:

Setting/Field

Enable

Offline

Open in (encrypted)

Open in (unencrypted)

Clipboard

Description

The storage provider is available in the app.

Users are allowed to add files from the storage provider to the app's Favorites list for offline use.

Users can share encrypted files with other apps via Open In.

Users can share unencrypted files with other apps via Open In.

Users can copy parts of a document and paste them into other apps.

Sophos Mobile

Enterprise provider settings

For WebDAV provider, also referred to as enterprise provider, you can centrally define server settings and login credentials. These cannot be changed by users.

Credential settings that you do not define centrally can be chosen by the users in the app's provider credential screens.

For example you can centrally define the server and user account to be used but you can leave the password field undefined. Users then would have to know the password when accessing the storage provider.

Setting/Field

Name

Server

User name

Password

Upload folder

Description

The name of the provider that is displayed in the

Sophos Secure Workspace app.

In this field, enter:

• The URL of the root folder on the

Corporate Documents WebDAV server.

• The URL of the root folder on the WebDAV server.

Use the following format: https:// server.company.com

Only the https protocol is supported.

The user name for the relevant server. You can also use the %_USERNAME_% variable.

The password for the relevant account.

The upload folder for the relevant account.

Other settings

Setting/Field

Enable Documents

Description

This turns on the Documents feature to securely distribute company documents.

Sophos Mobile

Setting/Field

Passphrase complexity

Deny screenshots

Extra settings

Description

The required minimum complexity of passphrases for encryption keys. More secure passphrases are always allowed.

You can select the following settings:

• 4 char password

• 6 char password

• 8 char password

• 10 char password

Users can’t take screenshots that show the

Sophos Secure Workspace app.

Only configure these settings if instructed by

Sophos Support.

14.16.4 Corporate Browser configuration (Android Sophos container policy)

With the Corporate Browser configuration you define settings for the Corporate Browser feature of the

Sophos Secure Workspace app.

The Corporate Browser allows you to securely access corporate intranet pages and other allowed pages. You can define domains and bookmarks within a domain.

Every bookmarks belongs to a certain domain. When you add a bookmark, the domain entry is created automatically if it does not exist.

General settings

Setting/Field

Deny screenshots

Description

Users can’t take screenshots that show the

Corporate Browser.

154

Domain settings

Setting/Field

URL

Allow copy/paste

Allow open with

Description

The domain that you want to allow.

Users can copy and paste text from the

Corporate Browser to other apps.

Users can download attachments or pass them on to other apps.

Setting/Field

Allow save password

Sophos Mobile

Description

Users can save their passwords in the

Corporate Browser.

Bookmark settings

Setting/Field

Name

URL

Description

The name for the bookmark.

The web address for the bookmark.

14.16.5 Root certificate configuration (Android Sophos container policy)

With the Root certificate configuration you install a root certificate onto devices. This certificate is available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the

Sophos container.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

14.16.6 Client certificate configuration (Android Sophos container policy)

With the Client certificate configuration you install a client certificate onto devices. This certificate is available to the Sophos Secure Workspace app if it’s installed in the Sophos container.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

Sophos Mobile

156

14.16.7 SCEP configuration (Android Sophos container policy)

Corporate Browser feature of the Sophos Secure Workspace app.

Note

You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.

Setting/Field

URL

Alias name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the

SCEP tab of the Sophos setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in profiles and policies (page

97).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified

URL of the CA server.

Setting/Field

AD user logon name

Challenge

Root certificate

Key size

Use as digital signature

Use for encryption

Sophos Mobile

Description

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the

SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current profile.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

14.17 Configurations for Mobile Security policies for

Android

With a Mobile Security policy you configure the Sophos Mobile Security app.

For information on how to create a Mobile Security policy, see Create profile or policy

(page 94).

Note

When you assign this policy to an Android enterprise device, this also installs the Sophos Mobile

Security app. You must have approved this app in managed Google Play.

Sophos Mobile

14.17.1 Network configuration (Sophos Mobile Security policy for Android)

With the Network configuration you manage the network settings of the Sophos Mobile Security app that protects users from network-based threats.

Note

When you assign this configuration to a device, the corresponding settings in the Sophos Mobile

Security app are disabled. The user can’t change them.

Setting/Field

Man-in-the-middle protection

Extra settings

Description

Sophos Mobile Security checks the Wi-Fi connection for man-in-the-middle attacks.

Only configure these settings if instructed by Sophos

Support.

158

14.17.2 Antivirus configuration (Sophos Mobile Security policy for Android)

With the Antivirus configuration you manage the malware protection settings of the Sophos Mobile

Security app.

Note

When you assign this configuration to a device, the corresponding settings in the Sophos Mobile

Security app are disabled. The user can’t change them.

Setting/Field

Cloud scan mode

Scheduled scan interval

Scan system apps

Scan storage

Description

Select when Sophos Mobile Security loads the latest malware information from the Sophos server.

Select how often malware scans are performed.

If you select Daily while charging, a scan is performed when the device is connected to a power supply for more than 30 minutes.

Scan system apps.

System apps aren’t scanned by default because they are protected by the Android OS and because the user can’t uninstall them.

Scan all files on internal shared storage, SD card, and connected USB devices for threats, in addition to the default scanning of all installed apps.

Setting/Field

Detect PUAs

Enable user to allow PUAs

Mode

Scan notification

Monitor storage

App group

Sophos Mobile

Description

Scan for Potentially Unwanted Applications (PUAs).

PUAs are apps that, while not malicious, are generally considered unsuitable for business networks. PUAs include adware, dialers, system monitors, remote administration tools, and hacking tools. However, certain apps that can fall into the PUA category might be considered useful by some users.

Users can allow an app that was classified as PUA.

Allowed apps are ignored in subsequent scans.

Select how to deal with low reputation apps:

Allow: Turn off scanning for low reputation apps.

Warn: Display a warning on the device when a low reputation app is detected. Users can choose how to deal with the app. They can add it to a list of allowed apps so that no further warning is displayed if this app is detected.

Block: The user can’t start low reputation apps.

When an app is scanned after installation, Sophos Mobile

Security creates a notification.

If the check box is cleared, no notifications are created for clean apps.

Monitor internal shared storage, SD card, and connected

USB devices for changes. When new files are stored in these locations, they are scanned.

Select a group of allowed apps. The apps in that group are excluded from scans.

14.17.3 Web Filtering configuration (Sophos Mobile Security policy for Android)

With the Web Filtering configuration you manage the Web Filtering feature of the Sophos Mobile

Security app. This protects users from browsing sites with malicious, undesirable or illegal content.

Important

You must also turn off the Denial of SMSec permissions allowed compliance rule. If you don’t, users are able to stop Web Filtering by turning off Sophos Accessibility Service.

Sophos Mobile

Settings

Setting/Field

Filter malicious websites

Filter websites by category

Website exceptions

Description

Select if users can access websites with malicious content.

Select if users can access websites that fall into a certain category.

Sophos Mobile Security categorizes websites based on data from SophosLabs. The data is updated constantly.

Tip

For the purpose of testing website filtering, Sophos has created the site sophostest.com

containing example pages for each category. Although some of these pages are classified as potentially offensive or dangerous, the page content itself is harmless in all cases.

Configure exceptions to the category filters:

Allowed domains: Websites that are allowed, even though the category they belong to is blocked.

Blocked domains: Websites that are blocked, even though the category they belong to is allowed.

You can enter domain names or IP addresses. Examples:

• www.example.com

• *.example.com

• 198.51.100.1

• 198.51.100.0/24

Supported browsers

Web Filtering can be used in combination with the following web browsers:

• Android web browser

• Firefox

• Google Chrome

• Microsoft Edge

Other browsers may also work, but have not been tested.

Sophos Mobile

14.18 Configurations for Knox container profiles

With a Knox container profile you configure settings that are related to the Knox container of Samsung devices.

For information on how to create a Knox container profile, see Create profile or policy

(page 94).

14.18.1 Password policies configuration (Knox container profile)

With the Password policies configuration you define requirements for the Knox container password.

Note

The settings supported may depend on the version of the operating system or on other device features. This is indicated by blue labels in Sophos Mobile Admin.

Password type

In the Password type list, select the type of password users are allowed to configure:

Setting/Field

Pattern, PIN or password

Simple password

PIN or password

Alphanumeric password

Complex password

Description

Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.

No additional restrictions are imposed.

Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.

Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.

Users must set a Password screen lock. The password must contain both letters and digits.

You can define a minimum length. See the following table.

Users must set a Password screen lock.

If you select Simple password, PIN or password, Alphanumeric password or Complex

password, the following fields are displayed:

Sophos Mobile

Setting/Field Description

Minimum password length The minimum number of characters a password must contain.

Maximum idle time before password prompt The time after the Knox container is locked if it has not been used. The container can be unlocked by entering the password.

Note

The device might impose a shorter time period than what you configure here.

Maximum password age in days

Maximum sign-in attempts

Password history

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

The Knox container is deleted after this number of incorrect sign-in attempts.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

If you select Complex password, the following additional fields are displayed:

Setting/Field

Minimum number of letters

Minimum number of lowercase letters

Minimum number of uppercase letters

Minimum number of non-alphabetic characters

Minimum number of digits

Minimum number of special characters

Description

The minimum number of letters a password must contain.

The minimum number of lowercase letters a password must contain.

The minimum number of uppercase letters a password must contain.

The minimum number of non-alphabetic characters (for example & or !) a password must contain.

The minimum number of numerals a password must contain.

The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.

Sophos Mobile

Biometric authentication

Setting/Field

Allow fingerprint authentication

Allow iris authentication

Allow face authentication

Description

If supported by the device, the user can use fingerprint authentication to unlock the Knox container.

If supported by the device, the user can use iris authentication to unlock the Knox container.

If supported by the device, the user can use face authentication to unlock the Knox container.

14.18.2 Restrictions configuration (Knox container profile)

With the Restrictions configuration you configure restrictions and related settings for the Knox container of Samsung devices.

Setting/Field

Allow screen capture

Allow camera

Allow clipboard

Allow "Share via"

Allow microphone

Enforce the use of the secure keypad

Allow addition of new email accounts

Allow data export

Allow copying files into the container

Allow Bluetooth

Allow NFC

Description

Users can capture the screen content of apps inside the Samsung Knox container.

Apps inside the Samsung Knox container can access the camera.

Users can copy any contents to the clipboard.

The Share via feature that certain apps use is turned on.

Apps inside the Samsung Knox container can access the microphone.

Users must use the secure keypad.

Users can add email accounts beyond the accounts that are configured by a Sophos Mobile profile.

Private apps can access data from within the Samsung

Knox container.

Private files can be copied or moved into the Samsung

Knox container.

Apps inside the Samsung Knox container can use

Bluetooth connections.

Apps inside the Samsung Knox container can use NFC

(near-field communication) connections.

Sophos Mobile

Setting/Field

Enforce multi-factor authentication

Allowed apps / Forbidden apps

Description

More than one authentication method is required to unlock the Samsung Knox container, for example password and fingerprint.

You can configure either Allowed apps or Forbidden

apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.

App installations initiated by the Sophos Mobile server are not restricted by this setting.

For information on creating app groups, see

App groups

(page 300).

14.18.3 Exchange account configuration (Knox container profile)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server. These settings are applied to the Samsung Knox container.

Setting/Field

Account name

Exchange server

Description

The account name.

The Exchange server address.

Note

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

Domain

User

Email address

Sender

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

A sender name for this account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

Setting/Field

Password

Synchronization period

Synchronization interval

SSL/TLS

Default account

Allow all certificates

Allow forwarding from other accounts

Allow use of HTML format

Maximum attachment size in MB

Synchronize content types

Sophos Mobile

Description

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

The account is used as the default email account.

Allow all certificates in transfer processes from the email server.

This account can be used to forward emails received by another account.

For example if we call this account A and there exists another account B in the Knox container, an email message received by account B can be forwarded using account A as sender.

Note

This setting is only used by the native Android email app.

Allow the use of HTML format in emails.

The maximum size of a single email message (1,

3, 5, 10, Unlimited).

The content types to be synchronized.

14.19 Configurations for Android Things policies

With an Android Things policy you configure various aspects of Android Things devices. Currently, only

Wi-Fi settings are supported.

For information on how to create an Android Things policy, see Create profile or policy

(page 94).

Sophos Mobile

14.19.1 Wi-Fi configuration (Android Things policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Security type

Description

The ID of the Wi-Fi network.

The security type of the Wi-Fi network:

• None

• WEP

• WPA/WPA2

If you select WEP or WPA/WPA2, a Password field is displayed. Enter the relevant password.

14.20 Configurations for iOS device profiles

With an iOS device profile you configure various aspects of iOS devices, like password policies, restrictions or Wi-Fi settings.

For information on how to create a device profile, see

Create profile or policy (page 94).

14.20.1 Password policies configuration (iOS device profile)

With the Password policies configuration you define requirements for the device password.

Note

When the Password policies configuration is assigned to a device, a grace period of 60 minutes starts. Within the grace period, the user is asked to change the password when they return to the

Home screen to comply with the policies. After the grace period, the user may not start any apps on the device, including internal apps.

Setting/Field

Allow simple value

Require alphanumeric value

Minimum password length

Description

Users are allowed to use sequential or repeated characters in their password, for example 1111 or abcde .

Passwords must contain at least one letter or number.

Specifies the minimum number of characters a password must contain.

Sophos Mobile

Setting/Field

Minimum number of complex characters

Maximum password age in days

Maximum Auto-Lock (in minutes)

Password history

Maximum grace period for device lock

Number of failed attempts until device wipe

Description

Specifies the minimum number of nonalphanumeric characters (for example & or !) a password must contain.

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

In this field, you can specify the maximum value the user is allowed to configure on the device. Auto-Lock specifies how soon (in minutes) the device will be locked if it has not been used.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

In this field, you can specify the maximum value the user is allowed to configure on the device. The grace period for device lock specifies for how long the device can be unlocked after a lock without a password prompt. If you select None, the user can select any of the intervals available. If you select

Immediately, users must enter a password every time they unlock their devices.

In this field, you can specify the number of failed attempts to enter the correct password before the device is wiped. After six failed attempts, a time delay is imposed before a password can be entered again. The delay increases with each failed attempt. After the final failed attempt, all data and settings are securely removed from the device. The time delay starts after the sixth attempt. So if you set this value to 6 or lower, no delay is imposed and the device is wiped when the attempt limit is exceeded.

14.20.2 Restrictions configuration (iOS device profile)

With the Restrictions configuration you define restrictions for devices.

Note

Some options are only available for certain versions of iOS or for supervised devices. This is indicated by blue labels in Sophos Mobile Admin.

Sophos Mobile

168

Device

Setting/Field

Allow app installation

Allow app installation from device UI

Allow use of camera

Allow FaceTime

Allow screen capture

Allow automatic sync while roaming

Allow Siri

Allow Siri while device is locked

Allow Siri querying content from the web

Force Siri explicit language filter

Allow voice dialing while device is locked

Description

If the check box is cleared, the App Store is unavailable and its icon is removed from the Home screen. Users can’t install or update apps from the App

Store or Apple Configurator.

If the check box is cleared, the App Store is unavailable and its icon is removed from the Home screen. Users can still install or update apps from

Apple Configurator.

If the check box is cleared, the camera is unavailable and the Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.

Users can place or receive FaceTime video calls.

Users can take a screenshot of the display.

If the check box is cleared, devices that are roaming will only sync when the user accesses an account.

If the check box is cleared, users cannot use Siri, voice commands, or dictation.

If the check box is cleared, users must unlock their devices by entering their password before they use

Siri.

If the check box is cleared, Siri does not query content from the web.

If the check box is cleared, the Siri filter for explicit language is not enforced on the device.

If the check box is cleared, users cannot dial by using voice commands when the device is locked by a password.

Note

If the user has not configured a device password, voice dialing is always allowed.

Allow Passbook while device is locked

Allow in-app purchase

Passbook notifications are displayed when the device is locked.

Users can make in-app purchases.

Sophos Mobile

Setting/Field Description

Force user to enter store password for all purchases

Users must enter their Apple ID password to make any purchase.

If the check box is cleared, there is a brief grace period during which users can make subsequent purchases without having to enter their password again.

Allow multiplayer gaming Users can play multi-player games in Game Center.

Allow Game Center If the check box is cleared, Game Center is unavailable.

Users can add friends in Game Center.

Allow adding Game Center friends

Allow find my friends modification

Allow host pairing

If the check box is cleared, modifications to the Find my Friends app are unavailable.

If the check box is cleared, host pairing is turned off with the exception of the supervision host. If no supervision host certificate is configured, all pairing is turned off.

Allow pairing with Apple Watch If the check box is cleared, users cannot pair the device with an Apple Watch. Any currently paired

Apple Watch is unpaired.

A paired Apple Watch must use Wrist Detection.

Force Wrist Detection

Allow AirDrop

Allow Control Center on lock screen

Allow Notification Center on lock screen

Allow Today view on lock screen

Content sharing with AirDrop is turned on.

If the check box is cleared, the Control Center is unavailable when the device screen is locked.

If the check box is cleared, the Notification Center is unavailable when the device screen is locked.

If the check box is cleared, the Today view is unavailable when the device screen is locked.

The News app is available.

Over-the-air PKI updates are possible.

Allow News

Allow over-the-air PKI updates

Allow iBooks Store

Allow explicit sexual content in iBooks Store

Allow user to install configuration profiles

Allow iMessage

Users can purchase books in iBooks.

If the check box is cleared, explicit sexual content through iBooks Store is blocked.

Users can install configuration profiles.

Users can use iMessage to send or receive text messages.

Sophos Mobile

Setting/Field

Allow app removal

Allow system app removal

Allow erase all contents and settings

Allow internet search result for

Spotlight

Allow enabling of restrictions option

Allow Handoff

Allow device name modification

Allow wallpaper modification

Allow changing notification settings

Allow keyboard shortcuts

Allow dictation for keyboard input

Allow predictive keyboard

Allow auto-correction

Allow spell check

Allow automatic app download

Allow Apple Music

Allow Apple Music Radio

Allow modification of Bluetooth settings

Allow VPN creation

Force automatic date and time

Description

Users can uninstall apps from the device.

Users can uninstall system apps from the device.

If the check box is cleared, the Erase all Content And

Settings option in the Reset UI is unavailable.

If the check box is cleared, Spotlight does not return internet search results.

If the check box is cleared, the Enable Restrictions option in the Reset UI is unavailable.

Users can use the Apple Continuity feature Handoff.

With Handoff, users can start to work on a document, email or message on one device and continue from another device.

Users can change the device name.

Users can change the wallpaper.

Users can change the notification settings.

Users can use keyboard shortcuts.

Users can turn on the Enable Dictation keyboard setting.

Users can turn on the Predictive keyboard setting.

Users can turn on the Auto-Correction keyboard setting.

Users can turn on the Check Spelling keyboard setting.

If the check box is cleared, the automatic downloading of apps purchased on other devices is turned off. This does not affect updates to existing apps.

Users can access the Apple Music library.

Users can access Apple Music Radio.

Users can modify the Bluetooth settings.

Users can add VPN configurations.

The iOS Date & Time setting Set Automatically is turned on and can’t be turned off by the user.

Setting/Field iOS software update delay

Sophos Mobile

Description

The number of days that an update of the iOS software is delayed after its release date.

Enter a value between 0 (no delay) and 90.

Company data

Setting/Field

Allow documents to be shared only within managed apps/accounts

Description

This restricts the opening of documents with apps or accounts managed by Sophos Mobile, for example a corporate email account.

If users have an email account managed by Sophos

Mobile and apps managed by Sophos Mobile on their devices, attachments from the managed email account can only be opened with managed apps.

In this way you can prevent corporate documents from being opened in unmanaged apps.

If you turn this setting off, the next two settings are disabled. Contacts from managed accounts can be shared with unmanaged apps.

Allow managed apps to write contacts to unmanaged accounts

Managed apps can write contacts to unmanaged accounts.

Allow unmanaged apps to read contacts from managed accounts

Allow documents to be shared only within unmanaged apps/accounts

Unmanaged apps can read contacts from managed accounts.

This restricts the opening of documents with apps/ accounts not managed by Sophos Mobile, for example a private email account.

If users have an email account and apps not managed by Sophos Mobile on their devices, attachments from the unmanaged email account can only be opened with unmanaged apps.

In this way you can prevent personal documents from being opened in managed apps.

AirDrop is considered an unmanaged drop target.

Force AirDrop documents to be used as unmanaged documents

Allow managed apps to sync with iCloud

Managed apps can use iCloud synchronization.

Allow backup for enterprise books

Allow enterprise books notes and highlights sync

Enterprise books are backed up.

Enterprise books notes and highlights are synchronized.

Sophos Mobile

Applications

Setting/Field

Allow use of the iTunes Store

Allow use of Safari

Enable auto-fill

Force fraud warning

Block pop-ups

Allow JavaScript in browser

Accept cookies

Allow modification of cellular data usage per app

Allowed apps / Forbidden apps

Description

If the check box is cleared, the iTunes Store is unavailable and its icon is removed from the Home screen. Users cannot preview, purchase or download content.

If the check box is cleared, the Safari web browser is unavailable and its icon is removed from the Home screen. This also prevents users from opening Web

Clips.

If the check box is cleared, Safari does not auto-fill web forms with previously entered information.

The Safari security setting to warn the user when they visit a suspected phishing website is always turned on.

The Safari pop-up blocker is turned on.

Web pages can execute JavaScript code on the device.

In this field, you specify if Safari accepts cookies.

When you allow cookies, you can specify if only cookies from the current site, from previously visited sites, or from all sites are accepted.

Users can change the cellular data usage per app.

You can specify either Allowed apps or Forbidden

apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.

For information on creating app groups, see App groups

(page 300).

iCloud

Setting/Field

Allow backup

Allow document sync

Description

Users can back up their devices to iCloud.

Users can store documents and app configuration data in iCloud.

Setting/Field

Allow Photo Stream

Allow iCloud Photo Library

Allow shared photo streams

Allow iCloud Keychain sync

Sophos Mobile

Description

Users can upload photos to My Photo Stream.

Note

If you clear the check box to forbid My Photo

Stream, this also removes existing photos shared via My Photo Stream from all devices. If there are no other copies of these photos, they are lost.

Users can use iCloud Photo Library.

Users can invite others to view their photo streams and can view photo streams shared by others.

Users can use iCloud Keychain to synchronize passwords across their iPhones, iPads, and Macs.

If the check box is cleared, iCloud Keychain data is only stored locally on the device.

Security and privacy

Setting/Field

Allow diagnostic data to be sent to

Apple

Allow user to accept untrusted TLS certificates

Trust enterprise apps

Allow password modification

Allow account modification

Allow Touch ID to unlock device

Force limit ad-tracking

Force encrypted backups

Force configured Wi-Fi networks

Description

If the check box is cleared, iOS diagnostic information is not sent to Apple.

If the check box is cleared, users are not asked if they want to trust certificates that cannot be verified.

This setting applies to Safari and to Mail contacts and

Calendar accounts.

Enterprise apps are trusted.

Users can add, change or remove the device password.

If the check box is cleared, users cannot modify accounts. The Accounts menu is unavailable.

If the check box is cleared, the device can’t be unlocked by Touch ID.

Anonymous user data apps used for targeting ads are no longer provided.

Users must encrypt backups in iTunes.

Devices can only connect to Wi-Fi networks that have been configured by a Sophos Mobile profile.

Sophos Mobile

Setting/Field

Allow AirPrint

Allow AirPrint credentials storage

Allow iBeacon discovery of AirPrint printers

Description

Users can send files to AirPrint-enabled printers.

The AirPrint user name and password can be stored in the system keychain.

The device uses iBeacon to discover AirPrint devices.

Important

If you allow this, malicious AirPrint devices can perform phishing attacks on network traffic.

Force trusted certificates for AirPrint over TLS

Allow Quick Start transfer to new device

Allow password auto-fill

Force authentication before auto-fill

AirPrint over TLS is rejected if the AirPrint device uses an untrusted certificate.

The user can transfer data from the device to a new device, using the Quick Start feature of the iOS Setup

Assistant.

Users can turn on the AutoFill Passwords setting, which lets them use saved password or credit card information in Safari or other apps.

If this check box is cleared, automatic suggestion of strong passwords is disabled as well.

Users must authenticate when using auto-fill.

This setting is only enforced on devices that support

Face ID or Touch ID.

Request Wi-Fi passwords from nearby devices

Allow AirDrop password sharing

The device requests passwords from nearby devices when setting up a Wi-Fi connection.

Users can share passwords from Password Manager with other users via AirDrop.

Content ratings

Setting/Field

Allow explicit music and podcasts

Description

If the check box is cleared, explicit music or video content is hidden in the iTunes Store. Explicit content is flagged by content providers, for example record labels, when listed on the iTunes Store.

Sophos Mobile

14.20.3 Exchange account configuration (iOS device profile)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server.

Setting/Field

Account name

Exchange server

Description

The account name.

The Exchange server address.

Note

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

Domain

User

Email address

Password

OAuth

Synchronization period

SSL/TLS

Allow move

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The account uses OAuth for authentication, i.e.

users authenticate with their Microsoft credentials.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

Users can move emails from this account to another. This also allows users to use a different account when replying to or forwarding a message from this account.

Sophos Mobile

Setting/Field

Allow recent address syncing

Use in Mail only

Identity certificate

Enable S/MIME

Signing certificate

Encryption certificate

Allow user to send unencrypted emails

Description

The account is included in the syncing of recently used addresses with other devices using iCloud.

The account can only be used to send messages from the Mail app. It cannot be selected as a sending account for messages created with other apps, for example Photos or Safari.

Select the identity certificate for the connection to the Exchange server.

The list includes all certificates from Client

certificate configurations of the current profile.

Support the S/MIME encryption standard.

The certificates that are used for email signing and encryption.

To select a certificate, you must first upload it in a Client certificate configuration of the current profile.

For each outgoing email, the user can choose to encrypt it or not.

14.20.4 Wi-Fi configuration (iOS device profile)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Connect automatically

Hidden network

Description

The ID of the Wi-Fi network.

Automatically connect to the target network.

The target network is not open or visible.

Setting/Field

Security type

Sophos Mobile

Description

The security type of the Wi-Fi network:

• None

• WEP (personal)

• WPA/WPA2 (personal)

• Any (personal)

• WEP (enterprise)

• WPA/WPA2 (enterprise)

• Any (enterprise)

If you select a type with Personal in its name, a

Password field is displayed. Enter the relevant password.

If you select a type with Enterprise in its name, the tabs Protocols, Authentication and Trust are displayed.

On the Protocols tab configure the following:

• Under Accepted EAP types, select the EAP methods to be used for authentication. Depending on the types selected on this tab, the values in the Internal identity field on this tab become available for selection.

• Under EAP-FAST, configure the EAP-FAST Protected

Access credential settings.

• In TLS minimum version and TLS maximum version, select a minimum and a maximum TLS version to be used with EAP authentication.

On the Authentication tab, configure client authentication settings:

• In the User field, enter the user name for the connection to the Wi-Fi network.

• Select Require password on each connect, if the password is to be queried for each connection and transferred with the authentication.

• In the Password field, enter the relevant password.

• In the Identity certificate list, select the certificate for the connection to the Wi-Fi network.

Note

The certificate to be used has to be specified in a

Client certificate configuration.

• In the External identity field, enter the externally visible

ID (for TTLS, PEAP and EAP-FAST).

On the Trust tab, configure server authentication settings:

Select the trusted certificates from the list.

Note

You must specify the certificates in a Root

certificate configuration.

177

Sophos Mobile

Setting/Field

Proxy

Description

In this list, select the proxy settings for the Wi-Fi connection:

• No proxy

• Manually

• Automatic

If you select Manually, the fields Server and port,

Authentication and Password are displayed.

Enter the required proxy information. If you select

Automatic, the field PAC URL is displayed. Enter the URL of the proxy server.

178

14.20.5 Single app mode configuration (iOS device profile)

With the Single app mode configuration you define settings for the operation mode that locks devices into a single app and prevents users from changing to other apps.

Setting/Field

Select source

App identifier

Disable touchscreen

Disable rotation

Disable volume buttons

Disable ringer switch

Disable sleep wake button

Disable Auto-Lock

Enable VoiceOver

Enable Zoom

Enable Invert Colors

Enable AssistiveTouch

Description

Select how you want to specify the app for the single app mode:

• App list: Select the app from a list of all available iOS apps.

• Custom: Manually enter the bundle ID of the app.

The app for the single app mode.

Either select an app from the list or enter a bundle ID.

Touch gestures are unavailable.

The screen does not rotate.

Volume buttons are unavailable.

The ringer switch is unavailable.

The wake button is unavailable.

The Auto-Lock feature that puts the device into sleep after an idle period is turned off.

VoiceOver is available.

The Zoom feature is available.

The Invert Colors feature is available.

AssistiveTouch is available.

Sophos Mobile

Setting/Field

Enable Speak Selection

Enable Mono Audio

VoiceOver

Zoom

Invert Colors

AssistiveTouch

Description

The Speak Selection feature is available.

The Mono Audio feature is available.

VoiceOver adjustments are available.

Zoom adjustment are available.

Invert Colors adjustment are available.

AssistiveTouch adjustment are available.

14.20.6 Access Point Name configuration (iOS device profile)

With the Access Point Name configuration you specify an Access Point Name (APN) configuration for iOS devices. APN configurations define how devices connect to a mobile network.

Note

The Access Point Name configuration is deprecated in favor of the Cellular configuration. See

Cellular configuration (iOS device profile) (page 180).

Important

If these settings are not correct, the device cannot access data using the cellular network. To undo settings changes, the profile must be removed from the device.

Setting/Field

APN

User name for access point

Password for access point

Description

The APN that the device quotes when it opens a GPRS connection with the carrier.

This must match an APN that the carrier accepts. Otherwise, the connection cannot be established.

The user name for the access point.

Note iOS supports APN user names of up to 64 characters.

The password for the access point.

Note iOS supports APN passwords of up to 64 characters.

Sophos Mobile

Setting/Field

Proxy server and port

Description

The address and the port of the proxy server.

14.20.7 Roaming/Hotspot configuration (iOS device profile)

With the Roaming/Hotspot configuration you define settings for roaming and personal hotspots.

Note

Users can change these settings on their devices anytime.

Setting/Field

Enable voice roaming

Enable data roaming

Enable personal hotspot

Description

Voice roaming is available.

This setting is ignored if the mobile network operator doesn’t support voice roaming.

Data roaming is available.

The user can configure the device to serve as a personal hotspot.

This setting is ignored if the mobile network operator doesn’t support personal hotspots.

14.20.8 Cellular configuration (iOS device profile)

With the Cellular configuration you define cellular network settings for iOS devices.

Note

A Cellular configuration cannot be installed onto a device if an Access Point Name configuration is already installed.

Setting/Field

Authentication

APN

Description

PAP

CHAP

The APN that the device quotes when it opens a GPRS connection with the carrier.

This must match an APN that the carrier accepts. Otherwise, the connection cannot be established.

Setting/Field

User name for access point

Password for access point

Proxy server and port

Sophos Mobile

Description

The user name for the access point.

Note iOS supports APN user names of up to 64 characters.

The password for the access point.

Note iOS supports APN passwords of up to 64 characters.

The address and the port of the proxy server.

14.20.9 Network usage rules configuration (iOS device profile)

With the Network usage rules configuration you specify how managed apps are allowed to use cellular data networks.

General rules

Under Rules for all managed apps, enter the settings for managed apps in general.

Setting/Field

Allow cellular data

Allow data roaming

Description

Managed apps are allowed to use data communication over cellular networks.

Managed apps are allowed to use data communication while the device is roaming on a foreign cellular network.

Exceptions

Exceptions override the general rules. Use Add exception to define rules that are specific to an app group.

Setting/Field

App group

Allow cellular data

Description

Select an app group.

The exception applies to all managed apps in that group.

Managed apps from the selected app group are allowed to use data communication over cellular networks.

Sophos Mobile

Setting/Field

Allow data roaming

Description

Managed apps from the selected app group are allowed to use data communication while the device is roaming on a foreign cellular network.

Note

You cannot define multiple exceptions for the same app group.

14.20.10 VPN configuration (iOS device profile)

With the VPN configuration you define VPN settings for network connections.

Setting/Field

Connection name

Connection type

Identifier (reverse DNS format)

Server

Account

Third-party settings

Send all traffic through VPN

Group

Description

The name of the connection shown on the device.

The type of the VPN connection:

• Cisco AnyConnect

• Cisco Legacy AnyConnect

• IPsec (Cisco)

• F5

• Check Point

• Custom SSL/TLS

Different entry fields are shown on the VPN page depending on the connection type you select here.

The custom identifier in reverse DNS format.

The host name or the IP address of the server.

The user account for the authentication of the connection.

If your vendor has specified custom connection properties, you can enter them in this field.

To enter a property, click Add and then enter

Key and Value of the property in the dialog box.

All traffic is sent through VPN.

The group that may be required for the authentication of the connection.

Setting/Field

User authentication

Device authentication

Proxy

Sophos Mobile

Description

The type of user authentication for the connection:

• Password

If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.

• Certificate

If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.

The type of device authentication:

• Keys (Shared Secret)/Group name

If you select this option, the fields Group

name, Keys (Shared Secret), Use hybrid

authentication and Request password are displayed below the Device authentication field. Enter the required authentication information in the Group name and Keys

(Shared Secret) fields. Select Use hybrid

authentication and Request password as required.

• Certificate

If you select this option, the fields

Certificate and Including user PIN are displayed below the Device authentication field. In the Certificate list, select the required certificate. Select Including user

PIN to include the user PIN in device authentication.

The proxy settings for the connection:

• No proxy

• Manually

If you select this option, the fields Server

and port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the Password field, enter the password for the connection to the proxy server.

• Automatic

If you select this option, the Proxy server

URL field is displayed. Enter the URL of the server with the proxy setting in this field.

183

Sophos Mobile

Setting/Field

Provider type

Description

The VPN connection type.

• App proxy: Network traffic is sent through a

VPN tunnel at the application layer.

• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.

14.20.11 Per app VPN configuration (iOS device profile)

With the Per app VPN configuration you define VPN settings for individual apps.

You can configure apps to automatically connect to VPN when they are started. So you can, for example, ensure that data transmitted by managed apps travels through VPN.

After you have set up per app VPN configurations, you can select a configuration on the Edit

package page of an app. See Assign a VPN connection to an iOS app

(page 298).

Setting/Field

Connection name

Connection type

Identifier (reverse DNS format)

Server

Account

Third-party settings

Send all traffic through VPN

Group

Description

The name of the connection shown on the device.

The type of the VPN connection:

• Cisco AnyConnect

• Cisco Legacy AnyConnect

• F5

• Check Point

• Custom SSL/TLS

Different entry fields are shown on the VPN page depending on the connection type you select here.

The custom identifier in reverse DNS format.

The host name or the IP address of the server.

The user account for the authentication of the connection.

If your vendor has specified custom connection properties, you can enter them in this field.

To enter a property, click Add and then enter

Key and Value of the property in the dialog box.

All traffic is sent through VPN.

The group that may be required for the authentication of the connection.

Setting/Field

User authentication

Proxy

Provider type

Sophos Mobile

Description

The type of user authentication for the connection:

• Password

If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.

• Certificate

If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.

The proxy settings for the connection:

• No proxy

• Manually

If you select this option, the fields Server

• Automatic

If you select this option, the Proxy server

URL field is displayed. Enter the URL of the server with the proxy setting in this field.

The VPN connection type.

• App proxy: Network traffic is sent through a

VPN tunnel at the application layer.

• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.

Sophos Mobile

Setting/Field

Safari domains

Description

In this field, you can enter a list of domain strings. Use a new line for each domain string.

When a domain that matches one of the domain strings is opened in Safari or another browser app, the VPN connection is triggered.

The rule matching behavior is as follows:

• Leading and trailing dots are ignored.

For example, the string .example.com

matches the same domains as the string example.com

• Each string component must match a whole domain component. For example, the string example.com

matches the domain www.example.com

, but not www.myexample.com

• Strings with a single component only match that specific domain. For example, the string example matches the domain example , but not www.example.com

14.20.12 Web Clip configuration (iOS device profile)

With the Web Clip configuration you define Web Clips to be added to the Home screen of user devices. Web Clips provide fast access to favorite web pages. But you can also add a Web Clip with a support phone number for example, to provide a quick way to dial the helpdesk.

Setting/Field

Description

URL

Can be removed

Full screen

Description

A description for the Web Clip.

The web address of the Web Clip.

If the check box is cleared, the user cannot remove the Web Clip. It cannot be deleted from the device unless the user removes the profile that installed it.

The Web Clip is opened full screen on the device. A full screen Web Clip opens the URL as a web app.

Setting/Field

Icon

Sophos Mobile

Description

Select an image to be used as the Web Clip icon on the Home screen. This must be a PNG,

GIF or JPEG image with a maximum file size of

1 MB.

The image is cropped to a square and scaled to match the display resolution. For best results, we recommend that you use an image of size

180 px by 180 px.

Note

When a favicon is defined in the HTML code of the web page, the device might display that favicon as Web Clip icon. This happens for certain web pages only, depending on how the favicon is configured in the web page code.

14.20.13 Wallpaper configuration (iOS device profile)

With the Wallpaper configuration you define background images for the lock screen and/or the Home screen of iOS devices.

Setting/Field

Apply to

Image

Description

Select whether the image is used for the Lock screen, for the

Home Screen, or both.

Select a PNG or JPEG image with a maximum file size of 5 MB that is used for the wallpaper.

iOS crops and scales the image as required. For best results, use the following image sizes (in pixels):

• 640 × 1136 (iPhone 5)

• 750 × 1334 (iPhone 6/7)

• 1242 × 2208 (iPhone 6/7 Plus)

• 1536 × 2048 (iPad, iPad mini, iPad Air)

• 2048 × 2732 (iPad Pro)

Note

Users can change the wallpaper at any time.

Sophos Mobile

14.20.14 Web content filter configuration (iOS device profile)

With the Web content filter configuration you define blocked URLs and allowed URLs with bookmarks.

Setting/Field

Blocked URLs

Allowed URLs with bookmarks

Block adult content

Description

If you select the check box, you can define a list of blocked URLs that may not be accessed on the devices.

Click Next to display the Web content filter page. On this page, you can add individual

URLs.

Use a new line for each URL.

If you select the check box, you can define allowed URLs with bookmarks to be added to the Safari browser on the devices. All other sites are blocked.

Click Next to display the Web content filter page. Click Add to add individual URLs as bookmarks.

On the Web content filter page, use this to turn on an Apple filter that blocks adult content.

For example, web pages that contain swearing or sexually explicit language.

14.20.15 Global HTTP proxy configuration (iOS device profile)

With the Global HTTP proxy configuration you define a corporate proxy server.

Setting/Field

Proxy

Server and port

Authentication

Password

PAC URL

Description

Select Manually to configure the connection details manually.

Select Automatic if you have a proxy auto-config (PAC) file.

The name (or the IP address) and the port number of the HTTP proxy.

The user name to connect to the proxy server.

The password to connect to the proxy server.

The URL of the proxy auto-config (PAC) file.

Sophos Mobile

14.20.16 Managed domains configuration (iOS device profile)

With the Managed domains configuration you define managed domains for iOS devices.

Email domains

Enter email domains managed by your organization. Email messages from an address that doesn’t match one of the configured domains are highlighted as out-of-domain in the Mail app.

Web domains

Files downloaded from one of the configured domains are treated as managed documents. If you activate the Allow documents to be shared only within managed apps/accounts restriction, these documents can only be opened by managed apps.

For information on managed apps, see

Managed apps for iOS (page 292).

Note

If a managed web domain entry contains a port number, only addresses that specify that port number will be considered managed. Otherwise, only the standard ports will be considered managed (port 80 for http and 443 for https).

14.20.17 CalDAV configuration (iOS device profile)

With the CalDAV configuration you configure the synchronization of calendar data with a CalDAV server. For example, this can be used to sync Google Calendar with an iOS device.

Setting/Field

Account name

Account host and port

Description

The display name of the CalDAV account on the device.

The host name or IP address and optionally the port number of the CalDAV server.

For example, for Google Calendar enter: calendar.google.com:443

Sophos Mobile

Setting/Field

Principal URL

User name, Password

SSL/TLS

Description

If required by the CalDAV server, enter the principal URL of the calendar resource.

For example, to sync with a calendar other than the primary calendar in a Google account, enter: https://apidata.googleusercontent.com/ caldav/

v2/calendar_id/user where calendar_id is the ID of the calendar you want to sync with. In the Google Calendar web application, the calendar ID is displayed in the calendar settings. See the

Google Calendar help for details.

The login credentials for the CalDAV account.

For example, for Google Calendar enter the credentials of the Google account.

The connection to the CalDAV server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

14.20.18 CardDAV configuration (iOS device profile)

With the CardDAV configuration you configure the synchronization of contact data with a CardDAV server. For example, this can be used to sync Google Contacts with an iOS device.

Setting/Field

Account name

Account host and port

Principal URL

Description

The display name of the CardDAV account on the device.

The host name or IP address and optionally the port number of the CardDAV server.

For example, for Google Contacts enter: google.com

If required by the CardDAV server, enter the principal URL of the contacts resource.

For example, the Google CardDAV API supports the following principal URL: https://www.googleapis.com/carddav/

v1/ principals/account_name@gmail.com

where account_name is the Google account name.

Setting/Field

User name, Password

SSL/TLS

Sophos Mobile

Description

The login credentials for the CardDAV account.

For example, for Google Contacts enter the credentials of the Google account.

The connection to the CardDAV server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

14.20.19 IMAP/POP configuration (iOS device profile)

With the IMAP/POP configuration you add an IMAP or POP email account to the iOS device.

Setting/Field

Account name

Account type

User display name

Email address

Allow move

Allow recent address syncing

Use in Mail only

Allow Mail Drop

Enable S/MIME

Signing certificate

Encryption certificate

Description

The display name of the email account on the device.

The type of the email server for incoming email (either

IMAP or POP).

The display name of the user for outgoing email.

Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.

The email address of the account.

Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.

Users can move emails from this account to another. This also allows users to use a different account when replying to or forwarding a message from this account.

The account is included in the syncing for the list of recent addresses.

The account can only be used to send messages from the

Mail app. It cannot be selected as a sending account for messages created with other apps, for example Photos or

Safari.

Allow Apple Mail Drop for this account.

Support the S/MIME encryption standard.

The certificates that are used for email signing and encryption.

To select a certificate, you must first upload it in a Client

certificate configuration of the current profile.

Sophos Mobile

Setting/Field

Allow user to send unencrypted emails

Incoming email

Email server and port

User name

Authentication type

Password

SSL/TLS

Outgoing email

Email server and port

User name

Authentication type

Password

Use same password as for incoming email

SSL/TLS

Description

For each outgoing email, the user can choose to encrypt it or not.

The host name or IP address and the port number of the server for incoming email (inbound server).

The user name for connecting to the inbound server.

The authentication method for connecting to the inbound server.

The password for connecting to the inbound server (if required).

The connection to the inbound server is secured by SSL or TLS (depending on what the server supports).

The host name or IP address and the port number of the server for outgoing email (outbound server).

The user name for connecting to the outbound server.

The authentication method for connecting to the outbound server.

The password for connecting to the outbound server (if required).

Use the password that is specified for incoming email.

The connection to the outbound server is secured by SSL or TLS (depending on what the server supports).

14.20.20 Google account configuration (iOS device profile)

With the Google account configuration you set up a Google account. After the configuration is assigned to a device, the user is asked to authenticate for the Google account. After authentication, the

Google account is set up on the device and the user can enable Google services.

Setting/Field

Google email address

Account description

Description

The full email address of the Google account.

An optional description of the account. The value is displayed in the Mail and Settings apps.

Setting/Field

User name

Sophos Mobile

Description

The user’s name. The value is used for outgoing email messages.

14.20.21 Single sign-on configuration (iOS device profile)

With the Single sign-on configuration you define settings for a single sign-on for third-party apps.

Setting/Field

Name

Kerberos principal name

Realm

URLs

App IDs

Description

A human-readable name for the account.

The Kerberos principal name.

If you do not enter a value, the user must enter the name during profile installation.

The Kerberos realm name.

You must enter the name in upper-case.

A list of URL prefixes that must be matched to use the account for Kerberos authentication over HTTP.

Values must begin with http:// or https://

If a value doesn’t end with / , the / is added by

Sophos Mobile.

You may use a single asterisk (*) to match all values. For example, https://*.example.com/ matches

https://www.example.com/ and https://

m.example.com/.

A list of bundle IDs of apps.

Values must be either exact matches (e.g.

com.sophos.smsec

), or prefixes, using the characters .* at the end of the string (e.g.

com.sophos.* ).

14.20.22 AirPrint configuration (iOS device profile)

With the AirPrint configuration you add AirPrint printers to the user’s AirPrint printer list.

Setting/Field

IP address

Description

The IP address of the AirPrint printer.

Sophos Mobile

Setting/Field

Resource path

Port

Force TLS

Description

The resource path associated with the printer.

Examples:

• printers/<printer model>

• ipp/print

The listening port of the AirPrint printer.

AirPrint connections are secured by TLS.

14.20.23 Root certificate configuration (iOS device profile)

With the Root certificate configuration you install a root certificate onto devices.

Note

The certificate you upload here is only available for this profile. If you require certificates in other profiles or policies, you have to upload them again.

14.20.24 Client Certificate configuration (iOS device profile)

With the Client certificate configuration you install a client certificate onto devices.

Note

The certificate you upload here is only available for this profile. If you require certificates in other profiles or policies, you have to upload them again.

14.20.25 SCEP configuration (iOS device profile)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

URL

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.

Setting/Field

CA name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Retries

Retry delay

Key size

Use as digital signature

Sophos Mobile

Description

A name that is understood by the Certificate

Authority. The name can, for example, be used to distinguish between instances.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(SerialNumber)_% to specify an iPhone or iPad.

For information on available placeholders, see

Placeholders in profiles and policies (page 97).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.

The number of retries if the server sends a response of type pending.

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

195

Sophos Mobile

Setting/Field

Use for encryption

Description

If you select this check box, the public key can be used for data encryption.

14.20.26 Duo device certificate (iOS device profile)

With the Duo device certificate configuration you enable devices to request a certificate from the Duo Security SCEP server. If this certificate is installed on a device, the Duo Mobile iOS app classifies the device as trusted.

The required settings are common for all Duo Security accounts. Do not change the pre-populated values.

14.21 Configurations for Sophos container policies for iOS

With a Sophos container policy you configure settings that are related to the Sophos container apps

Sophos Secure Email and Sophos Secure Workspace.

For information on how to create a Sophos container policy, see

Create profile or policy (page

94).

14.21.1 General configuration (iOS Sophos container policy)

With the General configuration you define settings that apply to all Sophos container apps, if applicable.

Setting/Field

Enable Sophos container password

Description

Setting/Field

Password complexity

Always hide characters in password entry fields

Password age in days

Failed logins until lock

Allow fingerprint

Grace period in minutes

Sophos Mobile

Description

The required minimum complexity of the

Sophos container password. More secure passwords are always allowed. Passwords (a mix of numeric and alphanumeric characters) are always seen as more secure than PINs

(numeric characters only).

• Any: Sophos container passwords do not have restrictions.

• 4 digit PIN

• 6 digit PIN

• 4 char password

• 6 char password

• 8 char password

• 10 char password

Characters in password entry fields are not briefly displayed before they are masked.

The number of days that a password can be used before users are prompted to change it.

The number of failed login attempts that are tolerated before the container apps are locked.

Once they are locked an administrator needs to unlock the apps or, if allowed, users can use the

Self Service Portal to do so.

Users can use their fingerprint to unlock the app.

The period of time within which no Sophos container password must be entered when a container app comes to the foreground again.

The grace period applies to all container apps.

You can switch between the apps during the grace period without entering a password.

Sophos Mobile

Setting/Field

Last server connect

Description

The period of time within users can use a

Sophos container app without a connection to the Sophos Mobile server.

• On access: Server connection is always required and the app is locked when the server cannot be reached.

• 1 hour: Server connection is required when the app becomes active one hour or more after the last successful server connection.

• 3 hours

• 6 hours

• 12 hours

• 1 day

• 3 days

• None: No regular contact is required.

Sophos Mobile

Setting/Field

Offline starts without server connection

Description

In this field you define how often users can start one of the Sophos container apps without a server connection.

Note

This setting requires the Sophos container password feature to be turned on.

Jailbreak allowed

• Unlimited: No server connection is required.

• 0: Starting the app without a server connection is not possible.

• 1: After one start of the app, a successful server connection is necessary.

• 3

• 5

• 10

• 20

Container apps are allowed to run on jailbroken devices.

App usage constraints

Here you can define constraints on using the Sophos container apps. Click Add to enter constraints.

Geo-fencing

Time-fencing

Lets you add latitude and longitude and a radius within which the Sophos container apps can be used.

Lets you specify a start and end time within which the Sophos container apps can be used.

Days of the week on which the apps can be used can be specified as well.

Sophos Mobile

Setting/Field

Wi-Fi fencing

Description

If you select Wi-Fi connection required, the

Sophos container is locked when there is no active Wi-Fi connection.

If you add Wi-Fi networks to the list, the

Sophos container is locked when the device is connected to a Wi-Fi network not listed.

Important

We recommend that you do not rely on Wi-Fi fencing as the only security mechanism because

Wi-Fi names can be spoofed very easily.

14.21.2 Corporate Email configuration (iOS Sophos container policy)

With the Corporate Email configuration you define user settings for your Microsoft Exchange Server.

These settings are applied to the Sophos Secure Email app if it is installed in the Sophos container.

Setting/Field

Exchange server

Description

The Exchange server address.

Note

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

User

Email address

Domain

Support contact email

Use secure text fields

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The domain for this account.

The email address that will be used as the

"Contact Support" email address.

The content of input fields is secured. Autocomplete and auto-correction are disabled within the Sophos Secure Email app to prevent sensitive words to be saved in the memory of the device.

Setting/Field

Export contacts to device

Call identification

Notifications

Sophos Mobile

Description

Users are allowed to export the Exchange contacts to the local device contacts, so that they can identify company contacts in incoming calls.

Sophos Secure Email keeps the information synchronized.

Note

The local contact information is automatically deleted in the following situations:

• When the Corporate Email configuration is removed from the

Sophos container policy (requires a restart of the Secure Email app).

• When the Sophos container is removed from the device.

• When the device is unenrolled from

Sophos Mobile.

Contact information from Sophos Secure Email can be used to identify company contacts in incoming calls, without the need to export

Sophos Secure Email contacts to the device contacts.

To use this, users must turn on the following device settings:

• In the Settings app: Phone > Call Blocking &

Identification > Email

• In the Sophos Secure Email app: Settings >

Contacts > Call Identification

The notification type for new email:

• System: Notifications are managed by iOS.

They don’t include details like Sender or

Subject.

• App: Notifications are managed by the

Sophos Secure Email app. You can select how much detail is displayed. When the app is not running, no notifications are displayed.

• None: No notifications are displayed.

This setting also affects event reminders:

• System, None: Event reminders only include time information.

• App: Event reminders include time, location and title information.

201

Sophos Mobile

Setting/Field

Deny copy to clipboard

Open attachments

Maximum email size

Extra settings

Description

Users cannot copy or cut texts from the Sophos

Secure Email app.

In all apps: Attachments can be opened in all apps that support the file format.

In container apps: Attachments are encrypted with a device key and can only be opened in

Sophos Secure Workspace. The Open in action itself is not blocked.

Email messages that are larger than the size you select (including attachments) are not retrieved from the Exchange server.

Only configure these settings if instructed by

Sophos Support.

14.21.3 Corporate Documents configuration (iOS Sophos container policy)

With the Corporate Documents configuration you define settings for the Corporate Documents feature of the Sophos Secure Workspace app.

Configure storage providers

For each storage provider you can define the following settings separately:

Setting/Field

Enable

Offline

Open in (encrypted)

Open in (unencrypted)

Clipboard

Description

The storage provider is available in the app.

Users are allowed to add files from the storage provider to the app's Favorites list for offline use.

Users can share encrypted files with other apps via Open In.

Users can share unencrypted files with other apps via Open In.

Users can copy parts of a document and paste them into other apps.

Sophos Mobile

Enterprise provider settings

For Egnyte and WebDAV provider, also referred to as enterprise provider, you can centrally define server settings and login credentials. These cannot be changed by users.

Credential settings that you do not define centrally can be chosen by the users in the app's provider credential screens.

Setting/Field

Name

Server

User name

Password

Upload folder

Description

The name of the provider that is displayed in the

Sophos Secure Workspace app.

In this field, enter:

• The URL of the root folder on the

Corporate Documents WebDAV server.

• The URL of the root folder on the Egnyte server.

• The URL of the root folder on the WebDAV server.

Use the following format: https:// server.company.com

The user name for the relevant server. You can also use the %_USERNAME_% variable.

The password for the relevant account.

The upload folder for the relevant account.

Other settings

Setting/Field

Enable Documents

Description

This turns on the Documents feature to securely distribute company documents.

Sophos Mobile

Setting/Field

Passphrase complexity

Extra settings

Description

The required minimum complexity of passphrases for encryption keys. More secure passphrases are always allowed.

You can select the following settings:

• 4 char password

• 6 char password

• 8 char password

• 10 char password

Only configure these settings if instructed by

Sophos Support.

14.21.4 Corporate Browser configuration (iOS Sophos container policy)

With the Corporate Browser configuration you define settings for the Corporate Browser feature of the

Sophos Secure Workspace app.

The Corporate Browser allows you to securely access corporate intranet pages and other allowed pages. You can define domains and bookmarks within a domain.

Every bookmarks belongs to a certain domain. When you add a bookmark, the domain entry is created automatically if it does not exist.

Domain settings

Setting/Field

URL

Allow copy/paste

Allow open with

Allow save password

Description

The domain that you want to allow.

Users can copy and paste text from the

Corporate Browser to other apps.

Users can download attachments or pass them on to other apps.

Users can save their passwords in the

Corporate Browser.

Bookmark settings

Setting/Field

Name

Description

The name for the bookmark.

Setting/Field

URL

Description

The web address for the bookmark.

Sophos Mobile

14.21.5 Root certificate configuration (iOS Sophos container policy)

Sophos container.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

14.21.6 Client certificate configuration (iOS Sophos container policy)

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

14.21.7 SCEP configuration (iOS Sophos container policy)

Corporate Browser feature of the Sophos Secure Workspace app.

Note

You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.

Sophos Mobile

Setting/Field

URL

Alias name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the

SCEP tab of the Sophos setup page.

The name under which the certificate will appear in selection dialogs.

This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(SerialNumber)_% to specify an iPhone or iPad.

For information on available placeholders, see

Placeholders in profiles and policies (page

97).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified

URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the

SCEP tab of the Sophos setup page.

Setting/Field

Root certificate

Key size

Use as digital signature

Use for encryption

Sophos Mobile

Description

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current profile.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

14.22 Configurations for Mobile Security policies for iOS

With a Mobile Security policy you configure the Sophos Mobile Security app.

For information on how to create a Mobile Security policy, see Create profile or policy

(page 94).

14.22.1 Network configuration (Sophos Mobile Security policy for iOS)

With the Network configuration you manage the network settings of the Sophos Mobile Security app that protects users from network-based threats.

Note

When you assign this configuration to a device, the corresponding settings in the Sophos Mobile

Security app are disabled. The user can’t change them.

Setting/Field

Man-in-the-middle protection

Extra settings

Description

Sophos Mobile Security checks the Wi-Fi connection for man-in-the-middle attacks.

Only configure these settings if instructed by Sophos

Support.

Sophos Mobile

14.22.2 Web Filtering configuration (Sophos Mobile Security policy for iOS)

With the Web Filtering configuration you manage the Web Filtering feature of the Sophos Mobile

Security app. This protects users from browsing sites with malicious, undesirable or illegal content. This configuration only affects supervised devices.

Note

When you assign this configuration to a device, the corresponding settings in the Sophos Mobile

Security app are disabled. The user can’t change them.

Setting/Field

Filter malicious websites

Filter websites by category

Description

Select if users can access websites with malicious content.

Select if users can access websites that fall into a certain category.

Sophos Mobile Security categorizes websites based on data from SophosLabs. The data is updated constantly.

Tip

For the purpose of testing website filtering, Sophos has created the site sophostest.com

containing example pages for each category. Although some of these pages are classified as potentially offensive or dangerous, the page content itself is harmless in all cases.

Website exceptions Configure exceptions to the category filters:

Allowed domains: Websites that are allowed, even though the category they belong to is blocked.

Blocked domains: Websites that are blocked, even though the category they belong to is allowed.

You can enter domain names or IP addresses. Examples:

• www.example.com

• *.example.com

• 198.51.100.1

• 198.51.100.0/24

Sophos Mobile

14.22.3 SMS Filtering configuration (Sophos Mobile Security policy for iOS)

With the SMS Filtering configuration you define domain names for the SMS Filtering feature of the

Sophos Mobile Security iOS app.

SMS Filtering protects users from SMS and MMS attacks. It moves messages containing a fake domain to SMS Junk, excluding messages from senders available in Contacts.

A fake domain looks like your real domain but is slightly modified:

• Single characters are substituted, inserted, or transposed.

• The domain name is amended by prefix or suffix.

• The Top Level Domain (TLD) is different.

For example if your real domain is sophos.com

, the following are fake domains:

• s0phos.com

(substitution)

• soophos.com

(insertion)

• sohpos.com

(transposition)

• mysophos.com

(prefix)

• sophos.net

(different TLD)

Subdomains like hr.sophos.com

are not filtered.

14.23 Configurations for macOS device policies

With a macOS device policy you configure various aspects of Macs, like password policies, restrictions or Wi-Fi settings. The device policy applies to all users that log in to the Mac you assign the policy to, whether they are managed by Sophos Mobile or not.

Related concepts

About macOS policies

(page 96)

Configurations for macOS user policies (page 226)

Related tasks

Create profile or policy (page 94)

Sophos Mobile

210

14.23.1 Password policies configuration (macOS device policy)

With the Password policies configuration you define requirements for the passwords of Mac user accounts.

Note

When the Password policies configuration is assigned to a device, a grace period of 60 minutes starts. Within the grace period, the user is asked to change the password when they return to the

Home screen to comply with the policies. After the grace period, the user may not start any apps on the device, including internal apps.

Setting/Field

Allow simple value

Require alphanumeric value

Minimum password length

Minimum number of complex characters

Maximum password age in days

Maximum Auto-Lock (in minutes)

Password history

Maximum grace period for device lock

Description

Users are allowed to use sequential or repeated characters in their password, for example 1111 or abcde .

Passwords must contain at least one letter or number.

Specifies the minimum number of characters a password must contain.

Specifies the minimum number of nonalphanumeric characters (for example & or !) a password must contain.

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

In this field, you can specify the maximum value the user is allowed to configure on the device. Auto-Lock specifies how soon (in minutes) the device will be locked if it has not been used.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

Immediately, users must enter a password every time they unlock their devices.

Sophos Mobile

Setting/Field

Number of failed attempts until device wipe

Description

14.23.2 Restrictions configuration (macOS device policy)

With the Restrictions configuration you define restrictions for Macs.

Note

Some options are only available for certain versions of macOS. This is indicated by blue labels in

Sophos Mobile Admin.

Device

Setting/Field

Allow use of camera

Allow internet search result for

Spotlight

Allow Apple Music macOS software update delay

Description

If the check box is cleared, the camera is unavailable and the Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.

If the check box is cleared, Spotlight does not return internet search results.

Users can access the Apple Music library.

The number of days that an update of the macOS software is delayed after its release date.

Enter a value between 0 (no delay) and 90.

iCloud

Setting/Field

Allow backup

Description

Users can back up their devices to iCloud.

Sophos Mobile

Setting/Field

Allow iCloud Photo Library

Allow iCloud Keychain sync

Allow document sync

Allow Back to My Mac

Allow Find My Mac

Allow iCloud Bookmarks

Allow iCloud Mail

Allow iCloud Calendar

Allow iCloud Reminders

Allow iCloud Address Book

Allow iCloud Notes

Allow iCloud Drive for Desktop and

Documents

Description

Users can use iCloud Photo Library.

Users can use iCloud Keychain to synchronize passwords across their iPhones, iPads, and Macs.

If the check box is cleared, iCloud Keychain data is only stored locally on the device.

Users can store documents and app configuration data in iCloud.

Users can use iCloud Back to My Mac, i.e. file and screen sharing between a remote and a local Mac.

Users can use iCloud Find My Mac to locate, lock, or wipe their Mac remotely.

Users can use iCloud Bookmarks to synchronize web bookmarks between browsers and platforms.

Users can set up an iCloud Mail account on their Mac.

Users can use iCloud Calendar to share their calendars across their devices and with other iCloud users.

Users can use iCloud Reminders to share reminder lists across their devices and with other iCloud users.

Users can use iCloud Address Book to share contacts across their devices and with other iCloud users.

Users can use iCloud Notes to take notes and to share them across their devices and with other users.

Users can store their Mac Desktop and their

Documents folder in iCloud Drive and access them on other devices.

Security and privacy

Setting/Field

Allow Touch ID to unlock device

Allow definition lookup

Allow Auto Unlock

Description

If the check box is cleared, the device can’t be unlocked by Touch ID.

Users can look up definitions for highlighted words.

Users can use Auto Unlock to have their Mac automatically unlocked by their Apple Watch.

Sophos Mobile

Setting/Field

Allow iTunes File Sharing

Allow AirPrint

Allow iBeacon discovery of AirPrint printers

Description

Users can use File Sharing in iTunes to copy files between their Mac and an iPhone or iPad.

Users can send files to AirPrint-enabled printers.

The device uses iBeacon to discover AirPrint devices.

Important

If you allow this, malicious AirPrint devices can perform phishing attacks on network traffic.

Force trusted certificates for AirPrint over TLS

Allow password auto-fill

Request Wi-Fi passwords from nearby devices

Allow AirDrop password sharing

AirPrint over TLS is rejected if the AirPrint device uses an untrusted certificate.

Users can turn on the AutoFill Passwords setting, which lets them use saved password or credit card information in Safari or other apps.

If this check box is cleared, automatic suggestion of strong passwords is disabled as well.

The device requests passwords from nearby devices when setting up a Wi-Fi connection.

Users can share passwords from Password Manager with other users via AirDrop.

14.23.3 Wi-Fi configuration (macOS device policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Connect automatically

Hidden network

Description

The ID of the Wi-Fi network.

Automatically connect to the target network.

The target network is not open or visible.

Sophos Mobile

Setting/Field

Security type

214

Description

The security type of the Wi-Fi network:

• None

• WEP (personal)

• WPA/WPA2 (personal)

• Any (personal)

• WEP (enterprise)

• WPA/WPA2 (enterprise)

• Any (enterprise)

If you select a type with Personal in its name, a

Password field is displayed. Enter the relevant password.

If you select a type with Enterprise in its name, the tabs Protocols, Authentication and Trust are displayed.

On the Protocols tab configure the following:

• Under EAP-FAST, configure the EAP-FAST Protected

Access credential settings.

• In TLS minimum version and TLS maximum version, select a minimum and a maximum TLS version to be used with EAP authentication.

On the Authentication tab, configure client authentication settings:

• In the User field, enter the user name for the connection to the Wi-Fi network.

• Select Require password on each connect, if the password is to be queried for each connection and transferred with the authentication.

• In the Password field, enter the relevant password.

• In the Identity certificate list, select the certificate for the connection to the Wi-Fi network.

Note

The certificate to be used has to be specified in a

Client certificate configuration.

• In the External identity field, enter the externally visible

ID (for TTLS, PEAP and EAP-FAST).

On the Trust tab, configure server authentication settings:

Select the trusted certificates from the list.

Note

certificate configuration.

Setting/Field

Proxy

Sophos Mobile

Description

In this list, select the proxy settings for the Wi-Fi connection:

• No proxy

• Manually

• Automatic

If you select Manually, the fields Server and port,

Authentication and Password are displayed.

Enter the required proxy information. If you select

Automatic, the field PAC URL is displayed. Enter the URL of the proxy server.

14.23.4 Gatekeeper configuration (macOS device policy)

With the Gatekeeper configuration you configure macOS Gatekeeper, which blocks apps installed from forbidden sources.

Setting/Field

Allow apps downloaded from

Description

Select the required setting:

• Anywhere: Users can open all apps, regardless of where they were installed from.

• Mac App Store: Users can only open apps from Mac App Store.

• Mac App Store and identified developers:

Users can only open apps from Mac App

Store or from identified developers, i.e.

developers approved by Apple.

14.23.5 Kernel extension policy configuration (macOS device policy)

With the Kernel extension policy configuration you approve or block certain third-party kernel extensions (KEXTs). Without this configuration, macOS asks the user for approval when an app wants to install a kernel extension.

Setting/Field Description

Allow user-approved extensions

When an app wants to install a kernel extension not approved by this configuration, macOS asks the user to approve it.

If the check box is cleared, extensions not approved by this configuration are blocked.

Approve Sophos extensions Sophos kernel extensions are approved.

Sophos Mobile

Setting/Field

Approved Team IDs

Description

A list of

Team ID

values.

Kernel extensions signed by one of these IDs are approved.

To find the Team ID of a kernel extension, install it on a Mac in your test environment. Then enter the following two commands in Terminal: sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy

SELECT * FROM kext_policy;

Use Control-D to exit the sqlite3 session.

You get one line of output for every kernel extension installed. In each line, the first value is the

Team ID.

14.23.6 VPN configuration (macOS device policy)

With the VPN configuration you define VPN settings for network connections.

Setting/Field

Connection name

Connection type

Identifier (reverse DNS format)

Server

Account

Third-party settings

Send all traffic through VPN

Description

The name of the connection shown on the device.

The type of the VPN connection:

• Cisco AnyConnect

• Cisco Legacy AnyConnect

• IPsec (Cisco)

• F5

• Check Point

• Custom SSL/TLS

Different entry fields are shown on the VPN page depending on the connection type you select here.

The custom identifier in reverse DNS format.

The host name or the IP address of the server.

The user account for the authentication of the connection.

If your vendor has specified custom connection properties, you can enter them in this field.

To enter a property, click Add and then enter

Key and Value of the property in the dialog box.

All traffic is sent through VPN.

Setting/Field

Group

User authentication

Device authentication

Sophos Mobile

Description

The group that may be required for the authentication of the connection.

The type of user authentication for the connection:

• Password

If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.

• Certificate

If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.

The type of device authentication:

• Keys (Shared Secret)/Group name

If you select this option, the fields Group

name, Keys (Shared Secret), Use hybrid

authentication and Request password are displayed below the Device authentication field. Enter the required authentication information in the Group name and Keys

(Shared Secret) fields. Select Use hybrid

authentication and Request password as required.

• Certificate

If you select this option, the fields

Certificate and Including user PIN are displayed below the Device authentication field. In the Certificate list, select the required certificate. Select Including user

PIN to include the user PIN in device authentication.

Sophos Mobile

Setting/Field

Proxy

Provider type

Description

The proxy settings for the connection:

• No proxy

• Manually

If you select this option, the fields Server

• Automatic

If you select this option, the Proxy server

URL field is displayed. Enter the URL of the server with the proxy setting in this field.

The VPN connection type.

• App proxy: Network traffic is sent through a

VPN tunnel at the application layer.

• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.

14.23.7 Firewall configuration (macOS device policy)

With the Firewall configuration you define settings for the application firewall included in macOS.

Setting/Field

Turn on application firewall

Block all incoming connections

Use stealth mode

Automatically allow built-in apps

Description

The application firewall is turned on.

Sharing services, such as File Sharing or Screen Sharing, are not allowed to receive incoming connections.

This does not affect the following system services:

• configd (DHCP and other network configuration services)

• mDNSResponder (Bonjour)

• racoon (IPSec)

The computer ignores unexpected requests, such as ping requests.

Built-in apps, such as iTunes, are added to the list of apps allowed to receive connections.

You can’t turn this setting off.

Sophos Mobile

Setting/Field

Automatically allow signed downloaded apps

Allowed connections

Denied connections

Description

Apps signed by a valid certificate authority are added to the list of apps allowed to receive connections.

You can’t turn this setting off.

An app group containing apps allowed to receive connections.

For other apps, users can choose to allow or deny a connection.

An app group containing apps not allowed to receive connections.

For other apps, users can choose to allow or deny a connection.

14.23.8 Web content filter configuration (macOS device policy)

With the Web content filter configuration you define settings for a third-party app for filtering internet content.

Setting/Field

Filter name

Filter ID

Server

Organization

Description

A custom name for the filter configuration.

The bundle ID of the third-party app.

The server hosting the filtering service (host name, IP address, or

URL).

The name of your organization. The value is passed to the filtering service.

User name

Password

Certificate

Filter range

The credentials required for connecting to the filtering service.

Third-party settings

A certificate for authenticating to the filtering service.

The traffic to be filtered by the third-party app:

• Filter browser traffic: WebKit browser traffic is filtered.

• Filter socket traffic: Socket traffic is filtered.

• Filter browser and socket traffic: WebKit and socket traffic is filtered.

Additional configuration settings, if required by the third-party app.

Sophos Mobile

14.23.9 Global HTTP proxy configuration (macOS device policy)

With the Global HTTP proxy configuration you define a corporate proxy server.

Setting/Field

Proxy

Server and port

Authentication

Password

PAC URL

Description

Select Manually to configure the connection details manually.

Select Automatic if you have a proxy auto-config (PAC) file.

The name (or the IP address) and the port number of the HTTP proxy.

The user name to connect to the proxy server.

The password to connect to the proxy server.

The URL of the proxy auto-config (PAC) file.

14.23.10 Managed domains configuration (macOS device policy)

With the Managed domains configuration you define managed domains for Macs.

Email domains

Enter email domains managed by your organization. Email messages from an address that doesn’t match one of the configured domains are highlighted as out-of-domain in the Mail app.

14.23.11 Single sign-on configuration (macOS device policy)

With the Single sign-on configuration you define settings for a single sign-on for third-party apps.

Setting/Field

Name

Kerberos principal name

Realm

Description

A human-readable name for the account.

The Kerberos principal name.

If you do not enter a value, the user must enter the name during profile installation.

The Kerberos realm name.

You must enter the name in upper-case.

Setting/Field

URLs

App IDs

Sophos Mobile

Description

A list of URL prefixes that must be matched to use the account for Kerberos authentication over HTTP.

Values must begin with http:// or https://

If a value doesn’t end with / , the / is added by

Sophos Mobile.

A list of bundle IDs of apps.

Values must be either exact matches (e.g.

com.sophos.smsec

), or prefixes, using the characters .* at the end of the string (e.g.

com.sophos.* ).

14.23.12 AirPrint configuration (macOS device policy)

With the AirPrint configuration you add AirPrint printers to the user’s AirPrint printer list.

Setting/Field

IP address

Resource path

Description

The IP address of the AirPrint printer.

The resource path associated with the printer.

Examples:

• printers/<printer model>

• ipp/print

14.23.13 Directory service configuration (macOS device policy)

With the Directory service configuration you specify an Active Directory domain that a Mac joins when the policy is assigned to it.

Note

If the Active Directory domain you configure here is the same domain you use for the Self Service

Portal, the macOS user policy assigned to the Mac is applied to all Active Directory users that log in to the Mac.

General settings

Setting/Field

Domain host name

Description

The DNS host name of the Active Directory domain to join.

Sophos Mobile

Setting/Field

AD administrator name

Password

Organizational unit

Description

The credentials of the user account used for connecting to the Active Directory server.

This user must have permissions to add devices to the Active Directory database.

The organizational unit (OU) within the Active

Directory database where the joining computer is added.

222

User experience

Setting/Field

Create mobile account

Require confirmation before creating a mobile account

Force local home folder

Use UNC path from Active Directory

Network protocol

Default user shell

Description macOS creates a mobile account when a network user logs in for the first time.

With a mobile account, users can log in to the

Mac with their Active Directory credentials even when the Mac is not connected to the Active

Directory server.

The user decides whether to create a mobile account or not.

Select this check box to force the creation of user profiles on the startup disk. This is required for mobile accounts.

If you clear the check box, pure network home directories are used.

macOS mounts the home folder specified in the

Active Directory user account.

The protocol for mounting the home folder.

The command-line shell for the user.

If you leave this field empty, /bin/bash is used.

Mapping

Setting/Field

UID attribute

User GID attribute

Description

The Active Directory attribute that is mapped to the unique user ID (UID) in macOS.

The Active Directory attribute that is mapped to the primary group ID in macOS user accounts.

Setting/Field

Group GID attribute

Sophos Mobile

Description

The Active Directory attribute that is mapped to the group ID in macOS group accounts.

Important

If you change these mapping settings later, users might lose access to previously created files.

Administrative

Setting/Field

Preferred DC server

Password trust interval in days

Namespace

Packet signing

Packet encryption

Description

The Active Directory domain controller (DC) that is consulted first.

If you leave this field empty, macOS selects the domain controller by site information and controller responsiveness.

Specify how often macOS changes the password of its Active Directory computer account.

If you leave this field empty, macOS changes its password every 14 days.

If you set a value of 0 , macOS doesn’t change the password automatically.

• Forest

Namespace support is turned on. Multiple users with the same login name that exist in different domains of the Active Directory forest can log in.

Users must enter their login name as DOMAIN

\name .

• Domain

Namespace support is turned off. Users must have a unique login name.

macOS can sign and encrypt the LDAP connections used for Active Directory communication.

• Allow: macOS decides if to sign and/or encrypt the

LDAP connections.

• Disable: macOS doesn’t sign or encrypt the LDAP connections.

• Require: macOS always signs and encrypts LDAP connections.

• SSL/TLS: macOS always uses LDAP over SSL/TLS.

Sophos Mobile

Setting/Field

Multi-domain authentication

Domain administrator groups

Restrict DDNS

Description

Users from all domains in the Active Directory forest can log in.

A list of Active Directory groups.

Members of these groups are granted administrative privileges on the Mac.

To enter more than one group, press Enter after each entry.

A list of network interfaces.

By default, macOS uses Dynamic DNS (DDNS) for all network interfaces. To restrict DDNS to certain interfaces, enter their BSD names.

For example to restrict DDNS to the built-in

Ethernet port, enter en0 .

To enter more than one interface, press Enter after each entry.

14.23.14 Root certificate configuration (macOS device policy)

With the Root certificate configuration you install a root certificate onto Macs.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

14.23.15 Client Certificate configuration (macOS device policy)

With the Client certificate configuration you install a client certificate onto Macs.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

Sophos Mobile

14.23.16 SCEP configuration (macOS device policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

URL

CA name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.

A name that is understood by the Certificate

Authority. The name can, for example, be used to distinguish between instances.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(SerialNumber)_% to specify a Mac.

For information on available placeholders, see

Placeholders in profiles and policies (page 97).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.

Sophos Mobile

Setting/Field

Retries

Retry delay

Key size

Description

The number of retries if the server sends a response of type pending.

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

14.24 Configurations for macOS user policies

With a macOS user policy you configure various aspects of Macs, like password policies, restrictions or Wi-Fi settings. The user policy applies to all managed users of the Mac you assign the policy to.

Related concepts

About macOS policies

(page 96)

Configurations for macOS device policies (page 209)

Related tasks

Create profile or policy (page 94)

14.24.1 Password policies configuration (macOS user policy)

With the Password policies configuration you define requirements for the passwords of Mac user accounts.

Note

When the Password policies configuration is assigned to a device, a grace period of 60 minutes starts. Within the grace period, the user is asked to change the password when they return to the

Home screen to comply with the policies. After the grace period, the user may not start any apps on the device, including internal apps.

Setting/Field

Allow simple value

Require alphanumeric value

Minimum password length

Description

Users are allowed to use sequential or repeated characters in their password, for example 1111 or abcde .

Passwords must contain at least one letter or number.

Specifies the minimum number of characters a password must contain.

Sophos Mobile

Setting/Field

Minimum number of complex characters

Maximum password age in days

Maximum Auto-Lock (in minutes)

Password history

Maximum grace period for device lock

Number of failed attempts until device wipe

Description

Specifies the minimum number of nonalphanumeric characters (for example & or !) a password must contain.

Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.

In this field, you can specify the maximum value the user is allowed to configure on the device. Auto-Lock specifies how soon (in minutes) the device will be locked if it has not been used.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

Immediately, users must enter a password every time they unlock their devices.

14.24.2 Restrictions configuration (macOS user policy)

With the Restrictions configuration you define restrictions for Macs.

Note

Some options are only available for certain versions of macOS. This is indicated by blue labels in

Sophos Mobile Admin.

Sophos Mobile

Device

Setting/Field

Allow use of camera

Allow internet search result for

Spotlight

Allow Apple Music macOS software update delay

Description

If the check box is cleared, the camera is unavailable and the Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.

If the check box is cleared, Spotlight does not return internet search results.

Users can access the Apple Music library.

The number of days that an update of the macOS software is delayed after its release date.

Enter a value between 0 (no delay) and 90.

iCloud

Setting/Field

Allow backup

Allow iCloud Photo Library

Allow iCloud Keychain sync

228

Allow document sync

Allow Back to My Mac

Allow Find My Mac

Allow iCloud Bookmarks

Allow iCloud Mail

Allow iCloud Calendar

Description

Users can back up their devices to iCloud.

Users can use iCloud Photo Library.

Users can use iCloud Keychain to synchronize passwords across their iPhones, iPads, and Macs.

If the check box is cleared, iCloud Keychain data is only stored locally on the device.

Users can store documents and app configuration data in iCloud.

Users can use iCloud Back to My Mac, i.e. file and screen sharing between a remote and a local Mac.

Users can use iCloud Find My Mac to locate, lock, or wipe their Mac remotely.

Users can use iCloud Bookmarks to synchronize web bookmarks between browsers and platforms.

Users can set up an iCloud Mail account on their Mac.

Users can use iCloud Calendar to share their calendars across their devices and with other iCloud users.

Setting/Field

Allow iCloud Reminders

Allow iCloud Address Book

Allow iCloud Notes

Allow iCloud Drive for Desktop and

Documents

Sophos Mobile

Description

Users can use iCloud Reminders to share reminder lists across their devices and with other iCloud users.

Users can use iCloud Address Book to share contacts across their devices and with other iCloud users.

Users can use iCloud Notes to take notes and to share them across their devices and with other users.

Users can store their Mac Desktop and their

Documents folder in iCloud Drive and access them on other devices.

Security and privacy

Setting/Field

Allow Touch ID to unlock device

Allow definition lookup

Allow Auto Unlock

Allow iTunes File Sharing

Allow AirPrint

Allow iBeacon discovery of AirPrint printers

Description

If the check box is cleared, the device can’t be unlocked by Touch ID.

Users can look up definitions for highlighted words.

Users can use Auto Unlock to have their Mac automatically unlocked by their Apple Watch.

Users can use File Sharing in iTunes to copy files between their Mac and an iPhone or iPad.

Users can send files to AirPrint-enabled printers.

The device uses iBeacon to discover AirPrint devices.

Important

If you allow this, malicious AirPrint devices can perform phishing attacks on network traffic.

Force trusted certificates for AirPrint over TLS

Allow password auto-fill

Request Wi-Fi passwords from nearby devices

AirPrint over TLS is rejected if the AirPrint device uses an untrusted certificate.

Users can turn on the AutoFill Passwords setting, which lets them use saved password or credit card information in Safari or other apps.

If this check box is cleared, automatic suggestion of strong passwords is disabled as well.

The device requests passwords from nearby devices when setting up a Wi-Fi connection.

Sophos Mobile

Setting/Field

Allow AirDrop password sharing

Description

Users can share passwords from Password Manager with other users via AirDrop.

14.24.3 Exchange account configuration (macOS user policy)

With the Exchange account configuration you set up an Exchange Web Services (EWS) account for

Contacts, Mail, Reminders, and Calendar.

Setting/Field

Account name

Exchange server

Description

The account name.

The Exchange server address.

Note

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

Domain

User

Email address

Password

OAuth

OAuth sign-in URL

SSL/TLS

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The account uses OAuth for authentication, i.e.

users authenticate with their Microsoft credentials.

The URL of the sign-in page for OAuth authentication.

Use this setting if the Autodiscover service of the

Exchange server is turned off.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

Sophos Mobile

14.24.4 Wi-Fi configuration (macOS user policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Connect automatically

Hidden network

Description

The ID of the Wi-Fi network.

Automatically connect to the target network.

The target network is not open or visible.

Sophos Mobile

Setting/Field

Security type

232

Description

The security type of the Wi-Fi network:

• None

• WEP (personal)

• WPA/WPA2 (personal)

• Any (personal)

• WEP (enterprise)

• WPA/WPA2 (enterprise)

• Any (enterprise)

If you select a type with Personal in its name, a

Password field is displayed. Enter the relevant password.

If you select a type with Enterprise in its name, the tabs Protocols, Authentication and Trust are displayed.

On the Protocols tab configure the following:

• Under EAP-FAST, configure the EAP-FAST Protected

Access credential settings.

• In TLS minimum version and TLS maximum version, select a minimum and a maximum TLS version to be used with EAP authentication.

On the Authentication tab, configure client authentication settings:

• In the User field, enter the user name for the connection to the Wi-Fi network.

• Select Require password on each connect, if the password is to be queried for each connection and transferred with the authentication.

• In the Password field, enter the relevant password.

• In the Identity certificate list, select the certificate for the connection to the Wi-Fi network.

Note

The certificate to be used has to be specified in a

Client certificate configuration.

• In the External identity field, enter the externally visible

ID (for TTLS, PEAP and EAP-FAST).

On the Trust tab, configure server authentication settings:

Select the trusted certificates from the list.

Note

certificate configuration.

Setting/Field

Proxy

Sophos Mobile

Description

In this list, select the proxy settings for the Wi-Fi connection:

• No proxy

• Manually

• Automatic

If you select Manually, the fields Server and port,

Authentication and Password are displayed.

Enter the required proxy information. If you select

Automatic, the field PAC URL is displayed. Enter the URL of the proxy server.

14.24.5 VPN configuration (macOS user policy)

With the VPN configuration you define VPN settings for network connections.

Setting/Field

Connection name

Connection type

Identifier (reverse DNS format)

Server

Account

Third-party settings

Send all traffic through VPN

Description

The name of the connection shown on the device.

The type of the VPN connection:

• Cisco AnyConnect

• Cisco Legacy AnyConnect

• IPsec (Cisco)

• F5

• Check Point

• Custom SSL/TLS

Different entry fields are shown on the VPN page depending on the connection type you select here.

The custom identifier in reverse DNS format.

The host name or the IP address of the server.

The user account for the authentication of the connection.

If your vendor has specified custom connection properties, you can enter them in this field.

To enter a property, click Add and then enter

Key and Value of the property in the dialog box.

All traffic is sent through VPN.

Sophos Mobile

Setting/Field

Group

User authentication

Device authentication

Description

The group that may be required for the authentication of the connection.

The type of user authentication for the connection:

• Password

If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.

• Certificate

If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.

The type of device authentication:

• Keys (Shared Secret)/Group name

If you select this option, the fields Group

name, Keys (Shared Secret), Use hybrid

authentication and Request password are displayed below the Device authentication field. Enter the required authentication information in the Group name and Keys

(Shared Secret) fields. Select Use hybrid

authentication and Request password as required.

• Certificate

If you select this option, the fields

Certificate and Including user PIN are displayed below the Device authentication field. In the Certificate list, select the required certificate. Select Including user

PIN to include the user PIN in device authentication.

Setting/Field

Proxy

Provider type

Sophos Mobile

Description

The proxy settings for the connection:

• No proxy

• Manually

If you select this option, the fields Server

• Automatic

If you select this option, the Proxy server

URL field is displayed. Enter the URL of the server with the proxy setting in this field.

The VPN connection type.

• App proxy: Network traffic is sent through a

VPN tunnel at the application layer.

• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.

14.24.6 Web Clip configuration (macOS user policy)

With the Web Clip configuration you define Web Clips to be added to the macOS desktop. Web Clips provide fast access to favorite web pages. But you can also add a Web Clip with a support phone number for example, to provide a quick way to dial the helpdesk.

Setting/Field

Description

URL

Can be removed

Full screen

Description

A description for the Web Clip.

The web address of the Web Clip.

If the check box is cleared, the user cannot remove the Web Clip. It cannot be deleted from the device unless the user removes the profile that installed it.

The Web Clip is opened full screen on the device. A full screen Web Clip opens the URL as a web app.

Sophos Mobile

Setting/Field

Icon

Description

Select an image to be used as the Web Clip icon on the Home screen. This must be a PNG,

GIF or JPEG image with a maximum file size of

1 MB.

The image is cropped to a square and scaled to match the display resolution. For best results, we recommend that you use an image of size

180 px by 180 px.

Note

236

14.24.7 Web content filter configuration (macOS user policy)

With the Web content filter configuration you define settings for a third-party app for filtering internet content.

Setting/Field

Filter name

Filter ID

Server

Organization

Description

A custom name for the filter configuration.

The bundle ID of the third-party app.

The server hosting the filtering service (host name, IP address, or

URL).

The name of your organization. The value is passed to the filtering service.

User name

Password

Certificate

Filter range

The credentials required for connecting to the filtering service.

Third-party settings

A certificate for authenticating to the filtering service.

The traffic to be filtered by the third-party app:

• Filter browser traffic: WebKit browser traffic is filtered.

• Filter socket traffic: Socket traffic is filtered.

• Filter browser and socket traffic: WebKit and socket traffic is filtered.

Additional configuration settings, if required by the third-party app.

Sophos Mobile

14.24.8 Global HTTP proxy configuration (macOS user policy)

With the Global HTTP proxy configuration you define a corporate proxy server.

Setting/Field

Proxy

Server and port

Authentication

Password

PAC URL

Description

Select Manually to configure the connection details manually.

Select Automatic if you have a proxy auto-config (PAC) file.

The name (or the IP address) and the port number of the HTTP proxy.

The user name to connect to the proxy server.

The password to connect to the proxy server.

The URL of the proxy auto-config (PAC) file.

14.24.9 Managed domains configuration (macOS user policy)

With the Managed domains configuration you define managed domains for Macs.

Email domains

Enter email domains managed by your organization. Email messages from an address that doesn’t match one of the configured domains are highlighted as out-of-domain in the Mail app.

14.24.10 CalDAV configuration (macOS user policy)

With the CalDAV configuration you configure the synchronization of calendar data with a CalDAV server. For example, this can be used to sync Google Calendar with a Mac.

Setting/Field

Account name

Account host and port

Description

The display name of the CalDAV account on the device.

The host name or IP address and optionally the port number of the CalDAV server.

For example, for Google Calendar enter: calendar.google.com:443

Sophos Mobile

Setting/Field

Principal URL

User name, Password

SSL/TLS

Description

If required by the CalDAV server, enter the principal URL of the calendar resource.

For example, to sync with a calendar other than the primary calendar in a Google account, enter: https://apidata.googleusercontent.com/ caldav/

v2/calendar_id/user where calendar_id is the ID of the calendar you want to sync with. In the Google Calendar web application, the calendar ID is displayed in the calendar settings. See the

Google Calendar help for details.

The login credentials for the CalDAV account.

For example, for Google Calendar enter the credentials of the Google account.

The connection to the CalDAV server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

14.24.11 CardDAV configuration (macOS user policy)

With the CardDAV configuration you configure the synchronization of contact data with a CardDAV server. For example, this can be used to sync Google Contacts with a Mac.

Setting/Field

Account name

Account host and port

Principal URL

Description

The display name of the CardDAV account on the device.

The host name or IP address and optionally the port number of the CardDAV server.

For example, for Google Contacts enter: google.com

If required by the CardDAV server, enter the principal URL of the contacts resource.

For example, the Google CardDAV API supports the following principal URL: https://www.googleapis.com/carddav/

v1/ principals/account_name@gmail.com

where account_name is the Google account name.

Setting/Field

User name, Password

SSL/TLS

Sophos Mobile

Description

The login credentials for the CardDAV account.

For example, for Google Contacts enter the credentials of the Google account.

The connection to the CardDAV server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

14.24.12 IMAP/POP configuration (macOS user policy)

With the IMAP/POP configuration you add an IMAP or POP email account to Macs.

Setting/Field

Account name

Account type

User display name

Email address

Description

The display name of the email account on the device.

The type of the email server for incoming email (either

IMAP or POP).

The display name of the user for outgoing email.

Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.

The email address of the account.

Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.

Incoming email

Email server and port

User name

Authentication type

Password

SSL/TLS

The host name or IP address and the port number of the server for incoming email (inbound server).

The user name for connecting to the inbound server.

The authentication method for connecting to the inbound server.

The password for connecting to the inbound server (if required).

The connection to the inbound server is secured by SSL or TLS (depending on what the server supports).

Outgoing email

Email server and port The host name or IP address and the port number of the server for outgoing email (outbound server).

Sophos Mobile

Setting/Field

User name

Authentication type

Password

Use same password as for incoming email

SSL/TLS

Description

The user name for connecting to the outbound server.

The authentication method for connecting to the outbound server.

The password for connecting to the outbound server (if required).

Use the password that is specified for incoming email.

The connection to the outbound server is secured by SSL or TLS (depending on what the server supports).

14.24.13 Single sign-on configuration (macOS user policy)

With the Single sign-on configuration you define settings for a single sign-on for third-party apps.

Setting/Field

Name

Kerberos principal name

Realm

URLs

App IDs

Description

A human-readable name for the account.

The Kerberos principal name.

If you do not enter a value, the user must enter the name during profile installation.

The Kerberos realm name.

You must enter the name in upper-case.

A list of URL prefixes that must be matched to use the account for Kerberos authentication over HTTP.

Values must begin with http:// or https://

If a value doesn’t end with / , the / is added by

Sophos Mobile.

A list of bundle IDs of apps.

Values must be either exact matches (e.g.

com.sophos.smsec

), or prefixes, using the characters .* at the end of the string (e.g.

com.sophos.* ).

Sophos Mobile

14.24.14 LDAP configuration (macOS user policy)

With the LDAP configuration you add user information from an LDAP directory to the macOS Address

Book app.

Note

To configure a Mac to join an Active Directory domain, use the Directory service configuration.

See

Directory service configuration (macOS device policy) (page 221).

Setting/Field

Account description

Host name

User name

Password

Use SSL/TLS

Search settings

Base

Scope

Description

Description

A description of the LDAP connection.

The host name or IP address of the LDAP server.

The sign-in credentials Sophos Mobile uses to connect to the LDAP server.

The connection to the LDAP server is secured by SSL or TLS (depending on what the server supports).

The nodes in the LDAP tree to start searching from, and the search scope.

The path to the start node for the search.

For example: ou=users,o=my company

The scope of sub-nodes to include in the search:

• Base node only: Only the base node.

• Base node and direct child nodes: The base node and its child nodes, that is the firstlevel sub-nodes.

• Base node and all sub-nodes: The base node and all sub nodes.

A description of the search setting.

14.24.15 App Store configuration (macOS user policy)

With the App Store configuration you restrict the App Store usage.

Setting/Field

Require admin password

Description

Users require an administrator password to install or update apps.

Sophos Mobile

Setting/Field

Restrict to updates

Forbid app adoption

Turn off update notifications

Description

Users can update apps but can’t install new apps.

App adoption allows users to assign apps to their

Apple ID that have not been installed through the

App Store. If you forbid app adoption, users can’t update these apps.

For example, this affects iLife or iWork apps bundled with the Mac.

Users don’t receive update notifications.

14.24.16 Root certificate configuration (macOS user policy)

With the Root certificate configuration you install a root certificate onto Macs.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

14.24.17 Client Certificate configuration (macOS user policy)

With the Client certificate configuration you install a client certificate onto Macs.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

14.24.18 SCEP configuration (macOS user policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

URL

Description

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.

Setting/Field

CA name

Subject

Type of Subject Alternative Name

Value of Subject Alternative Name

AD user logon name

Challenge

Retries

Retry delay

Key size

Sophos Mobile

Description

A name that is understood by the Certificate

Authority. The name can, for example, be used to distinguish between instances.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(SerialNumber)_% to specify a Mac.

For information on available placeholders, see

Placeholders in profiles and policies (page 97).

To add a Subject Alternative Name (SAN) to the

SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:

• RFC 822 name: A valid email address.

• DNS name: The DNS name of the CA server.

• Uniform resource identifier: The fully qualified URL of the CA server.

The User logon name value set in Active

Directory, i.e. the user’s User Principal Name

(UPN).

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.

The number of retries if the server sends a response of type pending.

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

Sophos Mobile

14.25 Configurations for Windows Mobile policies

With a Windows Mobile policy you configure various aspects of Windows Mobile devices, like password policies, restrictions or Wi-Fi settings.

For information on how to create a Windows Mobile policy, see Create profile or policy

(page 94).

14.25.1 Password policies configuration (Windows Mobile policy)

With the Password policies configuration you define requirements for the device password.

Setting/Field

Password type

Minimum complexity of alphanumeric passwords

Allow simple password

Minimum password length

Description

The type of password users must define:

• Alphanumeric: Password must contain both digits and letters

• Numeric: Password must only contain digits

For Windows Phone 8.1, Alphanumeric covers passwords that contain digits and/or letters.

This defines the character classes that must be used in an alphanumeric password.

For Windows 10 Mobile:

• 1: Not applicable (if selected, 2 is used)

• 2: Digits and lowercase letters are required

• 3: Digits, lowercase letters, and uppercase letters are required

• 4: Digits, lowercase letters, uppercase letters, and special characters are required

For Windows Phone 8.1, the value you select is the number of different character classes that must be used in a password. Character classes are:

• Digits

• Lowercase letters

• Uppercase letters

• Special characters

Passwords can contain sequential or repeated characters, for example abcde or 1111 .

The minimum number of characters a password must contain.

Setting/Field

Maximum number of failed attempts

Time in minutes until the device is locked

Password history

Maximum password age in days

Allow the password grace period to be set

Sophos Mobile

Description

The number of failed login attempts to enter the correct password before the device is wiped.

Enter a value between 1 and 999 , or 0 for no restriction.

The time period (in minutes) after which the device is locked if it has not been used. The user can unlock the device.

Enter a value between 1 and 999 , or 0 for no restriction.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

The number of days after which users must change their password.

Enter a value between 1 and 730 , or 0 for no restriction.

Users are allowed to set the password grace period.

14.25.2 Restrictions configuration (Windows Mobile policy)

With the Restrictions configuration you define restrictions for devices.

Device

Setting/Field

Forbid SD card

Description

Users cannot access the storage card. This does not prevent apps from accessing the storage card.

Sophos Mobile

Setting/Field

Forbid unencrypted device

Description

Internal storage encryption is turned on.

Important

After internal storage encryption has been turned on on a device, you cannot turn it off again through a policy.

Note

You must enable BitLocker on the device before applying the policy.

Forbid action center notifications above lock screen

No Action Center notifications are displayed above the device lock screen.

Forbid manual addition of non-Microsoft email accounts

Forbid Microsoft account connection

Forbids adding all types of email accounts, as well as Exchange, Office 365 and Outlook.com

accounts.

Connecting to Microsoft services such as synchronization, backup, Skype, or the

Microsoft Store is not possible.

Important

This setting only affects Microsoft accounts that are set up on the device after the policy is assigned.

Forbid developer mode

Forbid Microsoft Store

Forbid native browser

Forbid camera

The Windows developer mode is turned off.

The app store is unavailable.

The Microsoft Edge browser is unavailable.

The Privacy setting Let apps use my camera is turned off.

Setting/Field

Telemetry level

Various

Setting/Field

Forbid copy and paste

Forbid Cortana

Forbid “Save as” for Office files

Forbid screen capture

Forbid sharing of Office files

Forbid “Sync my settings”

Forbid voice recording

Sophos Mobile

Description

The amount of Windows diagnostic and usage data that devices are allowed to send.

Windows 10:

• Full: All data required to identify and analyze issues.

• Enhanced: Data about how Windows and apps are used and how they perform.

• Basic: A limited set of data that’s critical for understanding the device and its configuration.

• Disabled (Windows Phone 8.1 only): Not supported on Windows 10 devices. If you select this, the Basic level is used.

Note

Levels are cumulative from bottom to top, e.g.

Enhanced includes all data from Basic.

Tip

For detailed information on the telemetry levels, see the Microsoft article Configure Windows telemetry in your organization (external link) .

Windows Phone 8.1 doesn’t support different telemetry levels:

• Full, Enhanced, Basic: Users can turn telemetry on or off.

• Disabled (Windows Phone 8.1 only): No telemetry data is submitted.

Description

The clipboard is unavailable.

Cortana is turned off.

Users cannot save a file on the device as an

Office file.

Screen captures are turned off.

Users cannot share Office files.

Device settings cannot be synchronized to and from other Windows devices.

Voice recording is turned off.

247

Sophos Mobile

Wi-Fi

Setting/Field

Forbid Wi-Fi

Forbid internet sharing

Forbid Wi-Fi Sense (hotspot auto-connect)

Forbid hotspot reporting

Forbid manual configuration

Description

Wi-Fi connections are turned off.

Internet Connection Sharing (ICS) is turned off.

The device does not automatically connect to

Wi-Fi hotspots.

The device does not send information about Wi-

Fi connections.

Users can’t configure Wi-Fi connections beyond the connections that are configured by Sophos

Mobile.

Existing user-configured and Wi-Fi Sense Wi-Fi profiles are deleted.

Connectivity

Setting/Field

Forbid NFC

Forbid Bluetooth

Forbid USB connection

Description

NFC (near-field communication) is turned off.

Bluetooth is turned off.

USB connection between the device and a computer to sync files or to use developer tools to deploy or debug apps is forbidden. This does not affect USB charging.

Roaming and costs

Setting/Field

Forbid cellular data roaming

Forbid VPN over cellular

Forbid VPN roaming over cellular

Description

Data connections over foreign cellular networks are turned off.

VPN connections over cellular networks are turned off.

VPN connections over foreign cellular networks are turned off.

Sophos Mobile

Security and privacy

Setting/Field

Forbid Bing Vision to store images from

Bing Vision search

Forbid use of location when searching

Forbid manual installation of root certificates

Forbid locating

SafeSearch permission

Description

Bing Vision does not store the contents of the images captured when performing Bing Vision search.

The search cannot utilize location information.

Users cannot manually install root and intermediate CA certificates.

All location privacy settings on the device are turned off. No apps can use the location service.

This also forbids Sophos Mobile to locate the device.

The level of search result filtering that is enforced on the device:

• Moderate: Moderate filtering against adult content. Valid search results are not filtered.

• Strict: Highest filtering against adult content.

Unenrollment

Setting/Field

Forbid user to reset the phone

Forbid manual MDM unenrollment

Description

Users cannot factory reset the device through the control panel or hardware key combinations.

Users cannot delete the workplace account.

14.25.3 Exchange account configuration (Windows Mobile policy)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server.

Setting/Field

Account name

Description

The account name.

Sophos Mobile

Setting/Field

Exchange server

Domain

User

Email address

Password

Synchronization period

Synchronization interval

SSL/TLS

Description

The Exchange server address.

Note

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

The content types to be synchronized.

Synchronize content types

14.25.4 Wi-Fi configuration (Windows Mobile policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Connect automatically

Description

In this field, enter the ID of the Wi-Fi network.

The connection will be established automatically.

Setting/Field

Hidden network

Security type

Proxy

Sophos Mobile

Description

The target network is not open or visible.

Select the security type from the list. If you select WPA (Personal) or WPA2 (Personal) you must specify the password.

If you select Manually from the list, you must specify server and port.

14.25.5 App restrictions configuration (Windows Mobile policy)

With the App restrictions configuration you specifically allow or block apps on the devices.

Setting/Field

Allowed apps

Forbidden apps

App group

Description

Contains a set of individual apps that users are allowed to install and use on the device. Users will be unable to install or use any apps that are not explicitly listed.

Use Allowed apps when you know the list of apps that you want to allow and want to block all other apps.

Contains a set of individual apps that users are prevented from installing on the device.

Users will be able to install any apps that are not explicitly listed.

Use Forbidden apps when you know the list of apps that you want to block and want to allow all other apps.

Select the app group that contains the list of apps you want to allow or block.

Note

The app group has to be created beforehand. See

App groups

(page 300).

14.25.6 IMAP/POP configuration (Windows Mobile policy)

With the IMAP/POP configuration you add an IMAP or POP email account to the device.

Setting/Field

Account type

Description

The type of the email server for incoming email (either

IMAP or POP).

Sophos Mobile

Setting/Field

Account name

Email address

User display name

User name

Domain

Password

Server for incoming email

Use SSL/TLS for incoming email

Server for outgoing email

Use SSL/TLS for outgoing email

Authentication required for outgoing connection

Synchronization period

Automatic synchronization

Description

The display name of the email account on the device.

The email address of the account.

Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.

The display name of the user for outgoing email.

Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.

The user name for connecting to the inbound server.

The domain part of the credentials for the inbound server

(if required).

The password for connecting to the inbound server (if required).

The host name (or the IP address) and the port number of the server for incoming email (inbound server).

Format: server name:port number

You don’t need to specify the port number if the standard port is used:

• 143 (IMAP)

• 993 (IMAP with SSL)

• 110 (POP3)

• 995 (POP3 with SSL)

Use Secure Sockets Layer for incoming email transfer.

The host name (or the IP address) and the port number of the server for outgoing email (outbound server).

Format: server name:port number

Use Secure Sockets Layer for outgoing email transfer.

The outbound server requires authentication.

The same credentials as for the inbound server are used, as specified in the User name, Domain and Password fields.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval for automatic email synchronization.

Sophos Mobile

14.25.7 Root certificate configuration (Windows Mobile policy)

With the Root certificate configuration you install a root certificate onto devices.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

14.25.8 SCEP configuration (Windows Mobile policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

Description

URL

Subject

Subject Alternative Name

Description

A description for the configuration.

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in profiles and policies (page 97).

Optionally, configure one or more Subject

Alternative Name (SAN) values.

Click Add and then enter a SAN type and a SAN value.

Sophos Mobile

Setting/Field

Challenge

Root certificate

Retries

Retry delay

Key size

Use as digital signature

Use for encryption

Hash algorithm

Description

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current profile.

The number of retries if the server sends a response of type pending.

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

Select one or more hash algorithms that are supported by the SCEP server.

Warning

We recommend that you don’t use the

SHA-1 algorithm because it is considered unsafe.

14.26 Configurations for Windows policies

With a Windows policy you configure various aspects of Windows computers, like password policies, restrictions or Wi-Fi settings.

For information on how to create a Windows policy, see

Create profile or policy (page 94).

Sophos Mobile

14.26.1 Password policies configuration (Windows policy)

With the Password policies configuration you define requirements for the passwords of Windows user accounts.

Note

Password complexity rules (for example length, number of uppercase and lowercase letters) for Windows computers are fixed and cannot be set by a Sophos Mobile policy. For details see

Windows password complexity rules (page 96).

Note

Password policies can’t be assigned to Windows computers if the following conditions are both met:

• There are other local users configured on the device in addition to the user that is enrolled with

Sophos Mobile.

• One or more of these other users are not allowed to change their password.

Setting/Field

Maximum number of failed attempts

Time in minutes until the device is locked

Password history

Maximum password age in days

Description

The number of failed login attempts to enter the correct password before the device is wiped.

Enter a value between 1 and 999 , or 0 for no restriction.

The time period (in minutes) after which the device is locked if it has not been used. The user can unlock the device.

Enter a value between 1 and 999 , or 0 for no restriction.

The number of previously used passwords

Sophos Mobile stores.

When the user sets a new password, it mustn’t match a password that was already used.

The number of days after which users must change their password.

Enter a value between 1 and 730 , or 0 for no restriction.

Sophos Mobile

14.26.2 Restrictions configuration (Windows policy)

With the Restrictions configuration you define restrictions for devices.

Device

Setting/Field

Forbid SD card

Forbid manual addition of non-Microsoft email accounts

Forbid developer mode

Forbid camera

Disable Edge autofill

Disable Edge F12 Developer Tools

Disable Edge pop-up blocker

Disable AutoPlay settings

Disable Date & Time settings

Disable Language settings

Disable Power & Sleep settings

Disable Region settings

Disable Sign-in settings

Disable VPN settings

Description

Users cannot access the storage card. This does not prevent apps from accessing the storage card.

Forbids adding all types of email accounts, as well as Exchange, Office 365 and Outlook.com

accounts.

The Windows developer mode is turned off.

The Privacy setting Let apps use my camera is turned off.

The Save form entries setting in the Edge web browser is turned off and cannot be turned on by the user.

If the check box is cleared, the setting is turned on and cannot be turned off by the user.

The F12 Developer Tools of the Edge web browser are unavailable.

The Block pop-ups setting in the Edge web browser is turned off and cannot be turned on by the user.

If the check box is cleared, the setting is turned on and cannot be turned off by the user.

The relevant sections of the Windows Control

Panel are unavailable. The user cannot change any of these settings after the policy has been assigned to the device.

Note

Disable AutoPlay settings does not affect connected devices, like for example mobile phones.

Sophos Mobile

Setting/Field

Disable Workplace settings

Disable Account settings

Telemetry level

Description

The amount of Windows diagnostic and usage data that devices are allowed to send.

• Full: All data required to identify and analyze issues.

• Enhanced: Data about how Windows and apps are used and how they perform.

• Basic: A limited set of data that’s critical for understanding the device and its configuration.

• Security: Information that is required to keep the device protected with the latest security updates.

Note

Levels are cumulative from bottom to top, e.g.

Enhanced includes all data from Basic and

Security.

Tip

For detailed information on the telemetry levels, see the Microsoft article Configure Windows telemetry in your organization (external link) .

Various

Setting/Field

Forbid Cortana

Forbid “Sync my settings”

Disable Windows tips

Description

Cortana is turned off.

Device settings cannot be synchronized to and from other Windows devices.

The Windows notification setting Show me tips

about Windows is cleared and unavailable.

Wi-Fi

Setting/Field

Forbid internet sharing

Forbid Wi-Fi Sense (hotspot auto-connect)

Description

Internet Connection Sharing (ICS) is turned off.

The device does not automatically connect to

Wi-Fi hotspots.

Sophos Mobile

Setting/Field

Forbid manual configuration

Description

Users can’t configure Wi-Fi connections beyond the connections that are configured by Sophos

Mobile.

Existing user-configured and Wi-Fi Sense Wi-Fi profiles are deleted.

Connectivity

Setting/Field

Forbid Bluetooth

Security and privacy

Setting/Field

Forbid use of location when searching

Unenrollment

Setting/Field

Forbid manual MDM unenrollment

Description

Bluetooth is turned off.

Description

The search cannot utilize location information.

Description

Users cannot delete the workplace account.

14.26.3 Exchange account configuration (Windows policy)

With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server.

Important

If you use multiple configurations to set up Exchange email accounts, the devices might only be able to retrieve mail for one account. This typically happens when the accounts are located on different Exchange servers and there are different mailbox policies defined on these servers.

Because Windows computers can only enforce a single mailbox policy, they will fail to connect to the accounts that use a different policy.

Note

Windows allows the user to reject all changes that you make to the Exchange configuration.

Setting/Field

Account name

Exchange server

Domain

User

Email address

Password

Synchronization period

Synchronization interval

SSL/TLS

Sophos Mobile

Description

The account name.

The Exchange server address.

Note

If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.

The domain for this account.

The user for this account.

If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.

The email address of the account.

If you enter the variable %_EMAILADDRESS_

% , the server replaces it with the actual email address.

The password for this account.

If you leave this field empty, users must enter the password on their devices.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval between email synchronization processes.

The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).

We recommend that you select this check box.

The content types to be synchronized.

Synchronize content types

14.26.4 Wi-Fi configuration (Windows policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Description

In this field, enter the ID of the Wi-Fi network.

Sophos Mobile

Setting/Field

Connect automatically

Hidden network

Security type

Description

The connection will be established automatically.

The target network is not open or visible.

Select the security type from the list. If you select WPA (Personal) or WPA2 (Personal) you must specify the password.

14.26.5 Kiosk mode configuration (Windows policy)

With the Kiosk mode configuration you set up a Windows computer to run in kiosk mode.

In kiosk mode, only a single app (the kiosk app) can run. Kiosk mode is turned on when the user associated with the kiosk mode (the kiosk user) logs in.

Note

By default, the computer remains in kiosk mode after a restart. To change this behavior, log into the computer with the kiosk user account, go to Settings > Accounts > Sign-in options, and turn off Use my sign-in info to automatically finish setting up my device after an update or

restart.

Setting/Field

User account

App AUMID

Description

The user associated with the kiosk mode (the kiosk user).

Format:

<computer name>\<user name> (local account)

<domain>\<user name> (domain account)

You can omit the <domain> part if the user name is unique across all domains.

The Application User Model ID (AUMID) of the app that is launched when the kiosk mode is turned on (the kiosk app).

For information on how to obtain the AUMID value, see the

Microsoft document Find the Application User Model ID of an installed app .

14.26.6 IMAP/POP configuration (Windows policy)

With the IMAP/POP configuration you add an IMAP or POP email account to Windows computers.

Setting/Field

Account type

Description

The type of the email server for incoming email (either

IMAP or POP).

Setting/Field

Account name

Email address

User display name

User name

Domain

Password

Server for incoming email

Use SSL/TLS for incoming email

Server for outgoing email

Use SSL/TLS for outgoing email

Authentication required for outgoing connection

Synchronization period

Automatic synchronization

Sophos Mobile

Description

The display name of the email account on the device.

The email address of the account.

Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.

The display name of the user for outgoing email.

Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.

The user name for connecting to the inbound server.

The domain part of the credentials for the inbound server

(if required).

The password for connecting to the inbound server (if required).

The host name (or the IP address) and the port number of the server for incoming email (inbound server).

Format: server name:port number

You don’t need to specify the port number if the standard port is used:

• 143 (IMAP)

• 993 (IMAP with SSL)

• 110 (POP3)

• 995 (POP3 with SSL)

Use Secure Sockets Layer for incoming email transfer.

The host name (or the IP address) and the port number of the server for outgoing email (outbound server).

Format: server name:port number

Use Secure Sockets Layer for outgoing email transfer.

The outbound server requires authentication.

The same credentials as for the inbound server are used, as specified in the User name, Domain and Password fields.

The time period used for synchronizing emails.

Only the emails from within the specified period are synchronized to the inbox on the managed device.

The interval for automatic email synchronization.

Sophos Mobile

14.26.7 Device Guard configuration (Windows policy)

With the Device Guard configuration you configure virtualization-based security (VBS) on Windows computers.

Note

All settings are applied the first time the Windows computer starts after the policy has been assigned.

Setting/Field Description

Turn on virtualization-based security (VBS) Virtualization-based security (VBS) is turned on.

Credential Guard configuration

Platform security level

•

Turn off: Turn off Credential Guard.

This doesn’t work if Credential Guard was turned on using the Turn on with UEFI lock option.

Turn on with UEFI lock: Turn on Credential

Guard and ensure that it can’t be turned off remotely.

Credential Guard can only be turned off again in the BIOS settings, requiring physical access to the computer.

Turn on without lock: Turn on Credential

Guard.

Credential Guard can be turned off again with the Turn off option, or with a Windows Group

Policy.

•

Secure Boot: VBS is turned on with as much protection as is supported by the computer’s hardware.

If the computer doesn’t have input/output memory management units (IOMMUs), VBS uses the Secure Boot UEFI feature.

If the computer has IOMMUs, VBS uses

Secure Boot with direct memory access

(DMA) protection.

Secure Boot and DMA protection: VBS uses Secure Boot with direct memory access

(DMA) protection.

VBS is not turned on if the computer doesn’t support DMA.

Sophos Mobile

14.26.8 Root certificate configuration (Windows policy)

With the Root certificate configuration you install a root certificate onto devices.

Note

The certificate you upload here is only available for this policy. If you require certificates in other profiles or policies, you have to upload them again.

14.26.9 Client Certificate configuration (Windows policy)

With the Client certificate configuration you install a client certificate onto Windows computers.

Setting/Field

File

Description

The certificate you want to install.

You can upload PEM and PKCS #12 certificates.

Click Upload a file and then navigate to the file that contains the certificate.

Tip

Alternatively, drag the file from File Explorer to the Upload a

file area.

Certificate name

Target store

Key location

After you’ve uploaded the certificate file, this field shows the subject value of the certificate.

The certificate store where the certificate is installed:

User: The certificate is available to the user enrolled with Sophos

Mobile.

Device: The certificate is available to all users on the computer.

The location where the private key of the certificate is stored:

Software: The key is stored in a software-based key store.

TPM or software: The key is stored in TPM if it's available.

Otherwise the key is stored in a software-based key store.

TPM: The key is stored in the Trusted Platform Module (TPM) hardware chip. If the computer doesn’t have a TPM chip or if

TPM is turned off in the BIOS, the certificate is not installed.

Windows Hello for Business: The key is stored in a Windows

Hello for Business container.

Sophos Mobile

Setting/Field

Key is exportable

Container name

Description

Users can also export the private key when they export the certificate.

The name of the Windows Hello for Business container where the private key of the certificate is stored.

14.26.10 SCEP configuration (Windows policy)

With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).

Setting/Field

Description

URL

Subject

Subject Alternative Name

Challenge

Description

A description for the configuration.

The web address of the Certificate Authority server.

Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.

The name of the entity (for example person or device) that will receive the certificate.

You can use placeholders for user data or device properties.

The value that you enter (with placeholders replaced by the actual data) must be a valid

X.500 name.

For example:

• Enter CN=%_USERNAME_% to specify a user.

• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.

For information on available placeholders, see

Placeholders in profiles and policies (page 97).

Optionally, configure one or more Subject

Alternative Name (SAN) values.

Click Add and then enter a SAN type and a SAN value.

The web address to obtain a challenge password from the SCEP server.

Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.

Setting/Field

Root certificate

Retries

Retry delay

Key size

Use as digital signature

Use for encryption

Hash algorithm

Sophos Mobile

Description

The CA certificate.

Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current profile.

The number of retries if the server sends a response of type pending.

The number of seconds between retries.

The size of the public key in the issued certificate.

Make sure that the value matches the size configured on the SCEP server.

If you select this check box, the public key can be used as a digital signature.

If you select this check box, the public key can be used for data encryption.

Select one or more hash algorithms that are supported by the SCEP server.

Warning

We recommend that you don’t use the

SHA-1 algorithm because it is considered unsafe.

14.27 Configurations for Windows IoT policies

With a Windows IoT policy you configure various aspects of Windows IoT devices, like restrictions or

Wi-Fi settings.

For information on how to create a Windows IoT policy, see

Create profile or policy (page 94).

Sophos Mobile

14.27.1 Restrictions configuration (Windows IoT policy)

With the Restrictions configuration you define restrictions for devices.

Device

Setting/Field

Forbid SD card

Forbid developer mode

Forbid camera

Disable Edge autofill

Disable Edge pop-up blocker

Description

Users cannot access the storage card. This does not prevent apps from accessing the storage card.

The Windows developer mode is turned off.

The Privacy setting Let apps use my camera is turned off.

The Save form entries setting in the Edge web browser is turned off and cannot be turned on by the user.

If the check box is cleared, the setting is turned on and cannot be turned off by the user.

The Block pop-ups setting in the Edge web browser is turned off and cannot be turned on by the user.

If the check box is cleared, the setting is turned on and cannot be turned off by the user.

Setting/Field

Telemetry level

Sophos Mobile

Description

The amount of Windows diagnostic and usage data that devices are allowed to send.

• Full: All data required to identify and analyze issues.

• Enhanced: Data about how Windows and apps are used and how they perform.

• Basic: A limited set of data that’s critical for understanding the device and its configuration.

• Security: Information that is required to keep the device protected with the latest security updates.

Note

Levels are cumulative from bottom to top, e.g.

Enhanced includes all data from Basic and

Security.

Tip

For detailed information on the telemetry levels, see the Microsoft article Configure Windows telemetry in your organization (external link) .

Wi-Fi

Setting/Field

Forbid internet sharing

Forbid Wi-Fi Sense (hotspot auto-connect)

Description

Internet Connection Sharing (ICS) is turned off.

The device does not automatically connect to

Wi-Fi hotspots.

Connectivity

Setting/Field

Forbid Bluetooth

Description

Bluetooth is turned off.

14.27.2 Wi-Fi configuration (Windows IoT policy)

With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.

Setting/Field

SSID

Description

In this field, enter the ID of the Wi-Fi network.

Sophos Mobile

Setting/Field

Connect automatically

Hidden network

Security type

Description

The connection will be established automatically.

The target network is not open or visible.

Select the security type from the list. If you select WPA (Personal) or WPA2 (Personal) you must specify the password.

14.27.3 Root certificate configuration (Windows IoT policy)

With the Root certificate configuration you install a root certificate onto devices.

Note

The certificate you upload here is only available for this profile. If you require certificates in other profiles or policies, you have to upload them again.

Sophos Mobile

15 Task bundles

By using task bundles you can bundle several tasks in one transaction. So you can bundle all tasks necessary to have a device enrolled and configured:

• Enroll the device.

• Apply required profiles.

• Apply required policies.

• Install required apps (for example managed apps for iOS devices).

You can also include wipe commands in task bundles to automatically wipe non-compliant (for

example jailbroken or rooted) devices. For further information, see Compliance policies (page 32).

Task bundles are available for the following platforms:

• Android

• iOS

• macOS

• Windows

15.1 Create task bundle

1. On the menu sidebar, under CONFIGURE, click Task bundles and then click the platform for which you want to create a task bundle.

2. On the Task bundles page, click Create task bundle.

The Edit task bundle page is displayed.

3. Enter a name and, optionally, a description for the new task bundle in the relevant fields.

The version is automatically incremented every time you save the task bundle.

4. Optional: Select Selectable for compliance actions to transfer the task bundle onto a device

when it violates a compliance rule. See Compliance policies (page 32).

Note

This option is disabled when you edit an existing task bundle and the task bundle is already used as a compliance action.

5. Optional: For iOS task bundles, select Ignore app installation failures to continue the task bundle processing even if an app installation fails.

This option is disabled when the task bundle contains no Install app task.

6. Click Create task.

7. Select the task type and click Next.

The next view depends on the task type you have selected. In each view you can specify your own meaningful task names. These task names are shown during installation on the Self Service Portal.

8. Follow the wizard steps to add the required task and click Apply to create the task.

9. Optional: Add further tasks to the task bundle.

Sophos Mobile

Note

You can’t mix Android and Android enterprise tasks.

Tip

You can change the installation order of the tasks by using the sort arrows on the right-hand side of the tasks list.

10. After you have added all required tasks to the task bundle, click Save on the Edit task bundle page.

The task bundle is available for transfer. It is displayed on the Task bundles page.

Note

When you edit an existing task bundle which is used as Initial package in the Self Service Portal

settings, the enrollment task cannot be deleted. See Configure Self Service Portal settings (page

27).

Related concepts

Available Android task types (page 270)

Available iOS task types

(page 273)

Available macOS task types

(page 276)

Available Windows task types

(page 278)

15.2 Available Android task types

The following task types are available for Android task bundles:

Enroll

When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.

When the task is transferred to a device that is already enrolled, the task is skipped.

Enroll Sophos container

When the task is transferred to a device that is already enrolled, the task is skipped.

Sophos Mobile

Install profile or assign policy

Select a profile or policy. For information on how to add profiles or policies to this list, see Profiles and policies (page 92).

When the task is transferred to devices, the profile is silently installed or the policy is silently assigned.

Uninstall Profile

Under Select source, select Profiles and then select a profile from the list.

In addition to the profiles that are available on the Sophos Mobile server, the list includes profiles that are in use on the managed devices.

You can also uninstall a profile that is not contained in the list. Select Identifier and then enter the identifier of the profile you want to uninstall from devices.

When the task is transferred to devices, the profile is silently uninstalled.

Note

You cannot directly uninstall a Sophos container policy or a Mobile Security policy from devices.

Instead, use the device action Unenroll Sophos container or Unenroll SMSec. This will also remove the related policies from the device.

Install app

Select an app from the list of available apps. For information on how to add apps to this list, see

Add app (page 281).

When the task is transferred to devices, users receive a notification on their devices that Sophos

Mobile wants to install the app. Users can tap OK to start the process, or Not now to be notified again after a short period of time.

If users tap OK but then tap Cancel in the subsequent Android dialog, the task fails.

If the app is already installed on a device that receives the task, it is updated.

Install managed Google Play app

This task type is available if you have configured Android enterprise for the customer.

Select an app from the list of managed Google Play apps you’ve approved for your organization. For

information on how to add apps to this list, see Edit managed Google Play app (page 318).

The installation task is sent to a Google service. Google then manages the installation of the app onto the device. On the Task view page, the task is displayed with state successful when it has been sent to Google.

Alternatively, you can install apps from the Approved apps page. See Install managed Google Play app (page 320).

For information on how to uninstall an app from devices, see Uninstall a managed Google Play app

(page 320).

Sophos Mobile

Uninstall app

Under Select source, select Apps to select an app from the list of available apps.

In addition to the apps that are available on the Sophos Mobile server, the list includes apps that are in use on the managed devices - with the exception of Android system apps and apps that have been pre-installed by the device manufacturer.

You can also uninstall an app that is not contained in the list. Select Identifier and then enter the package name of the app you want to uninstall from devices. If you select Knox container app, the app will be uninstall from the Samsung Knox container.

When the task is transferred to devices, users receive a notification on their devices that Sophos

Mobile wants to uninstall the app. Users can tap OK to start the process, or Not now to be notified again after a short period of time.

If users tap OK but then tap Cancel in the subsequent Android dialog, the task fails.

If the app is not installed on a device that receives the task, no notification is displayed.

Send message

Enter a plain text to be displayed on the devices.

When the task is transferred to devices, the message text is displayed in a notification window.

Users can display past messages in the Sophos Mobile Control app.

Unenroll

When the task is transferred to devices, they are unenrolled from Sophos Mobile. See

Unenroll devices

(page 50). Device users do not need to confirm the operation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Wipe

When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.

Important

Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.

Note

When a Wipe task is transferred to an Android enterprise device in profile owner mode, only the work profile and all managed Google Play apps are removed.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Sophos Mobile

Knox container: lock

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container is locked.

Knox container: unlock

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container is unlocked.

Knox container: reset password

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container password is reset. Users must set a new password to unlock the Knox container.

Knox container: remove

When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container

(including any container-related configuration) is removed.

Trigger SMSec scan

When the task is transferred to devices, the Sophos Mobile Security app is silently triggered to perform a scan against malware and potentially unwanted apps (PUAs).

This task requires that Sophos Mobile Security is managed by Sophos Mobile, that is, a Mobile

Security policy is assigned to the device. See

Manage Sophos Mobile Security (page 334).

If Sophos Mobile Security is not managed by Sophos Mobile on a device that receives the task (that is, if a Mobile Security policy is not assigned to the device), the task remains in the state Will be

retried.

15.3 Available iOS task types

The following task types are available for iOS task bundles:

Enroll

When the task is transferred to a device that is already enrolled, the task is skipped.

Sophos Mobile

Enroll Sophos container

When the task is transferred to a device that is already enrolled, the task is skipped.

Install profile or assign policy

Select a profile or policy. For information on how to add profiles or policies to this list, see Profiles and policies (page 92).

When the task is transferred to devices, the profile is silently installed or the policy is silently assigned.

Uninstall Profile

Under Select source, select Profiles and then select a profile from the list.

In addition to the profiles that are available on the Sophos Mobile server, the list includes profiles that are in use on the managed devices.

You can also uninstall a profile that is not contained in the list. Select Identifier and then enter the identifier of the profile you want to uninstall from devices.

When the task is transferred to devices, the profile is silently uninstalled.

Note

You cannot directly uninstall a Sophos container policy from devices. Instead, use the device action Unenroll Sophos container. This will also remove the related policy from the device.

Install provisioning profile

Select an app provisioning profile from the list of available profiles. For information on how to add

profiles to this list, see Import provisioning profiles for iOS apps

(page 95).

When the task is transferred to devices, the provisioning profile is silently installed.

Uninstall provisioning profile

Under Select source, select Profiles and then select a provisioning profile from the list.

In addition to the profiles that are available on the Sophos Mobile server, the list includes profiles that are in use on the managed devices.

You can also remove a provisioning profile that is not contained in the list. Select Identifier and then enter the identifier of the profile you want to remove from devices.

When the task is transferred to devices, the provisioning profile is silently removed.

Sophos Mobile

Reconfigure SMC app

When the task is transferred to a device, the user is asked to scan a QR code or to enter configuration details manually. This reconnects a previously uninstalled Sophos Mobile Control app to the server.

Note

This task should be preceded by an Install app task for the Sophos Mobile Control app.

Install app

Select an app from the list of available apps. For information on how to add apps to this list, see

Add app (page 281).

When the task is transferred to devices, users receive a notification on their devices that Sophos

Mobile wants to install the app. Users can tap Install to start the process, or Cancel to reject the installation.

If users reject the installation, the task fails.

If the app is already installed on a device that receives the task, it is updated.

Uninstall app

Under Select source, select Apps to select an app from the list of available apps.

In addition to the apps that are available on the Sophos Mobile server, the list includes apps that are in use on the managed devices - with the exception of iOS system apps.

You can also uninstall an app that is not contained in the list. Select Identifier and then enter the bundle ID of the app you want to uninstall from devices.

When the task is transferred to devices, the app is uninstalled silently.

Install latest iOS update

When the task is transferred to devices, the latest available update of the iOS software is installed.

Depending on the iOS device model, different updates might be installed.

You can update the iOS software for the following device types:

• Supervised devices

• Supervised Apple DEP devices

For other devices, the task will fail.

Send message

Enter a plain text to be displayed on the devices.

When the task is transferred to devices, the message text is displayed in a notification window.

Users can display past messages in the Sophos Mobile Control app.

Sophos Mobile

Unenroll

When the task is transferred to devices, they are unenrolled from Sophos Mobile. See

Unenroll devices

(page 50). Device users do not need to confirm the operation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Wipe

When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.

Important

Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

15.4 Available macOS task types

The following task types are available for macOS task bundles:

Enroll

When the task is transferred to a device that is already enrolled, the task is skipped.

Assign device policy

Select a policy from the list of available macOS device policies. For information on how to add policies to this list, see

Profiles and policies

(page 92).

When the task is transferred to devices, the policy is silently assigned to the device. If a device policy is already assigned, it is replaced.

Assign user policy

Select a policy from the list of available macOS user policies. For information on how to add policies to this list, see

Profiles and policies

(page 92).

When the task is transferred to devices, the policy is silently assigned to the device. If a user policy is already assigned, it is replaced.

User policies are applied to users the next time they log in to the Mac.

Sophos Mobile

Install app

Select an app from the list of available apps. For information on how to add apps to this list, see

Add app (page 281).

When the task is transferred to devices, the app is silently installed.

PKG package files might contain several apps. In this case, all apps are installed.

Note

A Successful task state means the device has started to download the app. To verify that the app was installed successfully, synchronize the device and check the list of installed apps on the device details page.

Unassign VPP app

Select an app from the list of available macOS VPP apps.

When the task is transferred to devices, the VPP license is removed from devices that have it assigned.

Users can continue to use the app for 30 days.

Unenroll

When the task is transferred to devices, they are unenrolled from Sophos Mobile. See

Unenroll devices

(page 50). Device users do not need to confirm the operation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Wipe

Set a 6-digit system lock PIN.

When the task is transferred to a Mac, it restarts and then begins wiping the disk. The user must enter the system lock PIN on the Mac to unlock it.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Important

Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.

Tip

In Sophos Mobile Admin, the macOS system lock PIN is displayed on the device page under

Device properties > Unlock passcode and on the Task details page under Lock PIN.

Sophos Mobile

15.5 Available Windows task types

The following task types are available for Windows task bundles:

Enroll

When the task is transferred to a device that is already enrolled, the task is skipped.

Assign policy

Select a policy from the list of available device policies. For information on how to add policies to this list, see

Profiles and policies (page 92).

When the task is transferred to devices, the policy is silently assigned to the device. If a device policy is already assigned, it is replaced.

Install app

Select an app from the list of available apps. For information on how to add apps to this list, see

Add app (page 281).

When the task is transferred to devices, the app is installed silently.

If the app is already installed on a device that receives the task, it is updated.

Uninstall app

Select an app from the list of available apps.

The list includes apps you have configured on the Sophos Mobile server and apps installed on any of the managed Windows computers - with the exception of Windows system apps.

When the task is transferred to devices, the selected app is uninstalled silently.

Note

You can only uninstall apps that have been installed by Sophos Mobile. If you try to uninstall an app installed by the user, the task fails.

Unenroll

When the task is transferred to devices, they are unenrolled from Sophos Mobile. See

Unenroll devices

(page 50). Device users do not need to confirm the operation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

Sophos Mobile

Wipe

When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.

Important

Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.

You can’t add an Unenroll task and a Wipe task to the same task bundle.

15.6 Duplicate task bundles

Since creating a task bundle can be time-consuming, you can duplicate finished task bundles. This function is helpful if several extensive task bundles with similar tasks are required. Then only a few tasks need to be deleted or added.

Note

You can only duplicate task bundles if they are not edited at the same time. Copies are named “Copy of” plus the name of the original. You can rename the bundles according to your requirements.

1. On the menu sidebar, under CONFIGURE, click Task bundles and then click Android or iOS.

The Task bundles page is displayed.

2. Click the blue triangle next to the task bundle you want to duplicate and then click Duplicate.

The task bundle is duplicated and shown on the Task bundles page. Click the duplicated task bundle to edit it.

15.7 Transfer task bundles to individual devices or to device groups

1. On the menu sidebar, under CONFIGURE, click Task bundles and then click Android or iOS.

The Task bundles page is displayed.

2. Click the blue triangle next to the required task and then click Transfer.

The Select devices page is displayed.

3. On this page, you can:

• Select individual devices you want to transfer the task bundle to.

• Click Select device groups, to open the Select device groups page and select one or several device groups for transferring the task bundle.

4. After you have made your selection, click Next.

The Set execution date page is displayed.

5. Under Scheduled date, select Now or specify a date and time for the execution of this task.

6. Click Finish.

The Task view page is shown.

Sophos Mobile

The task bundle is transferred to the selected devices at the specified date and time.

Sophos Mobile

16 Apps

You configure apps to make them available for installation from Sophos Mobile Admin

(administrator-initiated) or from the Sophos Mobile Control app (user-initiated).

App management is available for the following platforms:

• Android

• iOS

• macOS

• Windows

• Windows Mobile

To make an app available in Sophos Mobile, you can do one of the following:

• Upload the app package to the Sophos Mobile server. This option is not available for Windows

Mobile apps or for devices where Sophos Mobile only manages the Sophos container.

• Provide a link to the app in the relevant app store.

For both options, see section

Add app (page 281).

To install an app on a device, create a task bundle that contains an Install app task. For Android and iOS devices, you can create such task bundles directly from the Apps page. See

Install app

(page 282).

Note

To be able to install app packages that are stored on the Sophos Mobile server (in contrast to the installation from the app store), the following conditions must be met:

• For Android, the Android security setting Unknown sources must be enabled on the devices.

When you try to install an APK file when Unknown sources is disabled, the Sophos Mobile

Control app will direct the users to the page where they can enable the setting. This restriction does not apply to devices with LG GATE, Samsung Knox or Sony Enterprise API.

• For iOS, the installation of apps from IPA files is only possible for self-developed apps. When the app is ready for distribution, you must create a provisioning profile for the app and make it available on the devices, either installed separately beforehand or included in the app's IPA file. You can use Sophos Mobile to distribute provisioning profiles to your iOS devices. See

Import provisioning profiles for iOS apps

(page 95). For details on provisioning profiles, see the

iOS Developer Library.

16.1 Add app

You make an app available for installation either by uploading the app package or by linking to the app in the relevant app store.

1. On the menu sidebar, under CONFIGURE, click Apps and then click the platform for which you want to add the app.

2. Click Add app and then select the required option:

• Android link: Add an Android app by linking to it in Google Play.

• Android package: Add an Android app by uploading the APK file to Sophos Mobile.

Sophos Mobile

• iOS link: Add an iOS app by linking to it in the App Store.

• iOS package: Add an iOS enterprise app by uploading the IPA file to Sophos Mobile.

• macOS package: Add a macOS enterprise app by uploading the PKG file to Sophos Mobile.

• Windows Mobile link: Add a Windows Mobile app by linking to it in Microsoft Store.

• Windows MSI link: Add a Windows app by linking to its MSI installation file.

• Microsoft Store link: Add a Windows app by linking to it in Microsoft Store.

3. For iOS and macOS VPP apps, click Import VPP apps to load the list of apps you’ve purchased

through the Apple Volume Purchase Program (VPP). See Manage Apple VPP apps (page 293).

4. Configure the app settings as required.

5. Click Save to save the app settings and to return to the Apps page.

The app is available for installation. It is displayed on the Apps page. If you have configured the

Available to device groups field, the app is also displayed in the Enterprise App Store of the Sophos

Mobile Control app from where users can install it. The installation process runs unattended or with very little user interaction.

Note

On devices where Sophos Mobile only manages the Sophos container, apps that you added by uploading the APK file (for Android apps) or IPA file (for iOS apps) are not available.

Related reference

App settings (Android) (page 284)

App settings (iOS)

(page 286)

App settings (macOS)

(page 288)

App settings (Windows Mobile)

(page 289)

App settings (Windows)

(page 290)

16.2 Install app

Note

This section does not apply to Android enterprise. To install apps for Android enterprise, see Install managed Google Play app (page 320).

Note

This section does not apply to devices where Sophos Mobile only manages the Sophos container.

When you have added an app to Sophos Mobile as described in Add app

(page 281), you can manually install it on selected devices or device groups.

1. On the menu sidebar, under CONFIGURE, click Apps and then click the platform for which you want to install an app.

2. On the Apps page, click the blue triangle next to the required app and then click Install.

3. Select the devices on which you want to install the app. Do one of the following:

• Select individual devices.

• Click Select device groups and then select one or more device groups.

Sophos Mobile

When you are ready, click Next.

4. On the Set execution date page, set the date when the app will be installed:

• Select Now for an immediate execution.

• Select Date and then enter a date and a time for a scheduled execution.

5. Click Finish.

The selected app is installed onto the selected devices at the specified date.

Note

On the following devices apps are installed silently, that is without user interaction:

• Supervised iOS devices

• Android enterprise devices

• Android devices with Samsung Knox Standard SDK 5.1 or higher

• Android devices with LG GATE

• Android devices with Sony Enterprise API version 8 or higher

• Macs

• Windows computers, if you have configured the /quiet installation option for the app.

For the Samsung, LG, and Sony devices listed above, only APK files are installed silently, not apps installed from Google Play.

Tip

You can display the status of the installation task on the Task view page.

Tip

You can also install an app by using one of the following options:

• To install an app on a single device: On the device’s Show device page, select the Installed

apps tab and click Install app.

• To install an app on several devices: On the Devices page, select the required devices and then click Actions > Install app.

• To install an app on one or more devices as part of a task bundle: Add an Install app task to the task bundle and transfer it to the required devices or device groups.

16.3 Uninstall app

Note

This section does not apply to Android enterprise. To uninstall apps for Android enterprise, see

Uninstall a managed Google Play app (page 320).

Note

This section does not apply to devices where Sophos Mobile only manages the Sophos container.

Sophos Mobile

When you have added an app to Sophos Mobile as described in Add app

(page 281), you can manually uninstall it from selected devices or device groups.

1. On the menu sidebar, under CONFIGURE, click Apps and then click the platform for which you want to uninstall an app.

2. On the Apps page, click Uninstall.

3. Select the devices from which you want to uninstall an app. Do one of the following:

• Select individual devices.

• Click Select device groups and then select one or more device groups.

When you are ready, click Next.

4. On the Select app page, select the required app.

5. On the Set execution date page, set the date when the app will be uninstalled:

• Select Now for an immediate execution.

• Select Date and then enter a date and a time for a scheduled execution.

6. Click Finish.

The selected app is uninstalled from the selected devices at the specified date.

Note

On the following devices apps are uninstalled silently, that is without user interaction:

• Managed apps on supervised iOS devices

• Windows computers, if you have configured the /quiet installation option for the app.

Tip

Alternatively, you can use the following procedure to uninstall an app from a single device: Open the device's Show device page, go to the Installed apps tab and then click the trash can icon next to the app name.

16.4 App settings (Android)

General settings

Setting/Field

Name

Version

Description

The name of the app.

The version that is displayed in the Enterprise

App Store.

For app links, Sophos Mobile uses the version from Google Play.

Setting/Field

App ID

App category

Available to device groups

Description

Install in Knox container

Settings for app links

Setting/Field

Link

Sophos Mobile

Description

The internal identifier of the app.

For app links, click Get data to get the value from Google Play.

For app packages, Sophos Mobile gets the value from the APK file.

A category name, for example Productivity .

When you make the app available in the

Enterprise App Store, the app will be listed in a section with that name.

You can make the app available in the

Enterprise App Store so that it's installation can be initiated by the user. Click Show and select one or more device groups for which the app will be listed in the Enterprise App Store.

The app description displayed in the Enterprise

App Store.

You may use the placeholder

%_appstoretext_% anywhere in your description text. In the Enterprise App Store, this is replaced by the actual app description from

Google Play.

For Samsung Knox devices, the app will be installed inside the Knox container.

This setting is only available if you have configured a Samsung Knox license.

Description

The URL of the app in Google Play.

To determine the URL, click Go to Google Play to open Google Play in a new browser tab and navigate to the app page. Then copy the URL from the tab's address bar and paste it into the

Link field.

After you’ve entered the URL, click Get data to fill out the App ID field automatically.

285

Sophos Mobile

Settings for app packages

Setting/Field

Upload a file

Description

Click Upload a file to upload the app to the

Sophos Mobile server. Navigate to the APK file and click Open.

Tip

Alternatively, drag the file from File Explorer to the Upload a file area.

Related tasks

Add app

(page 281)

16.5 App settings (iOS)

General settings

Setting/Field

Name

Version

App ID

App category

Description

The name of the app.

For Apple VPP apps, this field is read-only.

The version that is displayed in the Enterprise

App Store.

For app links, Sophos Mobile uses the version from the App Store.

For Apple VPP apps, this field is read-only.

The internal identifier of the app.

Sophos Mobile gets this from the App Store or from the IPA file.

For Apple VPP apps, this field is read-only.

A category name, for example Productivity .

When you make the app available in the

Enterprise App Store, the app will be listed in a section with that name.

Setting/Field

Available to device groups

Sophos Mobile managed installation

Description

Sophos Mobile

Description

You can make the app available in the

Enterprise App Store so that it's installation can be initiated by the user. Click Show and select one or more device groups for which the app will be listed in the Enterprise App Store.

The app is installed as a managed app. See

Managed apps for iOS

(page 292).

This setting only affects apps that are installed by the user from the Enterprise App Store. Apps that you install from Sophos Mobile Admin are always managed.

The app description displayed in the Enterprise

App Store.

You may use the placeholder

%_appstoretext_% anywhere in your description text. In the Enterprise App Store, this is replaced by the actual app description from the App Store.

Settings for app links

Setting/Field

Search in App Store

Link

Settings and VPN

Description

Click Search in App Store to search for the app in the App Store database.

When you select an app in the search results list, the following fields are filled out automatically:

• App ID

• App category

• Link

The URL of the app in the App Store.

To determine the URL, click Obtain link to open iTunes Link Maker in a new browser tab.

Navigate to the app in Link Maker, and then copy the URL displayed under Direct Link into the Link field in Sophos Mobile Admin.

For Apple VPP apps, this field is read-only.

Click Show to configure a VPN connection that is used when the app is started, or to configure custom app settings.

287

Sophos Mobile

Setting/Field

VPP licenses

Description

Click Show to manually assign the app to users or devices. See

Manually assign VPP apps

(page 297).

Settings for app packages

Setting/Field

Upload a file

Description

Click Upload a file to upload the app to the

Sophos Mobile server. Navigate to the IPA file and click Open.

Tip

Alternatively, drag the file from File Explorer to the Upload a file area.

Related tasks

Add app

(page 281)

16.6 App settings (macOS)

General settings

Setting/Field

Name

Version

App ID

Description

The name of the app.

For app packages, Sophos Mobile gets this from the PKG file.

For Apple VPP apps, this field is read-only.

The app version from the App Store.

For app packages, Sophos Mobile gets this from the PKG file.

For Apple VPP apps, this field is read-only.

The internal identifier of the app.

For app packages, Sophos Mobile gets this from the PKG file.

For Apple VPP apps, this field is read-only.

Setting/Field

App category

Description

Sophos Mobile

Description

A category name, for example Productivity .

The value is currently not used.

A description of the app.

The value is currently not used.

Settings for VPP app links

Setting/Field

Link

VPP licenses

Description

The URL of the app in the App Store.

For Apple VPP apps, this field is read-only.

Click Show to manually assign the app to users or devices. See

Manually assign VPP apps

(page 297).

Settings for app packages

Setting/Field

Upload a file

Description

Click Upload a file to upload the app to the

Sophos Mobile server. Navigate to the PKG file and click Open.

Note

PKG package files might contain several apps. In this case, only the name, version, and identifier of one app are displayed.

16.7 App settings (Windows Mobile)

Setting/Field

Name

Version

Description

The name of the app.

The app version.

Sophos Mobile uses the version from Microsoft

Store.

Sophos Mobile

Setting/Field

App category

Description

Available to device groups

Link

Description

A category name, for example Productivity .

When you make the app available in the

Enterprise App Store, the app will be listed in a section with that name.

The app description displayed in the Enterprise

App Store.

You may use the placeholder

%_appstoretext_% anywhere in your description text. In the Enterprise App Store, this is replaced by the actual app description from

Microsoft Store.

You can make the app available in the

Enterprise App Store so that it's installation can be initiated by the user. Click Show and select one or more device groups for which the app will be listed in the Enterprise App Store.

The URL of the app in Microsoft Store.

To determine the URL, click Go to Microsoft

Store to open Microsoft Store for Windows

Phone apps in a new browser tab and navigate to the app page. Then copy the URL from the tab’s address bar and paste it into the Link field.

Related tasks

Add app

(page 281)

16.8 App settings (Windows)

General settings

Setting/Field

Name

Version

App category

Description

Description

The name of the app.

The app version.

For app links, Sophos Mobile uses the version from the Microsoft Store.

A category name, for example Productivity .

A description of the app.

Sophos Mobile

Settings for MSI links

Setting/Field

ProductCode GUID

Description

The ProductCode GUID of the MSI file.

Note

If you enter a wrong GUID value, the app can’t be uninstalled.

Link

SHA-256 file hash

The URL of the MSI file.

The SHA-256 hash value of the MSI file.

Note

If you enter a wrong hash value, the app can’t be installed.

Installation options The command-line options for the msiexec.exe

installer executable.

The default option /quiet installs the app without user interaction.

For more information on these settings, see Determine settings for Windows MSI links

(page 292).

Settings for Microsoft Store links

Setting/Field

Store ID

SKU ID

Package Family Name

Description

The Store ID of the app in Microsoft Store. The value is entered automatically when you click

Get data.

The app’s SKU ID (stock-keeping unit ID) in the

Microsoft Store catalog.

Apps might have different SKU IDs for full and trial versions, or for different market regions.

If you don’t know the SKU ID for an app, use the default value 0010 .

The Package Family Name (PFN) of the app.

The value is entered automatically when you click Get data.

Sophos Mobile

Setting/Field

Link

Description

The URL of the app in Microsoft Store.

To determine the URL, click Go to Microsoft

Store to open Microsoft Store for Windows apps in a new browser tab and navigate to the app page. Then copy the URL from the tab's address bar and paste it into the Link field.

After you have entered the URL, click Get data to fill out the following fields automatically:

• Product ID

• Package Family Name

Related tasks

Add app

(page 281)

16.9 Determine settings for Windows MSI links

This section provides guidance on how to determine the app settings for Windows MSI links.

• ProductCode GUID

—

If you already have the Microsoft Windows SDK installed, use the included

Orca program to get the ProductCode value of an MSI file. For an example, see the description on the web page Use Orca to find MSI file GUID product code .

Alternatively, use a PowerShell script. Such scripts can be found on the internet, for example on the web page How to get MSI file information with PowerShell .

Note

The value you enter in the ProductCode GUID field must not include surrounding brackets.

• SHA-256 file hash

—

Use the Get-FileHash PowerShell command to get the SHA-256 hash value of an MSI file:

PS> Get-FileHash <path-to-MSI-file>

For more information on the Get-FileHash command, see the Microsoft web page Get-

FileHash .

• Installation options

—

For information on the available command-line options for installing MSI files, see the Microsoft web page Standard Installer Command-Line Options .

Related reference

App settings (Windows)

(page 290)

292

16.10 Managed apps for iOS

For iOS apps that you add to Sophos Mobile, you can choose to have the app installed as managed or unmanaged on the users’ devices.

Sophos Mobile

Managed apps have the following characteristics:

• When users select a managed app in the Enterprise App Store, an installation task is created and processed in Sophos Mobile. In contrast, when users select an unmanaged app, they are redirected to the Apple App Store to install the app from there.

• You can uninstall managed apps in Sophos Mobile Admin. This is not possible for unmanaged apps.

• On supervised iOS devices, managed apps are installed and uninstalled silently, that is without user interaction.

• Certain settings in iOS device profiles are only available for managed apps.

• When an iOS device is unenrolled from Sophos Mobile, all managed apps are automatically uninstalled from the device. Unmanaged apps will remain on the device.

The following rules determine if an app is installed managed or unmanaged:

• Apps that you install from Sophos Mobile Admin are always managed.

• Apps that the user installs from the App Store are always unmanaged.

• Apps that the user installs from the Enterprise App Store are managed if you have activated the

SMC managed installation setting in the app properties, as described in Add app

(page 281).

To check the app status on a device, open the Show device page for that device and go to the

Installed apps tab. See

The Show device page

(page 51).

Tip

If a user has installed an unmanaged app you can convert it into a managed app. To do this, configure the app in Sophos Mobile as managed, and then create an installation task for it. Because the app is already installed, it is not installed again, but its status changes from

unmanaged to managed.

16.11 Manage Apple VPP apps

You can use the Apple Volume Purchase Program (VPP) to buy iOS and macOS app licenses. You can then distribute these within your organization.

After the order is completed you can download a service token (sToken). This contains the licenses for the purchased apps.

Assigning VPP apps to users or devices

For iOS, you can choose to assign a VPP app to a user or to a device. For macOS, you assign VPP apps to devices:

• When you assign an iOS VPP app to users, they can install it on all iPhones and iPads enrolled with Sophos Mobile that are connected to their Apple ID.

• When you assign an iOS VPP app to a device, you don’t need to associate it with an Apple ID.

• When you assign a macOS VPP app to a Mac, it’s available to all users that sign in to that Mac.

See

Manually assign VPP apps (page 297) and Automatically assign VPP apps (page 297).

Sophos Mobile

294

Inviting users to Apple VPP

Before you can assign a VPP app to a user, you must invite them to VPP. See

Invite users to Apple

VPP (page 295).

You don’t need to invite devices to VPP.

Installing VPP apps

You install VPP apps in Sophos Mobile Admin, the same way you install other apps. See

Install app

(page 282).

Users can install iOS VPP apps from the list of purchased apps in their App Store app. This is not possible for macOS VPP apps.

Unassigning VPP apps

You unassign a VPP app in the following ways:

• You deselect the required users or devices on the app’s details page.

• iOS apps: You deselect the app on a user’s details page.

• macOS apps: You transfer a task bundle with an Unassign VPP app task to the device.

VPP licenses are automatically released in the following situations:

• The app is uninstalled from the device.

• The device is unenrolled from Sophos Mobile.

Tip

When you unassign a VPP app, users can continue to use it for 30 days.

16.11.1 Set up Apple VPP

To set up Apple VPP, upload the sToken (service token) of your Apple VPP account to Sophos Mobile and configure app assignment settings.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple VPP tab.

2. Click the Apple iTunes VPP Portal link.

This opens the Apple VPP web portal in a new browser window.

3. On that page, select Business.

4. In the Business Store Sign In dialog, enter your Apple ID and your password.

5. Go to the Account Summary page and click Download Token.

The sToken is generated and saved to your local computer in a text file with extension .vpptoken

, using the download settings of your web browser.

6. Optional: Move the sToken file to a location that you can access from Sophos Mobile Admin.

7. In Sophos Mobile Admin, go back to the Apple VPP tab , click Upload a file, select the sToken file and then click Open.

Sophos Mobile

Sophos Mobile reads in the file and populates the Organization and Expiry date fields from the sToken details.

8. In Automatically assign VPP apps on installation, configure the automatic assignment of VPP apps. See

Automatically assign VPP apps

(page 297).

9. Optional: Select Automatically update iOS VPP apps assigned to devices to inform the user if there’s an update available for a VPP app. This applies to VPP apps assigned to an iPhone or iPad.

For VPP apps assigned to a user, the user must check the App Store for updates.

10. Optional: Fill in the remaining fields of the Apple VPP tab.

In the Country field, enter your two-letter country code, for example US for the United States.

11. Click Save.

16.11.2 Invite users to Apple VPP

You need to set up an sToken before you can invite users to the Apple Volume Purchase Program

(VPP). See

Set up Apple VPP (page 294).

1. On the menu sidebar, under MANAGE, click People.

2. On the People page, you can invite all users or individual users to Apple VPP:

• To invite all users: a) Click Invite users to Apple VPP at the top of the People page.

b) Click Yes in the confirmation dialog box.

• To invite a single user: a) Click the required user.

b) On the next page, click Invite user to VPP.

c) Click Yes in the confirmation dialog box.

• To invite a single user, when using external user management and the user has no devices enrolled yet: a) Click Search and invite a user to Apple VPP at the top of the People page.

b) In the Search user dialog, search for the user either by name or by email address.

c) In the search result list, select the user that you want to invite to Apple VPP.

d) Click Apply.

Sophos Mobile sends an invitation email to all relevant users.

Users must follow the link in their invitation email to connect their Apple iTunes account with Apple

VPP. Afterward, they can install and use the apps that are licensed by your company.

Note

When you are using external user management and invite all users to Apple VPP, users that do not have an email address assigned will be registered for Apple VPP, but do not receive the link to connect their Apple iTunes account with Apple VPP.

For information on how to complete the VPP registration process in this case, see

Invite users without email address to Apple VPP

(page 296).

Sophos Mobile

16.11.3 Invite users without email address to Apple VPP

This procedure requires a super administrator account, so it does not apply to Sophos Mobile as a

Service.

When you invite users from an external user directory to Apple VPP as described in

Invite users to

Apple VPP

(page 295), users that do not have an email address assigned will be registered for

Apple VPP, but will not receive the link to connect their Apple iTunes account with Apple VPP.

If this happens, perform the following steps to complete the Apple VPP registration process.

1. As Sophos Mobile super administrator, download the server log files.

See the Sophos Mobile super administrator guide .

2. Identify the affected user accounts from the log files.

3. On the menu sidebar of Sophos Mobile Admin, under MANAGE, click People.

4. Click one of the affected users.

5. On the next page, click Show invitation link.

For external users without email address, this function does not send an invitation email, but instead shows the invitation link in a message box.

6. Copy the link from the message box and communicate it to the user.

7. Repeat this for all affected users.

The users need to follow the link to connect their Apple iTunes account with Apple VPP.

16.11.4 Manage Apple VPP users

If you’ve set up Apple VPP, the Show user page includes an Apple Volume Purchase Program

(VPP) section.

You can view or edit the Apple VPP status of each user.

• View the Apple VPP user status.

— Registered: The user was invited to Apple VPP but hasn’t connected their Apple iTunes account with Apple VPP yet.

— Associated: The user has connected their Apple iTunes account with Apple VPP and can install VPP apps.

• View the Apple VPP apps the user has installed.

• Invite the user to the program.

An email with an invitation link is sent to the user. If the user account doesn’t contain an email address, the invitation link is displayed in a message box.

• If required, resend the invitation email.

• Deregister the user from Apple VPP.

Sophos Mobile

16.11.5 Manually assign VPP apps

You can assign VPP apps to individual users or devices.

Tip

You can automatically assign an app when it’s installed. See Automatically assign VPP apps (page

297).

1. On the menu sidebar, under CONFIGURE, click Apps > iOS or Apps > macOS.

2. Click Import VPP apps.

This retrieves the app information from the Apple VPP server and creates app entries in Sophos

Mobile, if required.

3. Click the VPP app you want to assign to users or devices.

Tip

VPP apps are marked by a check mark icon in the VPP column.

4. Click Show next to VPP licenses.

5. Select the users or devices you want to assign the app to.

You can choose from all users registered for or associated with Apple VPP, and from all devices with status Managed.

You can assign macOS apps to devices only.

6. Optionally, assign the app to devices by selecting device groups: a) Click Show next to Available to device groups.

b) Select the device groups.

7. By default, iOS VPP apps are installed as managed on the users’ devices. To install an app as unmanaged, clear the Sophos Mobile managed installation check box.

8. Click Save. This also synchronizes the app assignment with the Apple VPP server.

Note

Because the status of VPP apps is managed by the Apple VPP server, it may take some time until changes that you make in Sophos Mobile are visible on the devices.

16.11.6 Automatically assign VPP apps

You can assign VPP apps automatically when they are installed.

For iOS VPP apps, you can decide to assign them to the device or to the user assigned to the device.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple VPP tab.

2. In Automatically assign VPP apps on installation, select one of the following options:

• Prioritize device assignment: iOS VPP apps are assigned to the device. If the device doesn’t support VPP assignment, apps are assigned to the device user.

Sophos Mobile

• Prioritize user assignment: iOS VPP apps are assigned to the device user. If there is no device user, apps are assigned to the device.

• Disabled: You must assign VPP apps manually.

Note

You can’t assign macOS VPP apps to users. Both Prioritize device assignment and

Prioritize user assignment turn on automatic assignment.

16.11.7 Synchronize VPP license information

For performance reasons, Sophos Mobile keeps a local copy of VPP license information. You can trigger Sophos Mobile to synchronize its VPP data with the Apple VPP server.

Note

You only need to synchronize the VPP data if the displayed license information for an app is incorrect.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the Apple VPP tab.

2. Click Clear VPP cache.

Sophos Mobile discards its local VPP information for the customer and synchronizes the data with the

Apple VPP server.

Note

For information on how to display the license information for a VPP app, see Manually assign VPP apps (page 297).

16.12 Assign a VPN connection to an iOS app

When you assign a VPN connection to an iOS app, the app uses that connection for all of its network communication.

Prerequisite: You have created one or more iOS device profiles with a Per app VPN configuration.

See Per app VPN configuration (iOS device profile) (page 184).

To assign a VPN connection to an app:

1. On the menu sidebar, under CONFIGURE, click Apps > iOS.

2. On the Apps page, click the required app.

3. Click Show next to Settings and VPN.

4. In VPN connection used by the app, select a VPN configuration.

The list contains Per app VPN configurations of all iOS device profiles.

5. On the Edit settings and VPN page, click Apply.

6. Click Save.

Sophos Mobile

16.13 Add a managed app configuration to an iOS app

Managed app configuration is a feature of iOS apps that lets you configure an app remotely without physical access to the device on which the app is installed.

Requirements:

• The app developer has implemented managed app configuration.

•

The app was installed as a managed app. See Managed apps for iOS

(page 292).

To add a managed app configuration:

1. On the menu sidebar, under CONFIGURE, click Apps > iOS.

2. On the Apps page, click the required app.

3. Click Show next to Settings and VPN.

4. Under Managed configuration, click Add parameter.

5. Enter the required information.

6. On the Edit settings and VPN page, click Apply.

7. Click Save.

Sophos Mobile

300

17 App groups

In Sophos Mobile you create app groups to define list of apps for profiles, policies and compliance policies.

App groups are used in the following settings:

• In the App Protection configuration of Android device profiles.

• In the App Control configuration of Android device profiles.

• In the Restrictions configuration of Android device profiles, iOS device profiles and Knox container profiles.

• In the App restrictions configuration of Windows Mobile policies.

• In compliance policies to specify lists of allowed, forbidden and mandatory apps.

17.1 Create app group

1. On the menu sidebar, under SETTINGS, click App groups and then click the platform for which you want to create the app group.

2. Click Create app group.

3. On the Edit app group page, enter a name for the new app group and then click Add app.

4. Select an app you want to add to the group:

• To select an app from the list of all apps currently installed on your managed devices, click App

list and select an app.

• To add an app manually, click Custom and configure the app details.

Settings for Android apps:

App name

Identifier

Link

A unique name to identify the app.

The package name of the app.

You can get the package name from the app’s URL in Google

Play. For example, the URL of the Sophos Mobile Control app is play.google.com/store/apps/details?

id=com.sophos.mobilecontrol.client.android

and the package name is com.sophos.mobilecontrol.client.android

For apps from managed Google Play (apps for Android enterprise devices), put app: in front of the package name.

The URL of the app in Google Play.

Settings for iOS and macOS apps:

App name

Identifier

A unique name to identify the app.

The bundle ID of the app.

Sophos Mobile

Link The URL of the app in the App Store.

Settings for Windows Mobile apps:

App name

Identifier

Link

A unique name to identify the app.

The GUID of the app.

If you don’t know the GUID, fill in the Link field instead.

The URL of the app in Microsoft Store.

For example, the URL of the Sophos Mobile Control app is https://www.microsoft.com/en-us/store/p/ mobile-control-2017/9nblggh51qsj .

Settings for Windows apps:

App name A unique name to identify the app.

Identifier The ID of the app as reported by Windows.

For MSI apps, this is the ProductCode GUID of the MSI file.

For Microsoft Store apps, this is the Package Family Name

(PFN) of the app.

Link The URL of the app in Microsoft Store.

5. Click Add.

6. Optional: Repeat the previous steps to add more apps.

7. Click Save to save the app group.

17.2 Import app group

You can create an app group by importing a list of apps from a CSV file.

You can import up to 10,000 apps.

The CSV file must have the following specification:

• The first row is treated as a header and is not imported.

• Values must be separated by semicolon, not by comma.

• All rows must have the correct number of semicolon characters, even if you leave out optional values.

• The file extension must be .csv

• To ensure that non-English characters are imported correctly, the file must be UTF-8 encoded.

Tip

On the Import apps page, click Example CSV to download a sample file.

To import apps from a CSV file and add them to an app group:

Sophos Mobile

1. On the menu sidebar, under SETTINGS, click App groups and then click the platform for which you want to create the app group.

2. On the App group page, click Create app group.

3. On the Edit app group page, enter a Name for the new app group and then click Import apps.

4. On the Import apps page, click Upload a file and then navigate to the CSV file that you have prepared.

The entries are read in from the file and are displayed.

6. Click Finish to add the apps to the app group.

7. On the Edit app group page, click Save.

Sophos Mobile

18 Corporate documents

Note

This feature requires a license of type Mobile Advanced.

In Sophos Mobile, you can upload files for distribution to the devices of your users.

• Documents managed in Sophos Mobile are automatically added to the Corporate Documents storage provider in Sophos Secure Workspace.

• You can assign a category to each document from the Corporate Documents storage provider.

• Documents from the Corporate Documents storage provider are read only.

• If Sophos Secure Workspace is not managed by Sophos Mobile, the Corporate Documents storage provider is not available.

To distribute corporate documents:

1. Install the Sophos Secure Workspace app onto the devices. See

Apps

(page 281).

2. Assign a Sophos container policy with a Corporate Documents configuration.

3. Upload documents to Sophos Mobile.

18.1 Add corporate documents

Note

This feature requires a license of type Mobile Advanced.

To distribute documents to devices:

1. On the menu sidebar, under CONFIGURE, click Documents.

The Documents page is displayed.

2. Click Add document.

The Edit document page is displayed.

3. In the Category field, enter the category under which the document is displayed in the Corporate

Documents storage provider on the device.

If you leave this field blank, the file will be shown in the root folder of the Corporate Documents storage provider.

4. Define settings for the document:

• Select Copy to clipboard to allow users to copy the document to the clipboard.

• Select Share document to allow users to share the document.

• Select Use document offline to allow users to add the document to the Favorites list.

When an unencrypted document from Corporate Documents is added to the Favorites list, the local copy is stored encrypted. When sharing the document is allowed, the file is automatically decrypted before it is forwarded to other apps. If you clear the Use document

offline check box, local copies are automatically removed during the next synchronization.

5. Click Show next to Assigned groups and select the group that should have access to the document.

Sophos Mobile

6. Add a description for the document.

7. Click Upload a file and navigate to the document. Select it and click Open.

8. Repeat this step for each document you want to distribute.

The document is added to the documents list. It is distributed to the users, who can view it in the

Sophos Secure Workspace app.

Sophos Mobile

19 Android enterprise

Android includes functionality that simplifies the integration of devices into your company environment and helps your users to separate personal and corporate data on their device. This is referred to as Android enterprise (formerly Android for Work ).

Note

Sophos Mobile supports Android enterprise for devices with Android 6 or higher.

Sophos Mobile supports the Android enterprise enrollment modes Device owner and Profile owner .

Device owner

When a device is enrolled in device owner mode, device ownership is assigned to Sophos Mobile.

Sophos Mobile can monitor and manage settings, apps and data on the whole device.

Device owner mode differs from a standard enrollment as follows:

• Users have a simplified enrollment experience.

• Users don’t need to set up a personal Google account on the device.

• Users can only install apps from managed Google Play, and you can configure the store layout.

• Only a minimum set of apps is enabled by default: Google Play Store, Contacts, Messages, Phone.

• You can install, uninstall or update apps without user interaction.

• You can configure app permissions so that users are not asked to grant permissions at runtime.

• For apps that support it, you can configure custom app settings.

• You can reset the screen lock password. With standard enrollment, this is not possible for Android

7.0 or later.

• You can configure a kiosk mode that restricts app usage to a selection of apps, not just a single app.

• You can only enroll devices that have not been set up yet, or that have been reset to their factory settings.

• There is no dedicated unenroll action. To unenroll a device, wipe it.

Profile owner

When a device is enrolled in profile owner mode, a work profile is created on the device. Sophos

Mobile can only monitor and manage settings, apps and data within the work profile.

The profile owner mode is suitable for BYOD (bring your own device) scenarios.

Related information

Android enterprise help (external link)

Sophos Mobile

19.1 Set up Android enterprise - Overview

To set up Android enterprise for your organization, you can choose between two different scenarios:

Managed Google Play Account scenario

This is the easiest method to set up Android enterprise for your organization.

• Sophos Mobile guides you through the process of setting up an Android enterprise account for your organization.

• If required, you can create multiple Android enterprise accounts for your organization.

• Sophos Mobile manages the whole user account lifecycle.

• Devices can be enrolled in the Self Service Portal or in Sophos Mobile Admin.

See

Set up Android enterprise (Managed Google Play Account scenario) (page 306).

Managed Google Domain scenario

Use this method if you already have a Managed Google Domain or if you want to manage the accounts of your Android enterprise users outside of Sophos Mobile.

• You register a Managed Google Domain with Google and prove domain ownership.

• You bind Sophos Mobile as third-party EMM (Enterprise Mobility Management) software to your

Managed Google Domain.

• Sophos Mobile creates user accounts as needed. Other than that, Sophos Mobile does not manage the account lifecycle.

• Devices can only be enrolled in the Self Service Portal, not in Sophos Mobile Admin.

See

Set up Android enterprise (Managed Google Domain scenario) (page 307).

Note

You can’t change the user management mode after you’ve set up Android enterprise. For example, you can’t switch from internal user management to an external LDAP directory.

Tip

After you’ve set up Android enterprise, you can check the active scenario under Setup > Android

setup > Android enterprise > Android enterprise mode.

19.2 Set up Android enterprise (Managed Google

Play Account scenario)

For the Managed Google Play Account scenario, Sophos Mobile guides you through the procedure to set up Android enterprise for your organization.

Sophos Mobile

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the Android

enterprise tab.

3. Click Configure.

4. Select “Managed Google Play Account” scenario and then click Next.

5. Select Register account.

This redirects you to a Google website where you register your organization with Android enterprise.

6. Log in to the Google website with your Google account.

Note

We recommend that you create a new Google account for this purpose.

7. On the Google website, follow the steps to register your organization.

Tip

When specifying your organization name, include the term SMC and your Sophos Mobile customer name, like My organization name (SMC/My customer name) . The account properties don’t mention any information about the account being connected to Sophos Mobile.

After you have completed the registration steps, the Google website redirects you back to Sophos

Mobile.

8. In Sophos Mobile, click Finalize setup to complete the registration process.

This completes the procedure to set up Android enterprise for your organization.

Note

After you’ve set up Android enterprise you can’t change the user management mode, for example from internal user management to an external LDAP directory.

19.3 Set up Android enterprise (Managed Google

Domain scenario)

For the Managed Google Domain scenario, to set up Android enterprise for your organization, you:

1. Register a Managed Google Domain with Google.

2. Create an enterprise service account and configure the APIs that are required to communicate with the Google services.

3. Bind Sophos Mobile as third-party EMM (Enterprise Mobility Management) software to your

Managed Google Domain.

Note

After you’ve set up Android enterprise you can’t change the user management mode, for example from internal user management to an external LDAP directory.

Sophos Mobile

19.3.1 Register domain with Google

In the first stage of the procedure to set up Android enterprise for your organization, you register a domain with Google (Managed Google Domain), create a domain administrator (Managed Google

Account) and verify your domain ownership.

Note

If you already have a Managed Google Domain, for example because you have signed up for

G Suite (formerly Google Apps), you can skip this section.

1. Click the following link https://www.google.com/a/signup/?enterprise_product=ANDROID_WORK to sign up for a Managed Google Domain.

2. Fill the web form with the required information.

• Under About your business, enter the domain that will be used as the Managed Google

Domain in the Business domain address field. For example, you could use the domain of your Sophos Mobile server.

Note

If you want to configure Android enterprise for more than one customer in Sophos Mobile, you need a separate domain for each customer.

• Under Your Google admin account, enter the credentials for a new domain administrator.

Note

Make a note of the credentials as you will need them later in the setup procedure.

3. Click the button to create the domain administrator account.

This opens the Google Admin console.

4. In the Google Admin console, start the procedure to verify your domain ownership.

Follow the instructions provided by Google to verify your domain.

After your domain ownership is verified, you receive a token to connect your Managed Google Domain with your third-party EMM provider, that is, with Sophos Mobile.

Next, you must create a Google service account and configure the relevant Google APIs. See

Configure Google service account

(page 308).

308

19.3.2 Configure Google service account

In the second stage of the procedure to set up Android enterprise for your organization, you create and configure a Google service account.

Prerequisite: You have a domain administrator account for your Managed Google Domain.

A Google service account is a special type of Google account for an application. This account is used by Sophos Mobile to communicate with the Google APIs.

Create a project:

1. Click the following link https://console.developers.google.com/apis/library to open the Google API console. Log in with the credentials of your domain administrator account.

Sophos Mobile

2. In the header bar of the Google API console, click Project > Create project.

If you already have a project, the header bar shows the project name instead of the word Project.

3. In the New project dialog, enter a project name, for example Android enterprise , and then click Create.

Enable the required APIs:

4. On the menu sidebar, click Library, and then enter the string admin sdk in the search field.

5. In the search result list, click Admin SDK.

6. At the top of the Admin SDK page, click Enable.

7. Repeat the previous three steps for the Google Play EMM API: a) On the menu sidebar, click Library, and then enter the string emm in the search field.

b) In the search result list, click Google Play EMM API.

c) At the top of the Google Play EMM API page, click Enable.

Create a service account:

8. On the Google Play EMM API page, click Create credentials.

9. In step one of the Add credentials to your project page, click the service account link.

10. On the Service Accounts page, click Create Service Account.

11. In the Create service account dialog box, enter the following settings: a) In Name, enter a name to identify the service account, for example Android enterprise .

b) Select Furnish a new private key and then select JSON.

c) Select Enable G Suite Domain-wide Delegation.

d) In Product name for the consent screen, enter for example Android enterprise .

When you click Create, the private key for your service account is generated and saved to your computer in a JSON file.

Note

Store the JSON file in a secure location. You need it to bind Sophos Mobile to your Managed

Google Domain.

Configure API access:

12. Click the following link https://admin.google.com

to open the Google Admin console and log in with the credentials of your domain administrator account.

13. Click Security and then click Advanced settings.

Tip

You may need to click Show more to display Advanced settings.

14. Click Manage API client access.

15. Open the JSON file in a text editor and copy the client_id value into the Client Name field.

For example, if your JSON file contains a line

"client_id": "123456789"

, then enter 123456789 in the Client Name field.

Sophos Mobile

16. In the One or more API Scopes field, enter the following two URLs, separated by a comma: https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/androidenterprise

17. Click Authorize.

You can now bind Sophos Mobile to your Managed Google Domain. See Bind Sophos Mobile to your domain (page 310).

310

19.3.3 Bind Sophos Mobile to your domain

In the third stage of the procedure to set up Android enterprise for your organization, you bind Sophos

Mobile to your Managed Google Domain.

Prerequisites:

• You have a domain administrator account for your Managed Google Domain.

• You have verified your domain ownership.

• You have enabled the relevant Google APIs.

• You have created a Google service account.

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the Android

enterprise tab.

2. Click Configure.

3. Select “Managed Google Domain” scenario and then click Next.

4. In the dialog box that opens, configure the following settings:

Option

Business domain

Domain administrator

EMM token

Description

Your Managed Google Domain that has been verified to Google.

The name of your domain administrator account. This is the administrator that you created when you registered your domain with

Google.

The token that you received from Google after you verified your domain ownership.

You can view the token when you log in to the Google admin console ( https:// admin.google.com

) with your domain administrator credentials and navigate to

Security > Manage EMM provider for

Android.

5. Click Upload a file and then navigate to the JSON file that you downloaded from Google when creating the service account.

The JSON file that you select must have an extension .json

6. Click Bind.

Sophos Mobile contacts the Google web service to bind itself as an EMM provider to your Managed

Google Domain.

In the final stage of the procedure to set up Android enterprise for your organization, you must

configure the Google EMM settings. See Configure EMM settings

(page 311).

Sophos Mobile

19.3.4 Configure EMM settings

In the final stage of the procedure to set up Android enterprise for your organization, you configure the

Google EMM settings.

Prerequisite: You have bound Sophos Mobile to your Managed Google Domain.

1. Click the following link https://admin.google.com

to open the Google Admin console and log in with the credentials of your domain administrator account.

2. Click Security and then click Manage EMM provider for Android.

Tip

You may need to click Show more to display Manage EMM provider for Android.

3. Under General Settings, select Enforce EMM policies on Android devices.

This completes the procedure to set up Android enterprise for your organization.

Note

After you’ve set up Android enterprise you can’t change the user management mode, for example from internal user management to an external LDAP directory.

19.4 Configure Android enterprise device enrollment

Prerequisites:

• You have configured Android enterprise for the customer.

Complete the following steps to configure device enrollment for Android enterprise.

1. Create a policy for each Android enterprise enrollment mode you want to support.

• For device owner mode, create a policy of type Android enterprise device policy.

• For profile owner mode, create a policy of type Android enterprise work profile policy.

For a general description of how to create policies, see

Create profile or policy (page 94).

2. Create a task bundle for each Android enterprise enrollment mode you want to support.

The task bundle must contain at least an Enroll task and an Install profile or assign policy task for the policy you created earlier.

For a general description of how to create task bundles, see Create task bundle

(page 269).

3. In the Self Service Portal group settings, select the task bundle you have created as the initial package.

You can configure different packages for corporate and personal devices. For example, use device owner enrollment for corporate devices and profile owner enrollment for personal devices.

For a general description of how to configure Self Service Portal group settings, see

Configure

Self Service Portal settings

(page 27).

Sophos Mobile

After you’ve configured device enrollment, Self Service Portal users can enroll their Android devices with Sophos Mobile. Based on your configuration, the enrollment mode (device owner or profile

owner mode) is defined by the device type (corporate or personal device).

If you’ve set up Android enterprise for the Managed Google Play Account scenario, you can also

enroll devices using the Add device wizard. See Enroll Android enterprise devices

(page 46).

Important

For the Managed Google Play Account scenario, a user can only have ten devices enrolled at the same time. This limit is set by Google and might change in the future.

Note

If you configure Android enterprise enrollment for corporate and/or personal devices as described in this section, standard enrollment of Android devices is not available for that device type in the

Self Service Portal.

19.5 Manage users for Android enterprise

(Managed Google Domain scenario)

Note

This topic describes the management of Google user accounts if you have set up Android enterprise using the Managed Google Domain scenario.

For the Managed Google Play Account scenario, Sophos Mobile transparently manages the

Google accounts of your users.

A user must have a Managed Google Account to enroll an Android enterprise device. This account is connected to the domain that you registered with Google.

Account names are formed like an email addresses, for example user@your_managed_Google_domain .

When a user enrolls a device in the Self Service Portal, Sophos Mobile checks if a Managed Google

Account for the user already exists on the Google server. For this, the left part of the user’s email address in Sophos Mobile is combined with your Managed Google Domain. If an account with that name does not exist, Sophos Mobile creates it.

Example: If the user’s email address in Sophos Mobile is user@your_company.com

and your

Managed Google Domain is your_managed_Google_domain , Sophos Mobile checks the Google server for an account user@your_managed_Google_domain .

Other than creating a Managed Google Account for the user during enrollment, Sophos Mobile does not manage the account lifecycle. If you delete the user account in Sophos Mobile, the user’s

Managed Google Account remains.

You can manage the accounts for your Managed Google Domain from the Google Admin console.

If required, you can create accounts from your LDAP directory, using Google Apps Directory Sync

(GADS).

Related information

Google Admin console (external link)

About Google Apps Directory Sync (external link)

Sophos Mobile

19.6 Create work profile

A work profile is created when users enroll their devices in the Self Service Portal in Android enterprise profile owner mode.

You can delete the work profile in Sophos Mobile Admin, for example to delete corporate data from the device in case of lost or theft.

19.7 Lock work profile

You can lock or unlock the work profile in Sophos Mobile Admin. When the work profile is locked, all apps in the work profile are unavailable and no notifications are displayed for these apps.

Note

This section does not apply to Android enterprise devices in device owner mode. See Android enterprise (page 305)

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the blue triangle next to the device for which you want to lock or unlock the work profile and then click Show.

3. Click Actions > Set container access.

4. Select the access permissions.

• Deny: The work profile is locked. Users can no longer access apps or data within the work profile.

• Allow: The work profile is unlocked.

• Auto mode: The work profile is locked if the device violates a compliance rule that contains a

Lock container action. This is the default behavior if you have not set an access permission.

5. Click Yes.

The device is synchronized with the Sophos Mobile server. Once this is complete the setting is applied to the device.

Tip

To lock the whole device instead of just the work profile, use Actions > Lock.

Tip

Users can lock the work profile from the Quick Settings panel on their device, for example when they are on leave.

Sophos Mobile

19.8 Remove work profile from device

Note

This section does not apply to Android enterprise devices in device owner mode. See Android enterprise (page 305)

You can remove the work profile in Sophos Mobile Admin to delete corporate data from the device in case of lost or theft.

When you remove the work profile from the device, all apps installed in the work profile, including the

Sophos Mobile Control app, are also removed. In Sophos Mobile Admin, the device is displayed with status Unenrolled.

1. On the menu sidebar, under MANAGE, click Devices.

2. Click the blue triangle next to the device from which you want to remove the work profile and then click Show.

3. Click Actions > Wipe Android work profile.

A task to remove the work profile is created and transferred to the device.

Note

If the user has already removed the work profile manually, the task fails as the device cannot receive it anymore.

To re-create the work profile, the user must repeat the enrollment in the Self Service Portal.

19.9 User-initiated work profile removal

Users can remove the work profile from their device, either accidentally or intentionally. Sophos

Mobile is unable to detect this type of removal. It continues to display the device management status as Android enterprise (profile owner).

After the user has removed the work profile, the device cannot synchronize with the Sophos Mobile server.

Tip

You can use the Devices not synchronized in last 7 days report to identify potentially affected devices.

If the work profile was removed accidentally, it can be re-enrolled as follows:

1. You delete the device from Sophos Mobile.

2. The user repeats the device enrollment in the Self Service Portal.

Sophos Mobile

19.10 Android Factory Reset Protection

Note

This section applies to devices enrolled with Sophos Mobile in Android enterprise device owner mode.

Android devices include the Factory Reset Protection (FRP) security feature. When a Google account is set up on a device, the account credentials are required to unlock the device after it was reset to its factory settings.

Devices enrolled with Sophos Mobile in Android enterprise device owner mode are not secured by

FRP by default because there is no Google account set up on the device. To use FRP for these devices, configure one or more Google accounts to be assigned to all of your devices. When a

device is reset with FRP turned on, it can only be unlocked by one of these accounts. See Configure

Android Factory Reset Protection

(page 315).

When you have configured FRP, devices are protected as follows:

• Local reset: When the device is reset in the Settings app or by using the device hardware buttons, FRP is turned on by default. To change this behavior for individual devices, use the Set

Factory Reset Protection device action. See Turn Android Factory Reset Protection on or off

(page 59).

• Remote reset: When the device is reset remotely in Sophos Mobile Admin, FRP is turned

off by default. To perform a remote reset with FRP turned on, select Turn on Factory Reset

Protection in the wipe confirmation dialog. See Wipe device

(page 59).

19.10.1 Configure Android Factory Reset Protection

Note

This section applies to devices enrolled with Sophos Mobile in Android enterprise device owner mode.

Factory Reset Protection (FRP) is an Android security feature that ensures a device can only be reset to its factory settings when the Google account credentials are known.

For devices enrolled with Sophos Mobile in Android enterprise device owner mode, you can configure Google accounts to unlock any device that was reset with FRP turned on.

Prepare your Google accounts:

1. Create one or more Google accounts you want to use for FRP, or use existing accounts.

Important

Make sure you share the account credentials with your organization. These are required to unlock a device that was reset to its factory settings with FRP turned on.

2. Get the Google+ IDs of your Google accounts.

Every Google account has a Google+ ID assigned, even if the account is not registered for the

Google+ service.

To get the Google+ ID:

Sophos Mobile a) Enter the following address in your web browser to open the Google login page: https:// accounts.google.com/Login b) Log in with the Google account you want to use for FRP. If you already are logged in to Google with a different account, log out first.

c) Enter the following address in your web browser: https://plus.google.com/me

If the account is registered for Google+, you are forwarded to a Google+ page. If the account is not registered for Google+, you see an error page.

In both cases, the Google+ ID of the account is displayed in the browser’s address field, for example https://plus.google.com/123456789012345678901 .

d) Make a note of the 21-digit number. This is the Google+ ID.

Configure your Google accounts in Sophos Mobile Admin:

3. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the Android

enterprise tab.

4. Under Factory Reset Protection, click Use FRP.

5. In Google+ IDs, enter the Google+ IDs of the Google accounts you want to use for FRP.

6. Click Save.

FRP is turned on for all your devices enrolled in Android enterprise device owner mode. This happens the next time a device synchronizes with the Sophos Mobile server.

Important

If the Google+ IDs you enter in Sophos Mobile Admin are invalid, or if you forget the credentials of the Google accounts, devices become unusable when you reset them to their factory settings with

FRP turned on.

19.11 Managed Google Play apps

On Android enterprise devices, only managed Google Play apps you’ve approved for your organization can be installed.

Perform the following tasks in managed Google Play and in Sophos Mobile to make apps available to your users:

1. In managed Google Play, you select the apps for your organization. To do this:

• Approve the app.

• Purchase app licenses.

• Accept the app permissions.

See Approve managed Google Play app

(page 317).

2. In Sophos Mobile, you configure the app. To do this:

• Define the location of the app in the managed Google Play Store app on the users’ devices.

• For apps that support it, configure custom app settings.

• For paid apps, assign users a license for the app.

See Edit managed Google Play app

(page 318).

Sophos Mobile

19.11.1 Approve managed Google Play app

1. Open managed Google Play ( https://play.google.com/work ) and log in with your Android enterprise administrator account.

2. Select the app you want to make available to your users.

3. Either click Approve (for free apps) or Buy (for paid apps).

Note

Paid apps are currently only available in the United States and in Canada.

4. If the app requires permissions, accept these on behalf of your company.

When your users install that app, they are not asked to grant permissions.

5. For paid apps, enter the number of licenses and the payment method.

Note

If you receive an error when trying to buy an app, check in the Google Admin console that

Google payment services are enabled for your domain or your account.

At this stage, the app is approved for your domain but users are not able to install it yet. You must

complete the allocation process in Sophos Mobile. See Edit managed Google Play app (page 318).

Note

If an update to an approved app includes additional app permissions, you must accept these before your users can install the update. In the Google Play menu, click Update to view and approve pending updates.

Related information

Managed Google Play (external link)

Google Admin console (external link)

Managed Google Play help (external link)

19.11.2 Unapprove managed Google Play app

Prerequisite: You’ve removed the app from any Android task bundle.

1. On the menu sidebar, under CONFIGURE, click Apps > Android.

2. Click Approved apps.

3. Click the blue triangle next to the app you want to unapprove and then click Show.

4. Click Unapprove.

Tip

You can also unapprove apps in managed Google Play.

Sophos Mobile

19.11.3 Edit managed Google Play app

After you’ve approved a managed Google Play app for your organization, you must configure it in

Sophos Mobile to make it available to your users.

1. On the menu sidebar, under CONFIGURE, click Apps > Android.

2. On the Apps page, click Approved apps.

This opens the Approved apps page that displays a list of all apps you’ve approved in managed

Google Play.

3. Click Retrieve app list from Google to synchronize the changes you made in managed Google

Play. After synchronization, users can install the apps through the managed Google Play Store app.

4. Click the required app.

5. On the Edit approved app page, configure the settings as required. See

Settings for managed

Google Play apps

(page 318).

You can configure up to 30 categories per page and up to 100 apps per category.

6. Click Save to save your changes.

7. On the Approved apps page, click Send configuration to Google to send the updated layout information and app configuration to Google.

Note

If you skip this last step, the app configuration is only stored locally in Sophos Mobile. It is not transferred to the Google server and is not available to your users.

After the data is synchronized to the Google server, the app is available through the managed Google

Play Store app. Free apps are available to all your users. Paid apps are only available to users that have a license assigned.

19.11.4 Settings for managed Google Play apps

This section lists the settings for managed Google Play apps you’ve approved for your organization.

Setting/Field

Title

Product ID

Pricing

Description

The external app name as displayed in managed Google Play.

The internal app name.

The pricing type:

• Free

• Free with in-app purchases

• Paid

Setting/Field

Distribution type

Managed Google Play URL, Google Play

URL

Page

App category

Licenses

Sophos Mobile

Description

• Public (Google-hosted): The app is available to the general public in managed

Google Play.

• Private (Google-hosted): The app is developed by you and only available to users within your Managed Google Domain.

The APK file was uploaded to managed

Google Play.

• Private (self-hosted): Like Private

(Google-hosted), but the APK file is installed from your local server. Managed

Google Play is only used to manage the distribution.

The web address of the app in managed

Google Play and Google Play.

Click the link to open that page in a new browser window.

The page on which the app will appear in the users’ Google Play Store app.

The values are pre-configured by Sophos

Mobile and cannot be changed.

The name of a category under which the app will appear in the users’ Google Play Store app.

When you start to type, a list of matching categories is displayed. If you enter a category that is not available, it is created.

You can configure up to 30 categories per page and up to 100 apps per category.

Click Show next to Licenses to view or edit the number of used and remaining licenses for the app, and the users that have a license assigned.

This setting is only available for paid apps.

Sophos Mobile

Setting/Field

Managed configuration

Description

Click App settings to view or edit app-specific settings.

For information on the available settings, see the documentation provided by the app developer.

This setting is only available if the app offers managed configuration.

Tip

You can use the placeholders %_USERNAME_% and %_EMAILADDRESS_% which are replaced by the actual user name and email address.

320

19.11.5 Install managed Google Play app

After you have approved a managed Google Play app and have assigned app licenses to your users, you can install the app to selected devices or device groups.

Note

Users can install approved apps through the managed Google Play Store app.

1. On the menu sidebar, under CONFIGURE, click Apps > Android.

2. On the Apps page, click Approved apps.

3. Click the blue triangle next to the required app and then click Install.

4. Select the devices on which you want to install the app. Do one of the following:

• Select individual devices.

• Click Select device groups and then select one or more device groups.

When you are ready, click Next.

5. On the Set execution date page, set the date when the app will be installed:

• Select Now for an immediate execution.

• Select Date and then enter a date and a time for a scheduled execution.

6. Click Finish.

19.11.6 Uninstall a managed Google Play app

You can uninstall a managed Google Play app from selected devices or device groups.

1. On the menu sidebar, under CONFIGURE, click Apps and then click Android.

2. On the Apps page, click Approved apps.

3. On the Approved apps page, click Uninstall.

Sophos Mobile

4. Select the devices from which you want to uninstall an app. Do one of the following:

• Select individual devices.

• Click Select device groups and then select one or more device groups.

When you are ready, click Next.

5. On the Select app page, select the required app.

6. On the Set execution date page, set the date when the app will be uninstalled:

• Select Now for an immediate execution.

• Select Date and then enter a date and a time for a scheduled execution.

7. Click Finish.

A task to uninstall the app is sent to a Google service. Google then manages the removal of the app from the device. On the Task view page, the task is displayed with state successful after it has been sent to Google.

Tip

19.11.7 Licenses for managed Google Play apps

For paid apps you’ve approved in managed Google Play, you must assign an app license to a user to make the app available to the user.

You configure the license assignment on the Edit approved app page. See

Edit managed Google

Play app (page 318).

Note

• You don’t need to assign a license for administrator-initiated app installations. When you install an app as described in

Install managed Google Play app (page 320), a license from your

pool of purchased licenses is automatically assigned to the relevant users.

• You don’t need to assign a license for free apps you’ve approved in managed Google Play.

Free apps are automatically available to all your users after you synchronize the app list from

Google to Sophos Mobile.

19.11.8 Layout of managed Google Play

You can define the location of managed Google Play apps in the users’ Play Store app.

The configurable layout elements are Pages and Categories.

• Pages are named, vertically scrollable views. Pages and their names are pre-defined by Sophos

Mobile.

• Categories are named, horizontally scrollable subsections of a page that you define. In the Google documentation, categories are also called clusters.

• Each category is specific to a certain page, and each app appears within a certain category.

• Pages that do not contain any apps are not displayed.

Sophos Mobile

• You can configure up to 30 categories per page and up to 100 apps per category.

For each app, you define the page and, optionally, the category in which the app is displayed in the managed Google Play Store app on the users’ devices. By default, apps are placed on a page named Other.

You configure the store layout on the Edit approved app page. See

Edit managed Google Play app

(page 318).

19.11.9 Configurable apps

A managed Google Play app can offer a managed configuration. This feature is included by the app developer and allows you to configure custom settings for the app.

If an app supports managed configuration, a note This app offers managed configuration is displayed on the app’s page in managed Google Play.

You configure the app settings on the Edit approved app page. See Edit managed Google Play app

(page 318).

19.11.10 Private and self-hosted apps

For Android enterprise, all apps you want to make available to your users must be distributed through managed Google Play.

• Public apps are apps that are available to all users with a Managed Google Account.

• Private apps are apps developed by you that are only available to users inside your Managed

Google Domain.

• Self-hosted apps are private apps for which the app package (that is the APK file) is located on a server belonging to your organization instead of the Google server. However, the app store metadata for self-hosted apps must be uploaded to Google so that the app can be distributed through managed Google Play.

For information on private apps, see the Android in the enterprise developer information (external link).

Sophos Mobile

20 Intune app protection

Intune is a Microsoft service to manage mobile devices and apps. Intune app protection lets you define app-level usage restrictions and assign them to your users.

Because Intune app protection is based on the user identity and doesn’t require device management to secure your corporate data, it’s suitable for Bring Your Own Device (BYOD) programs.

You can manage your Intune app protection policies in Sophos Mobile Admin.

Features and requirements

• Devices don’t need to be enrolled with Sophos Mobile.

• Intune app protection policies can be applied to the Office 365 apps, and to other apps that have been integrated with the Intune App SDK.

• Policies are only applied when users log in to an app with their corporate account. There are no usage restrictions when they log in with their private account.

• You must have an Azure Active Directory (AD) Premium subscription.

• Users must have an Intune license assigned to their Azure AD account.

• For the Microsoft Outlook app, users must have an Office 365 Exchange Online mailbox and license linked to their Azure AD account.

• For the Microsoft Word, Excel, and PowerPoint apps, users must have an Office 365 Business or

Enterprise license linked to their Azure AD account.

Related information

Microsoft Intune documentation (external link)

Microsoft Intune apps (external link)

20.1 Set up Microsoft Intune integration

To be able to manage your Intune app protection policies in Sophos Mobile Admin, you must register

Sophos Mobile as a Microsoft Azure application. We recommend you use the Microsoft Azure

registration.

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the

Microsoft Azure tab.

2. Click Microsoft Azure registration wizard.

The wizard guides you through the registration process in the Microsoft Azure portal and in Sophos

Mobile Admin: a) Create an application for Sophos Mobile in the Microsoft Azure portal.

b) Enter the application ID in Sophos Mobile.

c) Upload the Sophos Mobile server certificate to your application.

d) Grant your application the required permissions.

Sophos Mobile

The wizard also contains a page to configure federated authentication. Only follow the steps on that page if you want to use federated authentication with Azure Active Directory instead of internal or external user management. See

Federated authentication

(page 87).

When you’ve completed the setup procedure, there is a new entry Profiles, policies > Intune app

protection in the menu sidebar of Sophos Mobile Admin.

20.2 Create Intune app protection policy

With an Intune app protection policy, you apply data restrictions based on the user identity. The restrictions are only applied when the app is used in a work context, i.e. when an assigned user opens an app using a corporate account.

You must create separate policies for Android and iOS apps.

1. On the menu sidebar, under CONFIGURE, click Profiles, policies > Intune app protection.

2. Confirm the dialog to be forwarded to a Microsoft page, and then log in with your Microsoft Azure administrator account.

This step is omitted if you’ve already logged in to Microsoft Azure during the current Sophos Mobile

Admin session.

3. On the Policies page of Sophos Mobile Admin, click Add and then click Android policy or iOS

policy.

4. On the Edit policy page, enter the required settings.

See

Intune app protection policy settings (Android)

(page 325) and Intune app protection policy settings (iOS) (page 329).

5. Click Save.

You can view the policy in the Microsoft Azure portal. You might need to sign in again to the portal to refresh the information displayed.

After you’ve created the Intune app protection policy, assign it to apps and to users. See

Assign apps to an Intune app protection policy

(page 324) and Assign users to an Intune app protection policy (page 325).

20.3 Assign apps to an Intune app protection policy

An Intune app protection policy is only applied to the apps you assign it to.

1. On the menu sidebar, under CONFIGURE, click Profiles, policies > Intune app protection.

2. Confirm the dialog to be forwarded to a Microsoft page, and then log in with your Microsoft Azure administrator account.

This step is omitted if you’ve already logged in to Microsoft Azure during the current Sophos Mobile

Admin session.

3. On the Policies page of Sophos Mobile Admin, click the blue triangle next to the policy you want to assign apps to, and then click Assign apps.

4. Select the apps you want to assign the policy to.

The list includes all Android or iOS apps you’ve added to your Microsoft Intune account in the

Microsoft Azure portal.

5. Click Save.

You can view the app assignment in the Microsoft Azure portal. You might need to sign in again to the portal to refresh the information displayed.

Sophos Mobile

20.4 Assign users to an Intune app protection policy

An Intune app protection policy is only applied to an app when it is used by an assigned user. You assign users not individually but by Azure Active Directory (AD) security groups.

1. On the menu sidebar, under CONFIGURE, click Profiles, policies > Intune app protection.

2. Confirm the dialog to be forwarded to a Microsoft page, and then log in with your Microsoft Azure administrator account.

This step is omitted if you’ve already logged in to Microsoft Azure during the current Sophos Mobile

Admin session.

3. On the Policies page of Sophos Mobile Admin, click the blue triangle next to the policy you want to assign users to, and then click Assign user groups.

4. In the list of available Azure AD security groups, select the groups you want to include or exclude:

• Include: The policy applies to members of this group.

• Exclude: The policy doesn’t apply to members of this group, even if they are also members of an Include group.

• Not assigned: The policy doesn’t apply to members of this group, unless they are also members of an Include group.

5. Click Save.

You can view the user assignment in the Microsoft Azure portal. You might need to sign in again to the portal to refresh the information displayed.

Note

The policy only applies to users with an Intune license assigned to their Azure AD account. Other users in the selected security groups are not affected.

20.5 Intune app protection policy settings (Android)

With an Intune app protection policy you define restrictions for Intune-managed apps. This section describes the available settings for Android apps.

General settings

Setting/Field

Name

Description

Description

The name of the policy.

A short description of the policy.

Data relocation

Under Data relocation, you configure how data is allowed to enter or leave the app.

Sophos Mobile

Note

All settings apply to data users access when logged in with their corporate account.

Setting/Field

Prevent Android backups

Allow app to transfer data to other apps

Description

The app doesn’t use the Android backup service.

The apps this app can transfer data to:

Policy-managed apps: Only allow transfer to other apps managed by an Intune policy.

All apps: Allow transfer to any app.

No apps: Do not allow transfer to any app.

Note

• There might be apps and services to which data transfer is always allowed. For details, see the

Microsoft Intune documentation on data transfer exemption.

• Data transfer to an Android instant app is always blocked.

Allow app to receive data from other apps

Prevent “Save As”

Storage locations

The apps this app can receive data from:

Policy-managed apps: Only allow transfer from other apps managed by an Intune policy.

All apps: Allow transfer from any app.

No apps: Do not allow transfer from any app.

Note

• There might be apps and services from which data transfer is always allowed. For details, see the

Microsoft Intune documentation on data transfer exemption.

• Data transfer from an Android instant app is always blocked.

The Save-As option of the app is disabled.

If Prevent “Save As” is selected, select the locations where corporate data is stored.

Users can save to the selected locations. Other locations are blocked.

Sophos Mobile

Setting/Field

Restrict cut, copy, and paste with other apps

Restrict web content to display in the

Managed Browser

Encrypt app data

Disable contacts sync

Disable printing

Description

Select how cut, copy, and paste actions can be used with the app.

Blocked: Do not allow cut, copy, and paste actions between this app and other apps.

Policy-managed apps: Allow cut, copy, and paste actions between this app and other apps managed by an Intune policy.

Policy-managed with paste in: Allow cut or copy between this app and other apps managed by an

Intune policy. Allow data from any app to be pasted into this app.

All apps: No restrictions for cut, copy, and paste to and from this app.

Enforce web links in the app to be opened in the Intune

Managed Browser app.

Data is encrypted using an encryption scheme defined by Intune.

The app doesn’t save data to the Contacts app.

Printing is disabled in the app.

Access

Under Access, you configure how users can access the app when logged in with their corporate account.

Setting/Field

Require PIN for access

Description

A PIN is required to use the app.

Users are prompted to set a PIN the first time they log in with their corporate account.

Note

All Intune-managed Android apps share the same PIN.

Number of attempts before PIN reset

Forbid simple PIN

PIN length

The number of failed login attempts before the PIN is reset.

Users are not allowed to use simple PIN sequences such as 1234 or 1111.

The minimum number of digits in a PIN sequence.

Sophos Mobile

Setting/Field

Forbid fingerprint

Require corporate credentials for access

Block managed apps from running on rooted devices

Access requirements timeout

Description

Users can’t use fingerprint authentication instead of a

PIN for authentication.

Users must enter their corporate password instead of a

PIN.

This setting overrides the other PIN requirements.

On rooted devices, users can’t use the app with their corporate account.

The time in minutes before the access requirements

(set in this policy) are rechecked when the app is launched.

Note

After users have entered the PIN once, they may use other Intune-managed apps without having to enter the

PIN again, for the time period defined in this setting.

Offline grace period

Offline interval before app data is wiped

Block screen capture and Android

Assistant

Required minimum Android version

Recommended minimum Android version

The time in minutes that a device can be offline before the access requirements for the app are rechecked.

After this period is expired, the app requires the user to connect to the network and authenticate again.

The number of days that a device can be offline before the user must connect to the network and authenticate again.

If authentication fails, corporate app data is wiped.

Note

For the Microsoft Outlook app, wiping the app data also removes data saved to the Contacts app.

Users can’t take screen captures or use the Google

Assistant.

This also blurs the app picture in the list of recent apps.

The minimum Android version required to use the app.

Leave the field empty to ignore this setting.

The recommended minimum Android version to use the app.

If the device doesn’t meet this requirement, a notification is displayed which the user can dismiss.

Leave the field empty to ignore this setting.

Sophos Mobile

Setting/Field

Required minimum app version

Recommended minimum app version

Required minimum Android patch version

Recommended minimum Android patch version

Description

The minimum app version required to use the app.

Leave the field empty to ignore this setting.

The recommended minimum app version to use the app.

If the app on the device doesn’t meet this requirement, a notification is displayed which the user can dismiss.

Leave the field empty to ignore this setting.

The minimum Android security patch level required to use the app.

Enter the patch level date, using the format YYYY-MM-

DD .

Leave the field empty to ignore this setting.

The recommended minimum Android security patch level to use the app.

Enter the patch level date, using the format YYYY-MM-

DD .

If the device doesn’t meet this requirement, a notification is displayed which the user can dismiss.

Leave the field empty to ignore this setting.

20.6 Intune app protection policy settings (iOS)

With an Intune app protection policy you define restrictions for Intune-managed apps. This section describes the available settings for iOS apps.

General settings

Setting/Field

Name

Description

Description

The name of the policy.

A short description of the policy.

Data relocation

Under Data relocation, you configure how data is allowed to enter or leave the app.

Note

All settings apply to data users access when logged in with their corporate account.

Sophos Mobile

Setting/Field

Prevent iTunes and iCloud backups

Allow app to transfer data to other apps

Description

The app doesn’t back up data to iTunes or iCloud.

The apps this app can transfer data to:

Policy-managed apps: Only allow transfer to other apps managed by an Intune policy.

All apps: Allow transfer to any app.

No apps: Do not allow transfer to any app.

Note

• There might be apps and services to which data transfer is always allowed. For details, see the

Microsoft Intune documentation on data transfer exemption.

• Policy-managed apps and No apps also block Siri to search data within the app.

Allow app to receive data from other apps

The apps this app can receive data from:

Policy-managed apps: Only allow transfer from other apps managed by an Intune policy.

All apps: Allow transfer from any app.

No apps: Do not allow transfer from any app.

Note

• There might be apps and services from which data transfer is always allowed. For details, see the

Microsoft Intune documentation on data transfer exemption.

• Some apps ignore this setting and allow all incoming data.

Prevent “Save As”

Storage locations

The Save-As option of the app is disabled.

If Prevent “Save As” is selected, select the locations where corporate data is stored.

Users can save to the selected locations. Other locations are blocked.

Sophos Mobile

Setting/Field

Restrict cut, copy, and paste with other apps

Restrict web content to display in the

Managed Browser

Encrypt app data

Disable contacts sync

Disable printing

Description

Select how cut, copy, and paste actions can be used with the app.

Blocked: Do not allow cut, copy, and paste actions between this app and other apps.

Policy-managed apps: Allow cut, copy, and paste actions between this app and other apps managed by an Intune policy.

Policy-managed with paste in: Allow cut or copy between this app and other apps managed by an

Intune policy. Allow data from any app to be pasted into this app.

All apps: No restrictions for cut, copy, and paste to and from this app.

Enforce web links in the app to be opened in the Intune

Managed Browser app.

Select when data is encrypted. Data is encrypted using the device-level encryption scheme provided by iOS.

When device is locked: App data is encrypted when the device is locked.

When device is locked and there are open files:

App data is encrypted when the device is locked, except data of currently open files.

When device restart: App data is encrypted when the devices is restarted, until the device is unlocked for the first time.

Use device settings: App data is encrypted based on the device settings.

The app doesn’t save data to the Contacts app.

Printing is disabled in the app.

Access

Under Access, you configure how users can access the app when logged in with their corporate account.

Sophos Mobile

Setting/Field

Require PIN for access

Password type

Description

A PIN is required to use the app.

Users are prompted to set a PIN the first time they log in with their corporate account.

Note

All Intune-managed iOS apps of the same publisher share the same PIN.

The type of PIN users must define:

Numeric: PIN must only contain digits.

Passcode: PIN must contain at least one letter, special character, or symbol (as available on the iOS

English language keyboard).

Note

Some apps don’t support the Passcode type.

Number of attempts before PIN reset

Forbid simple PIN

PIN length

Forbid fingerprint

Forbid facial recognition

Require corporate credentials for access

Block managed apps from running on jailbroken devices

The number of failed login attempts before the PIN is reset.

Users are not allowed to use simple PIN sequences such as 1234 or 1111.

If Password type is set to Passcode, the PIN must contain at least one digit, one letter, and one special character or symbol.

The minimum number of characters in a PIN sequence.

Users can’t use Touch ID instead of a PIN for authentication.

Users can’t use Face ID instead of a PIN for authentication.

Users must enter their corporate password instead of a

PIN.

This setting overrides the other PIN requirements.

On jailbroken devices, users can’t use the app with their corporate account.

Sophos Mobile

Setting/Field

Access requirements timeout

Description

The time in minutes before the access requirements

(set in this policy) are rechecked when the app is launched.

Note

After users have entered the PIN once, they may use other Intune-managed apps of the same publisher without having to enter the PIN again, for the time period defined in this setting.

Offline grace period

Offline interval before app data is wiped

The time in minutes that a device can be offline before the access requirements for the app are rechecked.

After this period is expired, the app requires the user to connect to the network and authenticate again.

The number of days that a device can be offline before the user must connect to the network and authenticate again.

If authentication fails, corporate app data is wiped.

Note

For the Microsoft Outlook app, wiping the app data also removes data saved to the Contacts app.

Required minimum iOS version

Recommended minimum iOS version

Required minimum app version

Recommended minimum app version

Required minimum Intune app protection policy SDK version

The minimum iOS version required to use the app.

Leave the field empty to ignore this setting.

The recommended minimum iOS version to use the app.

If the device doesn’t meet this requirement, a notification is displayed which the user can dismiss.

Leave the field empty to ignore this setting.

The minimum app version required to use the app.

Leave the field empty to ignore this setting.

The recommended minimum app version to use the app.

If the app on the device doesn’t meet this requirement, a notification is displayed which the user can dismiss.

Leave the field empty to ignore this setting.

The minimum Intune app protection policy SDK version the app must have.

Leave the field empty to ignore this setting.

Sophos Mobile

21 Manage Sophos Mobile Security

Note

This feature requires a license of type Mobile Advanced.

Sophos Mobile Security is a security app for Android and iOS devices. You can manage the app on devices that are enrolled with Sophos Mobile.

You can also manage the Sophos Mobile Security app on devices that are enrolled with third-party

Enterprise Mobility Management (EMM) software. The third-party EMM software must support

custom app settings. See Configure third-party EMM integration

(page 336).

When Sophos Mobile Security is managed by Sophos Mobile, you can perform the following tasks in

Sophos Mobile Admin:

• Configure settings for the Sophos Mobile Security app remotely and centrally. See

Configurations for Mobile Security policies for Android (page 157) and

Configurations for Mobile

Security policies for iOS

(page 207).

• Assign a compliance policy to ensure the Sophos Mobile Security app is installed and runs scans

at defined intervals. See Sophos Mobile Security compliance rules

(page 334).

•

For Android: Trigger device scans and view scan results. See Scan device

(page 56).

21.1 Sophos Mobile Security compliance rules

This section lists the compliance rules that you can select for the individual platforms.

Rule

Managed required

Root access allowed

Allow jailbreak

Minimum OS version

Maximum OS version

Maximum SMSec synchronization gap

Description

Define the action that will be executed when a device is no longer managed.

Select whether devices with root rights are allowed.

Select whether jailbroken devices are allowed.

Select the earliest operating system version required.

Select the latest operating system version allowed.

Specify the maximum interval between synchronization processes for devices.

Platforms

Android iOS

Rule

Maximum SMSec scan gap

Denial of SMSec permissions allowed

Malware apps allowed

Suspicious apps allowed

PUAs allowed

Sophos Mobile

Description Platforms

Specify the maximum scan interval for malware scans performed by the

Sophos Mobile Security app on the device.

Sophos Mobile Security needs permissions on the device to work properly. The user has to grant these permissions when the app is installed.

Select whether a denial of the required permissions results in a compliance violation.

Android

Android Select whether malware apps that have been detected by Sophos

Mobile Security are allowed.

Select whether suspicious apps that have been detected by Sophos

Mobile Security are allowed.

Android

Select whether Potentially Unwanted

Apps (PUAs) that have been detected by Sophos Mobile Security are allowed.

Android

Sophos Mobile

336

22 Configure third-party EMM integration

You can manage the Sophos Mobile Security app on devices enrolled with third-party Enterprise

Mobility Management (EMM) software. This requires configuration tasks both in the third-party EMM software and in Sophos Mobile.

In the third-party EMM software, you must create a custom app configuration for Sophos Mobile

Security. When the third-party EMM software installs the app, it automatically enrolls with Sophos

Mobile.

Note

For Android, the device must be enrolled in Android enterprise mode.

Perform these steps in Sophos Mobile Admin:

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the Third-

party EMM tab.

2. Click Generate connection code.

The code contains the information required by the Sophos Mobile Security app to enroll with

Sophos Mobile.

3. Configure the following settings:

Option

Owner

Description

The ownership type (Corporate or Personal) of devices you enroll with your third-party

EMM software.

Device group

Mobile Security policy (Android)

The Sophos Mobile device group devices are assigned to.

Optional: The Sophos Mobile policy for

Sophos Mobile Security on Android devices.

Mobile Security policy (iOS) Optional: The Sophos Mobile policy for

Sophos Mobile Security on iPhones and iPads.

4. Click Save.

5. Click Copy next to Connection code to copy the value to the clipboard.

You need the connection code to configure the third-party EMM software.

Perform the remaining steps in the third-party EMM software:

6. Create an app configuration for Sophos Mobile Security.

7. Add the following custom settings to the app configuration:

Parameter name smcData deviceId

Parameter value

The connection code you copied from Sophos Mobile.

The unique device identifier used by the third-party EMM software. The value is used to link the device created in Sophos Mobile with the device in the third-party EMM software.

Sophos Mobile

Parameter name deviceName email

Parameter value

Optional: The device name used by the third-party EMM software.

Optional: The user’s email address you want to assign to the device in

Sophos Mobile.

For details on how to configure custom app settings, see the documentation of the third-party

EMM software.

Tip

If supported by your third-party EMM software, we recommend you use placeholders to specify the device and user properties.

8. Install the Sophos Mobile Security app through the third-party EMM software.

On the first start after installation, the Sophos Mobile Security app enrolls with Sophos Mobile. You can manage the app from the Devices page in Sophos Mobile Admin.

If required, you can revoke the connection code to block future app enrollments. Sophos Mobile

Security apps already enrolled with the Sophos Mobile server are not affected.

Sophos Mobile

23 Create administrators

1. On the menu sidebar, under SETTINGS, click Setup > Administrators to open the Show

administrators page, and then click Create administrator.

2. On the Edit administrator page, configure the account details for the administrator.

• When External LDAP directory is selected as the user directory for the customer, you can click Lookup user via LDAP to select an existing LDAP account.

• If you do not use an external user directory enter the relevant data for Login name, First

name, Last name, Email address and Password.

The password that you specify is a one-time password. When the administrator logs in for the first time they are prompted to change it.

Note

The Login name field must only contain letters (Latin alphabet), digits, spaces and characters

\!._-# .

3. In the Role list, select one of the available roles.

The role defines the type of access rights the new administrator will have to Sophos Mobile. See

User roles

(page 4).

4. Click Save to create the administrator account.

The new administrator is created and shown on the Show administrators page. Forward the user credentials (user, customer and one-time password) to the new user. The new user can log in to

Sophos Mobile Admin and is prompted to change the password.

24 Send message to devices

Note

This section does not apply to Windows computers or Windows IoT devices.

You can send a custom message to managed devices.

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed.

2. Select one or more devices, click Actions and then click Send message.

3. In the Enter message dialog, enter the message you want to send.

The message can contain up to 500 characters.

4. Click Finish.

Sophos Mobile

25 Sophos container

Note

This feature requires a license of type Mobile Advanced.

The Sophos container is a logical area on a device containing the Sophos Secure Workspace,

Sophos Secure Email and Sophos Mobile Security apps when they are managed by Sophos Mobile.

The Sophos container is available on the following platforms:

• Android

• iOS

25.1 Configure Sophos container enrollment

Note

This feature requires a license of type Mobile Advanced.

To enroll devices with Sophos Mobile using the Sophos container enrollment type, you need to perform the following configuration steps. You need to do this for each platform (Android, iOS) for which you want to use Sophos container enrollment.

1. Create a container policy. See Configurations for Sophos container policies for Android

(page 146)

and Configurations for Sophos container policies for iOS (page 196).

2. Use this container policy in a task bundle.

The task bundle must contain at least an Enroll Sophos container task and an Install profile task. See

Create task bundle (page 269).

3. Use this task bundle as an initial package for enrollments through the Self Service Portal:

In the Self Service Portal settings, in the Group settings tab, select that task bundle in the Initial

package - corporate devices or Initial package - personal devices field. See

Configure Self

Service Portal settings

(page 27).

25.2 Mobile Advanced license

When you activate a Mobile Advanced license, you can use these additional features:

•

Manage the Sophos Secure Workspace and Sophos Secure Email apps. See Manage Sophos container apps

(page 341).

• For Android devices, manage the Sophos Mobile Security app. See

Manage Sophos Mobile

Security

(page 334).

After you have received your license key you need to activate the license.

340

Activate a Mobile Advanced license for Sophos Mobile on Premise

For Sophos Mobile on Premise, licenses are managed by the super administrator in customer management. For further information, see the Sophos Mobile super administrator guide .

Sophos Mobile

Activate a Mobile Advanced license for Sophos Mobile as a Service

In Sophos Mobile Admin, go to Setup > Sophos setup > License and enter your license key in the

Advanced license key field.

25.3 Manage Sophos container apps

Note

This feature requires a license of type Mobile Advanced.

For better data separation on the managed devices, Sophos Mobile provides the Sophos container apps Sophos Secure Email and Sophos Secure Workspace:

• Sophos Secure Email is an app for Android and iOS devices that provides a secure container for managing your email, calendar and contacts.

• Sophos Secure Workspace is an app for Android and iOS devices that allows users to access encrypted files stored in the cloud. Files can be decrypted and viewed in a seamless way.

Encrypted files can be handed over by other apps and uploaded to one of the supported cloud storage providers. Alternatively, the documents can be stored locally within the app.

With Sophos Secure Workspace, you can read files encrypted by SafeGuard Cloud Storage or

SafeGuard Data Exchange. Both are modules of SafeGuard Enterprise or one of its different editions. They allow you to encrypt files using a local key. These local keys are derived from a passphrase that is entered by a user. You can only decrypt a file when you know the passphrase that was used to encrypt the file.

The Sophos container provides:

• Centrally defined password rules

• Password rules for all container apps

• Single-Sign-On for all container apps

• Sophos Secure Workspace document settings

• Sophos Secure Workspace browser settings

• Sophos Secure Email settings

You can manage the Sophos apps with Sophos Mobile as follows:

• You can configure settings for the Sophos container apps on all managed devices remotely and

centrally in Sophos Mobile. See Configurations for Sophos container policies for Android

(page

146) and Configurations for Sophos container policies for iOS (page 196).

• Using compliance policies, you can make sure that the Sophos container apps are installed on the devices.

• You can enable secure distribution of documents using the Corporate Documents storage provider.

See

Corporate documents

(page 303).

• You can enable corporate keyring synchronization between the Sophos Secure Workspace app and Sophos SafeGuard Enterprise. This makes the keys from a user's SafeGuard keyring available

in the Sophos Secure Workspace keyring. See Enable corporate keyring synchronization

(page

343).

Sophos Mobile

342

Note

In order to manage the Sophos container apps, they must be distributed using Sophos Mobile.

If users already have an unmanaged version of Sophos Secure Workspace installed on their devices, they must uninstall it first and then install the managed version.

For further information on Sophos Secure Workspace, see the Sophos Secure Workspace help.

25.4 Reset Sophos container password

Note

This feature requires a license of type Mobile Advanced.

Note

This section applies to devices that have an assigned Sophos container policy.

You can reset the Sophos container password. This is useful, for example, when users forget their password. If you reset a Sophos container password, users will be asked to create a new container password.

1. On the menu sidebar, under MANAGE, click Devices.

The Devices page is displayed.

2. Click the device for which you want to reset the Sophos container password.

The Show device page is displayed.

3. Click Actions.

The Actions menu is displayed.

4. Click Reset Sophos container password.

5. In the dialog box, click Yes to confirm the operation.

The Sophos container password is reset. The user has to enter a new Sophos container password.

25.5 Lock and unlock the Sophos container

Note

This feature requires a license of type Mobile Advanced.

Note

This section applies to devices that have an assigned Sophos container policy.

You can lock or unlock the Sophos container, that is, set the access permissions for the Sophos container apps and for data within the Sophos container.

1. On the menu sidebar, under MANAGE, click Devices.

2. On the Devices page, click the blue triangle next to the device for which you want to lock or unlock the Sophos container and then click Show.

3. On the Show device page, click Actions > Set Sophos container access.

4. In the dialog box for setting the access permissions, select one of the following:

Sophos Mobile

• Deny: The Sophos container is locked. Users can no longer use it.

• Allow: The Sophos container is unlocked.

• Auto mode: The Sophos container is locked as long as the device violates a compliance rule for which Lock container is activated. This is the default behavior if you have not set an access permission.

5. Click Yes.

The device is triggered to synchronize with the Sophos Mobile server. On synchronization, the setting is applied to the device.

25.6 Corporate keyring synchronization

Corporate keyring synchronization adds the following features to the Sophos Secure Workspace app:

• The keys from a user's SafeGuard Enterprise keyring are available in the Sophos Secure

Workspace keyring (SSW keyring).

• Users of the app can then use the keys to decrypt and view documents, or encrypt documents.

• Users can continue to use local keys that were available in their SSW keyring when you enabled keyring synchronization.

• Users cannot create new local keys.

• For security reasons, the keys from the SafeGuard keyring are removed from a device when the

Sophos container is locked.

25.6.1 Enable corporate keyring synchronization

Prerequisites:

• You use Sophos SafeGuard Enterprise 8.0 or later.

• You have configured external user management for the Self Service Portal, using the same

Active Directory user database that is configured in SafeGuard Enterprise.

• Sophos Secure Workspace is managed by Sophos Mobile. This requires a Mobile Advanced license.

• Your Sophos Mobile server can connect to your SafeGuard Enterprise server via HTTPS.

To enable corporate keyring synchronization, you set up a connection between Sophos Mobile and

Sophos SafeGuard Enterprise as follows:

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the SGN tab.

2. Click the Certificate link to download the certificate of the Sophos Mobile server.

3. Open SafeGuard Management Center and go to Tools > Configuration Package Tool.

4. On the Servers tab, click Add, browse for the certificate file and then click OK. Do not change the value of the Server name field.

5. Optional: Select Recovery via mobile to enable the synchronization of BitLocker and FileVault recovery keys with the Sophos Secure Workspace app.

6. On the Managed client packages tab, configure the following settings:

• In the Configuration Package Name field, select Managed Client (Default).

• In the Primary Server field, select your SGN server.

Sophos Mobile

• In the Transport Encryption field, select SSL.

7. Click Create Configuration Package.

8. On the SGN tab of Sophos Mobile Admin, click Upload a file to upload the configuration package that you created in the SafeGuard Management Center to Sophos Mobile.

9. Click Save to save the SafeGuard integration settings.

Sophos Mobile

26 Transferring items to Sophos Central

To transfer Sophos Mobile objects and settings, you export the data from your Sophos Mobile server to an exchange file and then import that file into Sophos Central.

The following items are transferred:

• Device groups

• Device profiles and policies

• Compliance policies

• Task bundles

• App settings (without app package files)

• App groups

• Self Service Portal configurations (without user group assignments)

• Most system settings

Some settings are bound to a specific Sophos Mobile server and can’t be transferred.

For details, see the Sophos Mobile migration guide .

26.1 Export items

To transfer objects and settings from your Sophos Mobile server to Sophos Central, you can export them to an exchange file.

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup > Export.

Under Export preview, the items to be exported are displayed.

2. Click Export.

3. Set a password for the exchange file.

4. Click Download.

The exchange file sophosmobile.export

is downloaded to your computer. You can import the file into Sophos Central.

26.2 Import items

When you’ve created an exchange file with objects and settings from a Sophos Mobile server, you can import it to Sophos Central.

1. In Sophos Central Admin, go to Mobile.

2. Click Setup > Sophos setup > Import.

3. Click Upload exchange file.

4. Select the exchange file and enter the password you’ve set when exporting the data.

5. Click Upload.

6. Under Import preview, the items to be imported are listed. Check if there are any warnings.

Sophos Mobile

Important

If there are existing items with the same name as items to be imported, they are overwritten.

7. Click Import to import the data into Sophos Central.

After importing the data, you must perform these manual tasks:

• For apps for which you’ve uploaded the package file to Sophos Mobile, upload the APK file

(Android) or the IPA file (iOS) again.

• Because user groups are not transferred, you must assign Sophos Central user groups to your Self

Service Portal configurations.

For details, see the Sophos Mobile migration guide .

27 Glossary

ad hoc provisioning profile customer enrollment

Enterprise App Store provisioning

Self Service Portal

Mobile Advanced license

SMSec

Sophos Mobile client

Sophos Mobile console

Sophos Mobile Security

Sophos Secure Email

Sophos Secure Workspace

Sophos Mobile

A distribution provisioning profile you add to a self-developed iOS app. This allows you to install the app on designated devices without having to publish it to the App Store.

A customer represents a separate management area within Sophos Mobile. You can set up several customers and manage each customer’s devices independently. This is also known as

multitenancy.

The registration of a device with Sophos Mobile.

An app repository that is hosted on the Sophos

Mobile server. The administrator can use Sophos

Mobile Admin to add apps to the Enterprise App

Store. Users can then use the Sophos Mobile

Control app to install these apps onto their devices.

The process of installing the Sophos Mobile

Control app on a device.

The web interface that allows users to enroll their own devices and carry out other tasks without having to contact the helpdesk.

With a license of type Mobile Advanced you can manage the Sophos Mobile Security, Sophos

Secure Workspace and Sophos Secure Email apps through Sophos Mobile.

Abbreviation for Sophos Mobile Security.

The Sophos Mobile Control app that is installed onto devices managed by Sophos Mobile.

The web interface that you use to manage devices.

A security app for Android devices. You can manage this app with Sophos Mobile, provided that a license of type Mobile Advanced is activated.

An app for Android and iOS devices that provides a secure container for managing your email, calendar and contacts. You can manage this app with Sophos Mobile, provided that a license of type Mobile Advanced is activated.

An app for Android and iOS devices that provides a secure workspace where you can browse, manage, edit, share, encrypt and decrypt documents from various storage providers or distributed by your company. You can manage

347

Sophos Mobile task bundle

Team ID this app with Sophos Mobile, provided that a license of type Mobile Advanced is activated.

You create a package to bundle several tasks into one transaction. You can bundle all tasks necessary to have a device fully enrolled and running.

Every iOS and macOS app is signed by a Team

ID. The Team ID is supplied by Apple and is unique to a specific development team.

Sophos Mobile

28 Technical support

You can find technical support for Sophos products in any of these ways:

• Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.

• Visit the Sophos support knowledge base at www.sophos.com/en-us/support.aspx

• Download the product documentation at www.sophos.com/en-us/support/documentation.aspx

• Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/ support-query.aspx

Sophos Mobile

29 Legal notices

Copyright © 2019 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos

Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

Sophos Mobile administrator help

product version: 9

Contents

1 About this help

2 About Sophos Mobile

Sophos Mobile

Sophos Mobile Security

Sophos Secure Workspace

Sophos Secure Email

3 About Sophos Mobile Admin

3.1 Dashboard

3.2 Table views

3.3 Prerequisites

3.4 User roles

3.5 Change your password

3.6 Password recovery

4 Key steps for managing devices with

Sophos Mobile

5 Reports

6 Tasks

6.1 Monitor tasks

6.1.1 View unfinished, failed and latest finished tasks

6.1.2 View task archive

6.1.3 Task states

7 Alerts

Acknowledge alerts

Set up email reports for alerts

Which events trigger alerts?

8 Setup

8.1 Configure personal settings

8.2 Configure password policies

8.3 Configure SMC app settings

8.4 Configure Email

8.5 Configure IT contact

8.6 Configure privacy settings

8.7 Configure iOS settings

8.8 Apple Push Notification service certificates

8.8.1 Create APNs certificate

8.8.2 Renew APNs certificate

8.8.3 Copy APNs certificate to another customer

8.8.4 Identify the correct APNs certificate for renewal

8.8.5 Check APNs connectivity of devices

8.9 Configure iOS AirPlay destinations

8.10 Android settings

8.11 Set Android management mode

8.12 Host Sophos apps on your web server

8.13 Configure the synchronization interval of the

Sophos Mobile Control app

8.14 Enable Baidu Cloud Push service

8.15 Register Samsung Knox license

8.16 Configure polling interval for Windows devices

8.17 Check your licenses

8.18 Simple Certificate Enrollment Protocol (SCEP)

8.18.1 Prerequisites

8.18.2 Configure SCEP

8.19 Create customer properties

8.20 Configure SSL/TLS certificates

8.21 Configure EAS proxy

8.22 Configure Network Access Control

8.23 Configure email server connection

8.24 Configure proxy server connection

8.25 Configure portal access

8.26 Configure file upload limits

8.27 Turn on audit logging

8.28 Create system messages

9 Configure Self Service Portal

9.1 Configure Self Service Portal settings

9.2 Create enrollment texts

9.3 Available Self Service Portal actions

10 Compliance policies

10.1 Create compliance policy

10.2 Available compliance rules

10.3 Assign a compliance policy to device groups

10.4 Check devices for compliance

11 Devices

11.1 Add devices

11.1.1 Add device

11.1.2 Import devices

11.2 Enroll devices

Enrollment types