16 Work with applications. Sophos Sophos Mobile Control

Administrator guide

16 Work with applications

In the web console under Applications, you can create application packages to be installed on devices.

When you create packages, you can provide the packages to be installed on the devices as follows:

■ You can upload the package to the web console.

■ You can provide a link to the package for download.

Note: Windows Phone 8 apps can only be installed by a link through the Enterprise App Store.

In addition to installing and uninstalling packages on devices, you can enable and disable processes on Windows Mobile devices.

Note: For iOS devices in supervised mode silent installation of managed apps is supported, if the relevant device allows that.

16.1 Create application packages

1. In the web console menu bar, click Applications.

The Applications view is displayed.

2. Click the Create application button.

The Edit package view is displayed.

3. Enter a Name and a Version for the new package. These two fields are mandatory. In the field

App identifier, you can enter the identifier for the app.

Note: If you do not know the exact identifier, leave this field empty. For iOS apps the identifier is usually entered automatically.

4. For iOS, Android and Windows Phone 8 devices you can provide the application through the

Enterprise App Store and define it as recommended or required. To do so, select Recommended or Required in the Recommendation status field. If you select Recommended (managed

installation) or Required (managed installation), the app is pushed as a managed application to the end user device as soon as the user selects to install it.

5. In the Description text field, you can enter a description for the new application package.

6. Under Operating systems, select the operating system the new package applies to.

7. Select how the package is provided:

■ Select Upload package to directly upload the package to the web console. Select the required package and click Upload.

45

Sophos Mobile Control

■ To provide a link to the package, select Link to package. If you have not created the required link yet, you can obtain it by clicking the platform-specific links provided under the Link

field. For further information, see Create links to iOS packages (section 16.1.2.1) and

Create links to Android and Windows Phone 8 packages (section 16.1.2.2). Enter the link obtained

in the Link field.

8. Click the Save button.

The application package is available for installation. It is displayed in the Applications view. If you have configured the software as Recommended or Required, it is displayed in the Enterprise

App Store of the Sophos Mobile Control client on the end user device for download. Users can select it for installation. The installation process runs unattended or with very little user interaction.

For further information on installing required and recommended apps on devices, refer to the

Sophos Mobile Control user guides for Android, Apple iOS and Windows Phone 8.

16.1.1 Download uploaded application packages

Once you have uploaded an application package to the system, you can download it again any time to check it, so you do not need to manage files separately.

1. In the web console menu bar, click Applications.

The Applications view is displayed.

2. Go to the required package and click the Edit icon.

The Edit package view is displayed.

3. Click the Download icon next to the application package.

A file download dialog is displayed.

4. Save the file at the required location.

16.1.2 Create links to packages

If you want to provide links to packages, you can create them when you create the application packages in the web console or separately. The following sections describe how to create links to

Apple iOS, Android and Windows Phone 8 packages.

16.1.2.1 Create links to iOS packages

1. The first step depends on whether you create a link during the creation of application packages in the web console or separately:

■

■

If you are in the process of creating an application package, select Link to package in the

Edit package view and click the iOS link beneath the Link field.

If you want to create a link before you create an application package, open your internet browser and go to https://linkmaker.itunes.apple.com/us/ .

46

Administrator guide

2. In the Link Maker fields, specify the following for the relevant app:

■

■

■

■ In the Search field, enter a search term, for example the app provider or part of the app name.

Country

Media Type

Genre/Category

3. Click Search.

The apps found are shown below the search fields.

4. Go to the required app and click iPhone App Link or iPad App link.

The Linking to App: window is displayed. It shows the generated link.

5. Copy the link shown under Direct Link.

16.1.2.2 Create links to Android and Windows Phone 8 packages

1. The first step depends on whether you create a link during the creation of application packages in the web console or separately:

■

■

If you are in the process of creating an application package, select Link to package in the

Edit package view and click the Android or Windows Phone 8 link beneath the Link field.

If you want to create a link before you create an application package, open your internet browser and go to

■ https://play.google.com/store/apps for Android packages, or to

■ http://www.windowsphone.com/en-us/store for Windows Phone 8 packages.

2. Search for the required app and open it.

3. Copy the link shown in the web address bar of your browser.

16.2 Configure per app VPN and settings for iOS apps

Note: Per app VPN and settings are supported as of iOS 7.

For iOS apps, you can select a per app VPN to support the iOS feature "Per app VPN". With this feature, apps can be configured to automatically connect to VPN when they are launched. You can also configure settings for the app that will be deployed on the end user device during app installation.

Prerequisites:

■ To be able to select a per app VPN, you need to define a Per app VPN configuration in an iOS configuration profile in the web console, see

Create iOS profiles in the web console (section

17.1.1) and Available iOS configurations

(section 17.1.2).

47

Sophos Mobile Control

48

■ To define settings, you need to know the required parameter and the parameter type.

1. In the web console menu bar, click Applications.

The Applications view is displayed.

2. Click the Edit icon next to the required iOS app.

The Edit package view is displayed.

3. Click the Show button next to the Settings and VPN field.

The Settings and VPN view is displayed.

4. Select the required configuration from the Per app VPN dropdown list to define the VPN the app is supposed to connect to.

5. To add managed settings, click Create parameter.

The Configuration parameter view is displayed.

6. In this view, configure the following: a) In the Parameter field, enter the required parameter, for example SMC_URL.

b) In the Value field, enter the parameter value, for example smc.sophos.com.

c) In the Type field, select the parameter type: String, Bool, Integer or Real.

d) Click the Apply button.

The set of managed settings is displayed in the Settings and VPN view.

7. In the Settings and VPN view, click the Apply button.

The Show button in the Edit package view shows the number of sets of managed settings configured.

8. Click the Save button.

The selected per app VPN will be used when the app connects to VPN. The settings will be provided to end user devices during app installation.

16.3 Manage apps purchased with the Apple Volume Purchase Program

With the Apple Volume Purchase Program (VPP), you can buy iOS apps in volume for distribution within your company. For detailed information on how to enroll and use the Apple Volume

Purchase Program, see http://www.apple.com/business/vpp/ .

The procedures for managing apps purchased with the Apple VPP vary according to the licensing scheme used. With iOS 7 Apple has introduced a new VPP licensing scheme. The scheme has been changed from licensing based on redemption codes to licensing based on service tokens. The following sections describe the two different procedures.

Administrator guide

16.3.1 Manage Apple VPP apps based on service tokens

After an order placed with the Apple Volume Purchase Program has been completed, you can download a service token (sToken) that contains the licenses for the apps purchased.

To manage apps purchased with Apple Volume Purchase Program with Sophos Mobile Control, you can set up the service token in the Sophos Mobile Control web console. This service token is used for authentication at the Apple web service. You can provide the licenses included in the service token to users by inviting them to become authorized Apple VPP users. For this purpose you can set up an invitation email in the web console. After users have accepted their invitations, they become authorized VPP users.

The process for inviting users to become authorized VPP users differs depending on whether you use Sophos Mobile Control's 'internal' or 'external' user management. The instructions in this section cover both.

Note: For information on internal and external user management, see the Sophos Mobile Control

super administrator guide. Or, if you are using Sophos Mobile Control as a Service, see Configure

Self Service Portal user management for Sophos Mobile Control as a Service

(section 20.3.1).

The key steps for managing apps purchased with the Apple VPP based on service tokens are:

1. Set up the VPP service token in Sophos Mobile Control.

2. For external user management: Add VPP users manually or by import.

3. Set up an email inviting users to become authorized Apple VPP users.

4. Invite users.

5. Assign VPP licenses.

16.3.1.1 Set up VPP service token (sToken)

To provide licenses for apps purchased by the Apple Volume Purchase Program in Sophos Mobile

Control, you need to set up a VPP service token (sToken) in the web console.

1. In the Sophos Mobile Control web console, go to Settings and click System setup.

The System setup view is displayed.

2. In the iOS Volume Purchase Program tab under VPP service token (sToken), click the link to the Apple iTunes VPP Portal.

The Apple Volume Purchase Program website is displayed.

3. Select Business.

The Business Store Sign In page is displayed.

4. Enter your Apple ID and your Password to sign in.

5. On the next page, select your account.

Your Purchase History page is displayed.

49

Sophos Mobile Control

6. To generate a VPP service token and download it in a text file, click the Download button at the bottom of the page.

An sToken is generated and sent to you in a .txt file.

7. Open the file and copy its content.

8. In the Sophos Mobile Control web console under System setup in the iOS Volume Purchase

Program tab, paste the service token file content into the text field under sToken.

9. Click the Save button.

Note: After you have saved your changes, the service token text is no longer displayed in the text field for security reasons. But the field shows that a service token is in place.

16.3.1.2 Set up VPP invitation email

To enable end users to use the licenses from the VPP service token, they need to become authorized

VPP users. In the web console, you can invite users to become VPP users. You can set up an VPP invitation email that will be sent to all users you are inviting.

1. In the Sophos Mobile Control web console, go to Settings and click System setup.

The System setup view is displayed.

2. Go to the iOS Volume Purchase Program tab.

3. Under VPP invitation email, configure the following: a) In the Originator field, enter the email sender address. In the Subject field, enter an email subject, for example "VPP invitation".

b) In the text field under Content, predefine the email content. The following placeholders are available and will be replaced by the corresponding values in the email:

■ _FIRSTNAME_

■ _LASTNAME_

■ _VPP_INVITATION_URL_

4. Click the Save button.

16.3.1.3 Add VPP users with external user management

The process for inviting users to become authorized VPP users differs depending on whether you use Sophos Mobile Control's 'internal' or 'external' user management. If you use external user management, you can add specific VPP users in the web console manually or by import.

16.3.1.3.1 Create VPP users manually

1. In the web console menu bar, click VPP users.

The Show VPP users view is displayed.

50

Administrator guide

2. Click the Create VPP user button.

The Edit VPP user view is displayed.

3. Enter the Last name, the First name and the Email address for the new VPP user.

4. Click the Save button.

16.3.1.3.2 Import VPP users

1. In the web console menu bar, click VPP users.

The Show VPP users view is displayed.

2. Click the Import users button.

The Import VPP users view is displayed.

If you do not have a .csv file with users yet, you can download a sample file now and use it for creating your import file.

Note: Use a text editor for editing the .csv file. If you use Microsoft Excel, values entered may not be resolved correctly. Make sure that you save the file with the extension .csv.

3. Select the .csv file you want to import and click Upload file.

The entries in the.csv file are checked for errors and displayed on the import page.

Note: If there are any errors in the .csv file, it cannot be imported. An error message is displayed next to the relevant entries. Edit the .csv file accordingly and try again.

4. If all entries are correct, click the Finish button.

16.3.1.4 Invite users managed with external user management

Prerequisites:

■ You have added VPP users. For further information, see

Add VPP users with external user management

(section 16.3.1.3).

■

You have configured an VPP invitation email. For further information, see Set up VPP invitation email

(section 16.3.1.2).

1. In the web console menu bar, click VPP Users.

The Show VPP users view is displayed.

2. You can invite multiple users or individual users.

■

■

To invite multiple users, click the Invite multiple users to VPP button and confirm the message displayed. All users not yet invited are invited to become VPP users.

To invite an individual user, click the Edit icon next to the user in the Show VPP users view. In the Edit VPP user view, click the Invite to VPP button and click the Save button.

51

Sophos Mobile Control

The invitation emails are sent to the users invited. The users need to accept the invitation by clicking the VPP invitation URL included in the email and follow the relevant instructions to become authorized VPP users.

16.3.1.5 Invite users managed with internal user management

Prerequisites:

■ Users have been added to the web console through internal user management. For further

information, see Manage Self Service Portal users

(section 20.3).

■

You have configured a VPP invitation email. For further information, see Set up VPP invitation email

(section 16.3.1.2).

1. In the web console menu bar, click Users.

The Show users view is displayed.

2. You can invite multiple users or individual users.

■

■

To invite multiple users, click the Invite multiple users to VPP button and confirm the message displayed. All users not yet invited are invited to become VPP users.

To invite an individual user, click the Edit icon next to the user in the Show users view. In the Edit user view, click the Invite to VPP button and click the Save button.

The invitation emails are sent to the users invited. The users need to accept the invitation by clicking the VPP invitation URL included in the email and follow the relevant instructions to become authorized VPP users.

16.3.1.6 Assign VPP licenses

If you use the new licensing scheme you can assign VPP licenses in two ways:

■ You can assign VPP licenses to users directly in user management.

■ You can assign the VPP licenses of individual apps to users by using the Applications function.

16.3.1.6.1 Assign VPP licenses to users in user management

After users have become authorized Apple Volume Purchase Program users, you can assign the licenses available within the VPP service token to them.

1. The first step varies depending on whether you are using internal or external user management:

■

■

Internal user management: In the web console menu bar, select Users.

External user management: In the web console menu bar, select VPP users.

The Show users or Show VPP users view is displayed.

2. Click the Edit icon next to the required user.

The Edit user or Edit VPP user view is displayed.

52

Administrator guide

3. Click the Show VPP licenses button.

The available and used licenses for this user are displayed.

4. Select the license you want to assign and click the Apply button.

5. In the Edit user or Edit VPP user view, click the Save button.

16.3.1.6.2 Assign VPP licenses to users through Applications

1. In the web console menu bar, click Applications.

The Applications view is displayed.

2. Click the Edit icon next to the required app.

The Edit package view is displayed.

3. Click the Show button next to VPP licenses.

The VPP licenses view is displayed. It shows the licenses available and the registered users.

4. Select the user you want to assign and click the Apply button.

5. In the Edit package view, click the Save button.

16.3.2 Manage Apple VPP apps based on redemption codes

After an order placed with the Apple Volume Purchase Program has been completed, you can download an Excel spreadsheet with redemption codes for the apps you purchased. To manage apps purchased with Apple Volume Purchase Program with Sophos Mobile Control, you can upload the code spreadsheet and assign the individual VPP codes to the relevant software packages in the Sophos Mobile Control web console.

16.3.2.1 Upload and assign VPP codes

Prerequisites:

■ You have downloaded the .xls spreadsheet with the redemption codes for purchased apps from

Apple. For further information on how to use the Apple Volume Purchase Program, see http://www.apple.com/business/vpp/ .

■ You have created software packages with links to the purchased iOS apps in the web console.

For further information, see Create links to iOS packages

(section 16.1.2.1) and Create application packages

(section 16.1).

1. In the web console menu bar, click Applications.

The Applications view is displayed.

2. Click the Edit pencil icon next to the required iOS app.

The Edit package view is displayed.

53

Sophos Mobile Control

54

3. Click the Show button next to the VPP redemption codes (file) field.

The VPP codes view is displayed.

4. Browse for the .xls file you have downloaded and click Upload.

The VPP codes view is updated with the code information from the .xls file:

■ The Available codes field shows the number of available codes.

■ The Reserved codes field shows the number of codes reserved for specific devices.

■ The Used codes field shows the number of codes used.

■ The Invalid codes field shows the number of invalid codes.

In the table below these fields, the individual codes are shown with their status. If codes have been reserved for particular devices, the device UDIDs are shown.

5. Select the code you want to assign to the iOS app and click the Apply button.

The Edit package view is displayed again.

6. Click the Save button.

16.4 Install application packages

Prerequisite: The required application package has been created under Applications.

1. In the web console menu bar, click Applications.

The Applications view is displayed.

2. Click the Install button.

The Select device(s) view is displayed.

3. In this view, you can:

■

■

Select individual devices you want to install the software package on.

Click the Group selection button, to open the Select device group(s) view and select one or several device groups for installing the software.

4. After you have made your selection, click Next.

The Select software view is displayed.

5. Select the software package that you want to install and click Next.

The Set execution date view is displayed.

6. Under Scheduled date, select Now or specify a Date and Time for the execution of this task.

7. Select Enforce to force installation for the selected devices.

Administrator guide

8. Click the Finish button.

The application package is installed on the selected device(s) at the specified time.

16.5 Uninstall application packages

Note: Silent uninstallation works on iOS devices for managed apps distributed by Sophos Mobile

Control and for Windows Mobile devices. It does not work for Android devices.

1. In the web console menu bar, click Applications.

The Applications view is displayed.

2. Click the Uninstall button.

The Select device(s) view is displayed.

3. In this view, you can:

■

■

Select individual devices for uninstalling the software.

Click the Group selection button, to open the Select device group(s) view and select one or several device groups for uninstalling the software.

4. After you have made your selection, click Next.

The Select software view is displayed with all applications installed on the selected device(s).

5. Select the application(s) you want to uninstall and click Next.

The Set execution date view is displayed.

6. Under Scheduled date, select Now or specify a Date and Time for the execution of this task.

7. Select Enforce to force the uninstallation for the selected devices.

8. Click the Finish button.

The selected applications are uninstalled from the selected device(s) at the specified date and time.

16.6 Use the software filter

By using filters you can restrict the number of items shown in lists according to defined criteria.

With the software filter, you can restrict the results in lists of application packages.

Note: The filter is not only valid for the function currently displayed, but for all functions where items of this type are listed.

To use the software filter:

1. In the web console menu bar, click Applications.

The Applications view is displayed.

55

Sophos Mobile Control

2. Click the Filter inactive. button (magnifier icon) in the web console header.

The Software filter dialog is displayed with the status Filter is not active.

3. In the Software filter dialog, you can select the following filter options:

Option

Name

Version

Operating System

Description

Filter according to package name.

Filter according to package version.

Filter according to operating systems for which the packages are applicable.

4. After you have selected the required criteria, click filter.

The filter is activated and the list of devices is reloaded. The magnifier icon beside the filter button in the web console header changes its color from blue to pink to indicate that the filter is active.

The button text changes to Filter active!. A Reset button is available in the header for resetting the filter. The status of the software filter in the Software filter dialog changes to Filter is active!.

Note: Remember to reset filters manually when they are no longer needed. Otherwise lists or reports may not include the results you expect.

16.7 Enable/disable processes on Windows Mobile devices

In the web console under Applications, you can enable or disable processes on Windows Mobile devices. Disabled processes are not allowed to run. The Sophos Mobile Control client monitors all processes running on a device and immediately kills disabled processes. So you as an administrator can disable certain applications. Enabled processes are unaffected and can be started.

Note: If application packages are installed on the device manually (not through Sophos Mobile

Control), the included processes are disabled by default. If the package has been installed with

Sophos Mobile Control, they are activated automatically.

Note: If a package that contains activated processes is uninstalled, the processes remain activated.

This means that once the same application is installed again, the processes are still activated, regardless of whether the installation is done by Sophos Mobile Control or manually.

Processes can be enabled or disabled for single or multiple devices.

Note: For Windows Mobile devices the enabling and disabling of processes is deactivated by default. You can activate this functionality with the setConfig command (ProcessSecurityOn).

56

Administrator guide

16.7.1 Enable/disable processes on single devices

1. In the web console menu bar, click Applications.

The Applications view is displayed.

2. Click the Enable/disable button.

The Select device(s) view is displayed.

3. Select the required device and click Next.

The Activate/Deactivate processes view is displayed.

4. In the two tables displayed, select the required application packages and the system processes and activate or deactivate them by clicking the relevant icons.

5. Click Next.

The Select execution date and description view is displayed.

6. Under Scheduled date, select Now or specify a Date and Time for the execution of this task.

7. In the Description field, modify the description displayed, if necessary.

8. Click the Finish button.

The selected processes are enabled/disabled on the selected device at the specified date and time.

16.7.2 Enable/disable processes on multiple devices

1. In the web console menu bar, click Applications.

The Applications view is displayed.

2. Click the Enable/disable button.

The Select device(s) view is displayed.

3. In this view, you can:

■

■

Select several individual devices.

Click the Group selection button, to open the Select device group(s) view and select device groups.

4. After you have made your selection, click Next.

The Set device as data source view is displayed.

57

Sophos Mobile Control

5. Select the device you want to use as a data source for application packages and system processes by clicking the arrow icon next to the device. The device selected serves as the process information basis. Only the processes for this device are available for activation/deactivation.

But all devices selected in the Select device(s) or Select device group(s) view are affected by the activation/deactivation process, if they provide the same system processes.

The Activate/Deactivate processes view is displayed.

6. In the two tables displayed, select the required application packages and the system processes and activate or deactivate them by clicking the relevant icons.

7. Click Next.

The Select execution date and description view is displayed.

8. Under Scheduled date, select Now or specify a Date and Time for the execution of this task.

9. In the Description field, modify the description displayed, if necessary.

10. Click the Finish button.

The selected processes are enabled/disabled on the selected devices at the specified date and time.

58