Setup. Sophos Mobile

PDF

مستند

Sophos Mobile

8 Setup

In the Setup menu section you configure the general behavior of Sophos Mobile, the interaction with devices, and the interaction with external components like Google or Apple portals.

8.1 Configure personal settings

You can adjust the appearance of Sophos Mobile Admin to your personal preferences. For example, you can set the language, the time zone, or the visible device platforms.

Note

These settings only affect the administrator account you’re currently signed in with.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Personal tab.

2. Configure the following settings:

Option

Language

Description

The user interface language.

Time zone

Unit system

Lines per page in tables

Expert mode

The time zone in which dates are shown.

The unit system for lengths (Metric or Imperial).

Activated platforms

The maximum number of entries displayed per table page.

This setting turns on additional features:

• The Show device page includes the Custom properties tab with your custom device properties.

• The Show device page includes the Internal properties tab with additional properties the device reports.

• Several policy configuration pages include the Extra

settings section to configure optional settings.

The device platforms you want to view.

In Sophos Mobile Admin, only pages and settings relevant for the selected platforms are shown.

3. Select Save.

8.2 Configure password policies

To enforce password security, configure password policies for Sophos Mobile Admin users and the

Self Service Portal.

Sophos Mobile

Note

The password policies do not apply to users from an external LDAP directory.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Password

policies tab.

2. Under Rules, you can define password requirements, like a minimum number of lower-case, upper-case or numerical characters that a password must contain to be valid.

3. Under Settings, configure the following settings: a) Password change interval (days): Enter the number of days until a password expires

(between 1 and 730 ), or leave the field empty to disable password expiration.

b) Number of previous passwords which must not be reused: Select a value between 1 and

10 , or select -- to disable this restriction.

c) Maximum number of failed login attempts: Select the number of failed login attempts until the account gets locked (between 1 and 10 ), or select -- to allow an unlimited number of failed login attempts.

4. Select Save.

8.3 Configure SMC app settings

On the SMC app tab of the General settings page, you configure settings for the Sophos Mobile

Control app on Android, iOS and Windows Mobile devices.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the SMC app tab.

2. Configure the following settings:

Option

Disable unenrollment through app

Description

Remove the Unenroll button from the Sophos Mobile Control app to prevent users from unenrolling their device through the app.

Note

To completely prevent user-initiated unenrollment, also disable the Unenroll device option in the Self

Service Portal settings. See

Create Self Service Portal configurations (page 27).

3. Select Save.

8.4 Configure Email

On the Email configuration tab, you configure settings for emails that are sent by Sophos Mobile.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Email

configuration tab.

2. In Language, select the email language.

3. In Originator name, enter the name that appears as email originator.

Sophos Mobile

4. Optional: Under Alert email settings, configure alert reports that are sent to administrators: a) In Severity, select the severity levels that are included in the report.

b) In Email recipients, specify the recipients by entering one or more valid email addresses.

c) In Email schedule, enter a time of the day when the report is sent out, and then click Add.

Repeat this to send out more than one report per day.

Note

Times are in the server time zone.

5. Click Save.

Related concepts

Alerts (page 12)

8.5 Configure IT contact

Provide your IT contact details so that users can get help with questions or problems.

The information you enter here is displayed in the Self Service Portal and on the users’ devices.

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the IT contact tab.

2. Enter the contact information.

3. Select Save.

8.6 Configure privacy settings

You can prevent administrators from viewing privacy-related device information.

You can turn off the following privacy-related settings:

• Device location

When turned off, you can’t view the device location. Users can still view their device’s location in the Self Service Portal.

You can still view the Device location report that shows the last known location of all devices.

• Installed apps

When turned off, you can’t view the apps installed on a device. The Installed apps tab in the device details is not displayed and the Apps per device report is not available.

You can still view summary reports of installed apps for all devices.

To configure privacy settings:

1. On the menu sidebar, under SETTINGS, click Setup > General, and then click the Privacy tab.

2. To turn off viewing device locations, click Forbid admins to locate devices.

3. To turn off displaying installed apps, click Hide installed apps.

Sophos Mobile

Note

Sophos Mobile records the following privacy-related events:

• An administrator requests a device location.

• A user requests a device location in the Self Service Portal.

• Viewing device locations in Sophos Mobile Admin is turned on or off.

• Viewing installed apps in Sophos Mobile Admin is turned on or off.

8.7 Configure iOS settings

On the iOS tab of the Apple setup page, you configure settings for iOS devices.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the iOS tab.

2. Configure the following settings:

Option

Activation Lock bypass

Synchronize device name

Description

Select Enable to be able to clear the Activation Lock on supervised devices.

When this option is selected, Sophos Mobile retrieves a bypass code when syncing with a supervised device that has Activation Lock enabled. If required, you can perform the Activation Lock bypass action from the device's Show

device page to clear Activation Lock when the device needs to be erased and re-deployed.

Activation Lock is an iOS security feature to prevent the reactivation of lost or stolen devices. Normally, you need the correct Apple ID and password to clear Activation Lock. With the Activation Lock bypass feature, you can clear Activation

Lock by providing the bypass code only.

Select Enable to manage iOS devices under the name that is configured on the device.

When this option is selected, the device name that Sophos

Mobile uses is set every time the device synchronizes with

Sophos Mobile.

When this option is deselected, you set the device name during device enrollment.

3. Select Save.

8.8 Apple Push Notification service certificates

To use the built-in Mobile Device Management (MDM) protocol of iOS and macOS devices, Sophos

Mobile must use the Apple Push Notification service (APNs) to trigger the devices.

Sophos Mobile manages APNs certificates per customer. You must create and upload the certificates for each customer that you use.

APNs certificates have a validity period of one year.

Sophos Mobile

8.8.1 Create APNs certificate

Prerequisite: You have not uploaded a certificate for the Apple Push Notification service (APNs) to

Sophos Mobile yet.

To renew an existing certificate, see Renew APNs certificate

(page 17).

Tip

You can use the same certificate for several customers. See

Copy APNs certificate to another customer (page 18).

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

2. Click APNs certificate wizard.

3. On the Mode page, click Create a new APNs certificate.

4. On the CSR page, click Download certificate signing request.

This saves the certificate signing request file apple.csr

to your local computer. The signing request file is specific to the current customer.

5. You need an Apple ID. Even if you already have an ID, we recommend that you create a new one for use with Sophos Mobile. On the Apple ID page, click Create Apple ID in the Apple portal.

This opens an Apple web page where you can create an Apple ID for your company.

Note

Store the credentials in a safe place where your colleagues can access them. Your company will need these credentials to renew the certificate each year.

6. In the wizard, enter your new Apple ID in the Apple ID field.

7. On the Certificate page, click Create certificate on the Apple portal.

This opens the Apple Push Certificates Portal.

8. Log in with your Apple ID and upload the certificate signing request file apple.csr

9. Download the .pem

APNs certificate file and save it to your computer.

10. On the Upload page, click Upload certificate and then browse for the .pem

file that you received from the Apple Push Certificates Portal.

11. Select Save.

Sophos Mobile reads the certificate and displays the certificate details on the APNs tab.

8.8.2 Renew APNs certificate

Prerequisite: You have uploaded a certificate for the Apple Push Notification service (APNs) to

Sophos Mobile that is about to be expire and needs to be renewed.

To create and upload a new certificate, see Create APNs certificate (page 17).

CAUTION

In the Apple portal, it is important that you select the correct APNs certificate for renewal. If you renew the wrong certificate, you might need to re-enroll all iOS and macOS devices.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

Sophos Mobile

2. Click APNs certificate wizard.

3. On the Mode page, click Renew my APNs certificate.

4. On the CSR page, click Download certificate signing request.

This saves the certificate signing request file apple.csr

to your local computer. The signing request file is specific to the current customer.

5. On the Apple ID page, the Apple ID used to create the initial APNs certificate is displayed.

You need this ID to log into the Apple portal.

6. On the Certificate page, click Renew certificate on the Apple portal.

This opens the Apple Push Certificates Portal.

7. Log in with the Apple ID that was displayed in the wizard.

8. In the Apple Push Certificates Portal, click Renew next to your Sophos Mobile APNs certificate.

9. Upload the certificate signing request file apple.csr

you prepared earlier.

10. Download the .pem

APNs certificate file and save it to your computer.

11. On the Upload page, click Upload certificate and then browse for the .pem

file that you received from the Apple Push Certificates Portal.

12. Select Save.

CAUTION

If the following message is shown, you are not renewing the correct certificate:

The topic of the new certificate does not correspond to the old one. If devices have been set up with the previous certificate, they have to be set up again. Do you really want to save your changes?

This message indicates that you are about to create a new APNs certificate with a different identifier. If you confirm the message, all existing iOS and macOS devices are not manageable any more and you have to re-enroll them.

For information on how to select the correct certificate, see Identify the correct APNs certificate for renewal (page 19).

8.8.3 Copy APNs certificate to another customer

You can copy a certificate for the Apple Push Notification service (APNs) to another customer within the same or a different installation of Sophos Mobile.

CAUTION

If there already exists an APNs certificate at the target location, it is important that the Topic property of the certificate that you want to copy is identical to the Topic of the existing certificate.

If you copy the wrong certificate, you might need to re-enroll all iOS and macOS devices of the customer.

Download the certificate:

1. Log in to Sophos Mobile Admin as an administrator of the customer whose APNs certificate you want to copy.

2. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

3. Make a note of the Topic value that is displayed under APNs certificate.

4. Click Download certificate as PKCS #12 file.

5. In the confirmation dialog, the password for the certificate file is displayed. Make a note of that password and then click Download.

Sophos Mobile

This saves the certificate file apns_cert.p12

to your local computer.

Upload the certificate to a different customer:

6. Log in to Sophos Mobile Admin as an administrator of the customer to whom you want to upload the certificate.

7. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

8. If there already exists an APNs certificate, verify that the Topic value is identical to the value of the certificate you are about to copy.

9. Click APNs certificate wizard.

10. On the Mode page, click Upload an APNs certificate from another Sophos Mobile customer.

11. On the Apple ID page, enter the Apple ID used to create the APNs certificate you are about to upload.

12. On the Upload page, click Upload certificate and then browse for the apns_cert.p12

file you’ve downloaded from the other customer.

13. Enter the password and then click Apply.

14. Select Save.

8.8.4 Identify the correct APNs certificate for renewal

When you renew your Apple Push Notification service (APNs) certificate for the Sophos Mobile

server as described in Renew APNs certificate (page 17), it is important that on the Apple portal

you select the correct APNs certificate for renewal.

This section describes how to identify the APNs certificate that is currently uploaded to the Sophos

Mobile server.

Retrieve the certificate identifier:

1. Log in to Sophos Mobile Admin with an administrator account for the customer whose APNs certificate needs to be renewed.

2. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the APNs tab.

3. Make a note of the Topic value that is displayed under APNs certificate.

Identify the certificate:

4. Use your web browser to open the URL of the Apple Push Certificates Portal, https:// identity.apple.com/pushcert/ .

If you are experiencing issues with certain features of the Apple portal when using Microsoft

Internet Explorer, we recommend that you use the latest version of the Firefox, Opera, Chrome or

Safari browser instead.

5. Log in with the Apple ID that you used for the creation of the initial APNs certificate.

In the list of APNs certificates, click the Certificate Info icon next to a certificate entry.

This displays the certificate details.

7. In the Subject DN field, locate the value that follows the string UID= . If this matches the identifier that you determined in Sophos Mobile Admin, you have identified the correct certificate.

8.8.5 Check APNs connectivity of devices

Users of the Sophos Mobile Control app for iOS can check if their devices are able to connect to the

Apple Push Notification service (APNs) server.

1. In the Sophos Mobile Control app, tap the Information icon to open the About screen.

2. Tap Check APNs.

Sophos Mobile

The app tries to connect to the Apple APNs server. The expected server response time is 5 seconds or less.

Check your firewall settings if the APNs server can’t be reached. For a list of required connections see the Sophos Mobile server deployment guide .

8.9 Configure iOS AirPlay destinations

With Sophos Mobile you can remotely trigger AirPlay mirroring between an iOS device and predefined AirPlay destinations (for example AppleTV).

Note

AirPlay only works for devices within the same network.

You can define destinations for AirPlay mirroring.

1. On the menu sidebar, under SETTINGS, click Setup > Apple setup, and then click the iOS

AirPlay tab.

2. In the AirPlay destinations section, click Create AirPlay destination.

The AirPlay destination page is displayed.

3. Enter the device name and, optionally, the MAC address of the AirPlay destination device. If required, enter the password of the device.

4. Click Apply.

The device is shown under AirPlay destinations in the iOS AirPlay tab of the Apple setup page.

5. Select Save.

You can trigger AirPlay mirroring between an iOS device and this destination by clicking Request

AirPlay mirroring from the Actions menu on the Show device page for the relevant device.

8.10 Android settings

On the Android tab of the Android setup page, you configure settings for Android devices:

•

Set Android management mode (page 20)

•

Host Sophos apps on your web server

(page 21).

•

Configure the synchronization interval of the Sophos Mobile Control app (page 21).

•

Enable Baidu Cloud Push service (page 22)

8.10.1 Set Android management mode

For Android devices, you can choose between the Android Enterprise and Device administrator

(legacy feature) management modes.

Android Enterprise

Device administrator (legacy feature)

Sophos Mobile Control is the device or profile owner and uses Android Enterprise to manage a device or a work area on the device.

Sophos Mobile Control is a device administrator and uses Android mobile device management

(MDM) to manage a device.

Sophos Mobile

We recommend you use Android Enterprise.

1. On the menu sidebar, under SETTINGS, select Setup > Android setup and then the Android tab.

2. In Management mode, select the management mode for Android devices.

3. Select Save.

This setting affects which policy types are available in the user interface.

If you’ve selected the Android Enterprise mode, you must set up Android Enterprise for your organization before you can enroll devices.

Related concepts

Set up Android Enterprise - Overview

(page 318)

8.10.2 Host Sophos apps on your web server

You can host the Android apps users install during enrollment, Sophos Mobile Control and Sophos

Intercept X for Mobile, on an internal web server instead of Google Play.

Warning

• This option introduces a security risk. When you host Sophos apps on an internal web server, you must allow app installations from outside Google Play in general.

• Make sure the latest app version is installed on the mobile devices. Regularly upload the newest version from the “Sophos Product Downloads and Updates” web page to your web server and then use a task bundle to install it on the devices.

To configure the installation source for Sophos Mobile Control and Sophos Intercept X for Mobile:

1. Sign in to Sophos Mobile Admin with a super administrator account.

2. On the menu sidebar, under SETTINGS, select Setup > Android setup and then the Android tab.

3. Under Select installation source, select Hosted APK file.

4. Enter the URL of Sophos Mobile Control in URL of the SMC APK file.

For example, if you have copied the APK file to an smc subdirectory below the deployment directory of your web server, enter this URL: <web_server_address>/smc/smc.apk

5. Likewise, enter the URL of the Intercept X app in URL of the Intercept X for Mobile APK file.

This requires a Mobile Advanced license.

6. Select Save.

Related information

Sophos Product Downloads and Updates

8.10.3 Configure the synchronization interval of the Sophos

Mobile Control app

The Sophos Mobile Control app synchronizes with the Sophos Mobile server at these times:

• Immediately, when it needs to communicate device-side changes.

• On request, when it is triggered by the server through the push notification services Google

Cloud Messaging (GCM) and, optionally, Baidu Cloud Push.

Sophos Mobile

• Time scheduled, every 24 hours by default.

If required, you can use a shorter interval for the time scheduled synchronization.

For Sophos Mobile on Premise, this is configured by the super administrator.

Warning

The default value of 24 hours is sufficient in most cases. We recommend that you only use a shorter interval if the push notification services do not work in your environment. Using shorter intervals impacts battery life and data consumption and causes higher server load.

To configure the synchronization interval that the Sophos Mobile Control app on Android devices uses:

1. On the menu sidebar, under SETTINGS, select Setup > Android setup and then the Android tab.

2. Under SMC app sync interval, select a value between 15 minutes and 24 hours from the Sync

interval list.

3. Select Save.

8.10.4 Enable Baidu Cloud Push service

Sophos Mobile uses the Google Firebase Cloud Messaging (FCM) service to send push notifications to Android devices, to trigger them to contact the Sophos Mobile server. In China, FCM will likely not work. Therefore, Sophos Mobile can also use Baidu Cloud Push, which is a Chinese push notification service.

If you manage Android devices that are located in China, enable the Baidu Cloud Push service as follows:

1. On the menu sidebar, under SETTINGS, select Setup > Android setup and then the Android tab.

2. In the Baidu Cloud Push service section, select Enable Baidu Cloud Push service.

3. Select Save.

When Baidu Cloud Push is enabled, Sophos Mobile sends all push notifications through FCM and through Baidu Cloud Push.

8.11 Register Samsung Knox license

If you have a Samsung Knox Premium license, you can manage the Knox container on your Samsung devices with Sophos Mobile.

To register a Samsung Knox Premium license key:

1. On the menu sidebar, under SETTINGS, click Setup > Android setup, and then click the

Samsung Knox license tab.

2. Enter your Samsung Knox Premium license key.

You can enter a license key of type KPE Premium or KLM Workspace .

3. Select Save.

If you later decide not to use your Samsung Knox Premium license with Sophos Mobile, click

Remove to deregister the license key.

Sophos Mobile

8.12 Configure polling interval for Windows devices

For Windows devices, you can configure the polling interval at which the Windows MDM client contacts the Sophos Mobile server. Usually, the server contacts the client using push notifications.

Polling is used as a safety measure when the push notification service is not available.

Note

The default values are sufficient in most cases. Using shorter intervals impacts battery life and data consumption and causes higher server load.

1. On the menu sidebar, under SETTINGS, click Setup > Microsoft setup, and then click the MDM

polling interval tab.

2. Select polling intervals for the different Windows operating systems.

3. Select Save.

8.13 Check your licenses

Sophos Mobile uses a user-based license scheme. One user license is valid for all devices assigned to that user. Devices that are not assigned to a user require one license each.

On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the License tab.

The following information is displayed:

• Maximum number of licenses: Maximum number of device users (and unassigned devices) that can be managed.

If the super administrator did not set a quota for the customer, the number of licenses is limited by the overall number for the Sophos Mobile server.

• Used licenses: Number of licenses in use.

• Valid until: The license expiration date.

• Advanced license: The super administrator has activated a Mobile Advanced license for the customer.

If you have any questions or concerns regarding the displayed license information, contact your

Sophos sales representative.

8.14 Simple Certificate Enrollment Protocol (SCEP)

You can distribute certificates to Android, iOS, and Windows Mobile devices using the Simple

Certificate Enrollment Protocol (SCEP).

8.14.1 Prerequisites

In order to use the Simple Certificate Enrollment Protocol, the following prerequisites must be fulfilled:

Sophos Mobile

• An SCEP-enabled Windows CA exists in the environment.

• Login credentials for a user who can create a challenge code are available.

• The Sophos Mobile server has http or https access to the following sites:

— https://YOUR-SCEP-SERVER/CertSrv/MSCEP_ADMIN

— https://YOUR-SCEP-SERVER/CertSrv/MSCEP

8.14.2 Configure SCEP

Before you can use SCEP for your devices, you must configure the connection to your SCEP server.

To configure SCEP:

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the SCEP tab.

2. Specify the following: a) In the SCEP server URL field, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP.

b) In the Challenge URL field, enter https://YOUR-SCEP-SERVER/CertSrv/MSCEP_ADMIN.

Note

If you use a Windows 2003 server as the SCEP server, enter https://YOUR-SCEP-

SERVER/CertSrv/MSCEP.

c) In the User and Password fields, enter the user credentials of the user who can create a challenge code.

Note

In the User field, enter a user who has the necessary rights to enroll certificates. Use the logon format: username@domain d) In the Challenge characters field, select the character types that are used for the challenge password.

e) In the Challenge length field, accept the default length.

f) Optional: Clear the Use HTTP proxy option if you want Sophos Mobile to bypass the HTTP proxy when connecting to the SCEP server. This option is only available if the HTTP proxy is enabled.

For Sophos Mobile on Premise, the super administrator can configure an HTTP proxy that

Sophos Mobile uses for outbound HTTP and SSL/TLS connections. See the Sophos Mobile super administrator guide .

For Sophos Mobile as a Service, the HTTP proxy is always enabled.

3. Select Save.

Sophos Mobile tests the connection to your SCEP server.

To deploy a certificate using SCEP, add a SCEP configuration to an Android, iOS, or Windows

Mobile policy.

Sophos Mobile

Tip

In the policy, you can configure an interval after which the device automatically requests a certificate renewal.

8.15 Create customer properties

You can create customer-level properties.

When you create a property with name my property , you can refer to the value of the property by using the placeholder %_CUSTPROP(my property)_% . For example, you can use this to refer to a domain that is specific to the customer.

For details on placeholders, see

Placeholders in policies (page 106).

To create a customer property:

1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the

Customer properties tab.

2. Click Add customer property.

3. Enter a name and a value for the customer property.

4. Click Apply.

5. Select Save.

The customer property is added to the Sophos Mobile customer.

8.16 Configure SSL/TLS certificates

On the SSL/TLS tab of the Sophos setup page, you configure SSL/TLS certificates for the secure connections between the Sophos Mobile server and the clients.