Policies. Sophos Mobile
Tangazo
Tangazo
Sophos Mobile
14 Policies
A policy contains settings you can apply to a device or device group.
There are two types of policies:
1.
Policies that take effect immediately when you assign them to a device. These policies are synchronized each time the device connects to Sophos Mobile. When you change the policy, you don’t have to update it on the device. To remove the settings applied by the policy, you must either update the policy or assign a different policy.
These policies are:
• Android Enterprise policies
• Sophos container policies
• Mobile Threat Defense policies
• macOS policies
• Windows policies
• Windows Mobile policies
• Chrome Security policies
2.
Policies Sophos Mobile installs on a device when you assign them. When you change the policy, you must update it on the device. To remove the settings applied by the policy, you can uninstall it from the device.
These policies are:
• Android device policies
• Knox container policies
• iOS device policies
Related concepts
Configurations for Android device policies
(page 153)
With an Android device policy you configure settings for Android devices enrolled with Sophos Mobile in “Device administrator” management mode.
Configurations for Knox container policies
(page 172)
With a Knox container policy you configure settings for the Knox container on Samsung devices.
Configurations for iOS device policies (page 177)
With an iOS device policy you configure settings for iPhones and iPads.
Configurations for Android Enterprise device policies
(page 109)
With an Android Enterprise device policy you configure settings for Android Enterprise fully managed devices.
Configurations for Android Enterprise work profile policies
(page 123)
With an Android Enterprise work profile policy you configure settings for Android Enterprise work profile devices.
Configurations for Sophos container policies for Android (page 137)
With a Sophos container policy you configure settings for Sophos Secure Email and Sophos Secure
Workspace on devices where Sophos Mobile manages the Sophos container.
Configurations for Mobile Threat Defense policies for Android (page 149)
Copyright © Sophos Limited 99
Sophos Mobile
With a Mobile Threat Defense policy you configure Sophos Intercept X for Mobile when it’s enrolled with Sophos Mobile.
Configurations for Sophos container policies for iOS (page 207)
With a Sophos container policy you configure settings for Sophos Secure Email and Sophos Secure
Workspace on devices where Sophos Mobile manages the Sophos container.
Configurations for Mobile Threat Defense policies for iOS (page 219)
With a Mobile Threat Defense policy you configure Sophos Intercept X for Mobile when it’s enrolled with Sophos Mobile.
Configurations for macOS device policies (page 221)
With a macOS device policy you configure settings for Macs that apply to all users.
Configurations for macOS user policies (page 238)
With a macOS user policy you configure settings for Macs that apply to users managed by Sophos
Mobile.
Configurations for Windows Mobile policies
(page 256)
With a Windows Mobile policy you configure settings for Windows Mobile devices.
Configurations for Windows policies
(page 267)
With a Windows policy you configure settings for Windows computers.
Configurations for Chrome Security policies (page 279)
With a Chrome Security policy you configure settings for the Sophos Chrome Security extension when it’s enrolled with Sophos Mobile.
100
14.1 Get started with device policies
The Policies startup wizard helps you create basic device policies for all platforms. You can enhance the policies later.
Restriction
These instructions don’t apply to Chrome devices.
To create policies with the Policies startup wizard:
1. On the dashboard, click Policies startup wizard in the Getting started tasks widget.
Tip
If you don’t see the widget, click Add widget > Getting started.
2. On the Platforms page, select the device platforms for which you want to create a policy.
3. For Android, you can select a management mode.
This setting affects which policy types are available. We recommend you use the Android
Enterprise mode.
4. On the Policies page, configure the following settings: a) Enter a name for the policy.
For each platform, a policy with this name is created.
b) Select the areas the policy manages.
If you clear a check box, the corresponding wizard page is skipped. You can configure the skipped areas (and more) later.
5. On the Passwords page, configure requirements for the device password.
Copyright © Sophos Limited
Sophos Mobile
6. On the Restrictions page, configure restrictions applied to devices, like turning off the camera or other device features that could be a security risk.
7. On the Wi-Fi page, configure the connection to your corporate Wi-Fi network.
If your Wi-Fi network uses a different security type than WPA/WPA2 PSK, you can change that setting later.
8. On the Email page, configure the connection to your corporate Microsoft Exchange email server.
The placeholders %_USERNAME_% and %_EMAILADDRESS_% are replaced by the name and the email address of the user assigned to the device.
9. Click Finish.
For each platform you’ve selected, the wizard creates a policy.
To view the policy, click Policies in the menu sidebar and then click the device platform.
To change the areas managed, click the policy’s name and then click Add configuration.
If you’ve selected the Android Enterprise mode, you must set up Android Enterprise for your organization before you can enroll devices. See
Set up Android Enterprise - Overview
(page 318).
14.2 Create policy
You create policies to configure settings for devices. Create several policies if you want to manage different types of devices.
Policies consist of configurations. By adding configurations to a policy, you define the areas Sophos
Mobile manages on a device.
To create a policy:
1. On the menu sidebar, under CONFIGURE, select Policies and then select a device platform.
2. Select Create and then select a policy type.
3. Enter a name and a description.
4. For iOS and macOS device policies, enter your organization name.
5. Optional: Check the configurations Sophos Mobile has added automatically to the policy and adjust them if required.
Sophos Mobile adds these configurations automatically:
• For Sophos container policies, a General configuration.
• For Android Enterprise policies, a Restrictions configuration.
• For Mobile Threat Defense policies, a Network configuration.
6. Select Add configuration to add more configurations to the policy.
7. In the settings page of the configuration, enter the required settings.
8. Optional: Select a renewal interval in SCEP renewal interval.
This option is available if you’ve added a SCEP or Duo device certificate configuration to the policy.
The device automatically requests a certificate renewal after the interval you’ve selected, calculated from when the policy was assigned to the device. The same interval is used for all
SCEP and Duo device certificate configurations of the policy.
9. After you’ve added all required configurations, select Save.
The policy is created. You can assign it to devices.
Copyright © Sophos Limited 101
Sophos Mobile
Related tasks
You assign a policy to devices to apply the settings it includes.
Apply policy changes to devices
(page 107)
When you change the settings of certain policies, you must update them on the devices for the changes to take effect.
14.3 Import iOS policy from Apple Configurator
For iOS, you can import a policy created in Apple Configurator or a policy exported from another instance of Sophos Mobile.
Prerequisite: Create a policy in Apple Configurator, export it unencrypted and unsigned, and save it to your computer.
Note
In Apple Configurator, policies are called profiles.
To import the policy:
1. On the menu sidebar, under CONFIGURE, select Policies > iOS.
2. Select Create > Import policy.
3. Enter a name and a description.
4. Select Upload a file and then select the file you’ve exported from Apple Configurator.
5. On the Import policy page, select Save.
The policy is imported. You assign it to devices in the same way you assign policies created in Sophos
Mobile.
Related tasks
You assign a policy to devices to apply the settings it includes.
14.4 Import iOS provisioning profile
You can import a provisioning profile for self-developed iOS apps to install it on your devices.
Prerequisite: Generate a provisioning profile in your iOS development environment and save it to your computer.
To import the provisioning profile:
1. On the menu sidebar, under CONFIGURE, select Policies > iOS.
2. Select Create > Import policy.
3. Enter a name and a description.
4. Select Upload a file and then select the provisioning profile.
5. On the Import policy page, select Save.
The provisioning profile is imported. You install it on devices in the same way you assign policies.
Related tasks
102 Copyright © Sophos Limited
Sophos Mobile
You assign a policy to devices to apply the settings it includes.
14.5 About macOS policies
For Macs there are two types of policies:
• Device policy: When you assign a device policy to a Mac, the settings apply to all users that sign in to the Mac.
• User policy: When you assign a user policy to a Mac, the settings apply to all managed users that sign in to the Mac.
Managed users are:
• The local user that has enrolled the Mac with Sophos Mobile.
• All network users that are known to Sophos Mobile, i.e. users from the external LDAP directory you have configured for the Self Service Portal.
About device and user policies
• In addition to the enrollment policy (which is a device policy) you can assign one device policy and one user policy to a Mac.
• If there are conflicting configurations in a device policy and a user policy assigned to the same
Mac, the more restrictive configuration is applied.
• On the Mac, the assigned policies are listed under System Preferences > Profiles.
• When you update a device policy, the changes take effect the next time the device syncs.
• When you update a user policy, the changes take effect the next time a user logs in to the Mac.
• Users may remove the user policy from the Mac but it is automatically re-assigned the next time the user logs in.
• Users can’t remove the device policy.
• When a user removes the enrollment policy, the Mac is unenrolled from Sophos Mobile. This requires administrator privileges.
Related concepts
Configurations for macOS device policies (page 221)
With a macOS device policy you configure settings for Macs that apply to all users.
Configurations for macOS user policies (page 238)
With a macOS user policy you configure settings for Macs that apply to users managed by Sophos
Mobile.
14.6 Configure Chrome tamper protection
With tamper protection you ensure the integrity of the Chrome Security policy.
On Chrome devices, malicious users could potentially modify the Chrome Security policy, for example by using the Chrome developer tools. When Sophos Mobile detects that the policy was modified on a device, it re-applies the original policy and performs actions you’ve configured in a compliance policy.
Copyright © Sophos Limited 103
Sophos Mobile
To configure tamper protection:
1. Create or edit a compliance policy for Chrome OS.
2. In the compliance policy, configure actions for the Tamper protection turned off rule.
You can create an alert or transfer a task bundle when the user modifies the policy.
3. Assign the compliance policy to the device group you use for Chrome devices.
Note
Tamper protection is always turned on, even if you don’t configure additional actions in a compliance policy.
Related tasks
(page 33)
14.7 Windows password complexity rules
Password complexity rules (for example length, number of uppercase and lowercase letters) for
Windows computers are fixed and cannot be set by a Sophos Mobile policy. Different rules apply for local and for Microsoft accounts.
Local accounts
• Password must not contain the user's account name or more than two consecutive characters from the user's full name.
• Password must be six or more characters long.
• Password must contain characters from three of the following four categories:
— Uppercase characters A-Z (Latin alphabet)
— Lowercase characters a-z (Latin alphabet)
— Digits 0-9
— Special characters (!, $, #, %, etc.)
Microsoft accounts
• Password must be eight or more characters long.
• Password must contain characters from two of the following four categories:
— Uppercase characters A-Z (Latin alphabet)
— Lowercase characters a-z (Latin alphabet)
— Digits 0-9
— Special characters (!, $, #, %, etc.)
104 Copyright © Sophos Limited
Sophos Mobile
14.8 Knox Service Plugin
The Knox Service Plugin (KSP) is an app for Android Enterprise devices that lets you assign Knox policies to Samsung Knox Platform for Enterprise (KPE) enabled devices.
Restriction
The Knox Service Plugin supports Android Enterprise fully managed devices with Android 8.0
(Knox 3.x) and later, and Android Enterprise work profile devices with Android 9.0 (Knox 3.2.1) and later.
For details on the Knox Service Plugin and the Samsung Knox Platform for Enterprise, see the
Samsung documentation.
To use the Knox Service Plugin with Sophos Mobile, complete the following steps:
1. Approve the Knox Service Plugin in managed Google Play for your Android Enterprise account.
2. Configure the policies in the Knox Service Plugin.
3. Install the Knox Service Plugin on selected devices or device groups, or let your users install it from managed Google Play.
Related tasks
Approve managed Google Play app
(page 328)
To make an app available to your users, you must approve it.
Configure policies in the Knox Service Plugin (page 105)
The Knox Service Plugin app includes Knox policy settings you can configure.
Install managed Google Play app
(page 333)
Related information
Samsung documentation on the Knox Service Plugin
Samsung documentation on Knox Platform for Enterprise
14.8.1 Configure policies in the Knox Service Plugin
The Knox Service Plugin app includes Knox policy settings you can configure.
Prerequisite: You’ve approved the Knox Service Plugin in managed Google Play.
To configure Knox policies in the Knox Service Plugin:
1. On the menu sidebar, under CONFIGURE, select Apps > Android.
2. On the Approved apps page, select the Knox Service Plugin app.
You might have to select Approved apps to open the Approved apps page.
3. In Page and App category, configure the location of the Knox Service Plugin in the users’ Google
Play Store app.
4. Select Use managed configuration.
5. Under Managed configuration, configure the required settings.
The available settings are defined in the Knox Service Plugin and may change when new app versions are released by Samsung.
Copyright © Sophos Limited 105
Sophos Mobile
In KPE Premium License key, you must enter your Knox license key. Otherwise, the policies are not applied when the app is installed.
6. Select Save.
7. Select Send app settings to Google to make the changes available to your users.
When you install the Knox Service Plugin on a device, the Knox policies are applied.
To remove the Knox policies, uninstall the app.
Related tasks
Approve managed Google Play app
(page 328)
To make an app available to your users, you must approve it.
14.9 Placeholders in policies
In policy settings, you can use placeholders which are replaced by a user, device, or customer property when the policy is assigned.
• %_EMAILADDRESS_% is replaced by the Email address property of the user assigned to the device.
• %_USERNAME_% is replaced by the User name property of the user assigned to the device.
• %_DEVPROP()_% is replaced by a device property.
For example, %_DEVPROP(IMEI)_% is replaced by the device’s IMEI value (if available).
You can use any of the properties listed on the Device properties and Custom properties tabs of the device’s Show device page.
• %_CUSTPROP()_% is replaced by a customer property.
For example if you’ve created a customer property “internal_id”, you can refer to it by
%_CUSTPROP(internal_id)_% .
You can use any of the properties listed under Setup > Sophos setup > Customer properties.
For macOS, user properties are replaced as follows:
• For the local Mac user, the properties from the Sophos Mobile user assigned to the device are used.
• For network users, the properties from the LDAP user account are used.
14.10 Assign a policy
You assign a policy to devices to apply the settings it includes.
To assign a policy to a device or device group:
1. On the menu sidebar, under CONFIGURE, select Policies and then select a device platform.
2. Select the blue triangle next to a policy and select Assign.
3. On the Select devices page, do one of following:
• Select individual devices.
• Select Select device groups and then select the required device groups.
4. On the Set execution date page, enter a date and time for the task to be carried out.
106 Copyright © Sophos Limited
Sophos Mobile
This step is only relevant for the following policies:
• Android device policies
• Knox container policies
• iOS device policies
5. Click Finish.
The policy is applied to the selected devices.
If you didn’t enter a date for the task to be carried out, the policy takes effect immediately.
You can also apply a policy by using one of the following options:
• To assign a policy to a single device: On the device’s Show device page, select the Policies tab and click Assign policy.
• To assign a policy to several devices: On the Devices page, select the required devices and then select Actions > Assign policy.
• To assign a policy as part of a task bundle: Add an Assign policy task to the task bundle and transfer it to the required devices or device groups.
Related tasks
Apply policy changes to devices
(page 107)
When you change the settings of certain policies, you must update them on the devices for the changes to take effect.
14.11 Apply policy changes to devices
When you change the settings of certain policies, you must update them on the devices for the changes to take effect.
You only need to apply changes to devices for the following policies:
• Android device policies
• Knox container policies
• iOS device policies
Other policies synchronize automatically each time the device connects to Sophos Mobile.
To apply policy changes to devices:
1. On the menu sidebar, under CONFIGURE, select Policies and then select a device platform.
2. Select the blue triangle next to a policy and select Update devices.
Sophos Mobile creates a task to update the policy on all devices to which it’s assigned.
14.12 Uninstall policy from devices
You uninstall a policy from a device to remove the settings applied by the policy.
You can only uninstall the following policies from a device:
• Android device policies
• Knox container policies
• iOS device policies
Copyright © Sophos Limited 107
Sophos Mobile
For other policies, either update the policy, assign a different policy, or unenroll the device.
Use one of the following procedures to uninstall a policy from devices:
• To uninstall a policy from a single device: a) On the menu sidebar, under MANAGE, select Devices.
b) Select a device name.
c) Select the Policies tab.
d) Select Uninstall.
• To uninstall a policy from selected devices: a) Create a task bundle with an Uninstall policy task.
b) Transfer the task bundle to the required devices or device groups.
• To uninstall a policy from all devices: a) On the menu sidebar, under CONFIGURE, select Policies and then select a device platform.
b) Click the blue triangle next to the policy you want to uninstall.
c) Select Unassign.
Related concepts
(page 50)
On the Show device page, all relevant information for an individual device is displayed.
Related tasks
You assign a policy to devices to apply the settings it includes.
Apply policy changes to devices
(page 107)
When you change the settings of certain policies, you must update them on the devices for the changes to take effect.
Transfer task bundles (page 291)
You can transfer task bundles to individual devices or to device groups.
14.13 Download policies
You can download policies. This is useful, for example if you need to pass the settings on to Sophos
Support.
To download a policy:
1. On the menu sidebar, go to Policies and click a device platform.
2. Click the blue triangle next to a policy and click Download.
The policy is saved to your computer.
108 Copyright © Sophos Limited
Sophos Mobile
14.14 Configurations for Android Enterprise device policies
With an Android Enterprise device policy you configure settings for Android Enterprise fully managed devices.
14.14.1 “Password policies” configuration (Android Enterprise device policy)
With the Password policies configuration you define requirements for the display lock password.
Password type
In the Password type list, select the type of password users are allowed to configure:
Setting/Field
Pattern, PIN or password
Simple password
PIN or password
Alphanumeric password
Complex password
Description
Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.
No additional restrictions are imposed.
Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.
Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.
Users must set a Password screen lock. The password must contain both letters and digits.
You can define a minimum length. See the following table.
Users must set a Password screen lock.
The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.
If you select Simple password, PIN or password, Alphanumeric password or Complex
password, the following fields are displayed:
Copyright © Sophos Limited 109
Sophos Mobile
Setting/Field Description
Minimum password length The minimum number of characters a password must contain.
Maximum idle time before password prompt The time after the device is locked if it has not been used. The device can be unlocked by entering the password.
Note
The device might impose a shorter time period than what you configure here.
Maximum password age in days
Maximum sign-in attempts
Password history
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
The device is wiped after this number of incorrect sign-in attempts.
The number of previously used passwords
Sophos Mobile stores.
When the user sets a new password, it mustn’t match a password that was already used.
If you select Complex password, the following additional fields are displayed:
Setting/Field
Minimum number of letters
Minimum number of lowercase letters
Minimum number of uppercase letters
Minimum number of non-alphabetic characters
Minimum number of digits
Minimum number of special characters
Description
The minimum number of letters a password must contain.
The minimum number of lowercase letters a password must contain.
The minimum number of uppercase letters a password must contain.
The minimum number of non-alphabetic characters (for example & or !) a password must contain.
The minimum number of numerals a password must contain.
The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.
110 Copyright © Sophos Limited
Sophos Mobile
14.14.2 Restrictions configuration (Android Enterprise device policy)
With the Restrictions configuration you set restrictions for Android Enterprise fully managed devices.
Security
Setting/Field
Force encryption
Allow factory reset
Allow safe mode
Allow debugging
Allow screen capture
Allow user to configure credentials
Allow Smart Lock
Description
Users must encrypt their devices.
Users can reset the device to its factory settings.
Users can boot the device in safe mode.
Users can turn on the debugging features in the
Android developer options.
Users can take a screenshot of the display.
Users can install or remove certificates.
Users can turn on the Android Smart Lock feature that automatically unlocks the device in certain situations.
Note
This setting affects the device lock. It is ignored if there is also a work profile lock configured.
Allow location sharing
Allow unlocking device by fingerprint
Allow changing the account picture
Hide sensitive information on lock screen
Users can turn on location sharing.
Users can use the fingerprint sensor to unlock the device.
Users can change the photo used for their user account.
If notifications on the lock screen are turned on, sensitive notification content is hidden.
Copyright © Sophos Limited 111
Sophos Mobile
Setting/Field
System update policy
Description
Select when system updates are installed:
• No policy: The user decides when to install system updates.
• Install automatically: System updates are installed automatically as soon as they are available.
• Install within maintenance window: System updates are installed automatically within a daily maintenance window.
Enter start and end time of the day.
• Postpone: System updates (except for security updates) are blocked for 30 days.
Accounts
Setting/Field
Allow managing accounts
Allow managing Google accounts
Description
Users can add or remove non-Google accounts such as app accounts from the device.
Users can add or remove Google accounts from the device.
Network and communication
Setting/Field
Allow SMS
Allow mobile data connection while roaming
Allow VPN
Allow Android Beam
Allow Bluetooth
Allow outgoing phone calls
Allow network reset
Enable Wi-Fi settings
Allow configuring cell broadcasts
Description
If the check box is cleared, users cannot send text messages.
If the check box is cleared, mobile data connections while roaming are turned off.
If the check box is cleared, users cannot use VPN connections.
Users can send data from apps through Android Beam
(data transfer through NFC).
If the check box is cleared, Bluetooth is turned off.
Users can make phone calls.
Users can reset network settings to their defaults.
Users can change the Wi-Fi settings.
Users can turn cell broadcast (CB) messages on or off in their messaging app.
112 Copyright © Sophos Limited
Setting/Field
Enable cellular networks settings
Enable tethering settings
Sophos Mobile
Description
Users can change the cellular network settings.
Users can change the tethering and portable hotspot settings.
Hardware
Setting/Field
Allow camera
Allow microphone
Allow external media
Enable USB storage
Allow transfering files over USB
Description
If the check box is cleared, the camera is unavailable.
If the check box is cleared, the microphone is unavailable.
Users can connect external media like USB storage to the device.
Users can connect the device in USB Mass Storage mode (USB MSC) to a host computer, i.e. as an external hard drive.
If you clear the check box, users can still connect the device in Media Transfer mode (USB MTP) or Picture
Transfer mode (USB PTP) to transfer files.
Users can transfer files between the device and external USB storage.
Applications
Setting/Field
Allow app uninstall
Allow installing apps from unknown sources
Enable system apps
Allow wallpaper change
Description
Users can uninstall apps.
If the check box is cleared, users can only install apps from Google Play, not from unknown sources or through Android Debug Bridge (ADB).
If the check box is cleared, only these apps are enabled: Google Play Store, Contacts, Messages,
Phone. Google recommends this for Android
Enterprise fully managed devices.
If you select the check box, all apps pre-installed by the manufacturer are enabled.
If the check box is cleared, users cannot change the wallpaper.
Copyright © Sophos Limited 113
Sophos Mobile
Setting/Field Description
Allow managing apps If the check box is cleared, users can’t perform the following tasks for apps:
• Uninstall apps
• Disable apps
• Stop apps
• Clear app cache
• Clear app data
• Clear setting Open by default
Allow disabling Google security scans Users can turn off the Google security setting Scan
device for security threats.
The setting is available in the Settings app, under
Google > Security > Google Play Protect.
Allow setting date and time
Short message
Users can set the date and time.
If the check box is cleared, network date and time is used.
A company-specific support message that is displayed to the user when functionality has been turned off.
Note
If you enter more than 200 characters, the message may be truncated.
Long message
Allowed accessibility services
Additional text to complement the short message. The text is displayed when the user taps More details in screens that display the short message.
Note
This text is also displayed on the Android Device
administrator screen for the Sophos Mobile
Control app.
Restrict the list of apps that can provide accessibility services:
• If you select All available apps, users can use all accessibility services.
• If you select Only system apps, users can only use accessibility services from system apps.
• If you select an app group, users can only use accessibility services from apps within that group, and from system apps.
114 Copyright © Sophos Limited
Sophos Mobile
14.14.3 Exchange account configuration (Android Enterprise device policy)
With the Exchange account configuration you set up a connection to a Microsoft Exchange Server mail server.
Setting/Field
Account name
Exchange server
Domain
User
Email address
Sender
Synchronization period
SSL/TLS
Allow all certificates
Client certificate
Description
The account name.
The Exchange server address.
If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.
The domain for this account.
The user for this account.
If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.
The user must enter the password.
The email address of the account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
A sender name for this account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
The time period used for synchronizing emails.
Only the emails from within the specified period are synchronized to the inbox on the managed device.
The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
Allow all certificates in transfer processes from the email server.
The client certificate for the connection to the
Exchange server.
Copyright © Sophos Limited 115
Sophos Mobile
14.14.4 Wi-Fi configuration (Android Enterprise device policy)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
Setting/Field
SSID
Security type
Phase 2 authorization
Identity
Anonymous identity
Password
Identity certificate
Description
The ID of the Wi-Fi network.
The security type of the Wi-Fi connection:
• None
• WEP
• WPA/WPA2 PSK
• EAP/PEAP
• EAP/TLS
• EAP/TTLS
The authentication method for phase 2 of the
EAP negotiation:
• None
• PAP
• CHAP
• MSCHAP
• MSCHAPv2
This field is available for EAP/PEAP and EAP/
TTLS connections.
The user identity.
This field is available for EAP connections.
The pseudonym identity sent unencrypted in phase 1 of the EAP negotiation.
This field is available for EAP connections.
The password for the Wi-Fi network.
The identity certificate for the connection to the
Wi-Fi network.
The list includes all certificates from Client
certificate configurations of the current policy.
This field is available for EAP connections.
116 Copyright © Sophos Limited
Setting/Field
Trusted certificate
Sophos Mobile
Description
The root CA for the certificate of the EAP server.
The list includes all certificates from Root
certificate configurations of the current policy.
This field is available for EAP connections.
14.14.5 App Protection configuration (Android Enterprise device policy)
With the App Protection configuration you define password requirements for protecting managed
Google Play apps.
With App Protection in use, users must create a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.
If App Protection is active on a device, the command Reset App Protection password is available in the Actions menu of the Show device page. The user can also reset the App Protection password in the Self Service Portal.
Setting/Field
Password complexity
Grace period in minutes
App group
Allow fingerprint authentication
Description
The minimum complexity requirements for the password to be defined by users.
After the grace period has expired, protected apps can only be unlocked by entering a password.
Select the app group containing the apps that are password protected.
For creating app groups, see
(page
312).
Users can use their fingerprint to unlock a protected app.
Copyright © Sophos Limited 117
Sophos Mobile
14.14.6 App Control configuration (Android Enterprise device policy)
With the App Control configuration you define apps that users are not allowed to start. For example, you can use this to block apps that have been pre-installed by the device manufacturer and cannot be uninstalled.
Setting/Field
App group
Description
Select the app group containing the blocked apps.
For information on creating app groups, see
(page 312).
14.14.7 App permissions configuration (Android Enterprise device policy)
With the App permissions configuration you configure what happens when an app requests a permission at runtime.
Setting/Field
Default response for runtime permission requests
App-specific runtime permissions
Description
The default response for runtime permission requests:
• Prompt: Users are prompted to grant a permission.
• Auto-accept: All runtime permission requests are automatically granted.
• Auto-deny: All runtime permission requests are automatically denied.
Users can’t edit permissions later if you select
Auto-accept or Auto-deny.
Grant or deny runtime permissions for specific apps.
Click Add to select an app and then select one of the following for each permission:
• Selectable: Users can edit the permission.
• Granted: The permission is granted.
• Denied: The permission is denied.
118 Copyright © Sophos Limited
Sophos Mobile
14.14.8 Kiosk mode configuration (Android Enterprise device policy)
With the Kiosk mode configuration you turn on Android Enterprise dedicated device management.
Setting/Field
Select source
App ID
App group
Allow volume change
Turn off screen lock
Stay on while charging
Description
• None: Allow all apps. The kiosk mode restrictions are applied to the device, but the user can start any app available on the device.
• Custom, App list : Lock a single app to the screen.
• App group: Allow multiple apps to appear on the screen.
The app available in kiosk mode.
Depending on your selection in Select source, either specify the app by its identifier, or select it from the list of available apps.
The apps available in kiosk mode.
Select one of the configured app groups.
If the check box is cleared, the device’s volume buttons are disabled.
The device screen is never locked.
The device screen stays on while the device is connected to a power supply.
14.14.9 Global HTTP proxy configuration (Android Enterprise device policy)
With the Global HTTP proxy configuration you define a corporate proxy server.
Setting/Field
Proxy
Server
Port
PAC URL
Description
Select Manually to configure the connection details manually.
Select Automatic if you have a proxy auto-config (PAC) file.
The name (or the IP address) of the HTTP proxy.
The port number of the HTTP proxy.
The URL of the proxy auto-config (PAC) file.
Copyright © Sophos Limited 119
Sophos Mobile
14.14.10 VPN configuration (Android Enterprise device policy)
With the VPN configuration you select a VPN client for Android Enterprise devices.
Setting/Field
VPN client
Description
The identifier of the VPN app.
The VPN client must be a managed Google Play app already installed on the device.
You configure the VPN connection in the app’s managed configuration. See the app documentation for details.
14.14.11 Root certificate configuration (Android Enterprise device policy)
With the Root certificate configuration you install a root certificate onto devices.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.14.12 Client certificate configuration (Android Enterprise device policy)
With the Client certificate configuration you install a client certificate onto devices.
Setting
File
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
120 Copyright © Sophos Limited
Setting
Certificate name
Sophos Mobile
Description
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.14.13 SCEP configuration (Android Enterprise device policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).
Note
You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.
Setting/Field
URL
Alias name
Description
The web address of the Certificate Authority server.
Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the
SCEP tab of the Sophos setup page.
The name under which the certificate will appear in selection dialogs.
This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.
Copyright © Sophos Limited 121
Sophos Mobile
Setting/Field
Subject
Type of Subject Alternative Name
Value of Subject Alternative Name
AD user logon name
Challenge
Root certificate
Key size
Description
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid
X.500 name.
For example:
• Enter CN=%_USERNAME_% to specify a user.
• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.
For information on available placeholders, see
Placeholders in policies (page 106).
To add a Subject Alternative Name (SAN) to the
SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:
• RFC 822 name: A valid email address.
• DNS name: The DNS name of the CA server.
• Uniform resource identifier: The fully qualified
URL of the CA server.
The User logon name value set in Active
Directory, i.e. the user’s User Principal Name
(UPN).
The web address to obtain a challenge password from the SCEP server.
Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the
SCEP tab of the Sophos setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
122 Copyright © Sophos Limited
Setting/Field
Key usage
Sophos Mobile
Description
Select what the certificate can be used for.
Use as digital signature: The certificate can be used as a digital signature.
Use for encryption: The certificate can be used for data encryption.
14.15 Configurations for Android Enterprise work profile policies
With an Android Enterprise work profile policy you configure settings for Android Enterprise work profile devices.
14.15.1 “Password policies - Device” configuration (Android
Enterprise work profile policy)
With the Password policies - Device configuration you define requirements for the display lock password.
Password type
In the Password type list, select the type of password users are allowed to configure:
Setting/Field
Pattern, PIN or password
Simple password
PIN or password
Alphanumeric password
Description
Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.
No additional restrictions are imposed.
Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.
Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.
Users must set a Password screen lock. The password must contain both letters and digits.
You can define a minimum length. See the following table.
Copyright © Sophos Limited 123
Sophos Mobile
Setting/Field
Complex password
Description
Users must set a Password screen lock.
The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.
If you select Simple password, PIN or password, Alphanumeric password or Complex
password, the following fields are displayed:
Setting/Field
Minimum password length
Description
The minimum number of characters a password must contain.
Maximum idle time before password prompt The time after the device is locked if it has not been used. The device can be unlocked by entering the password.
Note
The device might impose a shorter time period than what you configure here.
Maximum password age in days
Maximum sign-in attempts
Password history
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
The device is wiped after this number of incorrect sign-in attempts.
The number of previously used passwords
Sophos Mobile stores.
When the user sets a new password, it mustn’t match a password that was already used.
If you select Complex password, the following additional fields are displayed:
Setting/Field
Minimum number of letters
Minimum number of lowercase letters
Minimum number of uppercase letters
Description
The minimum number of letters a password must contain.
The minimum number of lowercase letters a password must contain.
The minimum number of uppercase letters a password must contain.
124 Copyright © Sophos Limited
Setting/Field
Minimum number of non-alphabetic characters
Minimum number of digits
Minimum number of special characters
Sophos Mobile
Description
The minimum number of non-alphabetic characters (for example & or !) a password must contain.
The minimum number of numerals a password must contain.
The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.
14.15.2 “Password policies - Work profile” configuration
(Android Enterprise work profile policy)
With the Password policies - Work profile configuration you define requirements for the work profile password. The user must enter that password to open an app when the work profile is locked.
Note
The settings supported may depend on the version of the operating system or on other device features. This is indicated by blue labels in Sophos Mobile Admin.
Password type
In the Password type list, select the type of password users are allowed to configure:
Setting/Field
Pattern, PIN or password
Simple password
PIN or password
Alphanumeric password
Description
Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.
No additional restrictions are imposed.
Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.
Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.
Users must set a Password screen lock. The password must contain both letters and digits.
You can define a minimum length. See the following table.
Copyright © Sophos Limited 125
Sophos Mobile
Setting/Field
Complex password
Weak biometric recognition
Description
Users must set a Password screen lock.
The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.
Users are allowed to use weak biometric recognition methods, like face recognition, to unlock the work profile.
Note
Weak biometric recognition methods provide similar security as a 3-digit PIN.
This means that unauthorized unlocking might happen in 1 of 1000 attempts.
If you select Simple password, PIN or password, Alphanumeric password or Complex
password, the following fields are displayed:
Setting/Field
Minimum password length
Description
The minimum number of characters a password must contain.
Maximum idle time before password prompt The time after the work profile is locked if it has not been used. The profile can be unlocked by entering the password.
Note
The device might impose a shorter time period than what you configure here.
Maximum password age in days
Maximum sign-in attempts
Password history
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
The work profile is deleted after this number of incorrect sign-in attempts.
The number of previously used passwords
Sophos Mobile stores.
When the user sets a new password, it mustn’t match a password that was already used.
If you select Complex password, the following additional fields are displayed:
126 Copyright © Sophos Limited
Setting/Field
Minimum number of letters
Minimum number of lowercase letters
Minimum number of uppercase letters
Minimum number of non-alphabetic characters
Minimum number of digits
Minimum number of special characters
Sophos Mobile
Description
The minimum number of letters a password must contain.
The minimum number of lowercase letters a password must contain.
The minimum number of uppercase letters a password must contain.
The minimum number of non-alphabetic characters (for example & or !) a password must contain.
The minimum number of numerals a password must contain.
The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.
14.15.3 Restrictions configuration (Android Enterprise work profile policy)
With the Restrictions configuration you set restrictions for Android Enterprise work profile devices.
Security
Setting/Field
Allow screen capture
Description
Users can capture the screen content of apps installed in the work profile.
Allow user to configure credentials
Allow work clipboard in personal apps Users can copy text from an app in the work profile and paste it into a personal app.
Pasting clipboard text from a personal app into an app in the work profile is always possible.
Allow Smart Lock
Users can install or remove certificates in the work profile.
Users can turn on the Android Smart Lock feature that automatically unlocks the device in certain situations.
Note
This setting affects the device lock. It is ignored if there is also a work profile lock configured.
Copyright © Sophos Limited 127
Sophos Mobile
Setting/Field
Allow location sharing
Allow opening web links in personal apps
Allow debugging
Allow unlocking device by fingerprint
Allow work contact info for personal calls
Allow work contact info for Bluetooth devices
Allow searches of work contacts in personal profile
Description
Apps in the work profile can access the device’s location features.
If the check box is cleared, apps in the work profile can’t access the device’s location features, even if the user has turned location sharing on.
Web links that the user taps in an app in the work profile can be opened by a personal browser app.
Users can turn on the debugging features in the
Android developer options.
Users can use the fingerprint sensor to unlock the device.
The personal phone app displays the caller’s name for incoming calls from work contacts.
Connected Bluetooth devices display the caller’s name for incoming personal calls from work contacts.
The personal phone app includes results from work contacts when searching for caller’s names.
Accounts
Setting/Field
Allow managing accounts
Description
Users can add or remove non-Google accounts such as app accounts from the work profile.
Network and communication
Setting/Field
Allow VPN
Allow Android Beam
Description
Users can use VPN connections for apps in the work profile.
Users can send data from apps in the work profile through Android Beam (data transfer through NFC).
128 Copyright © Sophos Limited
Sophos Mobile
Hardware
Setting/Field
Allow camera
Description
Apps in the work profile can access the camera.
Applications
Setting/Field
Allow app uninstall
Allow installing apps from unknown sources
Allow managing apps
Description
Users can uninstall apps from the work profile.
If the check box is cleared, users can only install apps in the work profile from Google Play, not from unknown sources or through Android Debug Bridge (ADB).
If the check box is cleared, users can’t perform the following tasks for apps in the work profile:
• Uninstall apps
• Disable apps
• Stop apps
• Clear app cache
• Clear app data
• Clear setting Open by default
Allow disabling Google security scans Users can turn off the Google security setting Scan
device for security threats.
The setting is available in the Settings app, under
Google > Security > Google Play Protect.
Short message A company-specific support message that is displayed to the user when functionality has been turned off.
Note
If you enter more than 200 characters, the message may be truncated.
Copyright © Sophos Limited 129
Sophos Mobile
Setting/Field
Long message
Description
Additional text to complement the short message. The text is displayed when the user taps More details in screens that display the short message.
Note
This text is also displayed on the Android Device
administrator screen for the Sophos Mobile
Control app.
14.15.4 Exchange account configuration (Android Enterprise work profile policy)
With the Exchange account configuration you set up a connection to a Microsoft Exchange Server mail server. These settings are applied to the Gmail app in the work profile.
Setting/Field
Account name
Exchange server
Domain
User
Email address
Sender
Synchronization period
Description
The account name.
The Exchange server address.
If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.
The domain for this account.
The user for this account.
If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.
The user must enter the password.
The email address of the account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
A sender name for this account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
The time period used for synchronizing emails.
Only the emails from within the specified period are synchronized to the inbox on the managed device.
130 Copyright © Sophos Limited
Setting/Field
SSL/TLS
Allow all certificates
Client certificate
Sophos Mobile
Description
The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
Allow all certificates in transfer processes from the email server.
The client certificate for the connection to the
Exchange server.
14.15.5 Wi-Fi configuration (Android Enterprise work profile policy)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
Setting/Field
SSID
Security type
Phase 2 authorization
Identity
Description
The ID of the Wi-Fi network.
The security type of the Wi-Fi connection:
• None
• WEP
• WPA/WPA2 PSK
• EAP/PEAP
• EAP/TLS
• EAP/TTLS
The authentication method for phase 2 of the
EAP negotiation:
• None
• PAP
• CHAP
• MSCHAP
• MSCHAPv2
This field is available for EAP/PEAP and EAP/
TTLS connections.
The user identity.
This field is available for EAP connections.
Copyright © Sophos Limited 131
Sophos Mobile
Setting/Field
Anonymous identity
Password
Identity certificate
Trusted certificate
Description
The pseudonym identity sent unencrypted in phase 1 of the EAP negotiation.
This field is available for EAP connections.
The password for the Wi-Fi network.
The identity certificate for the connection to the
Wi-Fi network.
The list includes all certificates from Client
certificate configurations of the current policy.
This field is available for EAP connections.
The root CA for the certificate of the EAP server.
The list includes all certificates from Root
certificate configurations of the current policy.
This field is available for EAP connections.
14.15.6 App Protection configuration (Android Enterprise work profile policy)
With the App Protection configuration you define password requirements for protecting managed
Google Play apps, i.e. apps installed in the work profile.
With App Protection in use, users must create a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.
If App Protection is active on a device, the command Reset App Protection password is available in the Actions menu of the Show device page. The user can also reset the App Protection password in the Self Service Portal.
Setting/Field
Password complexity
Grace period in minutes
App group
Allow fingerprint authentication
Description
The minimum complexity requirements for the password to be defined by users.
After the grace period has expired, protected apps can only be unlocked by entering a password.
Select the app group containing the apps that are password protected.
For creating app groups, see
(page
312).
Users can use their fingerprint to unlock a protected app.
132 Copyright © Sophos Limited
Sophos Mobile
14.15.7 App Control configuration (Android Enterprise work profile policy)
With the App Control configuration you define apps that users are not allowed to start.
Setting/Field
App group
Description
Select the app group containing the blocked apps.
For information on creating app groups, see
(page 312).
14.15.8 App permissions configuration (Android Enterprise work profile policy)
With the App permissions configuration you configure what happens when a managed Google Play app requests permissions at runtime.
Setting/Field
Default response for runtime permission requests
App-specific runtime permissions
Description
The default response for runtime permission requests:
• Prompt: Users are prompted to grant a permission.
• Auto-accept: All runtime permission requests are automatically granted.
• Auto-deny: All runtime permission requests are automatically denied.
Users can’t edit permissions later if you select
Auto-accept or Auto-deny.
Grant or deny runtime permissions for specific apps.
Click Add to select an app and then select one of the following for each permission:
• Selectable: Users can edit the permission.
• Granted: The permission is granted.
• Denied: The permission is denied.
Copyright © Sophos Limited 133
Sophos Mobile
14.15.9 VPN configuration (Android Enterprise work profile policy)
With the VPN configuration you select a VPN client for Android Enterprise devices.
Setting/Field
VPN client
Description
The identifier of the VPN app.
The VPN client must be a managed Google Play app already installed on the device.
You configure the VPN connection in the app’s managed configuration. See the app documentation for details.
14.15.10 Root certificate configuration (Android Enterprise work profile policy)
With the Root certificate configuration you install a root certificate onto devices. This certificate is available to managed Google Play apps, i.e. to apps installed in the work profile.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
134 Copyright © Sophos Limited
Sophos Mobile
14.15.11 Client certificate configuration (Android Enterprise work profile policy)
With the Client certificate configuration you install a client certificate onto devices. This certificate is available to managed Google Play apps, i.e. to apps installed in the work profile.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.15.12 SCEP configuration (Android Enterprise work profile policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP). These certificates are available to apps that are installed in the work profile.
Note
You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.
Setting/Field
URL
Description
The web address of the Certificate Authority server.
Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the
SCEP tab of the Sophos setup page.
Copyright © Sophos Limited 135
Sophos Mobile
Setting/Field
Alias name
Subject
Type of Subject Alternative Name
Value of Subject Alternative Name
AD user logon name
Challenge
Root certificate
Description
The name under which the certificate will appear in selection dialogs.
This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid
X.500 name.
For example:
• Enter CN=%_USERNAME_% to specify a user.
• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.
For information on available placeholders, see
Placeholders in policies (page 106).
To add a Subject Alternative Name (SAN) to the
SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:
• RFC 822 name: A valid email address.
• DNS name: The DNS name of the CA server.
• Uniform resource identifier: The fully qualified
URL of the CA server.
The User logon name value set in Active
Directory, i.e. the user’s User Principal Name
(UPN).
The web address to obtain a challenge password from the SCEP server.
Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the
SCEP tab of the Sophos setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.
136 Copyright © Sophos Limited
Setting/Field
Key size
Key usage
Sophos Mobile
Description
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
Select what the certificate can be used for.
Use as digital signature: The certificate can be used as a digital signature.
Use for encryption: The certificate can be used for data encryption.
14.16 Configurations for Sophos container policies for Android
With a Sophos container policy you configure settings for Sophos Secure Email and Sophos Secure
Workspace on devices where Sophos Mobile manages the Sophos container.
Note
On Android Enterprise devices, this policy also installs Sophos Secure Workspace and, if the policy contains a Work email configuration, Sophos Secure Email. Approve these apps in managed Google Play before you assign the policy.
14.16.1 General configuration (Android Sophos container policy)
With the General configuration you define settings that apply to all Sophos container apps, if applicable.
Setting/Field
Enable Sophos container password
Description
Users must enter an additional password to be able to start a Sophos container app. The password has to be defined when the first container app is started after the configuration has been applied. This password applies to all container apps.
Copyright © Sophos Limited 137
Sophos Mobile
Setting/Field
Password complexity
Always hide characters in password entry fields
Password age in days
Failed logins until lock
Allow fingerprint
Grace period in minutes
Lock on device lock
Description
The required minimum complexity of the
Sophos container password. More secure passwords are always allowed. Passwords (a mix of numeric and alphanumeric characters) are always seen as more secure than PINs
(numeric characters only).
• Any: Sophos container passwords do not have restrictions.
• 4 digit PIN
• 6 digit PIN
• 4 char password
• 6 char password
• 8 char password
• 10 char password
Characters in password entry fields are not briefly displayed before they are masked.
The number of days that a password can be used before users are prompted to change it.
The number of failed login attempts that are tolerated before the container apps are locked.
Once they are locked an administrator needs to unlock the apps or, if allowed, users can use the
Self Service Portal to do so.
Users can use their fingerprint to unlock the app.
The period of time within which no Sophos container password must be entered when a container app comes to the foreground again.
The grace period applies to all container apps.
You can switch between the apps during the grace period without entering a password.
When the device is locked, the Sophos container is locked as well.
If the check box is cleared, the container is locked only after the grace period has expired.
138 Copyright © Sophos Limited
Setting/Field
Last server connect
Sophos Mobile
Description
The period of time within users can use a
Sophos container app without a connection to the Sophos Mobile server.
When a Sophos container app becomes active and does not have contact with the server within the defined period of time, a lock screen will be displayed. Users can only unlock the app by tapping Retry on the lock screen. The app will then try to connect to the server. If the connection can be established, the app will be unlocked. If not, access will be denied.
• On access: Server connection is always required and the app is locked when the server cannot be reached.
• 1 hour: Server connection is required when the app becomes active one hour or more after the last successful server connection.
• 3 hours
• 6 hours
• 12 hours
• 1 day
• 3 days
• 3 days
• None: No regular contact is required.
Copyright © Sophos Limited 139
Sophos Mobile
Setting/Field
Offline starts without server connection
Description
In this field you define how often users can start one of the Sophos container apps without a server connection.
Note
This setting requires the Sophos container password feature to be turned on.
Root access allowed
A counter is incremented whenever users enter the Sophos container password. If the counter exceeds the defined number, the same lock screen as for the Last server connect setting will be displayed. The counter will be reset if a connection to the Sophos Mobile server is established.
• Unlimited: No server connection is required.
• 0: Starting the app without a server connection is not possible.
• 1: After one start of the app, a successful server connection is necessary.
• 3
• 5
• 10
• 20
Container apps are allowed to run on rooted devices.
App usage constraints
Here you can define constraints on using the Sophos container apps. Click Add to enter constraints.
Geo-fencing
Time-fencing
Lets you add latitude and longitude and a radius within which the Sophos container apps can be used.
Lets you specify a start and end time within which the Sophos container apps can be used.
Days of the week on which the apps can be used can be specified as well.
140 Copyright © Sophos Limited
Setting/Field
Wi-Fi fencing
Sophos Mobile
Description
If you select Wi-Fi connection required, the
Sophos container is locked when there is no active Wi-Fi connection.
If you add Wi-Fi networks to the list, the
Sophos container is locked when the device is connected to a Wi-Fi network not listed.
Warning
We recommend that you do not rely on Wi-Fi fencing as the only security mechanism because
Wi-Fi names can be spoofed very easily.
14.16.2 Corporate Email configuration (Android Sophos container policy)
With the Corporate Email configuration you define user settings for your Microsoft Exchange Server.
These settings are applied to the Sophos Secure Email app if it is installed in the Sophos container.
Setting/Field
Exchange server
User
Email address
Domain
Support contact email
Description
The Exchange server address.
If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.
The user for this account.
If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.
The email address of the account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
The domain for this account.
The email address that will be used as the
"Contact Support" email address.
Copyright © Sophos Limited 141
Sophos Mobile
Setting/Field
Export contacts to device
142
Export company names
Notification details
Deny copy to clipboard
Deny screenshots
Maximum email size
Allow viewing/sharing
Description
Users are allowed to export the Exchange contacts to the local device contacts, so that they can identify company contacts in incoming calls.
Sophos Secure Email keeps the information synchronized.
Note
The local contact information is automatically deleted in the following situations:
• When the Corporate Email configuration is removed from the
Sophos container policy (requires a restart of the Secure Email app).
• When the Sophos container is removed from the device.
• When the device is unenrolled from
Sophos Mobile.
The company name is included in the export of company contacts to the local device contacts.
When the check box is cleared, only name and phone number are exported.
Select the amount of information that is displayed in email notifications.
This setting also affects event reminders. If you select No notifications, event reminders are turned off. If you select any other value, event reminders are turned on and include time, location and title information.
Users cannot copy or cut texts from the Sophos
Secure Email app.
Users can’t take screenshots that show the
Sophos Secure Email app.
Email messages that are larger than the size you select (including attachments) are not retrieved from the Exchange server.
Users are allowed to view or share email attachments.
Copyright © Sophos Limited
Setting/Field
View attachments
Share attachments
Extra settings
Sophos Mobile
Description
Select whether attachments can be viewed in all apps or only in the Sophos container apps
Sophos Secure Workspace and Sophos Secure
Email.
With all apps: Attachments can be shared with all apps that support the file format.
With container apps: Attachments are encrypted with a device key and can only be opened in Sophos Secure Workspace. The sharing action itself is not blocked.
Only configure these settings if instructed by
Sophos Support.
Note
If Sophos Secure Email isn’t installed, users receive a message to install it. When they start the app for the first time, it’s configured automatically.
14.16.3 Corporate Documents configuration (Android Sophos container policy)
With the Corporate Documents configuration you define settings for the Corporate Documents feature of the Sophos Secure Workspace app.
Configure storage providers
For each storage provider you can define the following settings separately:
Setting/Field
Enable
Offline
Open in (encrypted)
Open in (unencrypted)
Clipboard
Description
The storage provider is available in the app.
Users are allowed to add files from the storage provider to the app's Favorites list for offline use.
Users can share encrypted files with other apps via Open In.
Users can share unencrypted files with other apps via Open In.
Users can copy parts of a document and paste them into other apps.
Copyright © Sophos Limited 143
Sophos Mobile
Enterprise provider settings
For WebDAV provider, also referred to as enterprise provider, you can centrally define server settings and login credentials. These cannot be changed by users.
Credential settings that you do not define centrally can be chosen by the users in the app's provider credential screens.
For example you can centrally define the server and user account to be used but you can leave the password field undefined. Users then would have to know the password when accessing the storage provider.
Setting/Field
Name
Server
User name
Password
Upload folder
Description
The name of the provider that is displayed in the
Sophos Secure Workspace app.
In this field, enter:
• The URL of the root folder on the
Corporate Documents WebDAV server.
• The URL of the root folder on the WebDAV server.
Use the following format: https:// server.company.com
Only the https protocol is supported.
The user name for the relevant server. You can also use the %_USERNAME_% variable.
The password for the relevant account.
The upload folder for the relevant account.
Other settings
Setting/Field
Enable Documents
Description
This turns on the Documents feature to securely distribute company documents.
144 Copyright © Sophos Limited
Setting/Field
Passphrase complexity
Deny screenshots
Extra settings
Sophos Mobile
Description
The required minimum complexity of passphrases for encryption keys. More secure passphrases are always allowed.
You can select the following settings:
• 4 char password
• 6 char password
• 8 char password
• 10 char password
Users can’t take screenshots that show the
Sophos Secure Workspace app.
Only configure these settings if instructed by
Sophos Support.
14.16.4 Corporate Browser configuration (Android Sophos container policy)
With the Corporate Browser configuration you define settings for the Corporate Browser feature of the
Sophos Secure Workspace app.
The Corporate Browser allows you to securely access corporate intranet pages and other allowed pages. You can define domains and bookmarks within a domain.
Every bookmarks belongs to a certain domain. When you add a bookmark, the domain entry is created automatically if it does not exist.
General settings
Setting/Field
Deny screenshots
Description
Users can’t take screenshots that show the
Corporate Browser.
Domain settings
Setting/Field
URL
Allow copy/paste
Allow open with
Copyright © Sophos Limited
Description
The domain that you want to allow.
Users can copy and paste text from the
Corporate Browser to other apps.
Users can download attachments or pass them on to other apps.
145
Sophos Mobile
Setting/Field
Allow save password
Description
Users can save their passwords in the
Corporate Browser.
Bookmark settings
Setting/Field
Name
URL
Description
The name for the bookmark.
The web address for the bookmark.
14.16.5 Root certificate configuration (Android Sophos container policy)
With the Root certificate configuration you install a root certificate onto devices. This certificate is available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the
Sophos container.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
146 Copyright © Sophos Limited
Sophos Mobile
14.16.6 Client certificate configuration (Android Sophos container policy)
With the Client certificate configuration you install a client certificate onto devices. This certificate is available to the Sophos Secure Workspace app if it’s installed in the Sophos container.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.16.7 SCEP configuration (Android Sophos container policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP). These certificates are available to the
Corporate Browser feature of the Sophos Secure Workspace app.
Note
You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.
Setting/Field
URL
Alias name
Description
The web address of the Certificate Authority server.
Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the
SCEP tab of the Sophos setup page.
The name under which the certificate will appear in selection dialogs.
This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.
Copyright © Sophos Limited 147
Sophos Mobile
Setting/Field
Subject
Type of Subject Alternative Name
Value of Subject Alternative Name
AD user logon name
Challenge
Root certificate
Key size
Description
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid
X.500 name.
For example:
• Enter CN=%_USERNAME_% to specify a user.
• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.
For information on available placeholders, see
Placeholders in policies (page 106).
To add a Subject Alternative Name (SAN) to the
SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:
• RFC 822 name: A valid email address.
• DNS name: The DNS name of the CA server.
• Uniform resource identifier: The fully qualified
URL of the CA server.
The User logon name value set in Active
Directory, i.e. the user’s User Principal Name
(UPN).
The web address to obtain a challenge password from the SCEP server.
Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the
SCEP tab of the Sophos setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
148 Copyright © Sophos Limited
Setting/Field
Key usage
Sophos Mobile
Description
Select what the certificate can be used for.
Use as digital signature: The certificate can be used as a digital signature.
Use for encryption: The certificate can be used for data encryption.
14.17 Configurations for Mobile Threat Defense policies for Android
With a Mobile Threat Defense policy you configure Sophos Intercept X for Mobile when it’s enrolled with Sophos Mobile.
Warning
On Android Enterprise devices, this policy installs the Intercept X app. You must approve the app in managed Google Play before you assign the policy.
14.17.1 Network configuration (Mobile Threat Defense policy for
Android)
With the Network configuration you manage the Wi-Fi Security feature of Sophos Intercept X for
Mobile. This protects users from network-based threats.
Note
When you assign this configuration to a device, the corresponding settings in Sophos Intercept X for Mobile are disabled. The user can’t change them.
Setting/Field
Man-in-the-middle protection
Extra settings
Description
Sophos Intercept X for Mobile checks the Wi-Fi connection for man-in-the-middle attacks.
Sophos Mobile creates an alert when a man-in-the-middle attack is detected.
Only configure these settings if instructed by Sophos
Support.
Copyright © Sophos Limited 149
Sophos Mobile
14.17.2 Antivirus configuration (Mobile Threat Defense policy for
Android)
With the Antivirus configuration you manage the malware protection settings of Sophos Intercept X for
Mobile.
Note
When you assign this configuration to a device, the corresponding settings in Sophos Intercept X for Mobile are disabled. The user can’t change them.
Setting/Field
Cloud scan mode
Scheduled scan interval
Scan system apps
Scan storage
Detect PUAs
Enable user to allow PUAs
Mode
Description
Select when Sophos Intercept X for Mobile loads the latest malware information from the Sophos server.
Select how often malware scans are performed.
If you select Daily while charging, a scan is performed when the device is connected to a power supply for more than 30 minutes.
Scan system apps.
System apps aren’t scanned by default because they are protected by the Android OS and because the user can’t uninstall them.
Scan all files on internal shared storage, SD card, and connected USB devices for threats, in addition to the default scanning of all installed apps.
Scan for Potentially Unwanted Applications (PUAs).
PUAs are apps that, while not malicious, are generally considered unsuitable for business networks. PUAs include adware, dialers, system monitors, remote administration tools, and hacking tools. However, certain apps that can fall into the PUA category might be considered useful by some users.
Users can allow an app that was classified as PUA.
Allowed apps are ignored in subsequent scans.
Select how to deal with low reputation apps:
Allow: Turn off scanning for low reputation apps.
Warn: Display a warning on the device when a low reputation app is detected. Users can choose how to deal with the app. They can add it to a list of allowed apps so that no further warning is displayed if this app is detected.
Block: The user can’t start low reputation apps.
150 Copyright © Sophos Limited
Setting/Field
Scan notification
Monitor storage
App group
Sophos Mobile
Description
When an app is scanned after installation, Sophos
Intercept X for Mobile creates a notification.
If the check box is cleared, no notifications are created for clean apps.
Monitor internal shared storage, SD card, and connected
USB devices for changes. When new files are stored in these locations, they are scanned.
Select a group of allowed apps. The apps in that group are excluded from scans.
14.17.3 Web Filtering configuration (Mobile Threat Defense policy for Android)
With the Web Filtering configuration you manage the Web Filtering feature of Sophos Intercept X for
Mobile. This protects users from browsing sites with malicious, undesirable or illegal content.
Note
You must also turn off the Intercept X for Mobile permissions can be denied compliance rule. If you don’t, users are able to stop Web Filtering by turning off Sophos Accessibility Service.
Tip
For the purpose of testing website filtering, Sophos has created the site sophostest.com
containing example pages for each category. Although some of these pages are classified as potentially offensive or dangerous, the page content itself is harmless in all cases.
Settings
Setting/Field
Filter malicious websites
Create alerts
Filter websites by category
Description
Select whether users can access websites with malicious content.
Select whether an alert is created when the user tries to access a filtered website.
You can select if alerts are only created for blockings or also for warnings.
Select whether users can access types of websites.
Websites are categorized based on data from
SophosLabs. The data is updated constantly.
Copyright © Sophos Limited 151
Sophos Mobile
Setting/Field
Website exceptions
Description
Configure exceptions to the category filters:
Allowed domains: Websites that are allowed, even though the category they belong to is blocked.
Blocked domains: Websites that are blocked, even though the category they belong to is allowed.
152
How to specify website exceptions
In Allowed domains and Blocked domains, enter one of the following per line (without separator):
• IPv4 or IPv6 address
203.0.113.0
2001:db8:85a3:0:0:8a2e:370:7334
• IPv4 or IPv6 subnet
203.0.113.0/24
2001:db8::/32
• Domain www.example.com
• Wildcard domain. The wildcard * must be the leftmost character.
*.example.com
*example.com
In Blocked domains, you can use a single wildcard * to block all websites.
Filtering logic
When Web Filtering evaluates whether a website must be allowed or blocked, the allow list takes precedence over the block list, and policy-defined lists take precedence over user-defined lists.
Filtering rules are applied in the following sequence:
1. If the website is included in Allowed domains, it is allowed.
2. If the website is included in Blocked domains, it is blocked.
3. If the user has added the website to the allow list, it is allowed.
4. If the user has added the website to the block list, it is blocked.
5. The website is allowed or blocked based on its category.
Supported browsers
Web Filtering can be used in combination with the following web browsers:
• Android web browser
• Firefox
Copyright © Sophos Limited
Sophos Mobile
• Google Chrome
• Microsoft Edge
Other browsers may also work, but have not been tested.
14.18 Configurations for Android device policies
With an Android device policy you configure settings for Android devices enrolled with Sophos Mobile in “Device administrator” management mode.
This is a legacy policy type. We recommend that you use the Android Enterprise management mode and policies instead.
Related concepts
Configurations for Android Enterprise device policies
(page 109)
With an Android Enterprise device policy you configure settings for Android Enterprise fully managed devices.
Configurations for Android Enterprise work profile policies
(page 123)
With an Android Enterprise work profile policy you configure settings for Android Enterprise work profile devices.
Related tasks
(page 20)
For Android devices, you can choose between the Android Enterprise and Device administrator
(legacy feature) management modes.
14.18.1 Password policies configuration (Android device policy)
With the Password policies configuration you define requirements for the display lock password.
Note
The settings supported may depend on the version of the operating system or on other device features. This is indicated by blue labels in Sophos Mobile Admin.
Password type
In the Password type list, select the type of password users are allowed to configure:
Setting/Field
Pattern, PIN or password
Simple password
Description
Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.
No additional restrictions are imposed.
Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.
Copyright © Sophos Limited 153
Sophos Mobile
Setting/Field
PIN or password
Alphanumeric password
Complex password
Description
Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.
Users must set a Password screen lock. The password must contain both letters and digits.
You can define a minimum length. See the following table.
Users must set a Password screen lock.
The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.
If you select Simple password, PIN or password, Alphanumeric password or Complex
password, the following fields are displayed:
Setting/Field
Minimum password length
Description
The minimum number of characters a password must contain.
Maximum idle time before password prompt The time after the device is locked if it has not been used. The device can be unlocked by entering the password.
Note
The device might impose a shorter time period than what you configure here.
Maximum password age in days
Maximum sign-in attempts
Password history
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
The device is wiped after this number of incorrect sign-in attempts.
The number of previously used passwords
Sophos Mobile stores.
When the user sets a new password, it mustn’t match a password that was already used.
If you select Complex password, the following additional fields are displayed:
Setting/Field
Minimum number of letters
Description
The minimum number of letters a password must contain.
154 Copyright © Sophos Limited
Setting/Field
Minimum number of lowercase letters
Minimum number of uppercase letters
Minimum number of non-alphabetic characters
Minimum number of digits
Minimum number of special characters
Sophos Mobile
Description
The minimum number of lowercase letters a password must contain.
The minimum number of uppercase letters a password must contain.
The minimum number of non-alphabetic characters (for example & or !) a password must contain.
The minimum number of numerals a password must contain.
The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.
Biometric authentication
Setting/Field
Allow fingerprint authentication
Allow iris authentication
Description
If supported by the device, the user can use fingerprint authentication to unlock the device.
If supported by the device, the user can use iris authentication to unlock the device.
14.18.2 Restrictions configuration (Android device policy)
With the Restrictions configuration you set restrictions for devices.
Security
Setting/Field
Force encryption
Force SD card encryption
Description
Users must encrypt their devices.
When the policy is assigned to a device, the user must encrypt the SD card.
Note
For some device types, users can choose to cancel the encryption. They will be reminded again on the next SD card mount.
Copyright © Sophos Limited 155
Sophos Mobile
Setting/Field
Allow fast encryption
Allow factory reset
Allow "Developer options"
Allow safe mode
Allow USB debugging
Allow firmware recovery
Allow backup
Allow settings changes
Allow clipboard
Enable shared clipboard
Allow screen capture
Allow mock GPS locations
Allow over-the-air firmware updates
Allow audio recording
Description
Users can change the fast encryption options in the device settings.
Users can reset their devices to factory state.
Users can change the developer options.
Users can boot the device in safe mode.
Users can turn on USB debugging.
Note
For Sony devices with Enterprise API level 9 or later, clearing the Allow USB debugging check box makes all developer options unavailable.
All types of firmware updates (like over-the-air, download etc.) are allowed.
Users can create system backups.
If the check box is cleared, Google backup is turned off but other backup methods (for example Sophos Mobile backups) remain available.
Users can change device settings.
Note
You must turn this on for Samsung devices on which you want to configure a Knox container.
Users can copy any contents to the clipboard.
Allows users to copy clipboard content between apps.
If the check box is cleared, each app has an individual clipboard.
This setting is only available if you select Allow
clipboard.
Users can take a screenshot of the display.
Users can select a mock location app in the Android developer options.
Over-the-air firmware updates are allowed.
Users can perform audio recording.
156 Copyright © Sophos Limited
Setting/Field
Allow video recording
Allow Activation Lock
Allow S Beam
Allow S Voice
Allow "Share via"
Sophos Mobile
Description
Users can record videos.
If the check box is cleared, users can still take pictures and stream videos.
Users can change the Activation Lock options in the device settings.
Users can start the Samsung S Beam app.
Users can start the Samsung S Voice app.
The Share via feature is available.
Accounts
Setting/Field
Allow multiple user accounts
Allow adding email accounts
Allow removal of the Google account
Allow auto-sync for Google accounts
Description
If the check box is cleared, multi-user support is turned off. Users or other apps cannot create additional user accounts.
If the check box is cleared, users cannot add email accounts.
This does not affect the account creation through a device policy.
If the check box is cleared, users cannot remove the
Google account from the device.
If the check box is cleared, Google accounts are not synchronized automatically. Users are still able to perform a manual sync from inside some apps like
Gmail.
Network and communication
Setting/Field
Allow airplane mode
Allow sync while roaming
Allow emergency calls only
Description
If the check box is cleared, users cannot enable airplane mode.
If the check box is cleared, synchronization while roaming is turned off.
Only emergency calls are allowed. All other calls will be blocked.
Copyright © Sophos Limited 157
Sophos Mobile
Setting/Field
Force manual sync during roaming
Force mobile data connection
Allow SMS
Allow mobile data connection while roaming
Allow voice calls while roaming
Allow user mobile data limit
Allow VPN
Allow Wi-Fi Direct
Allow Android Beam
Allow Miracast policy
Allow Bluetooth
Allow Advanced Audio Distribution
Profile (A2DP)
Allow Audio/Video Remote Control
Profile (AVRCP)
Allow Hands-Free Profile (HFP)
Allow Headset Profile (HSP)
Allow Phone Book Access Profile
(PBAP)
Allow Serial Port Profile (SPP)
Allow NFC
Allow Wi-Fi
Description
Automatic data synchronization is turned off when the device is roaming. This affects all configured accounts, such as Google or Exchange.
Users cannot turn off cellular data.
If the check box is cleared, users cannot send text messages.
If the check box is cleared, mobile data connections while roaming are turned off.
If the check box is cleared, voice calls while roaming are turned off.
If the check box is cleared, users cannot set a mobile data limit.
If the check box is cleared, users cannot use VPN connections.
If the check box is cleared, data transfer through Wi-Fi
Direct is turned off.
If the check box is cleared, data transfer through
Android Beam is turned off. This includes the Samsung
S Beam app.
If the check box is cleared, data transfer through
Miracast is turned off.
If the check box is cleared, Bluetooth is turned off.
To allow individual Bluetooth profiles, first select the Allow Bluetooth check box and then select the profiles you want to allow.
If the Allow Bluetooth check box is cleared, the settings have no effect, i.e. all profiles are forbidden.
If the check box is cleared, NFC (near-field communication) is turned off.
If the check box is cleared, Wi-Fi is turned off.
158 Copyright © Sophos Limited
Sophos Mobile
Tethering
Setting/Field
Allow tethering
Allow Wi-Fi tethering
Allow USB tethering
Allow Bluetooth tethering
Allow configuring Wi-Fi tethering
Description
If the check box is cleared, all tethering is turned off.
This includes tethering over Wi-Fi, USB and Bluetooth.
Note
If the check box is cleared, the settings Allow Wi-
Fi tethering, Allow USB tethering and Allow
Bluetooth tethering have no effect.
If the check box is cleared, Wi-Fi tethering (Wi-Fi
hotspot) is turned off.
If the check box is cleared, USB tethering is turned off.
If the check box is cleared, Bluetooth tethering is turned off.
The user can configure the settings of the Wi-Fi hotspot.
Hardware
Setting/Field
Allow camera
Allow camera on lock screen
Force GPS for location queries
Allow SD card
Allow moving apps to the SD card
Allow writing to unencrypted SD card
Allow microphone
Description
If the check box is cleared, the camera is unavailable.
If the check box is cleared, the camera is unavailable when the screen is locked.
To allow the camera on the lock screen you must also select the Allow camera option.
GPS information is used for device location.
If the check box is cleared, SD cards cannot be used in devices.
If the check box is cleared, users cannot move apps from the internal storage to the SD card.
If the check box is cleared, it is not possible to write to unencrypted SD cards.
If the check box is cleared, the microphone is unavailable.
Copyright © Sophos Limited 159
Sophos Mobile
Setting/Field
Allow USB
Allow USB media player
Allow power saving mode
Allow USB host storage
Description
The USB mass storage mode and the USB media device mode (MTP) are available on the device.
If the check box is cleared, the Media Transfer
Protocol (MTP) is unavailable. Because Android uses
MTP for USB file transfer, any file transfer over USB is blocked.
If the check box is cleared, the device doesn’t enter power saving mode.
All external storage devices the user connects are mounted. This includes portable USB storage devices, external HD drives and SD card readers.
If the check box is cleared, external storage devices are not mounted.
Applications
Setting/Field
Allow app install
Allow app uninstall
Allow unsigned app install
Allow Play Store
Allow apps from unknown sources
Allow native browser
Allow app crash reports
Allow wallpaper change
Show caller info
Description
If the check box is cleared, users cannot install apps.
If the check box is cleared, users cannot uninstall apps.
If the check box is cleared, users can only install signed APK files.
If the check box is cleared, the Google Play Store app is unavailable.
If the check box is cleared, users can only install apps through the Google Play Store app.
If the check box is cleared, the native browser is unavailable. Third-party browser apps are not affected.
If the check box is cleared, apps cannot send crash reports.
If the check box is cleared, users cannot change the wallpaper.
If the check box is cleared, caller details are not displayed for incoming phone calls. All callers are displayed as “unknown”.
160 Copyright © Sophos Limited
Sophos Mobile
Setting/Field
Allow autofill in browser
Allow cookies in browser
Description
The user can enable autofill in the settings of the native Android browser. If enabled, web pages can provide suggestions when the user is filling in form data.
If the check box is cleared, autofill is turned off and the browser setting is unavailable.
The user can enable cookies in the settings of the native Android browser. If enabled, web pages can store cookies on the device.
If the check box is cleared, cookies are turned off and the browser setting is unavailable.
Allow JavaScript in browser
Allow pop-ups in browser
The user can enable JavaScript in the settings of the native Android browser. If enabled, web pages can execute JavaScript code on the device.
If the check box is cleared, JavaScript is turned off and the browser setting is unavailable.
The user can enable pop-ups in the settings of the native Android browser. If enabled, web pages can open new browser windows.
If the check box is cleared, pop-ups are turned off and the browser setting is unavailable.
Allow changing date and time settings The user can change the date and time settings.
Allowed apps / Forbidden apps You can configure either Allowed apps or Forbidden
apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.
App installations initiated by the Sophos Mobile server are not restricted by this setting.
For information on creating app groups, see
(page 312).
14.18.3 Knox Premium restrictions configuration (Android device policy)
With the Knox Premium restrictions configuration you define restrictions for Samsung Knox devices.
These restrictions apply to the device, not to the Knox container.
Note
To enforce the Knox Premium restrictions, you must register a Samsung Knox Premium license with Sophos Mobile.
Copyright © Sophos Limited 161
Sophos Mobile
Option
Allow firmware auto update options
Enable ODE Trusted Boot verification
Prevent installation of another administrator app
Prevent activation of another administration app
Allow Common Criteria mode
Description
The device automatically checks for firmware updates. Users cannot change this in the device settings.
The device decrypts the data partition on boot only if the binary and the kernel are official, i.e. if the device is not rooted.
If the check box is cleared, the device always decrypts the data partition on boot.
The installation of apps that require device administrator privileges is prevented. This does not affect apps that are installed by Sophos
Mobile.
The activation of device administrator privileges for apps is prevented.
The Common Criteria mode (CC mode) of the device is turned on, ensuring that the device meets the security requirements stated by the
Mobile Device Fundamentals Protection Profile
(MDFPP).
Note: CC mode is only used if the following additional requirements are met:
• Device encryption is turned on.
• Fast encryption is turned off.
• External storage encryption is turned on.
• The number of failed login attempts until device wipe is set.
• Certificate revocation is turned on.
• Password history is turned off.
14.18.4 Exchange account configuration (Android device policy)
With the Exchange account configuration you set up a connection to a Microsoft Exchange Server mail server.
Setting/Field
Account name
Exchange server
Domain
Description
The account name.
The Exchange server address.
If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.
The domain for this account.
162 Copyright © Sophos Limited
Setting/Field
User
Email address
Sender
Password
Synchronization period
Synchronization interval
SSL/TLS
Default account
Allow all certificates
Client certificate
Allow forwarding emails
Allow use of HTML format
Maximum attachment size in MB
Synchronize content types
Sophos Mobile
Description
The user for this account.
If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.
The email address of the account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
A sender name for this account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The time period used for synchronizing emails.
Only the emails from within the specified period are synchronized to the inbox on the managed device.
The interval between email synchronization processes.
The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
The account is used as the default email account.
Allow all certificates in transfer processes from the email server.
The client certificate for the connection to the
Exchange server.
Allow forwarding of emails.
Allow the use of HTML format in emails.
The maximum size of a single email message.
The content types to be synchronized.
Copyright © Sophos Limited 163
Sophos Mobile
Note
On devices with LG GATE, Samsung Knox, or Sony Enterprise API, the email app is configured automatically. On other Android devices, users receive a message to configure the email app. The configuration details are available in the Sophos Mobile Control app.
Note
For Sony devices with Enterprise API level 6 or earlier, the Exchange account information must match the user assigned to the device.
On these devices, the Sophos Mobile Control app is not able to send the ActiveSync ID to the
Sophos Mobile server. When the device contacts the EAS proxy for the first time, the ActiveSync
ID that the email client sends is not known to Sophos Mobile. To verify the account details, the EAS proxy searches for a device with an unknown ActiveSync ID and an assigned user that matches the user information supplied by the email client. If such a device is found, the ActiveSync ID is assigned to that device and the email request is passed on to the Exchange server. Otherwise, the request is rejected.
For details, see Sophos knowledge base article 121360 .
14.18.5 Wi-Fi configuration (Android device policy)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
Setting/Field
SSID
Security type
Phase 2 authorization
Description
The ID of the Wi-Fi network.
The security type of the Wi-Fi connection:
• None
• WEP
• WPA/WPA2 PSK
• EAP/PEAP
• EAP/TLS
• EAP/TTLS
The authentication method for phase 2 of the
EAP negotiation:
• None
• PAP
• CHAP
• MSCHAP
• MSCHAPv2
This field is available for EAP/PEAP and EAP/
TTLS connections.
164 Copyright © Sophos Limited
Setting/Field
Identity
Anonymous identity
Password
Identity certificate
Trusted certificate
Proxy host
Proxy port
Sophos Mobile
Description
The user identity.
This field is available for EAP connections.
The pseudonym identity sent unencrypted in phase 1 of the EAP negotiation.
This field is available for EAP connections.
The password for the Wi-Fi network.
The identity certificate for the connection to the
Wi-Fi network.
The list includes all certificates from Client
certificate configurations of the current policy.
This field is available for EAP connections.
The root CA for the certificate of the EAP server.
The list includes all certificates from Root
certificate configurations of the current policy.
This field is available for EAP connections.
The name or IP address of a proxy server for the Wi-Fi connection.
The port number of the proxy server.
14.18.6 App Protection configuration (Android device policy)
With the App Protection configuration you define password requirements for protecting apps.
With App Protection in use, users must create a password when they start a protected app for the first time. After a failed login attempt a login delay is imposed.
If App Protection is active on a device, the command Reset App Protection password is available in the Actions menu of the Show device page. The user can also reset the App Protection password in the Self Service Portal.
Setting/Field
Password complexity
Grace period in minutes
Description
The minimum complexity requirements for the password to be defined by users.
After the grace period has expired, protected apps can only be unlocked by entering a password.
Copyright © Sophos Limited 165
Sophos Mobile
Setting/Field
App group
Allow fingerprint authentication
Description
Select the app group containing the apps that are password protected.
For creating app groups, see
(page
312).
Users can use their fingerprint to unlock a protected app.
14.18.7 App Control configuration (Android device policy)
With the App Control configuration you define apps that users are not allowed to start. For example, you can use this to block apps that have been pre-installed by the device manufacturer and cannot be uninstalled.
Setting/Field
App group
Description
Select the app group containing the blocked apps.
For information on creating app groups, see
(page 312).
14.18.8 App permissions configuration (Android)
With the App permissions configuration you configure what happens when an app requests permissions at runtime.
Setting/Field
App-specific runtime permissions
Description
Grant or deny runtime permissions for specific apps.
Click Add to select an app and then select one of the following for each permission:
• Selectable: Users can edit the permission.
• Granted: The permission is granted.
• Denied: The permission is denied.
14.18.9 Kiosk mode configuration (Android device policy)
With the Kiosk mode configuration you define restrictions for devices to put them into a kiosk mode.
Click Select source and then do one of the following to specify an app that is started when the policy is assigned to a device:
• Select Custom and enter an app identifier.
166 Copyright © Sophos Limited
Sophos Mobile
• Select App list and then select an app from the App identifier list. The list contains all apps that
you have configured on the Apps page. See Add app
(page 292).
• Select No app to configure kiosk mode without specifying an app. The kiosk mode restrictions are applied to the device, but no app is started.
Under Options, deselect hardware and software features you want to disable in kiosk mode.
When the policy is assigned to a device, the app that you specified is started. However, if you have not turn off any of the available hardware or software features, the user will be able to leave the app and use the device as normal. To set the device into a true kiosk mode, you must clear at least the
Allow Home button and Allow task manager check boxes.
Note
• The app that you specify must be installed on the device. If it is not, the transfer tasks will remain in state Incomplete until the app is installed. To install the app, create a task bundle with an Install app task, for example, and transfer it to your devices.
• For Sony devices with Enterprise API level 9 or later, if you clear any of the Allow volume
up, Allow volume down or Allow volume mute check boxes, all volume buttons of the device are disabled.
14.18.10 Access Point Name configuration (Android device policy)
With the Access Point Name configuration you specify an Access Point Name (APN) configuration for mobile devices. APN configurations define how devices connect to a mobile network.
CAUTION
We recommend that you ask your carrier for the required settings. If you select Use as default
APN and the settings are not correct, the device can’t access data through cellular networks.
Note
With the exception of the APN field, all settings are optional and should only be specified if required by your mobile network carrier.
Setting/Field
APN
User-friendly name
Server
Description
The APN that the device quotes when it opens a connection with the carrier.
This must match an APN that the carrier accepts. Otherwise, the connection cannot be established.
An optional name that is displayed on the device in addition to the APN.
The address of the HTTP server that is used for web traffic.
Copyright © Sophos Limited 167
Sophos Mobile
Setting/Field
Port
User name, User password
Server
MMSC
Use as default APN
Description
The port of the HTTP server that is used for web traffic.
A user name and password for connecting to the APN.
The WAP Gateway Server.
The Multimedia Messaging Service Center
(MMSC).
MMS proxy server, MMS proxy port
Mobile Country Code (MCC), Mobile Network
Code (MNC)
The address and port of a HTTP server that is used for communication with the MMSC.
MCC and MNC for specifying the carrier.
The APN is only used for this carrier.
Authentication type
APN type
Bearer
Protocol
The authentication method for PPP connections.
The types of data connection that this APN is used for.
To use the APN for all data types, enter * or leave the field empty.
The Radio Access Technology (RAT) that the carrier uses.
The network protocol that is supported by the carrier.
Roaming protocol The network protocol that is supported by the carrier when in roaming mode.
If selected, devices will use this APN as default.
An error is raised when you try to select this option in more than one Access Point Name configuration.
14.18.11 VPN configuration (Android device policy)
With the VPN configuration you define VPN settings for network connections.
Setting/Field Description
Connection name The name of the connection shown on the device.
Server The host name or the IP address of the server.
168 Copyright © Sophos Limited
Sophos Mobile
Setting/Field
Connection type
Description
The type of the VPN connection:
• L2TP/IPsec (PSK)
If you select this type, the fields User, Password and L2TP/IPsec
(PSK) are displayed. Enter the user and password. In the L2TP/IPsec
(PSK) field, enter the pre-shared key for authentication.
• L2TP/IPsec (certificate)
If you select this type, the fields Client certificate, Root certificate,
User and Password are displayed. In the fields Client certificate and
Root certificate, select the relevant certificates. In addition, enter the
User and the relevant Password.
• Cisco AnyConnect
If you select this type, you can upload XML files with an AnyConnect
VPN profile and/or an NVM (Network Visibility Module) profile. See the
Cisco AnyConnect administrator guide for information on these profiles.
14.18.12 Root certificate configuration (Android device policy)
With the Root certificate configuration you install a root certificate onto devices.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.18.13 Client certificate configuration (Android device policy)
With the Client certificate configuration you install a client certificate onto devices.
Setting
File
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
Copyright © Sophos Limited 169
Sophos Mobile
Setting
Certificate name
Description
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.18.14 SCEP configuration (Android device policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).
Note
You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.
Setting/Field
URL
Alias name
Description
The web address of the Certificate Authority server.
Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the
SCEP tab of the Sophos setup page.
The name under which the certificate will appear in selection dialogs.
This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.
170 Copyright © Sophos Limited
Setting/Field
Subject
Type of Subject Alternative Name
Value of Subject Alternative Name
AD user logon name
Challenge
Root certificate
Key size
Sophos Mobile
Description
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid
X.500 name.
For example:
• Enter CN=%_USERNAME_% to specify a user.
• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.
For information on available placeholders, see
Placeholders in policies (page 106).
To add a Subject Alternative Name (SAN) to the
SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:
• RFC 822 name: A valid email address.
• DNS name: The DNS name of the CA server.
• Uniform resource identifier: The fully qualified
URL of the CA server.
The User logon name value set in Active
Directory, i.e. the user’s User Principal Name
(UPN).
The web address to obtain a challenge password from the SCEP server.
Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the
SCEP tab of the Sophos setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
Copyright © Sophos Limited 171
Sophos Mobile
Setting/Field
Key usage
Description
Select what the certificate can be used for.
Use as digital signature: The certificate can be used as a digital signature.
Use for encryption: The certificate can be used for data encryption.
14.19 Configurations for Knox container policies
With a Knox container policy you configure settings for the Knox container on Samsung devices.
14.19.1 Password policies configuration (Knox container policy)
With the Password policies configuration you define requirements for the Knox container password.
Note
The settings supported may depend on the version of the operating system or on other device features. This is indicated by blue labels in Sophos Mobile Admin.
Password type
In the Password type list, select the type of password users are allowed to configure:
Setting/Field
Pattern, PIN or password
Simple password
PIN or password
Alphanumeric password
Description
Users must set a screen lock. They can choose a type Pattern, PIN or Password screen lock.
No additional restrictions are imposed.
Users must set a Password screen lock. Digits are allowed, but the password must contain at least one letter. You can define a minimum length. See the following table.
Users must set a PIN or Password screen lock. You can define a minimum length. See the following table.
Users must set a Password screen lock. The password must contain both letters and digits.
You can define a minimum length. See the following table.
172 Copyright © Sophos Limited
Sophos Mobile
Setting/Field
Complex password
Description
Users must set a Password screen lock.
The password must contain both letters and digits. You can define a minimum length and a minimum number of digits, lowercase and uppercase letters and special characters. See the following two tables.
If you select Simple password, PIN or password, Alphanumeric password or Complex
password, the following fields are displayed:
Setting/Field
Minimum password length
Description
The minimum number of characters a password must contain.
Maximum idle time before password prompt The time after the Knox container is locked if it has not been used. The container can be unlocked by entering the password.
Note
The device might impose a shorter time period than what you configure here.
Maximum password age in days
Maximum sign-in attempts
Password history
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
The Knox container is deleted after this number of incorrect sign-in attempts.
The number of previously used passwords
Sophos Mobile stores.
When the user sets a new password, it mustn’t match a password that was already used.
If you select Complex password, the following additional fields are displayed:
Setting/Field
Minimum number of letters
Minimum number of lowercase letters
Minimum number of uppercase letters
Description
The minimum number of letters a password must contain.
The minimum number of lowercase letters a password must contain.
The minimum number of uppercase letters a password must contain.
Copyright © Sophos Limited 173
Sophos Mobile
Setting/Field
Minimum number of non-alphabetic characters
Minimum number of digits
Minimum number of special characters
Description
The minimum number of non-alphabetic characters (for example & or !) a password must contain.
The minimum number of numerals a password must contain.
The minimum number of special characters (for example !"§$%&/()=,.-;:_@<>) a password must contain.
Biometric authentication
Setting/Field
Allow fingerprint authentication
Allow iris authentication
Allow face authentication
Description
If supported by the device, the user can use fingerprint authentication to unlock the Knox container.
If supported by the device, the user can use iris authentication to unlock the Knox container.
If supported by the device, the user can use face authentication to unlock the Knox container.
14.19.2 Restrictions configuration (Knox container policy)
With the Restrictions configuration you configure restrictions and related settings for the Knox container of Samsung devices.
Setting/Field
Allow screen capture
Allow camera
Allow clipboard
Allow "Share via"
Allow microphone
Enforce the use of the secure keypad
Description
Users can capture the screen content of apps inside the Samsung Knox container.
Apps inside the Samsung Knox container can access the camera.
Users can copy any contents to the clipboard.
The Share via feature that certain apps use is turned on.
Apps inside the Samsung Knox container can access the microphone.
Users must use the secure keypad.
174 Copyright © Sophos Limited
Sophos Mobile
Setting/Field
Allow addition of new email accounts
Allow data export
Allow copying files into the container
Allow Bluetooth
Allow NFC
Enforce multi-factor authentication
Allowed apps / Forbidden apps
Description
Users can add email accounts beyond the accounts that are configured by a Sophos Mobile policy.
Private apps can access data from within the Samsung
Knox container.
Private files can be copied or moved into the Samsung
Knox container.
Apps inside the Samsung Knox container can use
Bluetooth connections.
Apps inside the Samsung Knox container can use NFC
(near-field communication) connections.
More than one authentication method is required to unlock the Samsung Knox container, for example password and fingerprint.
You can configure either Allowed apps or Forbidden
apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.
App installations initiated by the Sophos Mobile server are not restricted by this setting.
For information on creating app groups, see
(page 312).
14.19.3 Exchange account configuration (Knox container policy)
With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server. These settings are applied to the Samsung Knox container.
Setting/Field
Account name
Exchange server
Domain
User
Description
The account name.
The Exchange server address.
If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.
The domain for this account.
The user for this account.
If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.
Copyright © Sophos Limited 175
Sophos Mobile
176
Setting/Field
Email address
Sender
Password
Synchronization period
Synchronization interval
SSL/TLS
Default account
Allow all certificates
Allow forwarding from other accounts
Allow use of HTML format
Maximum attachment size in MB
Synchronize content types
Description
The email address of the account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
A sender name for this account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The time period used for synchronizing emails.
Only the emails from within the specified period are synchronized to the inbox on the managed device.
The interval between email synchronization processes.
The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
The account is used as the default email account.
Allow all certificates in transfer processes from the email server.
This account can be used to forward emails received by another account.
For example if we call this account A and there exists another account B in the Knox container, an email message received by account B can be forwarded using account A as sender.
Note
This setting is only used by the native Android email app.
Allow the use of HTML format in emails.
The maximum size of a single email message.
The content types to be synchronized.
Copyright © Sophos Limited
Sophos Mobile
14.20 Configurations for iOS device policies
With an iOS device policy you configure settings for iPhones and iPads.
14.20.1 Password policies configuration (iOS device policy)
With the Password policies configuration you define requirements for the device password.
Note
When the Password policies configuration is assigned to a device, a grace period of 60 minutes starts. Within the grace period, the user is asked to change the password when they return to the
Home screen to comply with the policies. After the grace period, the user may not start any apps on the device, including internal apps.
Setting/Field
Allow simple value
Require alphanumeric value
Minimum password length
Minimum number of complex characters
Maximum password age in days
Maximum Auto-Lock (in minutes)
Password history
Description
Users are allowed to use sequential or repeated characters in their password, for example 1111 or abcde .
Passwords must contain at least one letter or number.
Specifies the minimum number of characters a password must contain.
Specifies the minimum number of nonalphanumeric characters (for example & or !) a password must contain.
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
In this field, you can specify the maximum value the user is allowed to configure on the device. Auto-Lock specifies how soon (in minutes) the device will be locked if it has not been used.
The number of previously used passwords
Sophos Mobile stores.
When the user sets a new password, it mustn’t match a password that was already used.
Copyright © Sophos Limited 177
Sophos Mobile
Setting/Field
Maximum grace period for device lock
Number of failed attempts until device wipe
Description
In this field, you can specify the maximum value the user is allowed to configure on the device. The grace period for device lock specifies for how long the device can be unlocked after a lock without a password prompt. If you select None, the user can select any of the intervals available. If you select
Immediately, users must enter a password every time they unlock their devices.
In this field, you can specify the number of failed attempts to enter the correct password before the device is wiped. After six failed attempts, a time delay is imposed before a password can be entered again. The delay increases with each failed attempt. After the final failed attempt, all data and settings are securely removed from the device. The time delay starts after the sixth attempt. So if you set this value to 6 or lower, no delay is imposed and the device is wiped when the attempt limit is exceeded.
14.20.2 Restrictions configuration (iOS device policy)
With the Restrictions configuration you define restrictions for devices.
Note
Some options are only available for certain versions of iOS or for supervised devices. This is indicated by blue labels in Sophos Mobile Admin.
Device
Setting/Field
Allow app installation
Allow app installation from device UI
Description
If the check box is cleared, the App Store is unavailable and its icon is removed from the Home screen. Users can’t install or update apps from the App
Store or Apple Configurator.
If the check box is cleared, the App Store is unavailable and its icon is removed from the Home screen. Users can still install or update apps from
Apple Configurator.
178 Copyright © Sophos Limited
Sophos Mobile
Setting/Field
Allow use of camera
Allow FaceTime
Allow screen capture
Allow automatic sync while roaming
Allow Siri
Allow Siri while device is locked
Description
If the check box is cleared, the camera is unavailable and the Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.
Users can place or receive FaceTime video calls.
Users can take a screenshot of the display.
If the check box is cleared, devices that are roaming will only sync when the user accesses an account.
If the check box is cleared, users cannot use Siri, voice commands, or dictation.
If the check box is cleared, users must unlock their devices by entering their password before they use
Siri.
Allow Siri querying content from the web
Force Siri explicit language filter
Allow adding Game Center friends
Allow find my friends modification
If the check box is cleared, Siri does not query content from the web.
If the check box is cleared, the Siri filter for explicit language is not enforced on the device.
Allow voice dialing while device is locked
If the check box is cleared, users cannot dial by using voice commands when the device is locked by a password.
If the user has not configured a device password, voice dialing is always allowed.
Passbook notifications are displayed when the device is locked.
Allow Passbook while device is locked
Allow in-app purchase Users can make in-app purchases.
Force user to enter store password for all purchases
Users must enter their Apple ID password to make any purchase.
If the check box is cleared, there is a brief grace period during which users can make subsequent purchases without having to enter their password again.
Allow multiplayer gaming
Allow Game Center
Users can play multi-player games in Game Center.
If the check box is cleared, Game Center is unavailable.
Users can add friends in Game Center.
If the check box is cleared, modifications to the Find my Friends app are unavailable.
Copyright © Sophos Limited 179
Sophos Mobile
Setting/Field
Allow host pairing
Allow pairing with Apple Watch
Force Wrist Detection
Allow AirDrop
Allow Control Center on lock screen
Allow Notification Center on lock screen
Allow Today view on lock screen
Allow News
Allow over-the-air PKI updates
Allow iBooks Store
Allow explicit sexual content in iBooks Store
Allow user to install configuration profiles
Allow iMessage
Description
If the check box is cleared, you can only pair the device with Macs you’ve configured for device supervision.
If the check box is cleared, users cannot pair the device with an Apple Watch. Any currently paired
Apple Watch is unpaired.
A paired Apple Watch must use Wrist Detection.
Content sharing with AirDrop is turned on.
If the check box is cleared, the Control Center is unavailable when the device screen is locked.
If the check box is cleared, the Notification Center is unavailable when the device screen is locked.
If the check box is cleared, the Today view is unavailable when the device screen is locked.
The News app is available.
Over-the-air PKI updates are possible.
Users can purchase books in iBooks.
If the check box is cleared, explicit sexual content through iBooks Store is blocked.
Users can install configuration profiles.
Allow app removal
Allow system app removal
Allow erase all contents and settings
Allow internet search result for
Spotlight
Allow enabling of restrictions option
Users can use iMessage to send or receive text messages.
Users can uninstall apps from the device.
Users can uninstall system apps from the device.
If the check box is cleared, the Erase all Content And
Settings option in the Reset UI is unavailable.
If the check box is cleared, Spotlight does not return internet search results.
If the check box is cleared, the Enable Restrictions option in the Reset UI is unavailable.
180 Copyright © Sophos Limited
Sophos Mobile
Setting/Field
Allow Handoff
Allow device name modification
Allow wallpaper modification
Allow changing notification settings
Allow keyboard shortcuts
Allow dictation for keyboard input
Allow predictive keyboard
Allow auto-correction
Allow spell check
Allow automatic app download
Allow Apple Music
Allow Apple Music Radio
Allow modification of Bluetooth settings
Allow VPN creation
Force automatic date and time iOS software update delay
Description
Users can use the Apple Continuity feature Handoff.
With Handoff, users can start to work on a document, email or message on one device and continue from another device.
Users can change the device name.
Users can change the wallpaper.
Users can change the notification settings.
Users can use keyboard shortcuts.
Users can turn on the Enable Dictation keyboard setting.
Users can turn on the Predictive keyboard setting.
Users can turn on the Auto-Correction keyboard setting.
Users can turn on the Check Spelling keyboard setting.
If the check box is cleared, the automatic downloading of apps purchased on other devices is turned off. This does not affect updates to existing apps.
Users can access the Apple Music library.
Users can access Apple Music Radio.
Users can modify the Bluetooth settings.
Users can add VPN configurations.
The iOS Date & Time setting Set Automatically is turned on and can’t be turned off by the user.
The number of days that an update of the iOS software is delayed after its release date.
Enter a value from 0 (no delay) to 90.
Copyright © Sophos Limited 181
Sophos Mobile
Company data
Setting/Field
Allow documents to be shared only within managed apps/accounts
Allow managed apps to write contacts to unmanaged accounts
Allow unmanaged apps to read contacts from managed accounts
Allow documents to be shared only within unmanaged apps/accounts
Description
This restricts the opening of documents with apps or accounts managed by Sophos Mobile, for example a corporate email account.
If users have an email account managed by Sophos
Mobile and apps managed by Sophos Mobile on their devices, attachments from the managed email account can only be opened with managed apps.
In this way you can prevent corporate documents from being opened in unmanaged apps.
If you turn this setting off, the next two settings are disabled. Contacts from managed accounts can be shared with unmanaged apps.
Managed apps can write contacts to unmanaged accounts.
Unmanaged apps can read contacts from managed accounts.
This restricts the opening of documents with apps/ accounts not managed by Sophos Mobile, for example a private email account.
If users have an email account and apps not managed by Sophos Mobile on their devices, attachments from the unmanaged email account can only be opened with unmanaged apps.
In this way you can prevent personal documents from being opened in managed apps.
AirDrop is considered an unmanaged drop target.
Force AirDrop documents to be used as unmanaged documents
Allow managed apps to sync with iCloud
Allow backup for enterprise books
Allow enterprise books notes and highlights sync
Managed apps can use iCloud synchronization.
Enterprise books are backed up.
Enterprise books notes and highlights are synchronized.
182 Copyright © Sophos Limited
Sophos Mobile
Applications
Setting/Field
Allow use of the iTunes Store
Allow use of Safari
Enable auto-fill
Force fraud warning
Block pop-ups
Allow JavaScript in browser
Accept cookies
Allow modification of cellular data usage per app
Allowed apps / Forbidden apps
Description
If the check box is cleared, the iTunes Store is unavailable and its icon is removed from the Home screen. Users cannot preview, purchase or download content.
If the check box is cleared, the Safari web browser is unavailable and its icon is removed from the Home screen. This also prevents users from opening Web
Clips.
If the check box is cleared, Safari does not auto-fill web forms with previously entered information.
The Safari security setting to warn the user when they visit a suspected phishing website is always turned on.
The Safari pop-up blocker is turned on.
Web pages can execute JavaScript code on the device.
In this field, you specify if Safari accepts cookies.
When you allow cookies, you can specify if only cookies from the current site, from previously visited sites, or from all sites are accepted.
Users can change the cellular data usage per app.
You can specify either Allowed apps or Forbidden
apps. Select the desired option from the first list and then select the app group containing the apps that should be allowed or forbidden from the second list.
For information on creating app groups, see App groups
(page 312).
iCloud
Setting/Field
Allow backup
Allow document sync
Description
Users can back up their devices to iCloud.
Users can store documents and app configuration data in iCloud.
Copyright © Sophos Limited 183
Sophos Mobile
Setting/Field
Allow Photo Stream
Allow iCloud Photo Library
Allow shared photo streams
Allow iCloud Keychain sync
Description
Users can upload photos to My Photo Stream.
CAUTION
If you clear the check box to forbid My Photo
Stream, this also removes existing photos shared via My Photo Stream from all devices. If there are no other copies of these photos, they are lost.
Users can use iCloud Photo Library.
Users can invite others to view their photo streams and can view photo streams shared by others.
Users can use iCloud Keychain to synchronize passwords across their iPhones, iPads, and Macs.
If the check box is cleared, iCloud Keychain data is only stored locally on the device.
184
Security and privacy
Setting/Field
Allow diagnostic data to be sent to
Apple
Allow user to accept untrusted TLS certificates
Trust enterprise apps
Allow password modification
Allow account modification
Allow Touch ID to unlock device
Force limit ad-tracking
Force encrypted backups
Force configured Wi-Fi networks
Description
If the check box is cleared, iOS diagnostic information is not sent to Apple.
If the check box is cleared, users are not asked if they want to trust certificates that cannot be verified.
This setting applies to Safari and to Mail contacts and
Calendar accounts.
Enterprise apps are trusted.
Users can add, change or remove the device password.
If the check box is cleared, users cannot modify accounts. The Accounts menu is unavailable.
If the check box is cleared, the device can’t be unlocked by Touch ID.
Anonymous user data apps used for targeting ads are no longer provided.
Users must encrypt backups in iTunes.
Devices can only connect to Wi-Fi networks that have been configured by a Sophos Mobile policy.
Copyright © Sophos Limited
Sophos Mobile
Setting/Field
Allow AirPrint
Allow AirPrint credentials storage
Allow iBeacon discovery of AirPrint printers
Description
Users can send files to AirPrint-enabled printers.
The AirPrint user name and password can be stored in the system keychain.
The device uses iBeacon to discover AirPrint devices.
Warning
If you allow this, malicious AirPrint devices can perform phishing attacks on network traffic.
Force trusted certificates for AirPrint over TLS
Allow Quick Start transfer to new device
Allow password auto-fill
Force authentication before auto-fill
AirPrint over TLS is rejected if the AirPrint device uses an untrusted certificate.
The user can transfer data from the device to a new device, using the Quick Start feature of the iOS Setup
Assistant.
Users can turn on the AutoFill Passwords setting, which lets them use saved password or credit card information in Safari or other apps.
If this check box is cleared, automatic suggestion of strong passwords is disabled as well.
Users must authenticate when using auto-fill.
This setting is only enforced on devices that support
Face ID or Touch ID.
Request Wi-Fi passwords from nearby devices
Allow AirDrop password sharing
The device requests passwords from nearby devices when setting up a Wi-Fi connection.
Users can share passwords from Password Manager with other users via AirDrop.
Content ratings
Setting/Field
Allow explicit music and podcasts
Description
If the check box is cleared, explicit music or video content is hidden in the iTunes Store. Explicit content is flagged by content providers, for example record labels, when listed on the iTunes Store.
Related tasks
(page 77)
Copyright © Sophos Limited 185
Sophos Mobile
You can configure Macs that are allowed to supervise your iOS DEP devices. These Macs can pair with an iOS DEP device even if you block USB pairing in general.
14.20.3 Exchange account configuration (iOS device policy)
With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server.
Setting/Field
Account name
Exchange server
Domain
User
Email address
Password
OAuth
Synchronization period
SSL/TLS
Allow move
Allow recent address syncing
Description
The account name.
The Exchange server address.
If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.
The domain for this account.
The user for this account.
If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.
The email address of the account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The account uses OAuth for authentication, i.e.
users authenticate with their Microsoft credentials.
The time period used for synchronizing emails.
Only the emails from within the specified period are synchronized to the inbox on the managed device.
The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
Users can move emails from this account to another. This also allows users to use a different account when replying to or forwarding a message from this account.
The account is included in the syncing of recently used addresses with other devices using iCloud.
186 Copyright © Sophos Limited
Setting/Field
Use in Mail only
Identity certificate
Enable S/MIME
Signing certificate
Encryption certificate
Allow user to send unencrypted emails
Sophos Mobile
Description
The account can only be used to send messages from the Mail app. It cannot be selected as a sending account for messages created with other apps, for example Photos or Safari.
Select the identity certificate for the connection to the Exchange server.
The list includes all certificates from Client
certificate configurations of the current policy.
Support the S/MIME encryption standard.
The certificates that are used for email signing and encryption.
To select a certificate, you must first upload it in a Client certificate configuration of the current policy.
For each outgoing email, the user can choose to encrypt it or not.
14.20.4 Wi-Fi configuration (iOS device policy)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
Setting/Field
SSID
Connect automatically
Hidden network
Description
The ID of the Wi-Fi network.
Automatically connect to the target network.
The target network is not open or visible.
Copyright © Sophos Limited 187
Sophos Mobile
Setting/Field
Security type
188
Description
The security type of the Wi-Fi network:
• None
• WEP (personal)
• WPA/WPA2 (personal)
• Any (personal)
• WEP (enterprise)
• WPA/WPA2 (enterprise)
• Any (enterprise)
If you select a type with Personal in its name, a
Password field is displayed. Enter the relevant password.
If you select a type with Enterprise in its name, the tabs Protocols, Authentication and Trust are displayed.
On the Protocols tab configure the following:
• Under Accepted EAP types, select the EAP methods to be used for authentication. Depending on the types selected on this tab, the values in the Internal identity field on this tab become available for selection.
• Under EAP-FAST, configure the EAP-FAST Protected
Access credential settings.
• In TLS minimum version and TLS maximum version, select a minimum and a maximum TLS version to be used with EAP authentication.
On the Authentication tab, configure client authentication settings:
• In the User field, enter the user name for the connection to the Wi-Fi network.
• Select Require password on each connect, if the password is to be queried for each connection and transferred with the authentication.
• In the Password field, enter the relevant password.
• In the Identity certificate list, select the certificate for the connection to the Wi-Fi network.
Note
The certificate to be used has to be specified in a
Client certificate configuration.
• In the External identity field, enter the externally visible
ID (for TTLS, PEAP and EAP-FAST).
On the Trust tab, configure server authentication settings:
Select the trusted certificates from the list.
Note
certificate configuration.
Setting/Field
Proxy
Sophos Mobile
Description
In this list, select the proxy settings for the Wi-Fi connection:
• No proxy
• Manually
• Automatic
If you select Manually, the fields Server, Port,
Authentication and Password are displayed.
Enter the required proxy information. If you select
Automatic, the field PAC URL is displayed. Enter the URL of the proxy server.
14.20.5 Single app mode configuration (iOS device policy)
With the Single app mode configuration you define settings for the operation mode that locks devices into a single app and prevents users from changing to other apps.
Setting/Field
Select source
App identifier
Disable touchscreen
Disable rotation
Disable volume buttons
Disable ringer switch
Disable sleep wake button
Disable Auto-Lock
Enable VoiceOver
Enable Zoom
Enable Invert Colors
Enable AssistiveTouch
Description
Select how you want to specify the app for the single app mode:
• App list: Select the app from a list of all available iOS apps.
• Custom: Manually enter the bundle ID of the app.
The app for the single app mode.
Either select an app from the list or enter a bundle ID.
Touch gestures are unavailable.
The screen does not rotate.
Volume buttons are unavailable.
The ringer switch is unavailable.
The wake button is unavailable.
The Auto-Lock feature that puts the device into sleep after an idle period is turned off.
VoiceOver is available.
The Zoom feature is available.
The Invert Colors feature is available.
AssistiveTouch is available.
Copyright © Sophos Limited 189
Sophos Mobile
Setting/Field
Enable Speak Selection
Enable Mono Audio
VoiceOver
Zoom
Invert Colors
AssistiveTouch
Description
The Speak Selection feature is available.
The Mono Audio feature is available.
VoiceOver adjustments are available.
Zoom adjustment are available.
Invert Colors adjustment are available.
AssistiveTouch adjustment are available.
14.20.6 Access Point Name configuration (iOS device policy)
With the Access Point Name configuration you specify an Access Point Name (APN) configuration for iOS devices. APN configurations define how devices connect to a mobile network.
Note
The Access Point Name configuration is deprecated in favor of the Cellular configuration. See
Cellular configuration (iOS device policy)
(page 191).
CAUTION
If these settings are not correct, the device can’t access data using the cellular network. To undo settings changes, the policy must be removed from the device.
Setting/Field
APN
User name for access point
Password for access point
Description
The APN that the device quotes when it opens a GPRS connection with the carrier.
This must match an APN that the carrier accepts. Otherwise, the connection cannot be established.
The user name for the access point.
Note iOS supports APN user names of up to 64 characters.
The password for the access point.
Note iOS supports APN passwords of up to 64 characters.
190 Copyright © Sophos Limited
Setting/Field
Server, Port
Sophos Mobile
Description
The address and port of the proxy server.
14.20.7 Roaming/Hotspot configuration (iOS device policy)
With the Roaming/Hotspot configuration you define settings for roaming and personal hotspots.
Note
Users can change these settings on their devices anytime.
Setting/Field
Enable voice roaming
Enable data roaming
Enable personal hotspot
Description
Voice roaming is available.
This setting is ignored if the mobile network operator doesn’t support voice roaming.
Data roaming is available.
The user can configure the device to serve as a personal hotspot.
This setting is ignored if the mobile network operator doesn’t support personal hotspots.
14.20.8 Cellular configuration (iOS device policy)
With the Cellular configuration you define cellular network settings for iOS devices.
Note
A Cellular configuration cannot be installed onto a device if an Access Point Name configuration is already installed.
Setting/Field
Authentication
APN
Description
PAP
CHAP
The APN that the device quotes when it opens a GPRS connection with the carrier.
This must match an APN that the carrier accepts. Otherwise, the connection cannot be established.
Copyright © Sophos Limited 191
Sophos Mobile
Setting/Field
User name for access point
Password for access point
Server, Port
Description
The user name for the access point.
Note iOS supports APN user names of up to 64 characters.
The password for the access point.
Note iOS supports APN passwords of up to 64 characters.
The address and port of the proxy server.
14.20.9 Network usage rules configuration (iOS device policy)
With the Network usage rules configuration you specify how managed apps are allowed to use cellular data networks.
General rules
Under Rules for all managed apps, enter the settings for managed apps in general.
Setting/Field
Allow cellular data
Allow data roaming
Description
Managed apps are allowed to use data communication over cellular networks.
Managed apps are allowed to use data communication while the device is roaming on a foreign cellular network.
Exceptions
Exceptions override the general rules. Use Add exception to define rules that are specific to an app group.
Setting/Field
App group
Allow cellular data
Description
Select an app group.
The exception applies to all managed apps in that group.
Managed apps from the selected app group are allowed to use data communication over cellular networks.
192 Copyright © Sophos Limited
Setting/Field
Allow data roaming
Sophos Mobile
Description
Managed apps from the selected app group are allowed to use data communication while the device is roaming on a foreign cellular network.
Note
You cannot define multiple exceptions for the same app group.
14.20.10 VPN configuration (iOS device policy)
With the VPN configuration you define VPN settings for network connections.
Setting/Field
Connection name
Connection type
Identifier (reverse DNS format)
Server
Account
Third-party settings
Send all traffic through VPN
Group
Description
The name of the connection shown on the device.
The type of the VPN connection:
• Cisco AnyConnect
• Cisco Legacy AnyConnect
• IPsec (Cisco)
• F5
• Check Point
• Custom SSL/TLS
Different entry fields are shown on the VPN page depending on the connection type you select here.
The custom identifier in reverse DNS format.
The host name or the IP address of the server.
The user account for the authentication of the connection.
If your vendor has specified custom connection properties, you can enter them in this field.
To enter a property, click Add and then enter
Key and Value of the property in the dialog box.
All traffic is sent through VPN.
The group that may be required for the authentication of the connection.
Copyright © Sophos Limited 193
Sophos Mobile
194
Setting/Field
User authentication
Device authentication
Proxy
Description
The type of user authentication for the connection:
• Password
If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.
• Certificate
If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.
The type of device authentication:
• Keys (Shared Secret)/Group name
If you select this option, the fields Group
name, Keys (Shared Secret), Use hybrid
authentication and Request password are displayed below the Device authentication field. Enter the required authentication information in the Group name and Keys
(Shared Secret) fields. Select Use hybrid
authentication and Request password as required.
• Certificate
If you select this option, the fields
Certificate and Including user PIN are displayed below the Device authentication field. In the Certificate list, select the required certificate. Select Including user
PIN to include the user PIN in device authentication.
The proxy settings for the connection:
• No proxy
• Manually
If you select this option, the fields Server
and port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the Password field, enter the password for the connection to the proxy server.
• Automatic
If you select this option, the Proxy server
URL field is displayed. Enter the URL of the server with the proxy setting in this field.
Copyright © Sophos Limited
Setting/Field
Provider type
Sophos Mobile
Description
The VPN connection type.
• App proxy: Network traffic is sent through a
VPN tunnel at the application layer.
• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.
14.20.11 Per app VPN configuration (iOS device policy)
With the Per app VPN configuration you define VPN settings for individual apps.
You can configure apps to automatically connect to VPN when they are started. So you can, for example, ensure that data transmitted by managed apps travels through VPN.
After you have set up per app VPN configurations, you can select a configuration on the Edit
package page of an app. See Assign a VPN connection to an iOS app
(page 310).
Setting/Field
Connection name
Connection type
Identifier (reverse DNS format)
Server
Account
Third-party settings
Send all traffic through VPN
Group
Description
The name of the connection shown on the device.
The type of the VPN connection:
• Cisco AnyConnect
• Cisco Legacy AnyConnect
• F5
• Check Point
• Custom SSL/TLS
Different entry fields are shown on the VPN page depending on the connection type you select here.
The custom identifier in reverse DNS format.
The host name or the IP address of the server.
The user account for the authentication of the connection.
If your vendor has specified custom connection properties, you can enter them in this field.
To enter a property, click Add and then enter
Key and Value of the property in the dialog box.
All traffic is sent through VPN.
The group that may be required for the authentication of the connection.
Copyright © Sophos Limited 195
Sophos Mobile
Setting/Field
User authentication
Proxy
Provider type
Description
The type of user authentication for the connection:
• Password
If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.
• Certificate
If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.
The proxy settings for the connection:
• No proxy
• Manually
If you select this option, the fields Server
and port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the Password field, enter the password for the connection to the proxy server.
• Automatic
If you select this option, the Proxy server
URL field is displayed. Enter the URL of the server with the proxy setting in this field.
The VPN connection type.
• App proxy: Network traffic is sent through a
VPN tunnel at the application layer.
• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.
196 Copyright © Sophos Limited
Setting/Field
Safari domains
Sophos Mobile
Description
In this field, you can enter a list of domain strings. Use a new line for each domain string.
When a domain that matches one of the domain strings is opened in Safari or another browser app, the VPN connection is triggered.
The rule matching behavior is as follows:
• Leading and trailing dots are ignored.
For example, the string .example.com
matches the same domains as the string example.com
.
• Each string component must match a whole domain component. For example, the string example.com
matches the domain www.example.com
, but not www.myexample.com
.
• Strings with a single component only match that specific domain. For example, the string example matches the domain example , but not www.example.com
.
14.20.12 Web Clip configuration (iOS device policy)
With the Web Clip configuration you define Web Clips to be added to the Home screen of user devices. Web Clips provide fast access to favorite web pages. But you can also add a Web Clip with a support phone number for example, to provide a quick way to dial the helpdesk.
Setting/Field
Description
URL
Can be removed
Full screen
Description
A description for the Web Clip.
The web address of the Web Clip.
If the check box is cleared, the user cannot remove the Web Clip. It cannot be deleted from the device unless the user removes the policy that installed it.
The Web Clip is opened full screen on the device. A full screen Web Clip opens the URL as a web app.
Copyright © Sophos Limited 197
Sophos Mobile
Setting/Field
Icon
Description
Select an image to be used as the Web Clip icon on the Home screen. This must be a PNG,
GIF or JPEG image with a maximum file size of
1 MB.
The image is cropped to a square and scaled to match the display resolution. For best results, we recommend that you use an image of size
180 px by 180 px.
Note
When a favicon is defined in the HTML code of the web page, the device might display that favicon as Web Clip icon. This happens for certain web pages only, depending on how the favicon is configured in the web page code.
14.20.13 Wallpaper configuration (iOS device policy)
With the Wallpaper configuration you define background images for the lock screen and/or the Home screen of iOS devices.
Setting/Field
Apply to
Image
Description
Select whether the image is used for the Lock screen, for the
Home Screen, or both.
Select a PNG or JPEG image with a maximum file size of 5 MB that is used for the wallpaper.
iOS crops and scales the image as required. For best results, use the following image sizes (in pixels):
• 640 × 1136 (iPhone 5)
• 750 × 1334 (iPhone 6/7)
• 1242 × 2208 (iPhone 6/7 Plus)
• 1536 × 2048 (iPad, iPad mini, iPad Air)
• 2048 × 2732 (iPad Pro)
Note
Users can change the wallpaper at any time.
198 Copyright © Sophos Limited
Sophos Mobile
14.20.14 Web content filter configuration (iOS device policy)
With the Web content filter configuration you define blocked URLs and allowed URLs with bookmarks.
Setting/Field
Blocked URLs
Allowed URLs with bookmarks
Block adult content
Description
Select this to configure URLs users are not allowed to access.
Enter one URL per line.
Select this to configure allowed URLs with bookmarks for the Safari browser.
Other URLs will be blocked.
On the Web content filter page, use this to turn on an Apple filter that blocks adult content.
For example, web pages that contain swearing or sexually explicit language.
14.20.15 Global HTTP proxy configuration (iOS device policy)
With the Global HTTP proxy configuration you define a corporate proxy server.
Setting/Field
Proxy
Server
Port
Authentication
Password
PAC URL
Description
Select Manually to configure the connection details manually.
Select Automatic if you have a proxy auto-config (PAC) file.
The name (or the IP address) of the HTTP proxy.
The port number of the HTTP proxy.
The user name to connect to the proxy server.
The password to connect to the proxy server.
The URL of the proxy auto-config (PAC) file.
14.20.16 Managed domains configuration (iOS device policy)
With the Managed domains configuration you define managed domains for iOS devices.
Email domains
Enter email domains managed by your organization. Email messages from an address that doesn’t match one of the configured domains are highlighted as out-of-domain in the Mail app.
Copyright © Sophos Limited 199
Sophos Mobile
Web domains
Files downloaded from one of the configured domains are treated as managed documents. If you activate the Allow documents to be shared only within managed apps/accounts restriction, these documents can only be opened by managed apps.
For information on managed apps, see
Managed apps for iOS (page 304).
Note
If a managed web domain entry contains a port number, only addresses that specify that port number will be considered managed. Otherwise, only the standard ports will be considered managed (port 80 for http and 443 for https).
14.20.17 CalDAV configuration (iOS device policy)
With the CalDAV configuration you configure the synchronization of calendar data with a CalDAV server. For example, this can be used to sync Google Calendar with an iOS device.
Setting/Field
Account name
Server
Port
Principal URL
User name, Password
SSL/TLS
Description
The display name of the CalDAV account on the device.
The host name or IP address of the CalDAV server.
The port number of the CalDAV server.
If required by the CalDAV server, enter the principal URL of the calendar resource.
For example, to sync with a calendar other than the primary calendar in a Google account, enter: https://apidata.googleusercontent.com/ caldav/
v2/calendar_id/user where calendar_id is the ID of the calendar you want to sync with. In the Google Calendar web application, the calendar ID is displayed in the calendar settings. See the
Google Calendar help for details.
The login credentials for the CalDAV account.
For example, for Google Calendar enter the credentials of the Google account.
The connection to the CalDAV server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
200 Copyright © Sophos Limited
Sophos Mobile
14.20.18 CardDAV configuration (iOS device policy)
With the CardDAV configuration you configure the synchronization of contact data with a CardDAV server. For example, this can be used to sync Google Contacts with an iOS device.
Setting/Field
Account name
Server
Port
Principal URL
User name, Password
SSL/TLS
Description
The display name of the CardDAV account on the device.
The host name or IP address of the CardDAV server.
The port number of the CardDAV server.
If required by the CardDAV server, enter the principal URL of the contacts resource.
For example, the Google CardDAV API supports the following principal URL: https://www.googleapis.com/carddav/
v1/ principals/account_name@gmail.com
where account_name is the Google account name.
The login credentials for the CardDAV account.
For example, for Google Contacts enter the credentials of the Google account.
The connection to the CardDAV server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
14.20.19 IMAP/POP configuration (iOS device policy)
With the IMAP/POP configuration you add an IMAP or POP email account to the iOS device.
Setting/Field
Account name
Account type
User display name
Description
The display name of the email account on the device.
The type of the email server for incoming email (either
IMAP or POP).
The display name of the user for outgoing email.
Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.
Copyright © Sophos Limited 201
Sophos Mobile
Setting/Field
Email address
Allow move
Allow recent address syncing
Use in Mail only
Allow Mail Drop
Enable S/MIME
Signing certificate
Encryption certificate
Allow user to send unencrypted emails
Incoming email
Server
Port
User name
Authentication type
Password
SSL/TLS
Outgoing email
Server
Description
The email address of the account.
Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.
Users can move emails from this account to another. This also allows users to use a different account when replying to or forwarding a message from this account.
The account is included in the syncing for the list of recent addresses.
The account can only be used to send messages from the
Mail app. It cannot be selected as a sending account for messages created with other apps, for example Photos or
Safari.
Allow Apple Mail Drop for this account.
Support the S/MIME encryption standard.
The certificates that are used for email signing and encryption.
To select a certificate, you must first upload it in a Client
certificate configuration of the current policy.
For each outgoing email, the user can choose to encrypt it or not.
The host name or IP address of the server for incoming email (inbound server).
The port number of the server for incoming email (inbound server).
The user name for connecting to the inbound server.
The authentication method for connecting to the inbound server.
The password for connecting to the inbound server (if required).
The connection to the inbound server is secured by SSL or TLS (depending on what the server supports).
The host name or IP address of the server for outgoing email (outbound server).
202 Copyright © Sophos Limited
Setting/Field
Port
User name
Authentication type
Password
Use same password as for incoming email
SSL/TLS
Sophos Mobile
Description
The port number of the server for outgoing email
(outbound server).
The user name for connecting to the outbound server.
The authentication method for connecting to the outbound server.
The password for connecting to the outbound server (if required).
Use the password that is specified for incoming email.
The connection to the outbound server is secured by SSL or TLS (depending on what the server supports).
14.20.20 Google account configuration (iOS device policy)
With the Google account configuration you set up a Google account. After the configuration is assigned to a device, the user is asked to authenticate for the Google account. After authentication, the
Google account is set up on the device and the user can enable Google services.
Setting/Field
Google email address
Account description
User name
Description
The full email address of the Google account.
An optional description of the account. The value is displayed in the Mail and Settings apps.
The user’s name. The value is used for outgoing email messages.
14.20.21 Single sign-on configuration (iOS device policy)
With the Single sign-on configuration you define settings for a single sign-on for third-party apps.
Setting/Field
Name
Kerberos principal name
Realm
Description
A human-readable name for the account.
The Kerberos principal name.
If you leave this field empty, the user must enter the name.
The Kerberos realm name.
You must enter the name in upper-case.
Copyright © Sophos Limited 203
Sophos Mobile
Setting/Field
URLs
App IDs
Description
A list of URL prefixes that must be matched to use the account for Kerberos authentication over HTTP.
Values must begin with http:// or https://
If a value doesn’t end with / , the / is added by
Sophos Mobile.
You may use a single asterisk (*) to match all values. For example, https://*.example.com/ matches
https://www.example.com/ and https://
m.example.com/.
A list of bundle IDs of apps.
Values must be either exact matches (e.g.
com.sophos.smsec
), or prefixes, using the characters .* at the end of the string (e.g.
com.sophos.* ).
14.20.22 AirPrint configuration (iOS device policy)
With the AirPrint configuration you add AirPrint printers to the user’s AirPrint printer list.
Setting/Field
IP address
Resource path
Port
Force TLS
Description
The IP address of the AirPrint printer.
The resource path associated with the printer.
Examples:
• printers/<printer model>
• ipp/print
The listening port of the AirPrint printer.
AirPrint connections are secured by TLS.
14.20.23 Root certificate configuration (iOS device policy)
With the Root certificate configuration you install a root certificate onto devices.
Setting
File
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
204 Copyright © Sophos Limited
Setting
Certificate name
Sophos Mobile
Description
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.20.24 Client Certificate configuration (iOS device policy)
With the Client certificate configuration you install a client certificate onto devices.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.20.25 SCEP configuration (iOS device policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).
Setting/Field
URL
Description
The web address of the Certificate Authority server.
Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.
Copyright © Sophos Limited 205
Sophos Mobile
Setting/Field
CA name
Subject
Type of Subject Alternative Name
Value of Subject Alternative Name
AD user logon name
Challenge
Retries
Retry delay
Key size
Description
A name that is understood by the Certificate
Authority. The name can, for example, be used to distinguish between instances.
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid
X.500 name.
For example:
• Enter CN=%_USERNAME_% to specify a user.
• Enter CN=%_DEVPROP(SerialNumber)_% to specify an iPhone or iPad.
For information on available placeholders, see
(page 106).
To add a Subject Alternative Name (SAN) to the
SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:
• RFC 822 name: A valid email address.
• DNS name: The DNS name of the CA server.
• Uniform resource identifier: The fully qualified URL of the CA server.
The User logon name value set in Active
Directory, i.e. the user’s User Principal Name
(UPN).
The web address to obtain a challenge password from the SCEP server.
Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.
The number of retries if the server sends a response of type pending.
The number of seconds between retries.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
206 Copyright © Sophos Limited
Setting/Field
Key usage
Sophos Mobile
Description
Select what the certificate can be used for.
Use as digital signature: The certificate can be used as a digital signature.
Use for encryption: The certificate can be used for data encryption.
14.20.26 Duo device certificate (iOS device policy)
With the Duo device certificate configuration you enable devices to request a certificate from the Duo Security SCEP server. If this certificate is installed on a device, the Duo Mobile iOS app classifies the device as trusted.
The required settings are common for all Duo Security accounts. Do not change the pre-populated values.
14.21 Configurations for Sophos container policies for iOS
With a Sophos container policy you configure settings for Sophos Secure Email and Sophos Secure
Workspace on devices where Sophos Mobile manages the Sophos container.
14.21.1 General configuration (iOS Sophos container policy)
With the General configuration you define settings that apply to all Sophos container apps, if applicable.
Setting/Field
Enable Sophos container password
Description
Users must enter an additional password to be able to start a Sophos container app. The password has to be defined when the first container app is started after the configuration has been applied. This password applies to all container apps.
Copyright © Sophos Limited 207
Sophos Mobile
Setting/Field
Password complexity
Always hide characters in password entry fields
Password age in days
Failed logins until lock
Allow fingerprint
Grace period in minutes
Description
The required minimum complexity of the
Sophos container password. More secure passwords are always allowed. Passwords (a mix of numeric and alphanumeric characters) are always seen as more secure than PINs
(numeric characters only).
• Any: Sophos container passwords do not have restrictions.
• 4 digit PIN
• 6 digit PIN
• 4 char password
• 6 char password
• 8 char password
• 10 char password
Characters in password entry fields are not briefly displayed before they are masked.
The number of days that a password can be used before users are prompted to change it.
The number of failed login attempts that are tolerated before the container apps are locked.
Once they are locked an administrator needs to unlock the apps or, if allowed, users can use the
Self Service Portal to do so.
Users can use their fingerprint to unlock the app.
The period of time within which no Sophos container password must be entered when a container app comes to the foreground again.
The grace period applies to all container apps.
You can switch between the apps during the grace period without entering a password.
208 Copyright © Sophos Limited
Setting/Field
Last server connect
Sophos Mobile
Description
The period of time within users can use a
Sophos container app without a connection to the Sophos Mobile server.
When a Sophos container app becomes active and does not have contact with the server within the defined period of time, a lock screen will be displayed. Users can only unlock the app by tapping Retry on the lock screen. The app will then try to connect to the server. If the connection can be established, the app will be unlocked. If not, access will be denied.
• On access: Server connection is always required and the app is locked when the server cannot be reached.
• 1 hour: Server connection is required when the app becomes active one hour or more after the last successful server connection.
• 3 hours
• 6 hours
• 12 hours
• 1 day
• 3 days
• 3 days
• None: No regular contact is required.
Copyright © Sophos Limited 209
Sophos Mobile
Setting/Field
Offline starts without server connection
Description
In this field you define how often users can start one of the Sophos container apps without a server connection.
Note
This setting requires the Sophos container password feature to be turned on.
Jailbreak allowed
A counter is incremented whenever users enter the Sophos container password. If the counter exceeds the defined number, the same lock screen as for the Last server connect setting will be displayed. The counter will be reset if a connection to the Sophos Mobile server is established.
• Unlimited: No server connection is required.
• 0: Starting the app without a server connection is not possible.
• 1: After one start of the app, a successful server connection is necessary.
• 3
• 5
• 10
• 20
Container apps are allowed to run on jailbroken devices.
App usage constraints
Here you can define constraints on using the Sophos container apps. Click Add to enter constraints.
Geo-fencing
Time-fencing
Lets you add latitude and longitude and a radius within which the Sophos container apps can be used.
Lets you specify a start and end time within which the Sophos container apps can be used.
Days of the week on which the apps can be used can be specified as well.
210 Copyright © Sophos Limited
Setting/Field
Wi-Fi fencing
Sophos Mobile
Description
If you select Wi-Fi connection required, the
Sophos container is locked when there is no active Wi-Fi connection.
If you add Wi-Fi networks to the list, the
Sophos container is locked when the device is connected to a Wi-Fi network not listed.
Warning
We recommend that you do not rely on Wi-Fi fencing as the only security mechanism because
Wi-Fi names can be spoofed very easily.
14.21.2 Corporate Email configuration (iOS Sophos container policy)
With the Corporate Email configuration you define user settings for your Microsoft Exchange Server.
These settings are applied to the Sophos Secure Email app if it is installed in the Sophos container.
Setting/Field
Exchange server
User
Email address
Domain
Support contact email
Use secure text fields
Description
The Exchange server address.
If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.
The user for this account.
If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.
The email address of the account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
The domain for this account.
The email address that will be used as the
"Contact Support" email address.
The content of input fields is secured. Autocomplete and auto-correction are disabled within the Sophos Secure Email app to prevent sensitive words to be saved in the memory of the device.
Copyright © Sophos Limited 211
Sophos Mobile
Setting/Field
Export contacts to device
212
Call identification
Notifications
Description
Users are allowed to export the Exchange contacts to the local device contacts, so that they can identify company contacts in incoming calls.
Sophos Secure Email keeps the information synchronized.
Note
The local contact information is automatically deleted in the following situations:
• When the Corporate Email configuration is removed from the
Sophos container policy (requires a restart of the Secure Email app).
• When the Sophos container is removed from the device.
• When the device is unenrolled from
Sophos Mobile.
Contact information from Sophos Secure Email can be used to identify company contacts in incoming calls, without the need to export
Sophos Secure Email contacts to the device contacts.
To use this, users must turn on the following device settings:
• In the Settings app: Phone > Call Blocking &
Identification > Email
• In the Sophos Secure Email app: Settings >
Contacts > Call Identification
The notification type for new email:
• System: Notifications are managed by iOS.
They don’t include details like Sender or
Subject.
• App: Notifications are managed by the
Sophos Secure Email app. You can select how much detail is displayed. When the app is not running, no notifications are displayed.
• None: No notifications are displayed.
This setting also affects event reminders:
• System, None: Event reminders only include time information.
• App: Event reminders include time, location and title information.
Copyright © Sophos Limited
Setting/Field
Deny copy to clipboard
Open attachments
Maximum email size
Extra settings
Sophos Mobile
Description
Users cannot copy or cut texts from the Sophos
Secure Email app.
In all apps: Attachments can be opened in all apps that support the file format.
In container apps: Attachments are encrypted with a device key and can only be opened in
Sophos Secure Workspace. The Open in action itself is not blocked.
Email messages that are larger than the size you select (including attachments) are not retrieved from the Exchange server.
Only configure these settings if instructed by
Sophos Support.
14.21.3 Corporate Documents configuration (iOS Sophos container policy)
With the Corporate Documents configuration you define settings for the Corporate Documents feature of the Sophos Secure Workspace app.
Configure storage providers
For each storage provider you can define the following settings separately:
Setting/Field
Enable
Offline
Open in (encrypted)
Open in (unencrypted)
Clipboard
Description
The storage provider is available in the app.
Users are allowed to add files from the storage provider to the app's Favorites list for offline use.
Users can share encrypted files with other apps via Open In.
Users can share unencrypted files with other apps via Open In.
Users can copy parts of a document and paste them into other apps.
Copyright © Sophos Limited 213
Sophos Mobile
Enterprise provider settings
For Egnyte and WebDAV provider, also referred to as enterprise provider, you can centrally define server settings and login credentials. These cannot be changed by users.
Credential settings that you do not define centrally can be chosen by the users in the app's provider credential screens.
For example you can centrally define the server and user account to be used but you can leave the password field undefined. Users then would have to know the password when accessing the storage provider.
Setting/Field
Name
Server
User name
Password
Upload folder
Description
The name of the provider that is displayed in the
Sophos Secure Workspace app.
In this field, enter:
• The URL of the root folder on the
Corporate Documents WebDAV server.
• The URL of the root folder on the Egnyte server.
• The URL of the root folder on the WebDAV server.
Use the following format: https:// server.company.com
The user name for the relevant server. You can also use the %_USERNAME_% variable.
The password for the relevant account.
The upload folder for the relevant account.
Other settings
Setting/Field
Enable Documents
Description
This turns on the Documents feature to securely distribute company documents.
214 Copyright © Sophos Limited
Setting/Field
Passphrase complexity
Extra settings
Sophos Mobile
Description
The required minimum complexity of passphrases for encryption keys. More secure passphrases are always allowed.
You can select the following settings:
• 4 char password
• 6 char password
• 8 char password
• 10 char password
Only configure these settings if instructed by
Sophos Support.
14.21.4 Corporate Browser configuration (iOS Sophos container policy)
With the Corporate Browser configuration you define settings for the Corporate Browser feature of the
Sophos Secure Workspace app.
The Corporate Browser allows you to securely access corporate intranet pages and other allowed pages. You can define domains and bookmarks within a domain.
Every bookmarks belongs to a certain domain. When you add a bookmark, the domain entry is created automatically if it does not exist.
Domain settings
Setting/Field
URL
Allow copy/paste
Allow open with
Allow save password
Description
The domain that you want to allow.
Users can copy and paste text from the
Corporate Browser to other apps.
Users can download attachments or pass them on to other apps.
Users can save their passwords in the
Corporate Browser.
Bookmark settings
Setting/Field
Name
Description
The name for the bookmark.
Copyright © Sophos Limited 215
Sophos Mobile
Setting/Field
URL
Description
The web address for the bookmark.
14.21.5 Root certificate configuration (iOS Sophos container policy)
With the Root certificate configuration you install a root certificate onto devices. This certificate is available to the Sophos Secure Email and Sophos Secure Workspace apps if they are installed in the
Sophos container.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.21.6 Client certificate configuration (iOS Sophos container policy)
With the Client certificate configuration you install a client certificate onto devices. This certificate is available to the Sophos Secure Workspace app if it’s installed in the Sophos container.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
216 Copyright © Sophos Limited
Sophos Mobile
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.21.7 SCEP configuration (iOS Sophos container policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP). These certificates are available to the
Corporate Browser feature of the Sophos Secure Workspace app.
Note
You must first add a Root certificate configuration to upload the CA certificate of the SCEP server before you can add a SCEP configuration.
Setting/Field
URL
Alias name
Subject
Description
The web address of the Certificate Authority server.
Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the
SCEP tab of the Sophos setup page.
The name under which the certificate will appear in selection dialogs.
This should be a memorable name to identify the certificate. For example, use the same value as in the Subject field, but without the CN= prefix.
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid
X.500 name.
For example:
• Enter CN=%_USERNAME_% to specify a user.
• Enter CN=%_DEVPROP(SerialNumber)_% to specify an iPhone or iPad.
For information on available placeholders, see
Placeholders in policies (page 106).
Copyright © Sophos Limited 217
Sophos Mobile
Setting/Field
Type of Subject Alternative Name
Value of Subject Alternative Name
AD user logon name
Challenge
Root certificate
Key size
Key usage
Description
To add a Subject Alternative Name (SAN) to the
SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:
• RFC 822 name: A valid email address.
• DNS name: The DNS name of the CA server.
• Uniform resource identifier: The fully qualified
URL of the CA server.
The User logon name value set in Active
Directory, i.e. the user’s User Principal Name
(UPN).
The web address to obtain a challenge password from the SCEP server.
Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the
SCEP tab of the Sophos setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
Select what the certificate can be used for.
Use as digital signature: The certificate can be used as a digital signature.
Use for encryption: The certificate can be used for data encryption.
218 Copyright © Sophos Limited
Sophos Mobile
14.22 Configurations for Mobile Threat Defense policies for iOS
With a Mobile Threat Defense policy you configure Sophos Intercept X for Mobile when it’s enrolled with Sophos Mobile.
14.22.1 Network configuration (Mobile Threat Defense policy for iOS)
With the Network configuration you manage the Wi-Fi Security feature of Sophos Intercept X for
Mobile. This protects users from network-based threats.
Note
When you assign this configuration to a device, the corresponding settings in Sophos Intercept X for Mobile are disabled. The user can’t change them.
Setting/Field
Man-in-the-middle protection
Extra settings
Description
Sophos Intercept X for Mobile checks the Wi-Fi connection for man-in-the-middle attacks.
Sophos Mobile creates an alert when a man-in-the-middle attack is detected.
Only configure these settings if instructed by Sophos
Support.
14.22.2 Web Filtering configuration (Mobile Threat Defense policy for iOS)
With the Web Filtering configuration you manage the Web Filtering feature of Sophos Intercept X for Mobile. This protects users from browsing sites with malicious, undesirable or illegal content. This configuration only affects supervised devices.
Settings
Setting/Field
Filter malicious websites
Description
Select whether users can access websites with malicious content.
Copyright © Sophos Limited 219
Sophos Mobile
Setting/Field
Create alerts
Filter websites by category
Website exceptions
Description
Select whether an alert is created when the user tries to access a filtered website.
You can select if alerts are only created for blockings or also for warnings.
Select whether users can access types of websites.
Websites are categorized based on data from
SophosLabs. The data is updated constantly.
Configure exceptions to the category filters:
Allowed domains: Websites that are allowed, even though the category they belong to is blocked.
Blocked domains: Websites that are blocked, even though the category they belong to is allowed.
220
How to specify website exceptions
In Allowed domains and Blocked domains, enter one of the following per line (without separator):
• IPv4 or IPv6 address
203.0.113.0
2001:db8:85a3:0:0:8a2e:370:7334
• IPv4 or IPv6 subnet
203.0.113.0/24
2001:db8::/32
• Domain www.example.com
• Wildcard domain. The wildcard * must be the leftmost character.
*.example.com
*example.com
In Blocked domains, you can use a single wildcard * to block all websites.
Filtering logic
When Web Filtering evaluates whether a website must be allowed or blocked, the allow list takes precedence over the block list, and policy-defined lists take precedence over user-defined lists.
Filtering rules are applied in the following sequence:
1. If the website is included in Allowed domains, it is allowed.
2. If the website is included in Blocked domains, it is blocked.
3. If the user has added the website to the allow list, it is allowed.
4. If the user has added the website to the block list, it is blocked.
Copyright © Sophos Limited
Sophos Mobile
5. The website is allowed or blocked based on its category.
14.22.3 SMS Filtering configuration (Mobile Threat Defense policy for iOS)
With the SMS Filtering configuration you define domain names for the SMS Filtering feature of Sophos
Intercept X for Mobile.
SMS Filtering protects users from SMS and MMS attacks. It moves SMS messages containing a fake domain to SMS Junk, excluding messages from senders available in Contacts.
A fake domain looks like your real domain but is slightly modified:
• Single characters are substituted, inserted, or transposed.
• The domain name is amended by prefix or suffix.
• The Top Level Domain (TLD) is different.
For example if your real domain is sophos.com
, the following are fake domains:
• s0phos.com
(substitution)
• soophos.com
(insertion)
• sohpos.com
(transposition)
• mysophos.com
(prefix)
• sophos.net
(different TLD)
Subdomains like hr.sophos.com
are not filtered.
If an SMS message is filtered, all further messages from the same sender are filtered as well.
14.23 Configurations for macOS device policies
With a macOS device policy you configure settings for Macs that apply to all users.
Related concepts
(page 103)
Configurations for macOS user policies (page 238)
With a macOS user policy you configure settings for Macs that apply to users managed by Sophos
Mobile.
14.23.1 Password policies configuration (macOS device policy)
With the Password policies configuration you define requirements for the passwords of Mac user accounts.
Note
When the Password policies configuration is assigned to a device, a grace period of 60 minutes starts. Within the grace period, the user is asked to change the password when they return to the
Home screen to comply with the policies. After the grace period, the user may not start any apps on the device, including internal apps.
Copyright © Sophos Limited 221
Sophos Mobile
Setting/Field
Allow simple value
Require alphanumeric value
Minimum password length
Minimum number of complex characters
Maximum password age in days
Maximum Auto-Lock (in minutes)
Password history
Maximum grace period for device lock
Number of failed attempts until device wipe
Description
Users are allowed to use sequential or repeated characters in their password, for example 1111 or abcde .
Passwords must contain at least one letter or number.
Specifies the minimum number of characters a password must contain.
Specifies the minimum number of nonalphanumeric characters (for example & or !) a password must contain.
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
In this field, you can specify the maximum value the user is allowed to configure on the device. Auto-Lock specifies how soon (in minutes) the device will be locked if it has not been used.
The number of previously used passwords
Sophos Mobile stores.
When the user sets a new password, it mustn’t match a password that was already used.
In this field, you can specify the maximum value the user is allowed to configure on the device. The grace period for device lock specifies for how long the device can be unlocked after a lock without a password prompt. If you select None, the user can select any of the intervals available. If you select
Immediately, users must enter a password every time they unlock their devices.
In this field, you can specify the number of failed attempts to enter the correct password before the device is wiped. After six failed attempts, a time delay is imposed before a password can be entered again. The delay increases with each failed attempt. After the final failed attempt, all data and settings are securely removed from the device. The time delay starts after the sixth attempt. So if you set this value to 6 or lower, no delay is imposed and the device is wiped when the attempt limit is exceeded.
222 Copyright © Sophos Limited
Sophos Mobile
14.23.2 Restrictions configuration (macOS device policy)
With the Restrictions configuration you define restrictions for Macs.
Note
Some options are only available for certain versions of macOS. This is indicated by blue labels in
Sophos Mobile Admin.
Device
Setting/Field
Allow use of camera
Allow internet search result for
Spotlight
Allow Apple Music macOS software update delay
Description
If the check box is cleared, the camera is unavailable and the Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.
If the check box is cleared, Spotlight does not return internet search results.
Users can access the Apple Music library.
The number of days that an update of the macOS software is delayed after its release date.
Enter a value between 0 (no delay) and 90.
iCloud
Setting/Field
Allow backup
Allow iCloud Photo Library
Allow iCloud Keychain sync
Allow document sync
Allow Back to My Mac
Allow Find My Mac
Copyright © Sophos Limited
Description
Users can back up their devices to iCloud.
Users can use iCloud Photo Library.
Users can use iCloud Keychain to synchronize passwords across their iPhones, iPads, and Macs.
If the check box is cleared, iCloud Keychain data is only stored locally on the device.
Users can store documents and app configuration data in iCloud.
Users can use iCloud Back to My Mac, i.e. file and screen sharing between a remote and a local Mac.
Users can use iCloud Find My Mac to locate, lock, or wipe their Mac remotely.
223
Sophos Mobile
Setting/Field
Allow iCloud Bookmarks
Allow iCloud Mail
Allow iCloud Calendar
Allow iCloud Reminders
Allow iCloud Address Book
Allow iCloud Notes
Allow iCloud Drive for Desktop and
Documents
Description
Users can use iCloud Bookmarks to synchronize web bookmarks between browsers and platforms.
Users can set up an iCloud Mail account on their Mac.
Users can use iCloud Calendar to share their calendars across their devices and with other iCloud users.
Users can use iCloud Reminders to share reminder lists across their devices and with other iCloud users.
Users can use iCloud Address Book to share contacts across their devices and with other iCloud users.
Users can use iCloud Notes to take notes and to share them across their devices and with other users.
Users can store their Mac Desktop and their
Documents folder in iCloud Drive and access them on other devices.
Security and privacy
Setting/Field
Allow Touch ID to unlock device
Allow definition lookup
Allow Auto Unlock
Allow iTunes File Sharing
Allow AirPrint
Allow iBeacon discovery of AirPrint printers
Description
If the check box is cleared, the device can’t be unlocked by Touch ID.
Users can look up definitions for highlighted words.
Users can use Auto Unlock to have their Mac automatically unlocked by their Apple Watch.
Users can use File Sharing in iTunes to copy files between their Mac and an iPhone or iPad.
Users can send files to AirPrint-enabled printers.
The device uses iBeacon to discover AirPrint devices.
Warning
If you allow this, malicious AirPrint devices can perform phishing attacks on network traffic.
Force trusted certificates for AirPrint over TLS
AirPrint over TLS is rejected if the AirPrint device uses an untrusted certificate.
224 Copyright © Sophos Limited
Sophos Mobile
Setting/Field
Allow password auto-fill
Request Wi-Fi passwords from nearby devices
Allow AirDrop password sharing
Description
Users can turn on the AutoFill Passwords setting, which lets them use saved password or credit card information in Safari or other apps.
If this check box is cleared, automatic suggestion of strong passwords is disabled as well.
The device requests passwords from nearby devices when setting up a Wi-Fi connection.
Users can share passwords from Password Manager with other users via AirDrop.
14.23.3 Wi-Fi configuration (macOS device policy)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
Setting/Field
SSID
Connect automatically
Hidden network
Description
The ID of the Wi-Fi network.
Automatically connect to the target network.
The target network is not open or visible.
Copyright © Sophos Limited 225
Sophos Mobile
Setting/Field
Security type
226
Description
The security type of the Wi-Fi network:
• None
• WEP (personal)
• WPA/WPA2 (personal)
• Any (personal)
• WEP (enterprise)
• WPA/WPA2 (enterprise)
• Any (enterprise)
If you select a type with Personal in its name, a
Password field is displayed. Enter the relevant password.
If you select a type with Enterprise in its name, the tabs Protocols, Authentication and Trust are displayed.
On the Protocols tab configure the following:
• Under Accepted EAP types, select the EAP methods to be used for authentication. Depending on the types selected on this tab, the values in the Internal identity field on this tab become available for selection.
• Under EAP-FAST, configure the EAP-FAST Protected
Access credential settings.
• In TLS minimum version and TLS maximum version, select a minimum and a maximum TLS version to be used with EAP authentication.
On the Authentication tab, configure client authentication settings:
• In the User field, enter the user name for the connection to the Wi-Fi network.
• Select Require password on each connect, if the password is to be queried for each connection and transferred with the authentication.
• In the Password field, enter the relevant password.
• In the Identity certificate list, select the certificate for the connection to the Wi-Fi network.
Note
The certificate to be used has to be specified in a
Client certificate configuration.
• In the External identity field, enter the externally visible
ID (for TTLS, PEAP and EAP-FAST).
On the Trust tab, configure server authentication settings:
Select the trusted certificates from the list.
Note
certificate configuration.
Setting/Field
Proxy
Sophos Mobile
Description
In this list, select the proxy settings for the Wi-Fi connection:
• No proxy
• Manually
• Automatic
If you select Manually, the fields Server, Port,
Authentication and Password are displayed.
Enter the required proxy information. If you select
Automatic, the field PAC URL is displayed. Enter the URL of the proxy server.
14.23.4 Gatekeeper configuration (macOS device policy)
With the Gatekeeper configuration you configure macOS Gatekeeper, which blocks apps installed from forbidden sources.
Setting/Field
Allow apps downloaded from
Description
Select the required setting:
• Anywhere: Users can open all apps, regardless of where they were installed from.
• Mac App Store: Users can only open apps from Mac App Store.
• Mac App Store and identified developers:
Users can only open apps from Mac App
Store or from identified developers, i.e.
developers approved by Apple.
14.23.5 Kernel extension policy configuration (macOS device policy)
With the Kernel extension policy configuration you approve or block certain third-party kernel extensions (KEXTs). Without this configuration, macOS asks the user for approval when an app wants to install a kernel extension.
Setting/Field Description
Allow user-approved extensions
When an app wants to install a kernel extension not approved by this configuration, macOS asks the user to approve it.
If the check box is cleared, extensions not approved by this configuration are blocked.
Approve Sophos extensions Sophos kernel extensions are approved.
Copyright © Sophos Limited 227
Sophos Mobile
Setting/Field
Approved Team IDs
Description
A list of
values.
Kernel extensions signed by one of these IDs are approved.
To find the Team ID of a kernel extension, install it on a Mac in your test environment. Then enter the following two commands in Terminal: sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy
SELECT * FROM kext_policy;
Use Control-D to exit the sqlite3 session.
You get one line of output for every kernel extension installed. In each line, the first value is the
Team ID.
14.23.6 VPN configuration (macOS device policy)
With the VPN configuration you define VPN settings for network connections.
Setting/Field
Connection name
Connection type
Identifier (reverse DNS format)
Server
Account
Third-party settings
Send all traffic through VPN
Description
The name of the connection shown on the device.
The type of the VPN connection:
• Cisco AnyConnect
• Cisco Legacy AnyConnect
• IPsec (Cisco)
• F5
• Check Point
• Custom SSL/TLS
Different entry fields are shown on the VPN page depending on the connection type you select here.
The custom identifier in reverse DNS format.
The host name or the IP address of the server.
The user account for the authentication of the connection.
If your vendor has specified custom connection properties, you can enter them in this field.
To enter a property, click Add and then enter
Key and Value of the property in the dialog box.
All traffic is sent through VPN.
228 Copyright © Sophos Limited
Setting/Field
Group
User authentication
Device authentication
Sophos Mobile
Description
The group that may be required for the authentication of the connection.
The type of user authentication for the connection:
• Password
If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.
• Certificate
If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.
The type of device authentication:
• Keys (Shared Secret)/Group name
If you select this option, the fields Group
name, Keys (Shared Secret), Use hybrid
authentication and Request password are displayed below the Device authentication field. Enter the required authentication information in the Group name and Keys
(Shared Secret) fields. Select Use hybrid
authentication and Request password as required.
• Certificate
If you select this option, the fields
Certificate and Including user PIN are displayed below the Device authentication field. In the Certificate list, select the required certificate. Select Including user
PIN to include the user PIN in device authentication.
Copyright © Sophos Limited 229
Sophos Mobile
Setting/Field
Proxy
Provider type
Description
The proxy settings for the connection:
• No proxy
• Manually
If you select this option, the fields Server
and port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the Password field, enter the password for the connection to the proxy server.
• Automatic
If you select this option, the Proxy server
URL field is displayed. Enter the URL of the server with the proxy setting in this field.
The VPN connection type.
• App proxy: Network traffic is sent through a
VPN tunnel at the application layer.
• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.
14.23.7 Firewall configuration (macOS device policy)
With the Firewall configuration you define settings for the application firewall included in macOS.
Setting/Field
Turn on application firewall
Block all incoming connections
Use stealth mode
Automatically allow built-in apps
Description
The application firewall is turned on.
Sharing services, such as File Sharing or Screen Sharing, are not allowed to receive incoming connections.
This does not affect the following system services:
• configd (DHCP and other network configuration services)
• mDNSResponder (Bonjour)
• racoon (IPSec)
The computer ignores unexpected requests, such as ping requests.
Built-in apps, such as iTunes, are added to the list of apps allowed to receive connections.
You can’t turn this setting off.
230 Copyright © Sophos Limited
Sophos Mobile
Setting/Field
Automatically allow signed downloaded apps
Allowed connections
Denied connections
Description
Apps signed by a valid certificate authority are added to the list of apps allowed to receive connections.
You can’t turn this setting off.
An app group containing apps allowed to receive connections.
For other apps, users can choose to allow or deny a connection.
An app group containing apps not allowed to receive connections.
For other apps, users can choose to allow or deny a connection.
14.23.8 Web content filter configuration (macOS device policy)
With the Web content filter configuration you define settings for a third-party app for filtering internet content.
Setting/Field
Filter name
Filter ID
Server
Organization
Description
A custom name for the filter configuration.
The bundle ID of the third-party app.
The server hosting the filtering service (host name, IP address, or
URL).
The name of your organization. The value is passed to the filtering service.
User name
Password
Certificate
Filter range
The credentials required for connecting to the filtering service.
Third-party settings
A certificate for authenticating to the filtering service.
The traffic to be filtered by the third-party app:
• Filter browser traffic: WebKit browser traffic is filtered.
• Filter socket traffic: Socket traffic is filtered.
• Filter browser and socket traffic: WebKit and socket traffic is filtered.
Additional configuration settings, if required by the third-party app.
Copyright © Sophos Limited 231
Sophos Mobile
14.23.9 Global HTTP proxy configuration (macOS device policy)
With the Global HTTP proxy configuration you define a corporate proxy server.
Setting/Field
Proxy
Server
Port
Authentication
Password
PAC URL
Description
Select Manually to configure the connection details manually.
Select Automatic if you have a proxy auto-config (PAC) file.
The name (or the IP address) of the HTTP proxy.
The port number of the HTTP proxy.
The user name to connect to the proxy server.
The password to connect to the proxy server.
The URL of the proxy auto-config (PAC) file.
14.23.10 Managed domains configuration (macOS device policy)
With the Managed domains configuration you define managed domains for Macs.
Email domains
Enter email domains managed by your organization. Email messages from an address that doesn’t match one of the configured domains are highlighted as out-of-domain in the Mail app.
14.23.11 Single sign-on configuration (macOS device policy)
With the Single sign-on configuration you define settings for a single sign-on for third-party apps.
Setting/Field
Name
Kerberos principal name
Realm
Description
A human-readable name for the account.
The Kerberos principal name.
If you leave this field empty, the user must enter the name.
The Kerberos realm name.
You must enter the name in upper-case.
232 Copyright © Sophos Limited
Setting/Field
URLs
App IDs
Sophos Mobile
Description
A list of URL prefixes that must be matched to use the account for Kerberos authentication over HTTP.
Values must begin with http:// or https://
If a value doesn’t end with / , the / is added by
Sophos Mobile.
A list of bundle IDs of apps.
Values must be either exact matches (e.g.
com.sophos.smsec
), or prefixes, using the characters .* at the end of the string (e.g.
com.sophos.* ).
14.23.12 AirPrint configuration (macOS device policy)
With the AirPrint configuration you add AirPrint printers to the user’s AirPrint printer list.
Setting/Field
IP address
Resource path
Description
The IP address of the AirPrint printer.
The resource path associated with the printer.
Examples:
• printers/<printer model>
• ipp/print
14.23.13 Directory service configuration (macOS device policy)
With the Directory service configuration you specify an Active Directory domain that a Mac joins when the policy is assigned to it.
Note
If the Active Directory domain you configure here is the same domain you use for the Self Service
Portal, the macOS user policy assigned to the Mac is applied to all Active Directory users that log in to the Mac.
General settings
Setting/Field
Domain host name
Description
The DNS host name of the Active Directory domain to join.
Copyright © Sophos Limited 233
Sophos Mobile
Setting/Field
AD administrator name
Password
Organizational unit
Description
The credentials of the user account used for connecting to the Active Directory server.
This user must have permissions to add devices to the Active Directory database.
The organizational unit (OU) within the Active
Directory database where the joining computer is added.
234
User experience
Setting/Field
Create mobile account
Require confirmation before creating a mobile account
Force local home folder
Use UNC path from Active Directory
Network protocol
Default user shell
Description macOS creates a mobile account when a network user logs in for the first time.
With a mobile account, users can log in to the
Mac with their Active Directory credentials even when the Mac is not connected to the Active
Directory server.
The user decides whether to create a mobile account or not.
Select this check box to force the creation of user profiles on the startup disk. This is required for mobile accounts.
If you clear the check box, pure network home directories are used.
macOS mounts the home folder specified in the
Active Directory user account.
The protocol for mounting the home folder.
The command-line shell for the user.
If you leave this field empty, /bin/bash is used.
Mapping
Setting/Field
UID attribute
User GID attribute
Description
The Active Directory attribute that is mapped to the unique user ID (UID) in macOS.
The Active Directory attribute that is mapped to the primary group ID in macOS user accounts.
Copyright © Sophos Limited
Setting/Field
Group GID attribute
Sophos Mobile
Description
The Active Directory attribute that is mapped to the group ID in macOS group accounts.
CAUTION
If you change these mapping settings later, users might lose access to previously created files.
Administrative
Setting/Field
Preferred DC server
Password trust interval in days
Namespace
Packet signing
Packet encryption
Description
The Active Directory domain controller (DC) that is consulted first.
If you leave this field empty, macOS selects the domain controller by site information and controller responsiveness.
Specify how often macOS changes the password of its Active Directory computer account.
If you leave this field empty, macOS changes its password every 14 days.
If you set a value of 0 , macOS doesn’t change the password automatically.
• Forest
Namespace support is turned on. Multiple users with the same login name that exist in different domains of the Active Directory forest can log in.
Users must enter their login name as DOMAIN
\name .
• Domain
Namespace support is turned off. Users must have a unique login name.
macOS can sign and encrypt the LDAP connections used for Active Directory communication.
• Allow: macOS decides if to sign and/or encrypt the
LDAP connections.
• Disable: macOS doesn’t sign or encrypt the LDAP connections.
• Require: macOS always signs and encrypts LDAP connections.
• SSL/TLS: macOS always uses LDAP over SSL/TLS.
Copyright © Sophos Limited 235
Sophos Mobile
Setting/Field
Multi-domain authentication
Domain administrator groups
Restrict DDNS
Description
Users from all domains in the Active Directory forest can log in.
A list of Active Directory groups.
Members of these groups are granted administrative privileges on the Mac.
To add a group, enter the Active Directory domain name, a backslash, and the group account name. For example ADS\Domain
Admins .
Entries are case-sensitive.
A list of network interfaces.
By default, macOS uses Dynamic DNS (DDNS) for all network interfaces. To restrict DDNS to certain interfaces, enter their BSD names.
For example to restrict DDNS to the built-in
Ethernet port, enter en0 .
To enter more than one interface, press Enter after each entry.
14.23.14 Root certificate configuration (macOS device policy)
With the Root certificate configuration you install a root certificate onto Macs.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
236 Copyright © Sophos Limited
Sophos Mobile
14.23.15 Client Certificate configuration (macOS device policy)
With the Client certificate configuration you install a client certificate onto Macs.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.23.16 SCEP configuration (macOS device policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).
Setting/Field
URL
CA name
Description
The web address of the Certificate Authority server.
Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.
A name that is understood by the Certificate
Authority. The name can, for example, be used to distinguish between instances.
Copyright © Sophos Limited 237
Sophos Mobile
Setting/Field
Subject
Type of Subject Alternative Name
Value of Subject Alternative Name
AD user logon name
Challenge
Retries
Retry delay
Key size
Description
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid
X.500 name.
For example:
• Enter CN=%_USERNAME_% to specify a user.
• Enter CN=%_DEVPROP(SerialNumber)_% to specify a Mac.
For information on available placeholders, see
(page 106).
To add a Subject Alternative Name (SAN) to the
SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:
• RFC 822 name: A valid email address.
• DNS name: The DNS name of the CA server.
• Uniform resource identifier: The fully qualified URL of the CA server.
The User logon name value set in Active
Directory, i.e. the user’s User Principal Name
(UPN).
The web address to obtain a challenge password from the SCEP server.
Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.
The number of retries if the server sends a response of type pending.
The number of seconds between retries.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
14.24 Configurations for macOS user policies
With a macOS user policy you configure settings for Macs that apply to users managed by Sophos
Mobile.
238 Copyright © Sophos Limited
Sophos Mobile
Related concepts
(page 103)
Configurations for macOS device policies (page 221)
With a macOS device policy you configure settings for Macs that apply to all users.
14.24.1 Password policies configuration (macOS user policy)
With the Password policies configuration you define requirements for the passwords of Mac user accounts.
Note
When the Password policies configuration is assigned to a device, a grace period of 60 minutes starts. Within the grace period, the user is asked to change the password when they return to the
Home screen to comply with the policies. After the grace period, the user may not start any apps on the device, including internal apps.
Setting/Field
Allow simple value
Require alphanumeric value
Minimum password length
Minimum number of complex characters
Maximum password age in days
Maximum Auto-Lock (in minutes)
Password history
Description
Users are allowed to use sequential or repeated characters in their password, for example 1111 or abcde .
Passwords must contain at least one letter or number.
Specifies the minimum number of characters a password must contain.
Specifies the minimum number of nonalphanumeric characters (for example & or !) a password must contain.
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
In this field, you can specify the maximum value the user is allowed to configure on the device. Auto-Lock specifies how soon (in minutes) the device will be locked if it has not been used.
The number of previously used passwords
Sophos Mobile stores.
When the user sets a new password, it mustn’t match a password that was already used.
Copyright © Sophos Limited 239
Sophos Mobile
Setting/Field
Maximum grace period for device lock
Number of failed attempts until device wipe
Description
In this field, you can specify the maximum value the user is allowed to configure on the device. The grace period for device lock specifies for how long the device can be unlocked after a lock without a password prompt. If you select None, the user can select any of the intervals available. If you select
Immediately, users must enter a password every time they unlock their devices.
In this field, you can specify the number of failed attempts to enter the correct password before the device is wiped. After six failed attempts, a time delay is imposed before a password can be entered again. The delay increases with each failed attempt. After the final failed attempt, all data and settings are securely removed from the device. The time delay starts after the sixth attempt. So if you set this value to 6 or lower, no delay is imposed and the device is wiped when the attempt limit is exceeded.
240
14.24.2 Restrictions configuration (macOS user policy)
With the Restrictions configuration you define restrictions for Macs.
Note
Some options are only available for certain versions of macOS. This is indicated by blue labels in
Sophos Mobile Admin.
Device
Setting/Field
Allow use of camera
Allow internet search result for
Spotlight
Allow Apple Music macOS software update delay
Description
If the check box is cleared, the camera is unavailable and the Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.
If the check box is cleared, Spotlight does not return internet search results.
Users can access the Apple Music library.
The number of days that an update of the macOS software is delayed after its release date.
Enter a value between 0 (no delay) and 90.
Copyright © Sophos Limited
Sophos Mobile
iCloud
Setting/Field
Allow backup
Allow iCloud Photo Library
Allow iCloud Keychain sync
Allow document sync
Allow Back to My Mac
Allow Find My Mac
Allow iCloud Bookmarks
Allow iCloud Mail
Allow iCloud Calendar
Allow iCloud Reminders
Allow iCloud Address Book
Allow iCloud Notes
Allow iCloud Drive for Desktop and
Documents
Description
Users can back up their devices to iCloud.
Users can use iCloud Photo Library.
Users can use iCloud Keychain to synchronize passwords across their iPhones, iPads, and Macs.
If the check box is cleared, iCloud Keychain data is only stored locally on the device.
Users can store documents and app configuration data in iCloud.
Users can use iCloud Back to My Mac, i.e. file and screen sharing between a remote and a local Mac.
Users can use iCloud Find My Mac to locate, lock, or wipe their Mac remotely.
Users can use iCloud Bookmarks to synchronize web bookmarks between browsers and platforms.
Users can set up an iCloud Mail account on their Mac.
Users can use iCloud Calendar to share their calendars across their devices and with other iCloud users.
Users can use iCloud Reminders to share reminder lists across their devices and with other iCloud users.
Users can use iCloud Address Book to share contacts across their devices and with other iCloud users.
Users can use iCloud Notes to take notes and to share them across their devices and with other users.
Users can store their Mac Desktop and their
Documents folder in iCloud Drive and access them on other devices.
Copyright © Sophos Limited 241
Sophos Mobile
Security and privacy
Setting/Field
Allow Touch ID to unlock device
Allow definition lookup
Allow Auto Unlock
Allow iTunes File Sharing
Allow AirPrint
Allow iBeacon discovery of AirPrint printers
Description
If the check box is cleared, the device can’t be unlocked by Touch ID.
Users can look up definitions for highlighted words.
Users can use Auto Unlock to have their Mac automatically unlocked by their Apple Watch.
Users can use File Sharing in iTunes to copy files between their Mac and an iPhone or iPad.
Users can send files to AirPrint-enabled printers.
The device uses iBeacon to discover AirPrint devices.
Warning
If you allow this, malicious AirPrint devices can perform phishing attacks on network traffic.
Force trusted certificates for AirPrint over TLS
Allow password auto-fill
AirPrint over TLS is rejected if the AirPrint device uses an untrusted certificate.
Users can turn on the AutoFill Passwords setting, which lets them use saved password or credit card information in Safari or other apps.
If this check box is cleared, automatic suggestion of strong passwords is disabled as well.
Request Wi-Fi passwords from nearby devices
Allow AirDrop password sharing
The device requests passwords from nearby devices when setting up a Wi-Fi connection.
Users can share passwords from Password Manager with other users via AirDrop.
14.24.3 Exchange account configuration (macOS user policy)
With the Exchange account configuration you set up an Exchange Web Services (EWS) account for
Contacts, Mail, Reminders, and Calendar.
Setting/Field
Account name
Description
The account name.
242 Copyright © Sophos Limited
Setting/Field
Exchange server
Domain
User
Email address
Password
OAuth
OAuth sign-in URL
SSL/TLS
Sophos Mobile
Description
The Exchange server address.
If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.
The domain for this account.
The user for this account.
If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.
The email address of the account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The account uses OAuth for authentication, i.e.
users authenticate with their Microsoft credentials.
The URL of the sign-in page for OAuth authentication.
Use this setting if the Autodiscover service of the
Exchange server is turned off.
The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
14.24.4 Wi-Fi configuration (macOS user policy)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
Setting/Field
SSID
Connect automatically
Hidden network
Description
The ID of the Wi-Fi network.
Automatically connect to the target network.
The target network is not open or visible.
Copyright © Sophos Limited 243
Sophos Mobile
Setting/Field
Security type
244
Description
The security type of the Wi-Fi network:
• None
• WEP (personal)
• WPA/WPA2 (personal)
• Any (personal)
• WEP (enterprise)
• WPA/WPA2 (enterprise)
• Any (enterprise)
If you select a type with Personal in its name, a
Password field is displayed. Enter the relevant password.
If you select a type with Enterprise in its name, the tabs Protocols, Authentication and Trust are displayed.
On the Protocols tab configure the following:
• Under Accepted EAP types, select the EAP methods to be used for authentication. Depending on the types selected on this tab, the values in the Internal identity field on this tab become available for selection.
• Under EAP-FAST, configure the EAP-FAST Protected
Access credential settings.
• In TLS minimum version and TLS maximum version, select a minimum and a maximum TLS version to be used with EAP authentication.
On the Authentication tab, configure client authentication settings:
• In the User field, enter the user name for the connection to the Wi-Fi network.
• Select Require password on each connect, if the password is to be queried for each connection and transferred with the authentication.
• In the Password field, enter the relevant password.
• In the Identity certificate list, select the certificate for the connection to the Wi-Fi network.
Note
The certificate to be used has to be specified in a
Client certificate configuration.
• In the External identity field, enter the externally visible
ID (for TTLS, PEAP and EAP-FAST).
On the Trust tab, configure server authentication settings:
Select the trusted certificates from the list.
Note
certificate configuration.
Setting/Field
Proxy
Sophos Mobile
Description
In this list, select the proxy settings for the Wi-Fi connection:
• No proxy
• Manually
• Automatic
If you select Manually, the fields Server, Port,
Authentication and Password are displayed.
Enter the required proxy information. If you select
Automatic, the field PAC URL is displayed. Enter the URL of the proxy server.
14.24.5 VPN configuration (macOS user policy)
With the VPN configuration you define VPN settings for network connections.
Setting/Field
Connection name
Connection type
Identifier (reverse DNS format)
Server
Account
Third-party settings
Send all traffic through VPN
Description
The name of the connection shown on the device.
The type of the VPN connection:
• Cisco AnyConnect
• Cisco Legacy AnyConnect
• IPsec (Cisco)
• F5
• Check Point
• Custom SSL/TLS
Different entry fields are shown on the VPN page depending on the connection type you select here.
The custom identifier in reverse DNS format.
The host name or the IP address of the server.
The user account for the authentication of the connection.
If your vendor has specified custom connection properties, you can enter them in this field.
To enter a property, click Add and then enter
Key and Value of the property in the dialog box.
All traffic is sent through VPN.
Copyright © Sophos Limited 245
Sophos Mobile
Setting/Field
Group
User authentication
Device authentication
Description
The group that may be required for the authentication of the connection.
The type of user authentication for the connection:
• Password
If you select this option, the Password field is shown below the User authentication field. Enter the password for authentication.
• Certificate
If you select this option, the Certificate field is shown below the User authentication field. Select a certificate.
The type of device authentication:
• Keys (Shared Secret)/Group name
If you select this option, the fields Group
name, Keys (Shared Secret), Use hybrid
authentication and Request password are displayed below the Device authentication field. Enter the required authentication information in the Group name and Keys
(Shared Secret) fields. Select Use hybrid
authentication and Request password as required.
• Certificate
If you select this option, the fields
Certificate and Including user PIN are displayed below the Device authentication field. In the Certificate list, select the required certificate. Select Including user
PIN to include the user PIN in device authentication.
246 Copyright © Sophos Limited
Setting/Field
Proxy
Provider type
Sophos Mobile
Description
The proxy settings for the connection:
• No proxy
• Manually
If you select this option, the fields Server
and port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server. In the Authentication field, enter the user name for the connection to the proxy server. In the Password field, enter the password for the connection to the proxy server.
• Automatic
If you select this option, the Proxy server
URL field is displayed. Enter the URL of the server with the proxy setting in this field.
The VPN connection type.
• App proxy: Network traffic is sent through a
VPN tunnel at the application layer.
• Packet tunnel: Network traffic is sent through a VPN tunnel at the network layer.
14.24.6 Web Clip configuration (macOS user policy)
With the Web Clip configuration you define Web Clips to be added to the macOS desktop. Web Clips provide fast access to favorite web pages. But you can also add a Web Clip with a support phone number for example, to provide a quick way to dial the helpdesk.
Setting/Field
Description
URL
Can be removed
Full screen
Description
A description for the Web Clip.
The web address of the Web Clip.
If the check box is cleared, the user cannot remove the Web Clip. It cannot be deleted from the device unless the user removes the policy that installed it.
The Web Clip is opened full screen on the device. A full screen Web Clip opens the URL as a web app.
Copyright © Sophos Limited 247
Sophos Mobile
Setting/Field
Icon
Description
Select an image to be used as the Web Clip icon on the Home screen. This must be a PNG,
GIF or JPEG image with a maximum file size of
1 MB.
The image is cropped to a square and scaled to match the display resolution. For best results, we recommend that you use an image of size
180 px by 180 px.
Note
When a favicon is defined in the HTML code of the web page, the device might display that favicon as Web Clip icon. This happens for certain web pages only, depending on how the favicon is configured in the web page code.
248
14.24.7 Web content filter configuration (macOS user policy)
With the Web content filter configuration you define settings for a third-party app for filtering internet content.
Setting/Field
Filter name
Filter ID
Server
Organization
Description
A custom name for the filter configuration.
The bundle ID of the third-party app.
The server hosting the filtering service (host name, IP address, or
URL).
The name of your organization. The value is passed to the filtering service.
User name
Password
Certificate
Filter range
The credentials required for connecting to the filtering service.
Third-party settings
A certificate for authenticating to the filtering service.
The traffic to be filtered by the third-party app:
• Filter browser traffic: WebKit browser traffic is filtered.
• Filter socket traffic: Socket traffic is filtered.
• Filter browser and socket traffic: WebKit and socket traffic is filtered.
Additional configuration settings, if required by the third-party app.
Copyright © Sophos Limited
Sophos Mobile
14.24.8 Global HTTP proxy configuration (macOS user policy)
With the Global HTTP proxy configuration you define a corporate proxy server.
Setting/Field
Proxy
Server
Port
Authentication
Password
PAC URL
Description
Select Manually to configure the connection details manually.
Select Automatic if you have a proxy auto-config (PAC) file.
The name (or the IP address) of the HTTP proxy.
The port number of the HTTP proxy.
The user name to connect to the proxy server.
The password to connect to the proxy server.
The URL of the proxy auto-config (PAC) file.
14.24.9 Managed domains configuration (macOS user policy)
With the Managed domains configuration you define managed domains for Macs.
Email domains
Enter email domains managed by your organization. Email messages from an address that doesn’t match one of the configured domains are highlighted as out-of-domain in the Mail app.
14.24.10 CalDAV configuration (macOS user policy)
With the CalDAV configuration you configure the synchronization of calendar data with a CalDAV server. For example, this can be used to sync Google Calendar with a Mac.
Setting/Field
Account name
Server
Port
Description
The display name of the CalDAV account on the device.
The host name or IP address of the CalDAV server.
The port number of the CalDAV server.
Copyright © Sophos Limited 249
Sophos Mobile
Setting/Field
Principal URL
User name, Password
SSL/TLS
Description
If required by the CalDAV server, enter the principal URL of the calendar resource.
For example, to sync with a calendar other than the primary calendar in a Google account, enter: https://apidata.googleusercontent.com/ caldav/
v2/calendar_id/user where calendar_id is the ID of the calendar you want to sync with. In the Google Calendar web application, the calendar ID is displayed in the calendar settings. See the
Google Calendar help for details.
The login credentials for the CalDAV account.
For example, for Google Calendar enter the credentials of the Google account.
The connection to the CalDAV server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
14.24.11 CardDAV configuration (macOS user policy)
With the CardDAV configuration you configure the synchronization of contact data with a CardDAV server. For example, this can be used to sync Google Contacts with a Mac.
Setting/Field
Account name
Server
Port
Principal URL
User name, Password
Description
The display name of the CardDAV account on the device.
The host name or IP address of the CardDAV server.
The port number of the CardDAV server.
If required by the CardDAV server, enter the principal URL of the contacts resource.
For example, the Google CardDAV API supports the following principal URL: https://www.googleapis.com/carddav/
v1/ principals/account_name@gmail.com
where account_name is the Google account name.
The login credentials for the CardDAV account.
For example, for Google Contacts enter the credentials of the Google account.
250 Copyright © Sophos Limited
Setting/Field
SSL/TLS
Sophos Mobile
Description
The connection to the CardDAV server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
14.24.12 IMAP/POP configuration (macOS user policy)
With the IMAP/POP configuration you add an IMAP or POP email account to Macs.
Setting/Field
Account name
Account type
User display name
Email address
Description
The display name of the email account on the device.
The type of the email server for incoming email (either
IMAP or POP).
The display name of the user for outgoing email.
Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.
The email address of the account.
Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.
Incoming email
Server
Port
User name
Authentication type
Password
SSL/TLS
The host name or IP address of the server for incoming email (inbound server).
The port number of the server for incoming email (inbound server).
The user name for connecting to the inbound server.
The authentication method for connecting to the inbound server.
The password for connecting to the inbound server (if required).
The connection to the inbound server is secured by SSL or TLS (depending on what the server supports).
Outgoing email
Server
Port
The host name or IP address of the server for outgoing email (outbound server).
The port number of the server for outgoing email
(outbound server).
Copyright © Sophos Limited 251
Sophos Mobile
Setting/Field
User name
Authentication type
Password
Use same password as for incoming email
SSL/TLS
Description
The user name for connecting to the outbound server.
The authentication method for connecting to the outbound server.
The password for connecting to the outbound server (if required).
Use the password that is specified for incoming email.
The connection to the outbound server is secured by SSL or TLS (depending on what the server supports).
14.24.13 Single sign-on configuration (macOS user policy)
With the Single sign-on configuration you define settings for a single sign-on for third-party apps.
Setting/Field
Name
Kerberos principal name
Realm
URLs
App IDs
Description
A human-readable name for the account.
The Kerberos principal name.
If you leave this field empty, the user must enter the name.
The Kerberos realm name.
You must enter the name in upper-case.
A list of URL prefixes that must be matched to use the account for Kerberos authentication over HTTP.
Values must begin with http:// or https://
If a value doesn’t end with / , the / is added by
Sophos Mobile.
A list of bundle IDs of apps.
Values must be either exact matches (e.g.
com.sophos.smsec
), or prefixes, using the characters .* at the end of the string (e.g.
com.sophos.* ).
252 Copyright © Sophos Limited
Sophos Mobile
14.24.14 LDAP configuration (macOS user policy)
With the LDAP configuration you add user information from an LDAP directory to the macOS Address
Book app.
Note
To configure a Mac to join an Active Directory domain, use the Directory service configuration.
See
Directory service configuration (macOS device policy) (page 233).
Setting/Field
Account description
Host name
User name
Password
Use SSL/TLS
Search settings
Base
Scope
Description
Description
A description of the LDAP connection.
The host name or IP address of the LDAP server.
The sign-in credentials Sophos Mobile uses to connect to the LDAP server.
The connection to the LDAP server is secured by SSL or TLS (depending on what the server supports).
The nodes in the LDAP tree to start searching from, and the search scope.
The path to the start node for the search.
For example: ou=users,o=my company
The scope of sub-nodes to include in the search:
• Base node only: Only the base node.
• Base node and direct child nodes: The base node and its child nodes, that is the firstlevel sub-nodes.
• Base node and all sub-nodes: The base node and all sub nodes.
A description of the search setting.
14.24.15 App Store configuration (macOS user policy)
With the App Store configuration you restrict the App Store usage.
Setting/Field
Require admin password
Description
Users require an administrator password to install or update apps.
Copyright © Sophos Limited 253
Sophos Mobile
Setting/Field
Restrict to updates
Forbid app adoption
Turn off update notifications
Description
Users can update apps but can’t install new apps.
App adoption allows users to assign apps to their
Apple ID that have not been installed through the
App Store. If you forbid app adoption, users can’t update these apps.
For example, this affects iLife or iWork apps bundled with the Mac.
Users don’t receive update notifications.
14.24.16 Root certificate configuration (macOS user policy)
With the Root certificate configuration you install a root certificate onto Macs.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.24.17 Client Certificate configuration (macOS user policy)
With the Client certificate configuration you install a client certificate onto Macs.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
254 Copyright © Sophos Limited
Sophos Mobile
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.24.18 SCEP configuration (macOS user policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).
Setting/Field
URL
CA name
Subject
Type of Subject Alternative Name
Value of Subject Alternative Name
Description
The web address of the Certificate Authority server.
Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.
A name that is understood by the Certificate
Authority. The name can, for example, be used to distinguish between instances.
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid
X.500 name.
For example:
• Enter CN=%_USERNAME_% to specify a user.
• Enter CN=%_DEVPROP(SerialNumber)_% to specify a Mac.
For information on available placeholders, see
(page 106).
To add a Subject Alternative Name (SAN) to the
SCEP configuration, select the SAN type and then enter the SAN value. SAN types are:
• RFC 822 name: A valid email address.
• DNS name: The DNS name of the CA server.
• Uniform resource identifier: The fully qualified URL of the CA server.
Copyright © Sophos Limited 255
Sophos Mobile
Setting/Field
AD user logon name
Challenge
Retries
Retry delay
Key size
Description
The User logon name value set in Active
Directory, i.e. the user’s User Principal Name
(UPN).
The web address to obtain a challenge password from the SCEP server.
Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.
The number of retries if the server sends a response of type pending.
The number of seconds between retries.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
14.25 Configurations for Windows Mobile policies
With a Windows Mobile policy you configure settings for Windows Mobile devices.
14.25.1 Password policies configuration (Windows Mobile policy)
With the Password policies configuration you define requirements for the device password.
Setting/Field
Password type
Description
The type of password users must define:
• Alphanumeric: Password must contain both digits and letters
• Numeric: Password must only contain digits
For Windows Phone 8.1, Alphanumeric covers passwords that contain digits and/or letters.
256 Copyright © Sophos Limited
Setting/Field
Minimum complexity of alphanumeric passwords
Allow simple password
Minimum password length
Maximum number of failed attempts
Time in minutes until the device is locked
Password history
Maximum password age in days
Allow the password grace period to be set
Sophos Mobile
Description
This defines the character classes that must be used in an alphanumeric password.
For Windows 10 Mobile:
• 1: Not applicable (if selected, 2 is used)
• 2: Digits and lowercase letters are required
• 3: Digits, lowercase letters, and uppercase letters are required
• 4: Digits, lowercase letters, uppercase letters, and special characters are required
For Windows Phone 8.1, the value you select is the number of different character classes that must be used in a password. Character classes are:
• Digits
• Lowercase letters
• Uppercase letters
• Special characters
Passwords can contain sequential or repeated characters, for example abcde or 1111 .
The minimum number of characters a password must contain.
The number of failed login attempts to enter the correct password before the device is wiped.
Enter a value between 1 and 999 , or 0 for no restriction.
The time period (in minutes) after which the device is locked if it has not been used. The user can unlock the device.
Enter a value between 1 and 999 , or 0 for no restriction.
The number of previously used passwords
Sophos Mobile stores.
When the user sets a new password, it mustn’t match a password that was already used.
The number of days after which users must change their password.
Enter a value between 1 and 730 , or 0 for no restriction.
Users are allowed to set the password grace period.
Copyright © Sophos Limited 257
Sophos Mobile
258
14.25.2 Restrictions configuration (Windows Mobile policy)
With the Restrictions configuration you define restrictions for devices.
Device
Setting/Field
Forbid SD card
Forbid unencrypted device
Description
Users cannot access the storage card. This does not prevent apps from accessing the storage card.
Internal storage encryption is turned on.
CAUTION
After internal storage encryption has been turned on on a device, you cannot turn it off again through a policy.
Note
You must enable BitLocker on the device before applying the policy.
Forbid action center notifications above lock screen
No Action Center notifications are displayed above the device lock screen.
Forbid manual addition of non-Microsoft email accounts
Forbid Microsoft account connection
Forbids adding all types of email accounts, as well as Exchange, Office 365 and Outlook.com
accounts.
Connecting to Microsoft services such as synchronization, backup, Skype, or the
Microsoft Store is not possible.
Note
This setting only affects Microsoft accounts that are set up on the device after the policy is assigned.
Forbid developer mode
Forbid Microsoft Store
Forbid native browser
Forbid camera
The Windows developer mode is turned off.
The app store is unavailable.
The Microsoft Edge browser is unavailable.
The Privacy setting Let apps use my camera is turned off.
Copyright © Sophos Limited
Setting/Field
Telemetry level
Various
Setting/Field
Forbid copy and paste
Forbid Cortana
Forbid “Save as” for Office files
Forbid screen capture
Forbid sharing of Office files
Forbid “Sync my settings”
Forbid voice recording
Copyright © Sophos Limited
Sophos Mobile
Description
The amount of Windows diagnostic and usage data that devices are allowed to send.
Windows 10:
• Full: All data required to identify and analyze issues.
• Enhanced: Data about how Windows and apps are used and how they perform.
• Basic: A limited set of data that’s critical for understanding the device and its configuration.
• Disabled (Windows Phone 8.1 only): Not supported on Windows 10 devices. If you select this, the Basic level is used.
Note
Levels are cumulative from bottom to top, e.g.
Enhanced includes all data from Basic.
Tip
For detailed information on the telemetry levels, see the Microsoft article Configure Windows telemetry in your organization (external link) .
Windows Phone 8.1 doesn’t support different telemetry levels:
• Full, Enhanced, Basic: Users can turn telemetry on or off.
• Disabled (Windows Phone 8.1 only): No telemetry data is submitted.
Description
The clipboard is unavailable.
Cortana is turned off.
Users cannot save a file on the device as an
Office file.
Screen captures are turned off.
Users cannot share Office files.
Device settings cannot be synchronized to and from other Windows devices.
Voice recording is turned off.
259
Sophos Mobile
Wi-Fi
Setting/Field
Forbid Wi-Fi
Forbid internet sharing
Forbid Wi-Fi Sense (hotspot auto-connect)
Forbid hotspot reporting
Forbid manual configuration
Description
Wi-Fi connections are turned off.
Internet Connection Sharing (ICS) is turned off.
The device does not automatically connect to
Wi-Fi hotspots.
The device does not send information about Wi-
Fi connections.
Users can’t configure Wi-Fi connections beyond the connections that are configured by Sophos
Mobile.
Existing user-configured and Wi-Fi Sense Wi-Fi profiles are deleted.
Connectivity
Setting/Field
Forbid NFC
Forbid Bluetooth
Forbid USB connection
Description
NFC (near-field communication) is turned off.
Bluetooth is turned off.
USB connection between the device and a computer to sync files or to use developer tools to deploy or debug apps is forbidden. This does not affect USB charging.
Roaming and costs
Setting/Field
Forbid cellular data roaming
Forbid VPN over cellular
Forbid VPN roaming over cellular
Description
Data connections over foreign cellular networks are turned off.
VPN connections over cellular networks are turned off.
VPN connections over foreign cellular networks are turned off.
260 Copyright © Sophos Limited
Sophos Mobile
Security and privacy
Setting/Field
Forbid Bing Vision to store images from
Bing Vision search
Forbid use of location when searching
Forbid manual installation of root certificates
Forbid locating
SafeSearch permission
Description
Bing Vision does not store the contents of the images captured when performing Bing Vision search.
The search cannot utilize location information.
Users cannot manually install root and intermediate CA certificates.
All location privacy settings on the device are turned off. No apps can use the location service.
This also forbids Sophos Mobile to locate the device.
The level of search result filtering that is enforced on the device:
• Moderate: Moderate filtering against adult content. Valid search results are not filtered.
• Strict: Highest filtering against adult content.
Unenrollment
Setting/Field
Forbid user to reset the phone
Forbid manual MDM unenrollment
Description
Users cannot factory reset the device through the control panel or hardware key combinations.
Users cannot delete the workplace account.
14.25.3 Exchange account configuration (Windows Mobile policy)
With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server.
Setting/Field
Account name
Description
The account name.
Copyright © Sophos Limited 261
Sophos Mobile
Setting/Field
Exchange server
Domain
User
Email address
Password
Synchronization period
Synchronization interval
SSL/TLS
Synchronize content types
Description
The Exchange server address.
If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.
The domain for this account.
The user for this account.
If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.
The email address of the account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The time period used for synchronizing emails.
Only the emails from within the specified period are synchronized to the inbox on the managed device.
The interval between email synchronization processes.
The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
The content types to be synchronized.
14.25.4 Wi-Fi configuration (Windows Mobile policy)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
Setting/Field
SSID
Connect automatically
Hidden network
Description
In this field, enter the ID of the Wi-Fi network.
The connection will be established automatically.
The target network is not open or visible.
262 Copyright © Sophos Limited
Setting/Field
Security type
Proxy
Sophos Mobile
Description
Select the security type from the list. If you select WPA (Personal) or WPA2 (Personal) you must specify the password.
If you select Manually from the list, you must specify server and port.
14.25.5 App restrictions configuration (Windows Mobile policy)
With the App restrictions configuration you specifically allow or block apps on the devices.
Setting/Field
Allowed apps
Forbidden apps
App group
Description
Contains a set of individual apps that users are allowed to install and use on the device. Users will be unable to install or use any apps that are not explicitly listed.
Use Allowed apps when you know the list of apps that you want to allow and want to block all other apps.
Contains a set of individual apps that users are prevented from installing on the device.
Users will be able to install any apps that are not explicitly listed.
Use Forbidden apps when you know the list of apps that you want to block and want to allow all other apps.
Select the app group that contains the list of apps you want to allow or block.
Note
The app group has to be created beforehand. See
(page 312).
14.25.6 IMAP/POP configuration (Windows Mobile policy)
With the IMAP/POP configuration you add an IMAP or POP email account to the device.
Setting/Field
Account type
Account name
Description
The type of the email server for incoming email (either
IMAP or POP).
The display name of the email account on the device.
Copyright © Sophos Limited 263
Sophos Mobile
Setting/Field
Email address
User display name
User name
Domain
Password
Server for incoming email
Use SSL/TLS for incoming email
Server for outgoing email
Use SSL/TLS for outgoing email
Authentication required for outgoing connection
Synchronization period
Automatic synchronization
Description
The email address of the account.
Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.
The display name of the user for outgoing email.
Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.
The user name for connecting to the inbound server.
The domain part of the credentials for the inbound server
(if required).
The password for connecting to the inbound server (if required).
The host name (or the IP address) and the port number of the server for incoming email (inbound server).
Format: server name:port number
You don’t need to specify the port number if the standard port is used:
• 143 (IMAP)
• 993 (IMAP with SSL)
• 110 (POP3)
• 995 (POP3 with SSL)
Use Secure Sockets Layer for incoming email transfer.
The host name (or the IP address) and the port number of the server for outgoing email (outbound server).
Format: server name:port number
Use Secure Sockets Layer for outgoing email transfer.
The outbound server requires authentication.
The same credentials as for the inbound server are used, as specified in the User name, Domain and Password fields.
The time period used for synchronizing emails.
Only the emails from within the specified period are synchronized to the inbox on the managed device.
The interval for automatic email synchronization.
264 Copyright © Sophos Limited
Sophos Mobile
14.25.7 Root certificate configuration (Windows Mobile policy)
With the Root certificate configuration you install a root certificate onto devices.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.25.8 SCEP configuration (Windows Mobile policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).
Setting/Field
Description
URL
Description
A description for the configuration.
The web address of the Certificate Authority server.
Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.
Copyright © Sophos Limited 265
Sophos Mobile
266
Setting/Field
Subject
Subject Alternative Name
Challenge
Root certificate
Retries
Retry delay
Key size
Key usage
Description
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid
X.500 name.
For example:
• Enter CN=%_USERNAME_% to specify a user.
• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.
For information on available placeholders, see
(page 106).
Optionally, configure one or more Subject
Alternative Name (SAN) values.
Click Add and then enter a SAN type and a SAN value.
The web address to obtain a challenge password from the SCEP server.
Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.
The number of retries if the server sends a response of type pending.
The number of seconds between retries.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
Select what the certificate can be used for.
Use as digital signature: The certificate can be used as a digital signature.
Use for encryption: The certificate can be used for data encryption.
Copyright © Sophos Limited
Sophos Mobile
14.26 Configurations for Windows policies
With a Windows policy you configure settings for Windows computers.
14.26.1 Password policies configuration (Windows policy)
With the Password policies configuration you define requirements for the passwords of Windows user accounts.
Note
Password complexity rules (for example length, number of uppercase and lowercase letters) for Windows computers are fixed and cannot be set by a Sophos Mobile policy. For details see
Windows password complexity rules (page 104).
Note
Password policies can’t be assigned to Windows computers if the following conditions are both met:
• There are other local users configured on the device in addition to the user that is enrolled with
Sophos Mobile.
• One or more of these other users are not allowed to change their password.
Setting/Field
Maximum number of failed attempts
Time in minutes until the device is locked
Password history
Maximum password age in days
Description
The number of failed login attempts to enter the correct password before the device is wiped.
Enter a value between 1 and 999 , or 0 for no restriction.
The time period (in minutes) after which the device is locked if it has not been used. The user can unlock the device.
Enter a value between 1 and 999 , or 0 for no restriction.
The number of previously used passwords
Sophos Mobile stores.
When the user sets a new password, it mustn’t match a password that was already used.
The number of days after which users must change their password.
Enter a value between 1 and 730 , or 0 for no restriction.
Copyright © Sophos Limited 267
Sophos Mobile
14.26.2 Restrictions configuration (Windows policy)
With the Restrictions configuration you define restrictions for devices.
Device
Setting/Field
Forbid SD card
Forbid manual addition of non-Microsoft email accounts
Forbid developer mode
Forbid camera
Disable Edge autofill
Disable Edge F12 Developer Tools
Disable Edge pop-up blocker
Disable AutoPlay settings
Disable Date & Time settings
Disable Language settings
Disable Power & Sleep settings
Disable Region settings
Disable Sign-in settings
Disable VPN settings
Description
Users cannot access the storage card. This does not prevent apps from accessing the storage card.
Forbids adding all types of email accounts, as well as Exchange, Office 365 and Outlook.com
accounts.
The Windows developer mode is turned off.
The Privacy setting Let apps use my camera is turned off.
The Save form entries setting in the Edge web browser is turned off and cannot be turned on by the user.
If the check box is cleared, the setting is turned on and cannot be turned off by the user.
The F12 Developer Tools of the Edge web browser are unavailable.
The Block pop-ups setting in the Edge web browser is turned off and cannot be turned on by the user.
If the check box is cleared, the setting is turned on and cannot be turned off by the user.
The relevant sections of the Windows Control
Panel are unavailable. The user cannot change any of these settings after the policy has been assigned to the device.
Note
Disable AutoPlay settings does not affect connected devices, like for example mobile phones.
268 Copyright © Sophos Limited
Sophos Mobile
Setting/Field
Disable Workplace settings
Disable Account settings
Telemetry level
Description
The amount of Windows diagnostic and usage data that devices are allowed to send.
• Full: All data required to identify and analyze issues.
• Enhanced: Data about how Windows and apps are used and how they perform.
• Basic: A limited set of data that’s critical for understanding the device and its configuration.
• Security: Information that is required to keep the device protected with the latest security updates.
Note
Levels are cumulative from bottom to top, e.g.
Enhanced includes all data from Basic and
Security.
Tip
For detailed information on the telemetry levels, see the Microsoft article Configure Windows telemetry in your organization (external link) .
Various
Setting/Field
Forbid Cortana
Forbid “Sync my settings”
Disable Windows tips
Description
Cortana is turned off.
Device settings cannot be synchronized to and from other Windows devices.
The Windows notification setting Show me tips
about Windows is cleared and unavailable.
Wi-Fi
Setting/Field
Forbid internet sharing
Forbid Wi-Fi Sense (hotspot auto-connect)
Description
Internet Connection Sharing (ICS) is turned off.
The device does not automatically connect to
Wi-Fi hotspots.
Copyright © Sophos Limited 269
Sophos Mobile
Setting/Field
Forbid manual configuration
Description
Users can’t configure Wi-Fi connections beyond the connections that are configured by Sophos
Mobile.
Existing user-configured and Wi-Fi Sense Wi-Fi profiles are deleted.
Connectivity
Setting/Field
Forbid Bluetooth
Security and privacy
Setting/Field
Forbid use of location when searching
Unenrollment
Setting/Field
Forbid manual MDM unenrollment
Description
Bluetooth is turned off.
Description
The search cannot utilize location information.
Description
Users cannot delete the workplace account.
14.26.3 Exchange account configuration (Windows policy)
With the Exchange account configuration you set up a connection to a Microsoft Exchange Server email server.
CAUTION
If you use multiple configurations to set up Exchange email accounts, the devices might only be able to retrieve mail for one account. This typically happens when the accounts are located on different Exchange servers and there are different mailbox policies defined on these servers.
Because Windows computers can only enforce a single mailbox policy, they will fail to connect to the accounts that use a different policy.
Note
Windows allows the user to reject all changes that you make to the Exchange configuration.
270 Copyright © Sophos Limited
Setting/Field
Account name
Exchange server
Domain
User
Email address
Password
Synchronization period
Synchronization interval
SSL/TLS
Synchronize content types
Sophos Mobile
Description
The account name.
The Exchange server address.
If you use the Sophos Mobile EAS proxy, enter the URL of the EAS proxy server.
The domain for this account.
The user for this account.
If you enter the variable %_USERNAME_% , the server replaces it with the actual user name.
The email address of the account.
If you enter the variable %_EMAILADDRESS_
% , the server replaces it with the actual email address.
The password for this account.
If you leave this field empty, users must enter the password on their devices.
The time period used for synchronizing emails.
Only the emails from within the specified period are synchronized to the inbox on the managed device.
The interval between email synchronization processes.
The connection to the Exchange server is secured by SSL or TLS (depending on what the server supports).
We recommend that you select this check box.
The content types to be synchronized.
14.26.4 Wi-Fi configuration (Windows policy)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
Configure manually
Select Configure manually to manually configure a Wi-Fi connection.
This option only supports connections with a WPA (Personal) or WPA2 (Personal) security type.
Copyright © Sophos Limited 271
Sophos Mobile
Setting/Field
SSID
Connect automatically
Hidden network
Security type
Description
In this field, enter the ID of the Wi-Fi network.
The connection will be established automatically.
The target network is not open or visible.
Select the security type from the list. If you select WPA (Personal) or WPA2 (Personal) you must specify the password.
Create from existing connection
Select Create from existing connection to create a configuration from an existing Wi-Fi connection on a Windows computer.
Setting/Field
Wi-Fi profile
Description
Upload the profile file of a Windows Wi-Fi connection.
For information on how to create the file, see
Export Windows Wi-Fi profile (page 272).
272
14.26.5 Export Windows Wi-Fi profile
You need to export a Wi-Fi profile from a Windows computer if you want to create a Sophos Mobile Wi-
Fi configuration from an existing connection.
Perform this procedure on a Windows 10 computer on which the Wi-Fi connection is listed under
Known networks.
1. Open a command prompt as an administrator.
2. Check the required profile is available: netsh wlan show profiles
3. Export the profile: netsh wlan export profile "<SSID>" key=clear folder=<Destination>
Replace <SSID> by the profile name and <Destination> by the destination folder of the profile file (for example c:\temp ).
The profile is exported to an XML file. You can use the file in a Sophos Mobile Wi-Fi configuration.
Warning
The XML file contains the unencrypted Wi-Fi password. For security reasons, we strongly recommend you delete the file after you’ve uploaded it to Sophos Mobile.
Related tasks
(page 101)
Copyright © Sophos Limited
Sophos Mobile
You create policies to configure settings for devices. Create several policies if you want to manage different types of devices.
Related reference
Wi-Fi configuration (Windows policy)
(page 271)
With the Wi-Fi configuration you specify settings for connecting to Wi-Fi networks.
14.26.6 Kiosk mode configuration (Windows policy)
With the Kiosk mode configuration you set up a Windows computer to run in kiosk mode.
In kiosk mode, only a single app (the kiosk app) can run. Kiosk mode is turned on when the user associated with the kiosk mode (the kiosk user) logs in.
Note
By default, the computer remains in kiosk mode after a restart. To change this behavior, log into the computer with the kiosk user account, go to Settings > Accounts > Sign-in options, and turn off Use my sign-in info to automatically finish setting up my device after an update or
restart.
Setting/Field
User account
App AUMID
Description
The user associated with the kiosk mode (the kiosk user).
Format:
<computer name>\<user name> (local account)
<domain>\<user name> (domain account)
You can omit the <domain> part if the user name is unique across all domains.
The Application User Model ID (AUMID) of the app that is launched when the kiosk mode is turned on (the kiosk app).
For information on how to obtain the AUMID value, see the
Microsoft document Find the Application User Model ID of an installed app .
14.26.7 IMAP/POP configuration (Windows policy)
With the IMAP/POP configuration you add an IMAP or POP email account to Windows computers.
Setting/Field
Account type
Account name
Description
The type of the email server for incoming email (either
IMAP or POP).
The display name of the email account on the device.
Copyright © Sophos Limited 273
Sophos Mobile
Setting/Field
Email address
User display name
User name
Domain
Password
Server for incoming email
Use SSL/TLS for incoming email
Server for outgoing email
Use SSL/TLS for outgoing email
Authentication required for outgoing connection
Synchronization period
Automatic synchronization
Description
The email address of the account.
Use the variable %_EMAILADDRESS_% to refer to the email address of the user that is assigned to the device.
The display name of the user for outgoing email.
Use the variable %_USERNAME_% to refer to the name of the user that is assigned to the device.
The user name for connecting to the inbound server.
The domain part of the credentials for the inbound server
(if required).
The password for connecting to the inbound server (if required).
The host name (or the IP address) and the port number of the server for incoming email (inbound server).
Format: server name:port number
You don’t need to specify the port number if the standard port is used:
• 143 (IMAP)
• 993 (IMAP with SSL)
• 110 (POP3)
• 995 (POP3 with SSL)
Use Secure Sockets Layer for incoming email transfer.
The host name (or the IP address) and the port number of the server for outgoing email (outbound server).
Format: server name:port number
Use Secure Sockets Layer for outgoing email transfer.
The outbound server requires authentication.
The same credentials as for the inbound server are used, as specified in the User name, Domain and Password fields.
The time period used for synchronizing emails.
Only the emails from within the specified period are synchronized to the inbox on the managed device.
The interval for automatic email synchronization.
274 Copyright © Sophos Limited
Sophos Mobile
14.26.8 Device Guard configuration (Windows policy)
With the Device Guard configuration you configure virtualization-based security (VBS) on Windows computers.
Note
All settings are applied the first time the Windows computer starts after the policy has been assigned.
Setting/Field Description
Turn on virtualization-based security (VBS) Virtualization-based security (VBS) is turned on.
Credential Guard configuration
Platform security level
•
•
•
Turn off: Turn off Credential Guard.
This doesn’t work if Credential Guard was turned on using the Turn on with UEFI lock option.
Turn on with UEFI lock: Turn on Credential
Guard and ensure that it can’t be turned off remotely.
Credential Guard can only be turned off again in the BIOS settings, requiring physical access to the computer.
Turn on without lock: Turn on Credential
Guard.
Credential Guard can be turned off again with the Turn off option, or with a Windows Group
Policy.
•
•
Secure Boot: VBS is turned on with as much protection as is supported by the computer’s hardware.
If the computer doesn’t have input/output memory management units (IOMMUs), VBS uses the Secure Boot UEFI feature.
If the computer has IOMMUs, VBS uses
Secure Boot with direct memory access
(DMA) protection.
Secure Boot and DMA protection: VBS uses Secure Boot with direct memory access
(DMA) protection.
VBS is not turned on if the computer doesn’t support DMA.
Copyright © Sophos Limited 275
Sophos Mobile
14.26.9 Root certificate configuration (Windows policy)
With the Root certificate configuration you install a root certificate onto devices.
Setting
File
Certificate name
Description
Select Upload a file and then select a PKCS #12 (.pfx) certificate file.
The name of the certificate.
Sophos Mobile reads the name from the certificate file.
Note
The certificate is available to other configurations of the same policy. If you require certificates in other policies, you must upload them again.
Tip
You can drag a certificate from File Explorer to the File area to upload it.
14.26.10 Client Certificate configuration (Windows policy)
With the Client certificate configuration you install a client certificate onto Windows computers.
Setting/Field
File
Description
The certificate you want to install.
You can upload PEM and PKCS #12 certificates.
Click Upload a file and then navigate to the file that contains the certificate.
Tip
Alternatively, drag the file from File Explorer to the Upload a file area.
Certificate name
Target store
After you’ve uploaded the certificate file, this field shows the subject value of the certificate.
The certificate store where the certificate is installed:
User: The certificate is available to the user enrolled with Sophos
Mobile.
Device: The certificate is available to all users on the computer.
276 Copyright © Sophos Limited
Setting/Field
Key location
Key is exportable
Container name
Sophos Mobile
Description
The location where the private key of the certificate is stored:
Software: The key is stored in a software-based key store.
TPM or software: The key is stored in TPM if it's available.
Otherwise the key is stored in a software-based key store.
TPM: The key is stored in the Trusted Platform Module (TPM) hardware chip. If the computer doesn’t have a TPM chip or if
TPM is turned off in the BIOS, the certificate is not installed.
Windows Hello for Business: The key is stored in a Windows
Hello for Business container.
Users can also export the private key when they export the certificate.
The name of the Windows Hello for Business container where the private key of the certificate is stored.
14.26.11 SCEP configuration (Windows policy)
With the SCEP configuration you enable devices to request certificates from a Certificate Authority using the Simple Certificate Enrollment Protocol (SCEP).
Setting/Field
Description
URL
Subject
Description
A description for the configuration.
The web address of the Certificate Authority server.
Use the variable %_SCEPPROXYURL_% to refer to the server URL that is configured on the SCEP tab of the Sophos setup page.
The name of the entity (for example person or device) that will receive the certificate.
You can use placeholders for user data or device properties.
The value that you enter (with placeholders replaced by the actual data) must be a valid
X.500 name.
For example:
• Enter CN=%_USERNAME_% to specify a user.
• Enter CN=%_DEVPROP(serial_number)_% to specify an Android device.
For information on available placeholders, see
(page 106).
Copyright © Sophos Limited 277
Sophos Mobile
Setting/Field
Subject Alternative Name
Challenge
Root certificate
Retries
Retry delay
Key size
Key usage
Description
Optionally, configure one or more Subject
Alternative Name (SAN) values.
Click Add and then enter a SAN type and a SAN value.
The web address to obtain a challenge password from the SCEP server.
Use the variable %_CACHALLENGE_% to refer to the challenge URL that is configured on the SCEP tab of the Sophos setup page.
The CA certificate.
Select the certificate from the list. The list contains all certificates that you have uploaded in Root certificate configurations of the current policy.
The number of retries if the server sends a response of type pending.
The number of seconds between retries.
The size of the public key in the issued certificate.
Make sure that the value matches the size configured on the SCEP server.
Select what the certificate can be used for.
Use as digital signature: The certificate can be used as a digital signature.
Use for encryption: The certificate can be used for data encryption.
278 Copyright © Sophos Limited
Sophos Mobile
14.27 Configurations for Chrome Security policies
With a Chrome Security policy you configure settings for the Sophos Chrome Security extension when it’s enrolled with Sophos Mobile.
14.27.1 Web Filtering configuration (Chrome Security policy)
With the Web Filtering configuration you manage the Web Filtering feature of the Sophos Chrome
Security extension. This protects users from browsing sites with malicious, undesirable or illegal content.
Tip
For the purpose of testing website filtering, Sophos has created the site sophostest.com
containing example pages for each category. Although some of these pages are classified as potentially offensive or dangerous, the page content itself is harmless in all cases.
Settings
Setting/Field
Filter malicious websites
Create alerts
Check embedded content
Filter websites by category
Website exceptions
Description
Select whether users can access websites with malicious content.
Select whether an alert is created when the user tries to access a filtered website.
You can select if alerts are only created for blockings or also for warnings.
Web pages are filtered based on their own content and on embedded content like ads. For example if you set the
Gambling category to Block, all gambling websites and all pages containing gambling-related ads are blocked.
If you turn off this option, Web Filtering ignores embedded content unless it’s malicious.
Select whether users can access types of websites.
Websites are categorized based on data from
SophosLabs. The data is updated constantly.
Configure exceptions to the category filters:
Allowed domains: Websites that are allowed, even though the category they belong to is blocked.
Blocked domains: Websites that are blocked, even though the category they belong to is allowed.
Copyright © Sophos Limited 279
Sophos Mobile
How to specify website exceptions
In Allowed domains and Blocked domains, enter one of the following per line (without separator):
• IPv4 or IPv6 address
203.0.113.0
2001:db8:85a3:0:0:8a2e:370:7334
• IPv4 or IPv6 subnet
203.0.113.0/24
2001:db8::/32
• Domain www.example.com
• Wildcard domain. The wildcard * must be the leftmost character.
*.example.com
*example.com
In Blocked domains, you can use a single wildcard * to block all websites.
IP addresses and subnets are ignored if the user refers to a website by its domain name.
Filtering logic
When Web Filtering evaluates whether a website must be allowed or blocked, the allow list takes precedence over the block list, and policy-defined lists take precedence over user-defined lists.
Filtering rules are applied in the following sequence:
1. If the website is included in Allowed domains, it is allowed.
2. If the website is included in Blocked domains, it is blocked.
3. If the user has added the website to the allow list, it is allowed.
4. If the user has added the website to the block list, it is blocked.
5. The website is allowed or blocked based on its category.
280 Copyright © Sophos Limited
Pakua
Kiungo cha umma kime sasishwa
Kiungo cha umma kwa mazungumzo yako kimesasishwa. You may view and manage your chat links after registration here.
Kiungo cha umma cha hati
Tangazo