Task bundles. Sophos Mobile
Pubblicità
Pubblicità
Sophos Mobile
15 Task bundles
With a task bundle you can bundle several tasks in one transaction.
For example, you can bundle all the tasks to enroll and configure a device:
• Enroll the device.
• Assign required policies.
• Install required apps (for example managed apps for iOS devices).
You can also include wipe commands in task bundles to automatically wipe non-compliant (for
example jailbroken or rooted) devices. For further information, see Compliance policies (page 33).
Task bundles are available for the following platforms:
• Android
• iOS
• macOS
• Windows
• Chrome OS
15.1 Create task bundle
You create separate task bundles for Android, iOS, and other device platforms you want to manage.
To create a task bundle:
1. On the menu sidebar, under CONFIGURE, select Task bundles and then select the platform for which you want to create a task bundle.
2. On the Task bundles page, select Create task bundle.
3. On the Edit task bundle page, enter a name and, optionally, a description for the task bundle.
The version is automatically incremented every time you save the task bundle.
4. Optional: If you select Selectable for compliance actions, you can transfer the task bundle to devices when they become non-compliant.
You configure this in a compliance policy.
5. Optional: For iOS task bundles, select Ignore app installation failures to continue the task bundle processing even if an app installation fails.
This option is only available if the task bundle contains an Install app task.
6. Select Add task and then select a task type.
7. Enter the required information and select Apply to create the task.
The task name is displayed in the Self Service Portal when the task bundle is applied.
8. Optional: Add more tasks to the task bundle, for example to install apps or to display a message on the device.
Note
You can’t mix Android and Android Enterprise tasks.
Copyright © Sophos Limited 281
Sophos Mobile
9. Optional: Change the installation order of the tasks by using the arrow icons on the right-hand side of the tasks list.
Related concepts
Available Android task types (page 282)
(page 285)
(page 287)
(page 289)
Available Chrome OS task types
(page 290)
15.2 Available Android task types
The following task types are available for Android task bundles:
Enroll
When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.
When the task is transferred to a device that is already enrolled, the task is skipped.
Enroll Sophos container
When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.
When the task is transferred to a device that is already enrolled, the task is skipped.
Assign policy
Select a policy. For information on how to add policies to this list, see
When the task is transferred to devices, the policy is silently assigned.
Uninstall policy
Under Select source, select Policies and then select a policy from the list.
In addition to the policies you’ve created in Sophos Mobile, the list includes all policies installed on a managed device.
You can also uninstall a policy that’s not listed if you know its identifier.
You can only uninstall Android device policies and Knox container policies. For other policy types, either update the policy, assign a different policy, or unenroll the device.
282 Copyright © Sophos Limited
Sophos Mobile
Install app
Select an app from the list of available apps. For information on how to add apps to this list, see
When the task is transferred to devices, users receive a notification on their devices that Sophos
Mobile wants to install the app. Users can tap OK to start the process, or Not now to be notified again after a short period of time.
If users tap OK but then tap Cancel in the subsequent Android dialog, the task fails.
If the app is already installed on a device that receives the task, it is updated.
Install managed Google Play app
This task type is available if you have configured Android Enterprise for the customer.
Select an app from the list of managed Google Play apps you’ve approved for your organization. For
information on how to add apps to this list, see Edit managed Google Play app (page 329).
The installation task is sent to a Google service. Google then manages the installation of the app onto the device. On the Task view page, the task is displayed with state successful when it has been sent to Google.
For information on how to uninstall an app from devices, see Uninstall a managed Google Play app
(page 333).
Uninstall app
Under Select source, select Apps to select an app from the list of available apps.
In addition to the apps that are available on the Sophos Mobile server, the list includes apps that are in use on the managed devices - with the exception of Android system apps and apps that have been pre-installed by the device manufacturer.
You can also uninstall an app that is not contained in the list. Select Identifier and then enter the package name of the app you want to uninstall from devices. If you select Knox container app, the app will be uninstall from the Samsung Knox container.
When the task is transferred to devices, users receive a notification on their devices that Sophos
Mobile wants to uninstall the app. Users can tap OK to start the process, or Not now to be notified again after a short period of time.
If users tap OK but then tap Cancel in the subsequent Android dialog, the task fails.
If the app is not installed on a device that receives the task, no notification is displayed.
Send message
Enter a plain text to be displayed on the devices.
When the task is transferred to devices, the message text is displayed in a notification window.
Users can display past messages in the Sophos Mobile Control app.
Copyright © Sophos Limited 283
Sophos Mobile
Unenroll
When the task is transferred to devices, they are unenrolled from Sophos Mobile. See
(page 49). Device users do not need to confirm the operation.
You can’t add an Unenroll task and a Wipe task to the same task bundle.
Wipe
When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.
CAUTION
Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.
Note
When a Wipe task is transferred to an Android Enterprise work profile device, only the work profile and all managed Google Play apps are removed.
You can’t add an Unenroll task and a Wipe task to the same task bundle.
Knox container: lock
When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container is locked.
Knox container: unlock
When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container is unlocked.
Knox container: reset password
When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container password is reset. Users must set a new password to unlock the Knox container.
Knox container: remove
When the task is transferred to a Samsung device that supports Samsung Knox, the Knox container
(including any container-related configuration) is removed.
284 Copyright © Sophos Limited
Sophos Mobile
Scan for malware
When the task is transferred to a device, Sophos Intercept X for Mobile scans it for malware and potentially unwanted apps (PUAs).
This task requires that Sophos Intercept X for Mobile is managed by Sophos Mobile.
15.3 Available iOS task types
The following task types are available for iOS task bundles:
Enroll
When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.
When the task is transferred to a device that is already enrolled, the task is skipped.
Enroll Sophos container
When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.
When the task is transferred to a device that is already enrolled, the task is skipped.
Assign policy
Select a policy. For information on how to add policies to this list, see
When the task is transferred to devices, the policy is silently assigned.
Uninstall policy
Under Select source, select Policies and then select a policy from the list.
In addition to the policies you’ve created in Sophos Mobile, the list includes all policies installed on a managed device.
You can also uninstall a policy that’s not listed if you know its identifier.
You can only uninstall iOS device policies. For other policy types, either update the policy, assign a different policy, or unenroll the device.
Install provisioning profile
Select an app provisioning profile from the list of available profiles. For information on how to add
profiles to this list, see Import iOS provisioning profile
(page 102).
Copyright © Sophos Limited 285
Sophos Mobile
When the task is transferred to devices, the provisioning profile is silently installed.
Uninstall provisioning profile
Under Select source, select Profiles and then select a provisioning profile from the list.
In addition to the profiles that are available on the Sophos Mobile server, the list includes profiles that are in use on the managed devices.
You can also remove a provisioning profile that is not contained in the list. Select Identifier and then enter the identifier of the profile you want to remove from devices.
When the task is transferred to devices, the provisioning profile is silently removed.
Reconfigure SMC app
When the task is transferred to a device, the user is asked to scan a QR code or to enter configuration details manually. This reconnects a previously uninstalled Sophos Mobile Control app to the server.
Note
This task should be preceded by an Install app task for the Sophos Mobile Control app.
Install app
Select an app from the list of available apps. For information on how to add apps to this list, see
When the task is transferred to devices, users receive a notification on their devices that Sophos
Mobile wants to install the app. Users can tap Install to start the process, or Cancel to reject the installation.
If users reject the installation, the task fails.
If the app is already installed on a device that receives the task, it is updated.
Uninstall app
Under Select source, select Apps to select an app from the list of available apps.
In addition to the apps that are available on the Sophos Mobile server, the list includes apps that are in use on the managed devices - with the exception of iOS system apps.
You can also uninstall an app that is not contained in the list. Select Identifier and then enter the bundle ID of the app you want to uninstall from devices.
When the task is transferred to devices, the app is uninstalled silently.
286
Install latest iOS update
When the task is transferred to devices, the latest available update of the iOS software is installed.
Depending on the iOS device model, different updates might be installed.
You can update the iOS software for the following device types:
Copyright © Sophos Limited
Sophos Mobile
• Supervised devices
• Supervised Apple DEP devices
For other devices, the task will fail.
Send message
Enter a plain text to be displayed on the devices.
When the task is transferred to devices, the message text is displayed in a notification window.
Users can display past messages in the Sophos Mobile Control app.
Unenroll
When the task is transferred to devices, they are unenrolled from Sophos Mobile. See
(page 49). Device users do not need to confirm the operation.
You can’t add an Unenroll task and a Wipe task to the same task bundle.
Wipe
When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.
CAUTION
Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.
You can’t add an Unenroll task and a Wipe task to the same task bundle.
15.4 Available macOS task types
The following task types are available for macOS task bundles:
Enroll
When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.
When the task is transferred to a device that is already enrolled, the task is skipped.
Assign device policy
Select a policy from the list of available macOS device policies. For information on how to add policies to this list, see
When the task is transferred to devices, the policy is silently assigned to the device. If a device policy is already assigned, it is replaced.
Copyright © Sophos Limited 287
Sophos Mobile
Assign user policy
Select a policy from the list of available macOS user policies. For information on how to add policies to this list, see
(page 99).
When the task is transferred to devices, the policy is silently assigned to the device. If a user policy is already assigned, it is replaced.
User policies are applied to users the next time they log in to the Mac.
Install app
Select an app from the list of available apps. For information on how to add apps to this list, see
When the task is transferred to devices, the app is silently installed.
PKG package files might contain several apps. In this case, all apps are installed.
Note
A Successful task state means the device has started to download the app. To verify that the app was installed successfully, synchronize the device and check the list of installed apps on the device details page.
Unassign VPP app
Select an app from the list of available macOS VPP apps.
When the task is transferred to devices, the VPP license is removed from devices that have it assigned.
Users can continue to use the app for 30 days.
Unenroll
When the task is transferred to devices, they are unenrolled from Sophos Mobile. See
(page 49). Device users do not need to confirm the operation.
You can’t add an Unenroll task and a Wipe task to the same task bundle.
Wipe
Set a 6-digit system lock PIN.
When the task is transferred to a Mac, it restarts and then begins wiping the disk. The user must enter the system lock PIN on the Mac to unlock it.
You can’t add an Unenroll task and a Wipe task to the same task bundle.
288 Copyright © Sophos Limited
Sophos Mobile
CAUTION
Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.
Tip
In Sophos Mobile Admin, the macOS system lock PIN is displayed on the device page under
Device properties > Unlock passcode and on the Task details page under Lock PIN.
15.5 Available Windows task types
The following task types are available for Windows task bundles:
Enroll
When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.
When the task is transferred to a device that is already enrolled, the task is skipped.
Assign policy
Select a policy from the list of available device policies. For information on how to add policies to this list, see
(page 99).
When the task is transferred to devices, the policy is silently assigned to the device. If a device policy is already assigned, it is replaced.
Install app
Select an app from the list of available apps. For information on how to add apps to this list, see
When the task is transferred to devices, the app is installed silently.
If the app is already installed on a device that receives the task, it is updated.
Uninstall app
Select an app from the list of available apps.
The list includes apps you have configured on the Sophos Mobile server and apps installed on any of the managed Windows computers - with the exception of Windows system apps.
When the task is transferred to devices, the selected app is uninstalled silently.
Copyright © Sophos Limited 289
Sophos Mobile
Note
You can only uninstall apps that have been installed by Sophos Mobile. If you try to uninstall an app installed by the user, the task fails.
Unenroll
When the task is transferred to devices, they are unenrolled from Sophos Mobile. See
(page 49). Device users do not need to confirm the operation.
You can’t add an Unenroll task and a Wipe task to the same task bundle.
Wipe
When the task is transferred to devices, they are reset to their factory settings. Device users do not need to confirm the operation.
CAUTION
Use this task type with care. All data on the devices that receive the task is deleted without user confirmation.
You can’t add an Unenroll task and a Wipe task to the same task bundle.
15.6 Available Chrome OS task types
The following task types are available for Chrome OS task bundles:
Enroll
When the task is transferred to devices, an enrollment email is sent to the email address that is configured for each device. Users must perform the steps that are described in the email to enroll their device.
When the task is transferred to a device that is already enrolled, the task is skipped.
Assign policy
Select a policy. For information on how to add policies to this list, see
When the task is transferred to devices, the policy is silently assigned.
Send message
Enter a plain text to be displayed on the devices.
When the task is transferred to devices, the message text is displayed in a notification window.
Users can display past messages in the Sophos Chrome Security extension.
290 Copyright © Sophos Limited
Sophos Mobile
Unenroll
When the task is transferred to devices, they are unenrolled from Sophos Mobile. See
(page 49). Device users do not need to confirm the operation.
15.7 Duplicate task bundles
You can duplicate a task bundle to use it as a starting point for other task bundles.
When you need to create similar task bundles it is easier to duplicate an existing task bundle and edit the duplicate.
To duplicate a task bundle:
1. On the menu sidebar, under CONFIGURE, select Task bundles and then select a device platform.
2. On the Task bundles page, select the blue triangle next to the task bundle you want to duplicate and then select Duplicate.
The task bundle is duplicated.
15.8 Transfer task bundles
You can transfer task bundles to individual devices or to device groups.
1. On the menu sidebar, under CONFIGURE, click Task bundles and then click Android or iOS.
The Task bundles page is displayed.
2. Click the blue triangle next to the required task and then click Transfer.
The Select devices page is displayed.
3. On this page, you can:
• Select individual devices you want to transfer the task bundle to.
• Click Select device groups, to open the Select device groups page and select one or several device groups for transferring the task bundle.
4. After you have made your selection, click Next.
The Set execution date page is displayed.
5. Under Scheduled date, select Now or specify a date and time for the task to be carried out.
6. Click Finish.
The Task view page is shown.
The task bundle is transferred to the selected devices at the specified date and time.
Copyright © Sophos Limited 291
Scarica
Link pubblico aggiornato
Il link pubblico alla tua chat è stato aggiornato. Puoi visualizzare e gestire i tuoi link di chat dopo la registrazione qui.
Link pubblico del documento
Pubblicità