Sophos Mobile
24 Sophos container
Note
This feature requires a license of type Mobile Advanced.
The Sophos container is a logical area on a device containing the Sophos Secure Workspace and
Sophos Secure Email apps when they are managed by Sophos Mobile.
The Sophos container is available on the following platforms:
• Android
• iOS
24.1 Configure Sophos container enrollment
Note
This feature requires a license of type Mobile Advanced.
To enroll devices with Sophos Mobile using the Sophos container enrollment type, you need to perform the following configuration steps. You need to do this for each platform (Android, iOS) for which you want to use Sophos container enrollment.
1. Create a container policy. See Configurations for Sophos container policies for Android
(page 137)
and Configurations for Sophos container policies for iOS (page 207).
2. Use this container policy in a task bundle.
The task bundle must contain at least an Enroll Sophos container task and an Assign policy task. See
Create task bundle (page 281).
3. Use this task bundle as an initial package for enrollments through the Self Service Portal:
In the Self Service Portal settings, in the Group settings tab, select that task bundle in the Initial
package - corporate devices or Initial package - personal devices field. See
Create Self
Service Portal configurations (page 27).
24.2 Mobile Advanced license
When you activate a Mobile Advanced license, you can use these additional features:
•
Manage the Sophos Secure Workspace and Sophos Secure Email apps. See Manage Sophos container apps
(page 355).
• For Android and iOS devices, manage Sophos Intercept X for Mobile. See
Mobile Threat
Defense with Sophos Intercept X for Mobile (page 336).
After you have received your license key you need to activate the license.
354
Activate a Mobile Advanced license for Sophos Mobile on Premise
For Sophos Mobile on Premise, licenses are managed by the super administrator in customer management. For further information, see the Sophos Mobile super administrator guide .
Copyright © Sophos Limited
Sophos Mobile
Activate a Mobile Advanced license for Sophos Mobile as a Service
In Sophos Mobile Admin, go to Setup > Sophos setup > License and enter your license key in the
Advanced license key field.
24.3 Manage Sophos container apps
Note
This feature requires a license of type Mobile Advanced.
For better data separation on the managed devices, Sophos Mobile provides the Sophos container apps Sophos Secure Email and Sophos Secure Workspace:
• Sophos Secure Email is an app for Android and iOS devices that provides a secure container for managing your email, calendar and contacts.
• Sophos Secure Workspace is an app for Android and iOS devices that allows users to access encrypted files stored in the cloud. Files can be decrypted and viewed in a seamless way.
Encrypted files can be handed over by other apps and uploaded to one of the supported cloud storage providers. Alternatively, the documents can be stored locally within the app.
With Sophos Secure Workspace, you can read files encrypted by SafeGuard Cloud Storage or
SafeGuard Data Exchange. Both are modules of SafeGuard Enterprise or one of its different editions. They allow you to encrypt files using a local key. These local keys are derived from a passphrase that is entered by a user. You can only decrypt a file when you know the passphrase that was used to encrypt the file.
The Sophos container provides:
• Centrally defined password rules
• Password rules for all container apps
• Single-Sign-On for all container apps
• Sophos Secure Workspace document settings
• Sophos Secure Workspace browser settings
• Sophos Secure Email settings
You can manage the Sophos apps with Sophos Mobile as follows:
• You can configure settings for the Sophos container apps on all managed devices remotely and
centrally in Sophos Mobile. See Configurations for Sophos container policies for Android
(page
137) and Configurations for Sophos container policies for iOS (page 207).
• Using compliance policies, you can make sure that the Sophos container apps are installed on the devices.
• You can enable secure distribution of documents using the Corporate Documents storage provider.
See
Corporate documents
(page 315).
• You can enable corporate keyring synchronization between the Sophos Secure Workspace app and Sophos SafeGuard Enterprise. This makes the keys from a user's SafeGuard keyring available
in the Sophos Secure Workspace keyring. See Enable corporate keyring synchronization
(page
357).
Copyright © Sophos Limited 355
Sophos Mobile
356
Note
In order to manage the Sophos container apps, they must be distributed using Sophos Mobile.
If users already have an unmanaged version of Sophos Secure Workspace installed on their devices, they must uninstall it first and then install the managed version.
For further information on Sophos Secure Workspace, see the Sophos Secure Workspace help.
24.4 Reset Sophos container password
Note
This feature requires a license of type Mobile Advanced.
Note
These instructions only apply to devices with a Sophos container policy.
You can reset the Sophos container password. This is useful, for example, when users forget their password. If you reset a Sophos container password, users will be asked to create a new container password.
1. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed.
2. Click the device for which you want to reset the Sophos container password.
The Show device page is displayed.
3. Click Actions.
The Actions menu is displayed.
4. Click Reset Sophos container password.
5. In the dialog box, click Yes to confirm the operation.
The Sophos container password is reset. The user has to enter a new Sophos container password.
24.5 Lock and unlock the Sophos container
Note
This feature requires a license of type Mobile Advanced.
Note
These instructions only apply to devices with a Sophos container policy.
You can lock or unlock the Sophos container, that is, set the access permissions for the Sophos container apps and for data within the Sophos container.
1. On the menu sidebar, under MANAGE, click Devices.
2. On the Devices page, click the blue triangle next to the device for which you want to lock or unlock the Sophos container and then click Show.
3. On the Show device page, click Actions > Set Sophos container access.
4. In the dialog box for setting the access permissions, select one of the following:
Copyright © Sophos Limited
Sophos Mobile
• Deny: The Sophos container is locked. Users can no longer use it.
• Allow: The Sophos container is unlocked.
• Auto mode: The Sophos container is locked as long as the device violates a compliance rule for which Lock container is activated. This is the default behavior if you have not set an access permission.
5. Click Yes.
The device is triggered to synchronize with the Sophos Mobile server. On synchronization, the setting is applied to the device.
24.6 Corporate keyring synchronization
Corporate keyring synchronization adds the following features to the Sophos Secure Workspace app:
• The keys from a user's SafeGuard Enterprise keyring are available in the Sophos Secure
Workspace keyring (SSW keyring).
• Users of the app can then use the keys to decrypt and view documents, or encrypt documents.
• Users can continue to use local keys that were available in their SSW keyring when you enabled keyring synchronization.
• Users cannot create new local keys.
• For security reasons, the keys from the SafeGuard keyring are removed from a device when the
Sophos container is locked.
24.6.1 Enable corporate keyring synchronization
Prerequisites:
• You use Sophos SafeGuard Enterprise 8.0 or later.
• You have configured external user management for the Self Service Portal, using the same
Active Directory user database that is configured in SafeGuard Enterprise.
• Sophos Secure Workspace is managed by Sophos Mobile. This requires a Mobile Advanced license.
• Your Sophos Mobile server can connect to your SafeGuard Enterprise server via HTTPS.
To enable corporate keyring synchronization, you set up a connection between Sophos Mobile and
Sophos SafeGuard Enterprise as follows:
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the SGN tab.
2. Click the Certificate link to download the certificate of the Sophos Mobile server.
3. Open SafeGuard Management Center and go to Tools > Configuration Package Tool.
4. On the Servers tab, click Add, browse for the certificate file and then click OK. Do not change the value of the Server name field.
5. Optional: Select Recovery via mobile to enable the synchronization of BitLocker and FileVault recovery keys with the Sophos Secure Workspace app.
6. On the Managed client packages tab, configure the following settings:
• In the Configuration Package Name field, select Managed Client (Default).
• In the Primary Server field, select your SGN server.
Copyright © Sophos Limited 357
Sophos Mobile
• In the Transport Encryption field, select SSL.
7. Click Create Configuration Package.
8. On the SGN tab of Sophos Mobile Admin, click Upload a file to upload the configuration package that you created in the SafeGuard Management Center to Sophos Mobile.
9. Click Save to save the SafeGuard integration settings.
358 Copyright © Sophos Limited
