17 Work with profiles. Sophos Mobile Control
Anúncio
Anúncio
Administrator guide
17 Work with profiles
In the web console under Profiles, you can create and transfer settings profiles for Apple iOS,
Android, Windows Phone 8 and Windows Mobile devices.
For iOS devices, you can also upload profiles created with the iPhone Configuration Utility and transfer them to devices.
For Windows Mobile devices, you can manage templates for settings profiles. They define the setting options available for web console users. Templates are supplied by Sophos.
Note: For Android devices, supported settings may depend on vendor specific APIs. Depending on the end user device, some settings may not have any effect. For further information, refer to the feature matrix in the Sophos Mobile Control technical guide.
17.1 Create profiles for Apple iOS devices
Sophos Mobile Control offers two methods for creating profiles for iOS devices:
■
You can create iOS profiles directly in the web console.
■ You can import profiles created with the Apple iPhone Configuration Utility into the web console.
17.1.1 Create iOS profiles in the web console
1. In the web console menu bar, go to Profiles and click Apple iOS.
The Profiles view is displayed.
2. Click the Create new profile button.
The Edit profile view is displayed.
3. Enter a Name and a Version for the new profile.
4. In the ID field, enter a unique ID for the profile.
Note: Special characters like ä or ö or spaces are not supported in iOS profile IDs.
5. In the Organization field, enter the name of the organization for the profile, for example a company name.
6. In the Description field, enter a description for the profile.
7. In the User can remove profile field, you can select whether users may remove the profile from their device:
■
Always
59
Sophos Mobile Control
■
With authentication
■
If you select this option, the Authentication password field is displayed below the User
can remove profile field. Enter the password required for removing the profile. To enable users to remove the profile, provide them with the password.
Never
8. In the Automatically remove on field, you can enter a date for the automatic removal of the profile from end user devices. The profile will be removed on the set date at 11 pm.
9. Under Operating systems, select the operating system the profile should apply to.
Note: The Operating systems field shows all iOS versions that are currently available in the system. Not all configuration settings may be supported for individual iOS versions. If you select all versions under Operating systems, some settings may not have any effect depending on the iOS version on the end user device.
10. Click the Add button to add configurations with iPhone configuration settings to the profile.
The Available configurations view is displayed.
11. Select the configuration you want to add and click Next.
The settings view of the configuration is displayed.
12. Specify the required settings. For a detailed list of all configurations and settings available, see
(section 17.1.2).
13. Click the Apply button to save your changes.
The configuration is displayed in the Edit profile view under Configurations.
14. Add further configurations as required.
15. After you have added all required configurations, click the Save button.
The profile is available for transfer. It is displayed in the Profiles view.
17.1.2 Available iOS configurations
The following configurations are available for iOS profiles in the Available configurations view when you create or edit a profile. Some configurations can be added only once within a profile, others several times.
Note: Supported settings may depend on the iOS version in use on individual devices. Depending on the end user device, some settings may not have any effect. The web console indicates if any setting is supported only since a particular iOS version or only in supervised mode. In the following descriptions, the relevant information is included at the beginning of the section or in a minimum requirements column, if applicable.
60
Administrator guide
Password policies
In this configuration, you can define password rules for devices. You can only add one Password
policies configuration within a profile.
Setting/field
Allow simple value
Require alphanumeric value
Minimum password length
Minimum number of complex characters
Maximum password age (1 - 730 days or none)
Maximum Auto-Lock (in minutes)
Password history (1 to 50 or 0)
Maximum grace period for device lock
Description
If you select this option, users are allowed to use sequential or repeated characters in their password, for example "1111" or "abcde".
If you select this option, passwords must contain at least one letter or number.
Specifies the minimum number of characters a password must contain.
Specifies the minimum number of non-alphanumeric characters (for example & or !) a password must contain.
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
In this field, you can specify when (in minutes) the device should be locked after it has not been used.
This setting specifies the maximum value the user is allowed to configure on the device.
In this field, you can specify how many old passwords are remembered and compared with new ones. When the user defines a new password, it will not be accepted, if it matches a previously used password. Value range: 1 to 50 or 0 (no password history).
In this field, you can specify how long the device can be unlocked after a lock without a password prompt. This setting specifies the maximum value the user is allowed to configure on the device. If you select None, the user can select any of the intervals available. If you select Immediately, users must enter a password every time they unlock their devices.
61
Sophos Mobile Control
Setting/field Description
Maximum number of failed attempts until device wipe
In this field, you can specify the maximum number of failed attempts to enter the correct password before the device is wiped. After six failed attempts, a time delay is imposed before a password can be entered again. The delay increases with each failed attempt. After the final failed attempt, all data and settings are securely removed from the device. The time delay starts after the sixth attempt. So if you set this value to 6 or lower, no delay is imposed and the device is wiped when the attempt limit is exceeded.
Restrictions
In this configuration, you can define restrictions for devices. You can only add one Restrictions configuration within a profile.
Setting/field
Device
Allow installing apps
Description Minimum requirements
Allow use of camera
Allow FaceTime
Allow screen capture
Allow automatic sync while roaming
If you deactivate this option, the App Store is disabled and its icon is removed from the
Home screen. Users cannot install or update apps through the App Store or iTunes.
If you deactivate this option, cameras are completely disabled on the device and the
Camera icon is removed from the Home screen. Users cannot take pictures, record videos, or use FaceTime.
If you deactivate this option, users cannot place or receive FaceTime video calls.
If you deactivate this option, users cannot take a screenshot of the display.
If you deactivate this option, devices that are roaming will only sync when the user accesses an account.
62
Administrator guide
Setting/field Description Minimum requirements
Allow Siri
Allow Siri while device is locked
Allow Siri querying content from the web
If you deactivate this option, Siri will not query content from the web.
Force Siri profanity filter
If you deactivate this option, the Siri profanity filter is not forced on the device.
7.0+ supervised
6.0+ supervised
Allow voice dialing
If you deactivate this option, users cannot use
Siri, voice commands, or dictations.
5.0+
If you deactivate this option, users must unlock their devices by entering their password before they use Siri.
6.0+
Allow Passbook while device is locked
Allow In-App purchase
If you deactivate this option, users cannot dial by using voice commands.
If you deactivate this option, a device does not show Passbook notifications while locked.
6.0+
If you deactivate this option, users cannot make in-app purchases.
Force user to enter store password for all purchases
Allow multiplayer gaming
Allow Game Center
Allow adding Game Center friends
Allow find my friends modification
Allow host pairing
If you select this option, users have to enter their Apple ID password to make any purchase. Usually, there is a brief grace period after a purchase before users have to authenticate for subsequent purchases.
5.0+
If you deactivate this option, users cannot play multiplayer games in Game Center.
If you deactivate this option, Game Center cannot be used on the device.
6.0+ supervised
If you deactivate this option, users cannot add friends in Game Center.
If you deactivate this option, modifications to the Find my Friends app are disabled.
7.0+ supervised
If you deactivate this option, host pairing is disabled with the exception of the supervision host. If no supervision host certificate has been configured, all pairing is disabled.
7.0+ supervised
63
Sophos Mobile Control
Setting/field Description Minimum requirements
Allow AirDrop
Allow Control Center on lock screen
If you deactivate this option, content sharing with AirDrop is not allowed on the device.
7.0+ supervised
If you deactivate this option, settings cannot be managed with Control Center when the device screen is locked.
7.0+
Allow Notification Center on lock screen
If you deactivate this option the Notification
Center is not available when the device screen is locked.
7.0+
Allow Today view on lock screen
If you deactivate this option the Today view is not available when the device screen is locked.
Allow over-the-air PKI updates
7.0+
If you deactivate this option, over-the-air PKI updates are not possible.
7.0+
Allow iBooks store
Allow explicit sexual content in iBooks store
Allow users to install configuration profiles
Allow iMessage
Allow app removal
If you deactivate this option, users cannot purchase books in iBooks.
6.0+ supervised
If you deactivate this option, explicit sexual content is not available through iBooks store.
6.0+ supervised
If you deactivate this option, users cannot install configuration profiles.
6.0+ supervised
If you deactivate this option, users cannot use iMessage for texting.
6.0+ supervised
If you deactivate this option, users cannot remove apps from the device.
6.0+ supervised
Company data
Allow documents to be shared only within managed apps/accounts
With this setting you can define a restriction on opening documents with apps/accounts
(for example a company email account) managed by Sophos Mobile Control. For example: If this option is selected, and users have an email account managed by Sophos
Mobile Control and apps managed by Sophos
Mobile Control on their devices, attachments from the managed email account can only be opened with managed apps. Thereby you can
7.0+
64
Administrator guide
Setting/field
Allow documents to be shared only within unmanaged apps/accounts
Description Minimum requirements
prevent corporate documents from being opened in unmanaged apps.
With this setting you can define a restriction on opening documents with apps/accounts
(for example a private email account) not managed by Sophos Mobile Control. For example: If this option is selected, and users have an email account and apps not managed by Sophos Mobile Control on their devices, attachments from the unmanaged email account can only be opened with unmanaged apps. Thereby you can prevent personal documents from being opened in managed apps.
7.0+
Applications
Allow use of YouTube
Allow use of iTunes Store
Allow use of Safari
Enable autofill
Force fraud warning
If you deactivate this option, the YouTube app is disabled and its icon is removed from the Home screen.
Note: This setting only applies to iOS versions older than version 6.
4.0-5.0
If you deactivate this option, the iTunes Store is disabled and its icon is removed from the
Home screen. Users cannot preview, purchase or download content.
If you deactivate this option, the Safari web browser is disabled and its icon is removed from the Home screen. This also prevents users from opening web clips.
If you deactivate this option, Safari does not autofill web forms with previously entered information.
5.0+
If you select this option, Safari attempts to prevent users from visiting websites identified as fraudulent or compromised.
5.0+
65
Sophos Mobile Control
Setting/field
Enable JavaScript
Block pop-ups
Accept cookies
Description Minimum requirements
If you deactivate this option, Safari ignores
JavaScript on websites.
6.0-6.1
If you select this option, Safari blocks popups.
5.0+
In this field, you can specify if cookies should be accepted:
■ Always
■ Never
■ From visited sites
5.0+
If you deactivate this option, users cannot change the cellular data usage per app.
7.0+ supervised Allow modification of cellular data usage per app iCloud
Allow backup
Allow document sync
Allow Photo Stream
Allow shared photo streams
Allow keychain sync
If you select this option, users can back up their devices to iCloud.
If you select this option, users can store documents in iCloud.
5.0+
5.0+
If you select this option, users can enable
Photo Stream.
Note: If you install a configuration profile that restricts the use of Photo Stream, Photo
Stream photos will be removed from the user's device. Photos will not be sent from the
Camera Roll to Photo Stream. If there are no further copies of these photos, they may be lost.
5.0+
If you select this option, users can invite others to view their photo streams and can view photo streams shared by others.
6.0+
If you deactivate this option, the iCloud feature Keychain for synchronizing passwords across different iOS and OS X devices is not allowed on the device.
7.0+
Security and privacy
66
Administrator guide
Setting/field Description Minimum requirements
Allow diagnostic data to be sent to Apple
Allow user to accept untrusted
TLS certificates
Allow account modification
Allow Touch ID to unlock a device
Force limit ad-tracking
Force encrypted backups
If you deactivate this option, iOS diagnostic information is not sent to Apple.
If you deactivate this option, users are not asked if they want to trust certificates that cannot be verified. This setting applies to
Safari and to Mail Contacts and Calendar accounts.
5.0+
5.0+
If you deactivate this option, account modification is disabled. The Accounts menu is not available on the device.
7.0+ supervised
If you deactivate this option, the device cannot be unlocked by Touch ID.
7.0+
If you select this option, anonymous user data apps use for targeting ads are no longer provided.
7.0+ supervised
If you select this option, users must encrypt backups in iTunes.
7.0+ supervised
Content ratings
Allow explicit music and podcasts
If you deactivate this option, explicit music or video content is hidden in the iTunes Store.
Explicit content is flagged by content providers, for example record labels, when listed on the iTunes Store.
Roaming/Hotspot settings
Minimum requirement: iOS version 7.0+
In this configuration, you can define settings for roaming and personal hotspots.
Note: Users can change these settings on their devices anytime.
Setting/field
Enable voice roaming
Description
If you deactivate this setting, voice roaming is disabled on the device.
67
Sophos Mobile Control
Setting/field
Enable data roaming
Enable personal hotspot
Description
If you deactivate this setting, data roaming is disabled on the device.
If you deactivate this setting, the device cannot be configured to serve as a personal hotspot.
Exchange ActiveSync
In this configuration, you can define user settings for your Microsoft Exchange Server. You can add multiple Exchange ActiveSync configurations.
Setting/field
Account name
Exchange ActiveSync Host
Allow move
Allow recent address syncing
Use only in mail
SSL
Description Minimum requirements
In this field, enter the account name for the Exchange ActiveSync account.
In this field, enter the Microsoft
Exchange Server.
If you deactivate this option, users cannot move messages sent or received by this account to a different mail account. This also prevents using a different account to reply or forward a message from this account.
5.0+
If you deactivate this option, recently used addresses are not synchronized with other devices using iCloud.
6.0+
If you select this option, this account can only be used to send messages from Mail. It cannot be selected as a sending account for messages created with other apps, for example Photos or Safari.
5.0+
Make sure that this option is selected, to send all communication through
SSL (Secure Socket Layer).
68
Setting/field
Domain
User
Email address
Password
Synchronization period
Administrator guide
Description
In this field, enter the domain of your environment. You can also leave this field empty.
In this field, enter the user for this account. You can use the variable
%_USERNAME_% and the server will replace it with the actual user name, if the device the profile is sent to has an LDAP link established.
In this field, enter the email address of the account. You can use the variable
%_EMAILADDRESS_% and the server will replace it with the actual email address, if the device the profile is sent to has an LDAP link established.
In this field, enter the password for this account.
In this field, select the time period for email synchronization. This is the number of days, emails are synchronized for. If you specify a time period here, not all emails are synchronized to the inbox on the mobile device, but only the emails from within the specified period. You can select the following synchronization periods:
■ Unlimited
■ One day
■ Three days
■ One week
■ Two weeks
■ One month
Minimum requirements
69
Sophos Mobile Control
Setting/field Description Minimum requirements
Identity certificate
In this field, select the identity certificate for the connection to
ActiveSync. If no certificate is available for selection, a message is displayed.
WiFi
In this configuration, you specify settings for connecting to WiFi networks. You can add multiple
WiFi configurations.
Setting/field
SSID
Connect automatically
Hidden network
Security type
Description Minimum requirements
In this field, enter the ID of the wireless network.
Select this option, to automatically connect to the target network.
5.0+
Select this option, if the target network is not open or visible.
In this field, you select the security type of the Wifi network:
■ None
■ WEP
■ WPA/WPA2
■ Any (personal)
■ Corporate WEP
■ Corporate WPA/WPA2
■ Any (company)
If you select the personal settings WEP,
WPA/WPA2 or Any (personal), a
Password field is displayed. Enter the relevant password.
If you select the corporate settings
Corporate WEP, Corporate WPA/WPA2
70
Setting/field
Proxy
Administrator guide
Description
or Any (company), the two tabs Protocols and Authentication are displayed.
In the Protocols tab configure the following:
■ Under Accepted EAP types, specify the
EAP methods to be used for authentication. Depending on the types selected here, the values in the Internal
identity field in this tab become available for selection.
■ Under EAP-FAST, configure the
EAP-FAST Protected Access credential settings.
In the Authentication tab, you specify authentication settings:
■ In the User field, enter the user name for the connection to the wireless network.
■ Select Use Per-Connection Password, if the password is to be queried for each connection and transferred with the authentication.
■ In the Password field, enter the relevant password.
■ In the Identity certificate field, select the certificate for the connection to the wireless network.
■ In the External identity field, enter the externally visible ID (for TTLS, PEAP and EAP-FAST).
In this field, select the proxy settings for the WiFi connection:
■ None
■ Manually
■ Automatic
If you select Manually, the fields Server
and port, Authentication and Password
Minimum requirements
71
Sophos Mobile Control
Setting/field Description Minimum requirements
are displayed. Enter the required proxy information. If you select Automatic, the field Proxy server URL is displayed. Enter the URL of the proxy server.
VPN
In this configuration, you can define VPN settings for network connections. You can add multiple
VPN configurations.
Setting/field
Connection name
Connection type
Server (both connection types)
Account (both connection types)
Group (connection type Cisco AnyConnect)
User authentication (connection type Cisco
AnyConnect)
Description
In this field, enter the name of the connection shown on the device.
In this field, select the connection type:
■ Cisco AnyConnect
■ IPSec (Cisco)
Different entry fields are shown in the VPN view depending on the connection type you select here.
In this field, enter the host name or the IP address of the server.
In this field, enter the user account for the authentication of the connection.
In this field, enter the group that may be required for the authentication of the connection.
In this field select the type of user authentication for the connection:
■ Password
If you select this option, the Password field is shown below the User Authentication field.
Enter the password for authentication.
■ Certificate
72
Administrator guide
Setting/field
Device authentication (connection type IPSec
(Cisco))
Proxy (both connection types)
Description
If you select this option, the Certificate field is shown below the User Authentication field.
Select a certificate.
In this field, select the type of device authentication:
■ Keys (Shared Secret)/Group name
If you select this option, the fields Group name,
Keys (Shared Secret), Use hybrid authentication and Request password are displayed below the
Device authentication field. Enter the required authentication information in the Group name and Keys (Shared Secret) fields. Select Use
hybrid authentication and Request password as required.
■ Certificate
If you select this option, the fields Certificate and Including user PIN are displayed below the
Device authentication field. In the Certificate field, select the required certificate. Select
Including user PIN to include the user PIN in device authentication.
In this field, select the proxy settings for the connection:
■ None
■ Manually
If you select this option, the fields Server and
port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server.
In the Authentication field, enter the user name for the connection to the proxy server. In the
Password field, enter the password for the connection to the proxy server.
■ Automatic
If you select this option, the Proxy server URL field is displayed. Enter the URL of the server with the proxy setting in this field.
73
Sophos Mobile Control
Per app VPN
Minimum requirement: iOS version 7.0+
In this configuration, you can define VPN settings to support the iOS feature "Per app VPN". With this feature, apps can be configured to automatically connect to VPN when they are launched. So you can for example ensure that data transmitted by managed apps travels through VPN.
After you have set up per app VPN configurations, you can select a configuration in the Edit
package view of an application, see
Configure per app VPN and settings for iOS apps
(section 16.2).
Setting/field
Connection name
Connection type
Server (both connection types)
Account (both connection types)
Group (connection type Cisco AnyConnect)
User authentication (connection type Cisco
AnyConnect)
Device authentication (connection type IPSec
(Cisco))
Description
In this field, enter the name of the connection shown on the device.
In this field, select the connection type:
■ Cisco AnyConnect
■ IPSec (Cisco)
Different entry fields are shown in the VPN view depending on the connection type you select here.
In this field, enter the host name or the IP address of the server.
In this field, enter the user account for the authentication of the connection.
In this field, enter the group that may be required for the authentication of the connection.
In this field select the type of user authentication for the connection:
■ Password
If you select this option, the Password field is shown below the User Authentication field.
Enter the password for authentication.
■ Certificate
If you select this option, the Certificate field is shown below the User Authentication field.
Select a certificate.
In this field, select the type of device authentication:
■ Keys (Shared Secret)/Group name
74
Administrator guide
Setting/field
Proxy (both connection types)
Connect automatically on demand
Description
If you select this option, the fields Group name,
Keys (Shared Secret), Use hybrid
authentication and Request password are displayed below the Device authentication field.
Enter the required authentication information in the Group name and Keys (Shared Secret) fields. Select Use hybrid authentication and
Request password as required.
■ Certificate
If you select this option, the fields Certificate and Including user PIN are displayed below the
Device authentication field. In the Certificate field, select the required certificate. Select
Including user PIN to include the user PIN in device authentication.
In this field, select the proxy settings for the connection:
■ None
■ Manually
If you select this option, the fields Server and
port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server.
In the Authentication field, enter the user name for the connection to the proxy server. In the
Password field, enter the password for the connection to the proxy server.
■ Automatic
If you select this option, the Proxy server URL field is displayed. Enter the URL of the server with the proxy setting in this field.
Select this field to ensure that the connection to
VPN is established automatically.
Single sign-on
Minimum requirement: iOS version 7.0+
In this configuration, you can define settings for a single sign-on for third-party apps.
75
Sophos Mobile Control
Setting/field
Name
Kerberos principal name
Realm
Description
A human-readable name for the account.
Optional. The Kerberos principal name. If not provided, the user is prompted for a name during profile installation.
The Kerberos realm name. This value should be properly capitalized.
In the URLs tab, you can optionally set up a list of URL prefixes that must be matched to use this account for Kerberos authentication through HTTP. If you do not specify prefixes here, the account matches all http:// and https:// URLs.
In the App identifiers tab, you can optionally set up a list of app identifiers that are allowed to use this login. If you do not specify app identifiers here, the login matches all identifiers.
Single app mode
Minimum requirements: iOS version 6.0+ supervised
In this configuration, you can define settings for the single mode that locks end user devices into a single app and prevents users from changing to other apps.
Setting/field
Select source
Options
Disable touch
Disable rotation
Description Minimum requirements
In this field, you can select the source for the single app:
■ If you select App list, the Apps dropdown list is displayed with a list of all available iOS apps for this customer. Select the app from the list and click Apply.
■ If you select Custom, the field App
identifier is displayed. Enter the app identifier and click Apply.
Select this option to disable touch for single app mode.
Select this option to disable rotation for single app mode.
7.0+
76
Administrator guide
Setting/field
Disable volume buttons
Disable ringer switch
Disable sleep wake button
Disable auto lock
Enable voice over
Enable zoom
Enable invert colors
Enable AssistiveTouch
Enable speak selection
Enable mono audio
User enabled options
Voice over
Zoom
Invert colors
AssistiveTouch
Description Minimum requirements
Select this option to disable volume buttons for single app mode.
Select this option to disable ringer switch for single app mode.
Select this option to disable the wake button for single app mode.
Select this option to disable auto lock for single app mode.
Select this option to enable voice over for single app mode.
Select this option to enable zoom for single app mode.
Select this option to enable the inversion of colors for single app mode.
Select this option to enable AssistiveTouch for single app mode.
Select this option to enable speak selection for single app mode.
Select this option to enable mono audio for single app mode.
Select this option to allow Voice Over adjustment.
Select this option to allow Zoom adjustment.
Select this option to allow Invert Colors adjustment.
Select this option to allow AssistiveTouch adjustment.
7.0+
77
Sophos Mobile Control
Web clip
In this configuration, you can define web clips to be added to the Home screen of user devices.
Web clips provide fast access to favorite web pages. But you can also add a web clip with a support phone number for example, to provide a quick way to dial the helpdesk. You can add multiple
Web clip configurations.
Setting/field
Description
URL
Can be removed
Full screen
Description
In this field, enter a description for the web clip.
In this field, enter the URL for the web clip.
If you deactivate this option, the user cannot remove the web clip. It cannot be deleted from the device unless the user removes the profile that installed it.
If you select this option, the web clip is opened full screen on the device. A full screen web clip opens the URL as a web app.
APN
With this configuration, you can change the device's Access Point Name (APN) and cell network proxy settings. These settings define how devices connect to the carrier's network. You can only add one APN configuration within a profile.
Note: If these settings are not correct, the device cannot access data using the cellular network.
To undo settings changes, the profile must be removed from the device.
Setting/field
Access point name (APN)
User name for access point
Password for access point
Description
In this field, enter the name of the access point of the carrier (GPRS).
In this field, enter the user name for the access point.
Note: iOS supports APN user names of up to 64 characters.
In this field, enter the password for the access point.
Note: iOS supports APN passwords of up to 64 characters.
78
Administrator guide
Setting/field
Proxy server and port
Description
In this field, you can enter the valid address and the port of the proxy server.
Web content filter
Minimum requirements: iOS version 7.0+ supervised
In this configuration, you can define URL blacklists and whitelisted bookmarks.
Setting/field
Blacklist
Whitelist with bookmarks
Description
Select this field to define a blacklist of URLs that may not be accessed on end user devices. Click Next to display the Web Content Filter view. In this view, you can add individual URLs or import blacklisted URLs from a .csv file.
Note: If you do not have a .csv file with blacklisted
URLs yet, you can download a sample file from the
Import blacklist view in the web console and use it for creating your import file.
In the Web Content Filter view, the Export
blacklist button is available for exporting the blacklist configured in the web console to a .csv file.
Select this field, to define a whitelist with bookmarks to be added to the Safari browser on end user devices. All other sites are blocked. Click
Next to display the Web Content Filter view. In this view, you can add individual URLs as bookmarks.
Global HTTP proxy
Minimum requirement: supervised
Note: This configuration is only effective for supervised devices.
With this configuration, you can configure a single corporate proxy server. You can only add one
Global HTTP proxy configuration within a profile.
79
Sophos Mobile Control
Setting/field
Global proxy
Description
In this field, select the proxy settings for the connection:
■ Manually
If you select this option, the fields Server and
port, Authentication and Password are displayed. In the Server and port field, enter the valid address and the port of the proxy server.
In the Authentication field, enter the user name for the connection to the proxy server. In the
Password field, enter the password for the connection to the proxy server.
■ Automatically
If you select this option, the Proxy server URL field is displayed. Enter the URL of the server with the proxy setting in this field.
Root certificate
In this configuration, you can upload a root certificate for devices. You can add multiple Root
certificate configurations. In the File field, browse for the relevant certificate and click Upload.
The name of the certificate is shown in the Certificate name field.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
Client certificate
In this configuration, you can upload a client certificate for devices. You can add multiple Client
certificate configurations. In the File field, browse for the relevant certificate and click Upload.
The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
SCEP
In this configuration, you can define settings that allow the devices to obtain certificates from a
Certificate Authority by using Simple Certificate Enrollment Protocol (SCEP). You can only add one SCEP configuration within a profile.
Note: This configuration is only available, if SCEP has been configured during Sophos Mobile
Control setup. SCEP needs to be enabled during Sophos Mobile Control installation, see the Sophos
Mobile Control installation guide. A super administrator can then configure the required SCEP
80
Administrator guide
settings in the web console, see the Sophos Mobile Control super administrator guide. The settings defined are transferred to iOS profiles.
Note: Super administrators are not supported for Sophos Mobile Control as a Service.
Setting/field
URL
Name
Subject
Type of subject alternative name
Challenge
Retries
Retry delay
Description
In this field, enter the URL of the SCEP server.
In this field, enter a name that is understood by the
Certificate Authority. The name can for example be used to distinguish between instances.
In this field, enter the representation of an X.500
name as an array of OID and value. For example:
/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar. This translates to: [ [ [“C”, “US”] ], [ [“O”, “Apple Inc.”]
], ..., [ [ “1.2.5.3”, “bar” ] ] ]
In this field, select the type of an alternative name for the SCEP server:
■ None
■ RFC 822 name (email address)
■ DNS name
■ Uniform Resource Identifier
If you select any other option than None, the fields
Value of subject alternative name and NT user
login name are displayed below the field Type of
subject alternative name. Enter the required name values.
In this field, enter a pre-shared secret the SCEP server can use to identify the request or user.
Note: If the SCEP module of the Sophos Mobile
Control server is used, this field is prefilled with
%_CACHALLENGE_%. Do not change this value.
In this field, enter the number of retries if the server sends a "pending" response.
In this field, enter the number of seconds between retries.
81
Sophos Mobile Control
Setting/field
Key size
Use as digital signature
Use for encryption
Signature
Description
In this field, select the key size:
■ 1024
■ 2048
Select this option to define the use as a digital signature as acceptable for the key.
Select this option to define the use for encryption as acceptable for the key.
In this field, enter a hexadecimal character string as a signature.
17.1.3 Import iOS profiles created with the Apple iPhone Configuration Utility
You can import profiles created with the Apple iPhone Configuration Utility into the web console.
Note: The Apple iPhone Configuration Utility is available for installation here:
■
For Windows:
http://support.apple.com/kb/DL1466
■
For Mac OS X:
http://support.apple.com/kb/DL1465
1. After you have created a profile in the Apple iPhone Configuration Utility, export it
(unencrypted and unsigned) and save it on your computer.
2. In the web console, go to Profiles and click Apple iOS.
The Profiles view is displayed.
3. Click the Import profile button.
The Edit profile view is displayed.
4. Enter a Name and a Version for the new profile.
5. Under Operating systems, select the operating system the profile should apply to.
6. Browse for the profile you have saved on your computer and click Upload.
The profile is displayed in the Edit profile view.
7. Click the Save button.
The profile is available for transfer. It is displayed in the Profiles view.
82
Administrator guide
17.2 Create profiles for Android and Windows Phone 8 devices
1. In the web console, go to Profiles and click Android or Windows Phone 8.
The Profiles view is displayed.
2. Click the Create new profile button.
The Edit profile view is displayed.
3. Enter a Name and a Version for the new profile.
4. For Android profiles: In the ID field, enter a unique ID for the profile.
Note: This step does not apply for Windows Phone 8 profiles, where the ID field is not available.
5. In the Description field, enter a description for the profile.
6. Under Operating systems, select the operating system the profile should apply to.
7. Click the Add button to add configurations with Android/Windows Phone 8 configuration settings to the profile.
The Available configurations view is displayed.
8. Select the configuration you want to add and click Next.
The settings view of the configuration is displayed.
9. Specify the required settings. For a detailed list of all configurations and settings available, see
Available Android configurations
(section 17.2.1) or
Available Windows Phone 8 configurations
(section 17.2.2).
10. Click the Apply button to save your changes.
The configuration is displayed in the Edit profile view under Configurations.
11. After you have added all required configurations, click the Save button.
The profile is available for transfer. It is displayed in the Profiles view for Android or Windows
Phone 8.
17.2.1 Available Android configurations
The following configurations are available for Android profiles in the Available configurations view when you create or edit a profile. Some configurations can be added only once within a profile, others several times.
Note: Supported settings may depend on vendor specific APIs and on the on the Android version in use on individual devices. Depending on the end user device, some settings may not have any effect. In the individual configuration, the web console shows labels to indicate if any setting is supported as of a particular Android version or only for devices with the Samsung Safe plugin
(for example SAFEv2+) or with an active TouchDown email client (TouchDown). In the following
83
Sophos Mobile Control
settings descriptions the relevant information is included at the beginning of the section or in a minimum requirements column, if applicable.
Password policies
In this configuration, you can define password rules for devices. You can only add one Password
policies configuration within a profile.
When you select the Password policies configuration, the Password type field is displayed. In this field, select the type of password you want to define:
■
Any
If you select this setting, users have to set a password on their devices. But there are no requirements or restrictions concerning the password. If you have selected this option, no further settings are required for the Password policies configuration.
■
Alphabetic
■
PIN
■
Alphanumeric
■
Complex
If you select Alphabetic, PIN or Alphanumeric, the following fields are displayed:
Setting/field
Minimum password length
Idle time in seconds before password prompt
Maximum password age (in days)
Maximum number of failed attempts
Minimum history length
Description
Specifies the minimum number of characters a password must contain.
In this field, you can specify when (in seconds) the device should be locked after it has not been used.
The device can be unlocked by entering the password.
Requires users to change their password in the specified interval (in days).
In this field, you can specify the maximum number of failed attempts to enter the correct password before the device is wiped.
In this field, you can specify how many old passwords are remembered and compared with new ones. When the user defines a new password, it will not be accepted, if it matches a previously used password. Value range: 1 to 5 or none.
84
Administrator guide
If you select Complex, the following fields are displayed in addition to the fields shown for the other password types:
Setting/field
Minimum number of letters
Minimum number of lowercase letters
Minimum number of uppercase letters
Minimum number of non-alphabetic characters
Minimum number of numbers
Minimum number of special characters
Description
Specifies the minimum number of letters a password must contain.
Specifies the minimum number of lowercase letters a password must contain.
Specifies the minimum number of uppercase letters a password must contain.
Specifies the minimum number of non-alphabetic characters (for example & or !) a password must contain.
Specifies the minimum number of numbers a password must contain.
Specifies the minimum number of special characters
(for example !"§$%&/()=,.-;:_@<>) a password must contain.
Restrictions
In this configuration, you can define restrictions for devices. You can only add one Restrictions configuration within a profile.
Setting/field
Allow factory reset
Allow settings changes
Allow backup
Description Minimum requirements
If you deactivate this option, users cannot reset their devices to factory state.
SAFEv2+
If you deactivate this option, users cannot change settings on the device. Depending on individual devices the settings icon is removed.
SAFEv2+
If you deactivate this option, users cannot create system backups. Google backup is deactivated. Other backup methods (for example Sophos Mobile Control backups) remain active.
SAFEv2+
85
Sophos Mobile Control
Setting/field
Allow native browser
Allow camera
Allow camera on lock screen
Allow widgets on lock screen
Allow clipboard
Allow Play Store
Allow non-market apps
Allow Bluetooth
Allow NFC
Allow screen capture
Allow SD card
Allow USB debugging
Description Minimum requirements
If you deactivate this option, native browsers are disabled on the device.
SAFEv2+
SAFEv2+ 4.0+
If you deactivate this option, cameras are completely disabled on the device.
If you deactivate this option, cameras are disabled on the device when the screen is locked.
4.2+
If you deactivate this option, widgets are disabled on the device when the screen is locked.
4.2+
SAFEv2+
Note: This setting applies to devices as of
Android 4.2.2.
If you deactivate this option, users cannot copy any contents to the clipboard.
Note: This setting applies to devices as of
Android 4.2.2.
If you deactivate this option, Play Store is disabled on the device.
If you deactivate this option, non-market apps are disabled on the device.
If you deactivate this option, Bluetooth is disabled on the device.
SAFEv2+
SAFEv2+
SAFEv2+
If you deactivate this option, NFC (near field communication) is disabled on the device.
SAFEv2+
SAFEv2+
If you deactivate this option, users cannot take a screenshot of the display.
If you deactivate this option, SD cards cannot be used in devices. SD cards are deactivated.
SAFEv2+
If you deactivate this option, USB debugging is disabled on the device.
SAFEv2+
86
Administrator guide
Setting/field Description Minimum requirements
Allow USB
If you deactive this option, the USB mass storage mode and the USB media player are disabled on the device.
SAFEv2+
Allow WiFi tethering
Allow USB tethering
Allow Bluetooth tethering
If you deactivate this option, WiFi tethering is disabled on the device.
SAFEv2+
If you deactivate this option, USB tethering is disabled on the device.
SAFEv2+
If you deactivate this option, Bluetooth tethering is disabled on the device.
SAFEv2+
Allow sync while roaming
Allow mobile data connection while roaming
Allow voice calls while roaming
If you deactivate this option, synchronisation while roaming is disabled.
SAFEv3+
If you deactivate this option, mobile data connections while roaming are disabled.
SAFEv2+
Allow application crash reports
If you deactivate this option, voice calls while roaming are disabled.
SAFEv3+
If you deactivate this option, application crash reports are disabled.
SAFEv4+
App protection
In this configuration, you can define settings for protecting apps on end user devices with passwords.
With app protection in use, users have to define a password when they start a protected app for the first time. In the App protection configuration, you define password requirements and the apps to be protected. After a failed login attempt a login delay is imposed.
If app protection is active on an end user device, a button is available in the Edit device view to reset the password defined by the user. For a description of this button and all other function buttons available the Edit device view, see
Carry out administrative tasks
(section 21.4). The user can also reset the app protection password in the Self Service Portal. For further information, see the Sophos Mobile Control user guide for Android.
You can add only one App protection configuration within a profile.
87
Sophos Mobile Control
Setting/field
Password complexity
Grace period in minutes
Description
In this field define the minimum complexity requirements for the password to be defined by users, for example 6 char password.
In this field, select a grace period. After the grace period has expired protected apps can only be unlocked by entering a password.
Click the Add icon to add apps to be password-protected. In the Edit identifier view, the following fields are available for configuring apps to be protected:
Setting/field
Select source
Description
Select the source for the apps to be added to the list of protected apps. Depending on your choice, different fields for defining the apps to be protected are displayed:
■ If you select App list, the Apps dropdown list is displayed with a list of all available Android apps for this customer. Select the app from the list and click Apply.
■ If you select Custom, the fields App name and
Identifier are displayed. Enter the app information and click Apply.
Exchange ActiveSync
Minimum requirements: SAFEv2+ TouchDown
In this configuration, you can define user settings for your Microsoft Exchange Server. You can add multiple Exchange ActiveSync configurations.
Note: Some of the settings in this configuration only apply to devices with an active TouchDown email client. These settings are indicated by the label TouchDown in the web console.
If a TouchDown client is active on a user device, this client will be used as the primary email client in Sophos Mobile Control 3.6 and later.
88
Setting/field
Name
Server address
Domain
User
Email address
Sender
Password
Synchronization period
Administrator guide
Description
In this field, enter an account name.
In this field, enter the address of the
Microsoft Exchange Server.
In this field, enter the domain for this account.
In this field, enter the user for this account. You can use the variable
%_USERNAME_% and the server will replace it with the actual user name, if the device the profile is sent to has an
LDAP link established.
In this field, enter the email address of the account. You can use the variable
%_EMAILADDRESS_% and the server will replace it with the actual email address, if the device the profile is sent to has an LDAP link established.
In this field, enter a sender name for this account. You can use the variable
%_EMAILADDRESS_% and the server will replace it with the actual email address, if the device the profile is sent to has an LDAP link established.
In this field, enter the password for this account.
In this field, select the time period for email synchronization. This is the number of days emails are synchronized for. If you specify a time period here, not all emails are synchronized to the inbox on the mobile device, but only the emails from within the specified period.
You can select the following synchronization periods:
■ One day
■ Three days
Minimum requirements
89
Sophos Mobile Control
Setting/field Description Minimum requirements
Synchronization interval
■ One week
■ Two weeks
■ One month
In this field, select the interval between email synchronization processes:
■ Never
■ 5 minutes
■ 10 minutes
■ 15 minutes
■ 30 minutes
■ 1 hour
Require manual sync when roaming
If you select this option, manual synchronization is required while roaming on a device with an active
TouchDown email client.
SSL
Default account
Make sure that this option is selected, to send all communication through SSL
(Secure Socket Layer).
Select this option to define the account as the default email account.
TouchDown
Allow all certificates
Client certificate
Disable copy/paste
Disable copy to phonebook
Select this option to allow all certificates in transfer processes from the email server.
In this field, select the client certificate for the connection to ActiveSync.
Select this option to disable copy/paste on devices with an active TouchDown email client.
TouchDown
Select this option to prevent users from copying details to their phonebooks on devices with an active TouchDown email client.
TouchDown
90
Administrator guide
Setting/field
Disable printing
Description Minimum requirements
Select this option to disable printing on devices with active TouchDown email clients.
TouchDown
WiFi
In this configuration, you specify settings for connecting to WiFi networks. You can add multiple
WiFi configurations.
Setting/field
SSID
Security type
Description
In this field, enter the ID of the wireless network.
In this field, you select the security type of the WiFi network:
■ None
■ WEP
■ WPA
■ EAP/PEAP
■ EAP/LEAP
■ EAP/TLS
■ EAP/TTLS
■ EAP/FAST
If you select the personal settings WEP or WPA, a
Password field is displayed. Enter the relevant password.
If you select the EAP settings, the fields Identity,
Anonymous Identity and Password are displayed.
Enter the required EAP information. If you select the EAP setting EAP TTLS, the field Phase 2
Authorization is displayed in addition. Select the type of authorization:
■ PAP
■ CHAP
■ MSCHAP
91
Sophos Mobile Control
Setting/field Description
■ MSCHAPv2
VPN
Minimum requirement: SAFEv2+
In this configuration, you can define VPN settings for network connections. You can add multiple
VPN configurations.
Setting/field
Connection name
Server
Connection type
Description
In this field, enter the name of the connection shown on the device.
In this field, enter the host name or the IP address of the server.
In this field, select the connection type:
■ IPsec (PSK)
If you select this type, the fields User, Password and IPsec (PSK) are displayed.
Enter the user and password. In the IPsec (PSK) field, enter the pre-shared key for authentication.
■ IPsec (Certificate)
If you select this type, the fields Client certificate, Root certificate, User and
Password are displayed. In the fields Client certificate and Root certificate, select the relevant certificates. In addition, enter the User and the relevant
Password.
Root certificate
Minimum requirement: SAFEv2+
In this configuration, you can upload a root certificate for devices. You can add multiple Root
certificate configurations. In the File field, browse for the relevant certificate and click Upload.
The name of the certificate is shown in the Certificate name field.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
Client certificate
Minimum requirement: SAFEv2+
In this configuration, you can upload a client certificate to devices. You can add multiple Client
certificate configurations. In the File field, browse for the relevant certificate and click Upload.
92
Administrator guide
The name of the certificate is shown in the Certificate name field. Enter the Password for the selected certificate.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
17.2.2 Available Windows Phone 8 configurations
The following configurations are available for Windows Phone 8 profiles in the Available
configurations view when you create or edit a profile. Some configurations can be added only once within a profile, others several times.
Password policies
In this configuration, you can define passcode rules for devices. You can only add one Password
policies configuration within a profile.
Setting/field
Password type
Description
In this field, select the type of password you want to define:
■ Alphanumeric
■ Alphanumeric or numeric
Allow simple password
Minimum password length
If you select this option, users are allowed to use sequential or repeated characters in their password, for example "1111" or "abcde".
Specifies the minimum number of characters a password must contain.
Maximum number of failed attempts (1 - 999 or
0)
In this field, you can specify the maximum number of failed attempts to enter the correct password before the device is wiped.
Time in minutes until the device is locked (1 - 999 or 0)
In this field, you can specify when (minutes) the device should be locked after it has not been used.
The device can be unlocked by entering the password.
Password history (1 - 50 or 0)
In this field, you can specify how many old passwords are remembered and compared with new ones. When the user defines a new password, it will not be accepted, if it matches a previously used
93
Sophos Mobile Control
Setting/field
Maximum password age (1 - 730 days or 0)
Minimum number of different character groups
Description
password. Value range: 1 to 50 or 0 (no password history).
Requires users to change their password in the specified interval. Value range: 0 (no password change required) to 730 days.
Specifies the minimum number of non-alphanumeric characters (for example & or !) a password must contain.
Restrictions
In this configuration, you can define restrictions for devices. You can only add one Restrictions configuration within a profile.
Setting/field
Allow SD card
Allow unencrypted device
Description
If you deactivate this option, SD cards cannot be used in devices.
If you deactivate this option, devices must be encrypted.
Exchange ActiveSync
In this configuration, you can define user settings for your Microsoft Exchange Server. You can add multiple Exchange ActiveSync configurations.
Setting/field
Name
Server address
SSL
Domain
User
Description
In this field, enter an account name.
In this field, enter the address of the Microsoft
Exchange Server.
Make sure that this option is selected, to send all communication through SSL (Secure Socket Layer).
In this field, enter the domain for this account.
In this field, enter the user for this account. You can use the variable %_USERNAME_% and the server
94
Setting/field
Email address
Password
Synchronization interval
Synchronization period
Synchronize content types
Administrator guide
Description
will replace it with the actual user name, if the device the profile is sent to has an LDAP link established.
In this field, enter the email address of the account.
You can use the variable %_EMAILADDRESS_% and the server will replace it with the actual email address, if the device the profile is sent to has an
LDAP link established.
In this field, enter the password for this account.
In this field, select the interval between synchronization processes:
■ Sync on receipt
■ Manually
■ 10 minutes
■ 15 minutes
■ 30 minutes
■ One hour
In this field, select the time period for synchronization. This is the number of days items are synchronized for. If you specify a time period here, not all items are synchronized to the inbox on the mobile device, but only the items from within the specified period. You can select the following synchronization periods:
■ Unlimited
■ Three days
■ One week
■ Two weeks
■ One month
In this field you select the type of items that are synchronized:
■ Contact
95
Sophos Mobile Control
Setting/field Description
■ Calendar
■ Task
96
Root certificate
In this configuration, you can upload a root certificate for devices. You can add multiple Root
certificate configurations. In the File field, browse for the relevant certificate and click Upload.
The name of the certificate is shown in the Certificate name field.
Note: The certificate you upload here is only available for this profile. If you require certificates in other profiles, you have to upload them again.
17.3 Upload templates for Windows Mobile profiles
You can use templates to create Windows Mobile profiles. To do so, you need to upload the templates provided by Sophos to the web console.
1. In the web console, go to Profiles and click Profile templates under Windows Mobile.
The Profile template view is displayed.
2. Click the Create new template button.
The Edit template view is displayed.
3. Under Operating systems, select the operating system the template should apply to.
4. Browse for the template supplied by Sophos and click Upload.
5. Click the Save button.
The template is available for creating profiles for Windows Mobile devices. It is displayed in the
Profile template view.
17.4 Create profiles for Windows Mobile devices
1. In the web console, go to Profiles, and click Windows Mobile.
The Profiles view is displayed.
2. Click the Create new profile button.
The Select profile template view is displayed.
3. Select the template to be used for the profile and click Next.
The Edit profile view is displayed.
Administrator guide
4. Enter a Name and a Version for the new profile.
5. Under Operating systems, select the operating system the profile should apply to.
6. In the profile settings displayed, click on the individual settings and enter any required information. Under Send settings, select true or false and click Apply.
Note: Make sure that you click Apply for each setting. Otherwise your settings will be lost.
7. After you have made your changes, click the Save button.
The profile is available for transfer. It is displayed in the Profiles view.
17.5 Placeholders for profiles
Generic profiles may contain placeholders which are replaced by user data at the time of task execution. The following placeholders can be used in profiles:
ActiveDirectory placeholders:
■ %_EMAILADDRESS_%
■
%_USERNAME_%
Device property placeholder:
%_DEVPROP(property-name)_%
This placeholder can for example be used to specify the IMEI of the device: %_DEVPROP(IMEI)_%
17.6 Transfer iOS, Android or Windows Mobile profiles
1. In the web console menu bar, go to Profiles and click the required mobile device type: Apple
iOS, Android or Windows Mobile.
The Profiles view for the mobile device type selected is displayed.
2. Click the Transfer button.
The Select device(s) view is displayed.
3. In this view, you can:
■
■
Select individual devices you want to transfer the profile to.
Click the Group selection button, to open the Select device group(s) view and select one or several device groups for transferring the profile.
4. After you have made your selection, click Next.
The Select profile view is displayed.
97
Sophos Mobile Control
98
5. Select the profile you want to transfer and click Next.
The Set execution date view is displayed.
6. Under Scheduled date, select Now or specify a Date and Time for the execution of this task.
7. Click the Finish button.
The Task view is shown.
The profile is transferred to the selected device(s) at the specified date and time.
17.7 Transfer Windows Phone 8 profiles
1. In the web console menu bar, go to Profiles and click Windows Phone 8.
The Profiles view for Windows Phone 8 is displayed.
2. Click the Transfer button.
The Select device(s) view is displayed.
3. In this view, you can:
■
■
Select individual devices you want to transfer the profile to.
Click the Group selection button, to open the Select device group(s) view and select one or several device groups for transferring the profile.
4. After you have made your selection, click Next.
The Select profile view is displayed.
5. Select the profile you want to transfer and click Next.
The Confirm view is displayed.
6. Click the Finish button.
The profile is transferred to the selected device(s) during the next synchronization process.
17.8 Download iOS, Android and Windows Phone 8 profiles from the web console
You can download iOS, Android and Windows Phone 8 profiles that you have configured in the web console. This is for example useful if you need to pass the defined settings on to Sophos
Support.
1. In the web console menu bar, go to Profiles and click the required mobile device type: Apple
iOS, Android or Windows Phone 8.
The Profiles view for the mobile device type selected is displayed.
Administrator guide
2. Click the Show magnifier icon next to the required profile.
The Show profile view is displayed.
3. Click the Download button.
A download dialog is displayed.
4. Download the profile to a location of your choice.
iOS profiles are saved as .mobileconfig files (Plist), Android profiles as .smcprofile files (xml format) and Windows Phone 8 profiles as .windowsphoneconfig files.
99
Download
Link público atualizado
O link público para seu chat foi atualizado. Você pode visualizar e gerenciar seus links de chat após o registro aqui.
Link público do documento
Anúncio