administrator help
12.4 Manage devices
On the menu sidebar, under MANAGE > Devices and Device groups, you can keep track of devices and device groups and carry out a number of administrative tasks. After adding devices to Sophos Mobile Control you can, for example:
■
■
View and edit device details.
Allow or forbid email access for devices.
■
■
■
■
■
Lock or unlock devices remotely.
Reset device passwords.
Wipe the device remotely in case of loss or theft.
Decommission devices (Android and iOS).
Delete devices.
12.4.1 View devices
1. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed, showing all devices enrolled with Sophos Mobile Control for this customer.
2. Go to the required device and click its name.
The Show device page is displayed for the selected device.
Tip:
On the Devices page you can display additional information by pointing to certain elements:
■
■
Point to the "Not managed" icon of a device to display the actual status like Unenrolled or
Checked out.
Point to the "Not compliant" icon of a device to display the severity level (high, medium, low).
12.4.1.1 The Show device page
On the Show device page, all relevant information for an individual device is displayed.
In the upper part of the page, you can see the most important device information at a glance.
In the lower part of the page, detailed device information is displayed on several tabs. The tabs and information shown depend on the device platform.
■
Profiles (Android, iOS)
Shows the profiles (including provisioning profiles) installed on the device.
The tab also contains commands to install profiles onto the device or to remove them.
■
Policies
Shows the policies assigned to the device.
55
Sophos Mobile Control
On this tab, the Assign policy button is available to assign a policy to the device.
■
Device properties
Shows device properties, for example, properties for model, model name, OS version. For
Android devices, rooted smartphones are detected and the relevant property is shown. For iOS devices, jailbroken smartphones are detected and the relevant property is shown.
■
Custom properties
Shows custom device properties. These are the properties that you can create yourself. Custom device properties can, for example, be used in placeholders if no Active Directory connection is available. When you edit a device, you can also add user-specific information here.
■
Internal properties
Shows internal device properties, for example, ActiveSync traffic allowed, IMEI.
■
Compliance violations
This tab is only displayed for non-compliant devices. It shows the compliance violations of the device and the actions taken because of the violation.
These actions are defined during the compliance rule configuration. See Create compliance rules (page 41).
■
Installed apps (Android, iOS)
Shows the software installed onto the device.
For iOS devices, the Managed column on the Installed apps tab indicates managed apps.
With Sophos Mobile Control you can push such apps to iOS devices and also silently remove them.
For Android devices, Sophos Mobile Control differentiates between system apps and apps that the user has installed onto the device.
The Size column shows the disk space usage of an app itself. The Data column shows the additional disk space that an app uses for user data, configurations, and so on.
With the Install app button, you can install software onto the device. You can also remove managed apps from iOS devices by clicking the Delete icon next to the relevant app.
■
System apps (Android)
Shows Android system apps on the device.
Note: System apps cannot be removed from the device.
■
Knox apps (Android)
This tab shows the apps that the user has installed in the Samsung Knox container.
■
Knox system apps (Android)
This tab shows the system apps that are installed in the Samsung Knox container.
■
Scan results (Android)
56
administrator help
This tab is only available if the Sophos Mobile Security functionality is available for the customer you are logged in to. It shows the results of the last Sophos Mobile Security scan performed on the device. Sophos Mobile Security is a security app for Android devices that protects devices from malicious apps and assists users in detecting app permissions that could be a security risk. The app can be managed by Sophos Mobile Control. For further information, see
Manage Sophos Mobile Security (page 205).
■
Certificates
Shows the certificates in use on the device.
■
Tasks
This tab shows all unfinished and failed tasks for the device as well as the finished tasks of the last few days. You can also view these tasks, together with the tasks for all other devices, on the Task view page. See
Monitor tasks (page 16).
From the Show device page, you can directly switch to the Edit device page. To edit the device you are viewing, click Edit.
12.4.1.2 Use the extended device filter
With the extended device filter, you can filter the device lists according to your needs.
To use the device filter:
1. On the Devices page, click the Extended filter button (magnifier icon) in the header bar.
The Device filter: Filter is not active. dialog box is displayed.
2. Define your filter criteria.
3. After you have selected the required criteria, click Filter.
The filter is activated and the list of devices is reloaded. The magnifier icon in the header bar changes its color from blue to green to indicate that the filter is active. To reset the filter, click
Extended filter again and click Reset in the filter dialog.
Note: Remember to reset filters manually when they are no longer needed. Otherwise, lists or reports may not include the results you expect.
12.4.2 Edit devices
1. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed with all devices enrolled with Sophos Mobile Control for this customer.
2. Click the blue triangle next to the required device and then click Edit.
The Edit device page is displayed for the selected device.
3. Make the necessary changes (for example, install or remove software on the Installed apps tab) and click Save.
Your changes are applied to the edited device.
57
Sophos Mobile Control
Note: Property changes only become valid after you have clicked Save. If you do not save the changes you have made, they do not have any effect.
12.4.2.1 Assign a user to a device
1. On the menu sidebar, under MANAGE, click Devices.
2. On the Devices page, click the blue triangle next to the required device and then click Edit.
3. On the Edit device page, click the Edit user assignment icon next to the User field and then click the relevant entry from the selection list:
■
■
To assign a user to a device that has no user assigned to it yet, click Assign user to
device.
To assign a different user to a device that already has a user assigned to it, click Reassign
user to device.
4. In the Enter user search parameters step of the assignment dialog, enter search parameter in one or more fields to filter the user list that will be displayed in the next step. For example, enter the user name or part of it.
5. In the Select user step, select the required user and then click Apply.
6. On the Edit device page, click Save.
12.4.2.2 Deassign a user from a device
1. On the menu sidebar, under MANAGE, click Devices.
2. On the Devices page, click the blue triangle next to the required device and then click Edit.
3. On the Edit device page, click the Edit user assignment icon next to the User field and then click Deassign user from device.
4. In the confirmation dialog, click Yes.
5. Click Save.
12.4.2.3 Define custom properties for devices
You can define custom properties for individual devices.
When you define a property with name my property
, you can refer to the value of the property in profiles and policies by using the placeholder
%_DEVPROP(my property)_%
. For example, you can use this to refer to the user that is assigned to a device.
For details on profile and policy placeholders, see
Placeholders in profiles and policies
(page 72).
Note:
■
■
■
You cannot create a custom device property with the same name as a standard device property.
When you duplicate a device as described in Duplicate a device
(page 49), the new device receives the custom properties of the source device.
As well as the device-level custom properties described here, you can also define customer-level custom properties. See
Define customer properties
(page 22).
58
administrator help
To define a custom device property:
1. On the menu sidebar, under SETTINGS, click Setup > General. On the Personal tab, make sure that the Show extended device details option is selected.
2. On the menu sidebar, under MANAGE, click Devices.
The Devices page is displayed with all devices enrolled with Sophos Mobile Control for this customer.
3. Click the blue triangle next to the required device and then click Edit.
4. On the Edit device page, go to the Custom properties tab and click Add custom property.
5. Enter a Name and a Value for the new custom device property.
6. Click Apply to add the property.
7. Click Save to save the changes to the device.
12.4.2.4 Configure network access
Before you can configure network access for a device, Network Access Control (NAC) must be enabled in Sophos Mobile Control.
For on-premise installation, NAC is enabled by the super administrator. See the Sophos Mobile
Control super administrator guide .
For Sophos Mobile Control as a Service, NAC is always enabled.
There are two options to configure network access for a device:
1. Allow or deny network access unconditionally.
2. Disable network access when the device violates a compliance rule, enable network access otherwise.
Note: Sophos Mobile Control does not control the network access by itself. Instead, it provides a Deny network status that can be used by external NAC software like Sophos UTM to block network communication.
To configure network access for a device:
1. On the menu sidebar, under MANAGE, click Devices.
2. On the Devices page, select the devices for which you want to set the network access mode.
3. Click Actions, and then click Set network access.
4. Select the network access mode:
■
■
■
Allow: Network access for the selected devices is allowed.
Deny: Network access for the selected devices is denied.
Auto mode: Network access for the selected devices is based on the compliance status of the devices.
5. Click Yes to save the changes.
For information on how to configure network access in compliance rules, see Create compliance rules
(page 41).
59
