MobileIron Core and Connector
11.1.0.0 Release and Upgrade Notes
March 4, 2021
For complete product documentation see:
MobileIron Core Documentation Home Page

Proprietary and Confidential | Do Not DistributeCopyright © 2009 - 2021 MobileIron, Inc. All Rights Reserved.
Any reproduction or redistribution of part or all of these materials is strictly prohibited. Information in this publication
is subject to change without notice. MobileIron, Inc. does not warrant the use of this publication. For some phone
images, a third-party database and image library, Copyright © 2007-2009 Aeleeta's Art and Design Studio, is used.
This database and image library cannot be distributed separate from the MobileIron product.
“MobileIron,” the MobileIron logos and other trade names, trademarks or service marks of MobileIron, Inc.
appearing in this documentation are the property of MobileIron, Inc. This documentation contains additional trade
names, trademarks and service marks of others, which are the property of their respective owners. We do notintend our use or display of other companies’ trade names, trademarks or service marks to imply a relationshipwith, or endorsement or sponsorship of us by, these other companies.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 2

Contents
About MobileIron Core

5

Before you upgrade

5

Understand the impact of TLS protocol changes
New features and enhancements summary

5
7

General features and enhancements

7

Android and Android Enterprise features and enhancements

9

iOS and macOS features and enhancements

10

MobileIron Threat Defense features11

Support and Compatibility for MobileIron Core 11.1.0.0

12Support policy

12

MobileIron end of sale and support policy

12

MobileIron Core support and compatibility

13

SAML / Identity Provider

13

LDAP

14

Hardware appliances

14

Atlas

14

Reporting database

15

Monitor15

Sentry15

Access15

Android

16

iOS

16

macOS

17

tvOS

17

Windows

18

Supported browsers and browser resolutions
Supported browser resolutions

19
19

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 3

Language support

20

Language support for MobileIron Core messages

20

Language support on Android and Android Enterprise devices

21

Language support on iOS and macOS devices

21

Language support on Windows devices

21

Resolved issues

22

Known issues

24

MobileIron Core upgrade information

26

Support community

26

MobileIron Core upgrade readiness checklists

26

Pre-Upgrade checklist

26

Upgrade considerations

28

Post-Upgrade checklist

29

Check disk space availability

30

The CLI command: show system disk

30

The System Manager

30

MobileIron Core upgrade paths

31

MobileIron Core upgrade URL

31

Backing up MobileIron Core

31

MobileIron Core end of sale and support policy

31Enterprise Connector upgrade information

32Enterprise Connector upgrade overview

32

MobileIron Enterprise Connector upgrade paths

32

Enterprise Connector upgrade URL

33Enterprise Connector upgrade notes

33

Documentation errata

34

Correction to Apple device enrollment profile settings
Documentation resources

34
35

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 4

About MobileIron Core
MobileIron Core is a mobile management software engine that enables IT to set policies for mobile devices,
applications, and content. This product enables Mobile Device Management, Mobile Application Management, andMobile Content Management capabilities.

Before you upgrade
Before you upgrade, you must consider the possible impact of certain security enhancements on your environment:

Understand the impact of TLS protocol changes
For heightened security, when you upgrade to MobileIron Core 10.3.0.0 through the most recently released version
as supported by MobileIron, MobileIron Core's configurations for incoming and outgoing SSL connections areautomatically updated to use only protocol TLSv1.2. TLSv1.2 cannot be disabled.
This change occurs regardless of the protocol settings before the upgrade.
This change means that MobileIron Core now uses only TLSv1.2 for incoming and outgoing connections with all
external servers. Examples of external servers to which Core makes outgoing connections are:lStandalone SentrylIntegrated SentrylConnectorl

SCEP serversl

LDAP serverslMobileIron GatewaylApple Push Notification Service (APNS)lContent Delivery Network serverslMobileIron support server (support.mobileiron.com)lOutbound proxy for Gateway transactions and system updatesl

SMTPS serverslPublic app stores (Apple, Google, Windows)lApple Volume Purchase Program (VPP) servers

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 5lApple Device Enrollment Program (DEP) serverslAndroid for Work servers

Therefore, if an external server is not configured to use TLSv1.2, change the external server to use
TLSv1.2.
To determine TLS protocol usage with external servers:ll

For outgoing connections from Core to external servers, use the MobileIron utility explained in thefollowing article to determine the TLS protocol usage with those servers:
https://help.mobileiron.com/s/article-detail-page?Id=kA134000000Qx3UCAS
For incoming connections to Core from external servers, determine each server's TLS protocol
usage (no MobileIron utility is available).

For more information:llThreat Advisory: Notice of Deprecation of TLS 1.0 and 1.1 on MobileIron Systems"Advanced: Incoming SSL Configuration" and "Advanced: Outgoing SSL Configuration" in the MobileIron
Core System Manager Guide.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 6

New features and enhancements summary
This section provides summaries of new features and enhancements available in this release of MobileIron Core.
References to documentation describing these features are also provided, when available.
lGeneral features and enhancementslAndroid and Android Enterprise features and enhancementsl

iOS and macOS features and enhancementsl

iOS and macOS features and enhancementslMobileIron Threat Defense features

For new features and enhancements provided in previous releases, see the release notes for those releases,
available in MobileIron Core Product Documentation. MobileIron Support credentials are required to access thesite.

General features and enhancements
This release includes the following new features and enhancements that are common to all platforms.
lWeaker SSH algorithms removed from Core in favor of stronger ones: The following SSH
algorithms have been removed from the options on the System Manager> Security > Advanced > SSH
Configuration page:odiffie-hellman-group-exchange-sha1odiffie-hellman-group14-sha1ohmac-sha1

Admins are encouraged to use the stronger algorithms, such as diffie-hellman-group-exchange-sha256
and hmac-sha2-512 instead. For more information, see Advanced: SSH Configuration in the Security
Settings chapter of the MobileIron Core System Manager Guide.
lConfirmation email sent automatically for new client registrations: When a device user accepts theTerms of Service (ToS) agreement in a registration invitation, the admin automatically receives an audit
email confirming the registration, from Core version 11.1.0.0 through the most recently released version as
supported by MobileIron. The email consists of a message and identifying client information:"The following user has accepted device registration terms and has attempted to enroll a new device:"
User name, display name, email address, date and time, IP address, platform, employee owned.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 7

For more information, see "Configuring an end user Terms of Service agreement" in the Self-service user
portal chapter of the MobileIron Core Device Management Guide for your operating system.
l

New option to hide QR code and registration URL: A new configuration checkbox has been added to
the Settings > System Settings > Users & Devices > Device Registration page that allows you to choose
whether or not to show users a QR code and registration URL. This option is enabled by default. Whenenabled, the QR code and registration URL display to users. For more information, see "Disabling the QR
code and registration URL" in the MobileIron Core Device Management Guide for your operating system.

l

New option to hide self-service portal (SSP) Activity page: A new configuration checkbox has been
added to the Settings > System Settings > General > Self-Service Portal page that allows you to choose
whether or not to show users their activity in the SSP. This option is enabled by default. When enabled, the
SSP Activity page displays to users. For more information, see "Disabling device history logs in the selfservice user portal" in the MobileIron Core Device Management Guide for your operating system.

l

AppConnect passcode history updates: The Passcode history option in the AppConnect Global policy
is changed as follows:o

The value options are updated to 12. This means that you can restrict device users from reusing any
password up to the past 12 passwords.

oThe passcode reuse is case insensitive. This means that the passcode case is not considered forreuse. Device users cannot change the case for past passcodes and reuse them. Password andpassWord are considered the same.

These feature updates require Mobile@Work 12.11.10 for iOS.
l

Increased capacity for broadcast notification messages to all device users: When an administrator
sends a message out to all device users via label, and the label contains more than 200 device users, Corenow sends the messages out in batches, and so is not limited to only sending 200 at a time. Administrators
can send, monitor, and confirm this process from the Devices & Users > Labels tab.
Because of the potential for accidental or deliberate spamming of users with this feature, Core provides
two levels of confirmation before sending the message. For more information, see "Notifying all device
users using labels" in the Managing Labels chapter of Getting Started with MobileIron Core.

l"Unlock User" option available to MobileIron administrators: MobileIron administrators now have theability to unlock users who have locked themselves out of the user portal. Typically, if a user does not log
in correctly within a configured number of tries, the user must wait the configured time before they can log
in again. This option allows the administrator to reset the account immediately, through the Devices &Users > Users > Actions menu. This feature is available on Core 11.1.0.0 through the most recently
released version as supported by MobileIron. For more information, see "Unlocking locked-out local users
in the admin portal" in the User Management chapter of Getting Started with MobileIron Core.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 8l

New endpoint for mutual certification authentication: New mutual authentication device endpoints areavailable for use by iOS and Android clients. The existing (old) OAuth endpoint is not protected by 2FA or
mutual certificate authentication and is vulnerable to password spraying and DOS attacks. The
administrator can disable the original OAuth endpoint and utilize the new endpoint. This feature isapplicable on Mobile@Work for Android version 11.1.0.0 and Mobile@Work for iOS version 12.11.10
through the latest versions as supported by MobileIron. For more information, see "New endpoint formutual certification authentication" in the MobileIron Core Device Management Guide for Android andAndroid Enterprise Devices or the MobileIron Core Device Management Guide for iOS and macOS
Devices.

Android and Android Enterprise features and enhancements
This release includes the following new features and enhancements that are specific to the Android and Android
Enterprise platforms.
l

New Lockdown Policy field added: "Allow install from unknown sources on the device" allows
installation of apps from untrusted sources in the personal profile. Unless this field is selected, the work
profile never allows installation of apps from unknown sources. Applicable for Android 11+ devices. For
more information, see "Lockdown policy fields for Android Enterprise devices in Work Managed Device
mode and Managed Device with Work Profile mode" and "Lockdown policy fields for Android Enterprisedevices in Work Profile for Company Owned Device mode" in the Getting Started with MobileIron Core.

lSupport for Samsung Knox Dual Encryption (DualDAR): Support for Dual Encryption (DualDAR) has
been added to further secure and protect sensitive data on devices. Samsung Knox includes a FIPS 140-2
certified encryption module within the inner layer of the encryption. DualDAR is applicable to Knox 3.0 on
Android 8.0 devices through the latest version as supported by MobileIron. DualDAR is applicable toAndroid Enterprise:oWork Profile modeoManaged Device with Work Profile mode

For more information, see "Samsung Knox Dual Encryption (DualDAR) support" in the MobileIron Core
Device Management Guide for Android and Android Enterprise Devices.
l

New Lockdown Policy field added: "Enable Cross profile whitelisting of Apps" allows users toshare information from specific apps from within the work profile to the personal side of the device. This
allows data from the Work Profile container to share data to the exact same app that is located on the
personal side. Applicable for Android 11+ devices. For more information, see "Lockdown policy fields forAndroid Enterprise devices in Work Profile for Company Owned Device mode" in Getting Started with
MobileIron Core.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 9lAbility to set apps to the foreground in devices: A new field setting, Auto Launch Application on
Install, allows administrators to set Android Enterprise apps to the foreground upon registration or
installation. A typical use case would be for a security/VPN app that needs to be configured by the deviceuser before the device can be protected. Applicable to:o

Any Android Enterprise app in the App CatalogoAndroid devices version 6.0 through the latest version as supported by MobileIrono

Device Owner, Managed Device with Work Profile, Work Profile on Company Owned Device modes

For more information, see "Adding in-house apps" and "Public and private Android Enterprise app
deployment" in theMobileIron Core Apps@Work Guide.
l

Added support for app restrictions with in-house applications for Android non-GMS devices: For
devices registered to Core in modes other than Google Mobile Services (GMS) mode, administrators canapply Android Open Source Project (AOSP) in-house app restrictions to these devices. Using the "Enable
AOSP app restrictions" field, the administrator can now set the in-house restrictions to display in the Appview page of the App Catalog.
Applicable to the following Android Enterprise modes:oWork Managed Device modeoWork Profile modeoManaged Device with Work Profile modeoWork Profile on Company Owned Device mode

For more information, see "App restrictions with in-house applications for Android" and "Adding in-houseapps" in the MobileIron Core Apps@Work Guide.

iOS and macOS features and enhancements
This release includes the following new features and enhancements that are specific to the iOS and macOS
platforms.
l

Two new fields have been added to Apple Per-App VPN configurations - Associated Domains
and Excluded Domains: In the Per-app VPN and in the MobileIron Tunnel configurations, administrators
can specify associated and excluded domains to be considered for association or exclusion from the perapp VPN and tunnel server connections. Applicable to iOS 14.3 and macOS 11.0 through the latest version
as supported by MobileIron. For more information, see "Managing VPN Settings" in the MobileIron Core
Device Management Guide for iOS and macOS Devices.

l

Support for IdP-based device registrations: As part of the DEP profile, the MDM server provides
Custom enrollment URL along with a standard URL to get the MDM profile to the Apple server. This URL

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 10

can be used by administrators to enforce their own authentication model or provide any other information.
An example use case would be where administrators cannot use their organization’s Identity provider "asis" for DEP authentication without heavy changes on the infrastructure. For more information, see"Customized registration using SAML IdP" and "Creating Apple Device Enrollment profiles" in the
MobileIron Core Device Management Guide for iOS and macOS Devices.
l

New option to parse or not parse .mobilconfig file: In the Configuration Profile Setting dialog box,
there is a new field "Send File Verbatim" that you can select if you wish to deploy a signed .mobileconfig
file, for example, Apple debug configurations via MobileIron MDM. Because Core does not expect a signed
file, it would not be able to parse it and inject a substitution variable because it would change the signatureof the signed file. Files uploaded with this option selected are sent "as is" to the device without parsing,validating, or signing of the file by MobileIron. For more information, see "Configuration profile settings(iOS, tvOS, and macOS)" in the MobileIron Core Device Management Guide for iOS and macOS Devices.

l

Supported certificate type values for iOS IKEv2 VPN configurations: iOS VPN configurations using
Internet Key Exchange version 2 (IKEv2) need to include a selected value from the following list ofcertificate types:
o

RSA

o

ECDSA256o

ECDSA384o

ECDSA512

For more information, see "IKEv2 (iOS Only)" in the "Managing VPN Settings" chapter of the MobileIron
Core Device Management Guide for iOS and macOS Devices.

MobileIron Threat Defense features
MobileIron Threat Defense protects managed devices from mobile threats and vulnerabilities affecting device,
network, and applications. For information on MobileIron Threat Defense-related features, as applicable for thecurrent release, see the MobileIron Threat Defense Solution Guide for Core, available on the MobileIron Threat
Defense for Core Documentation Home Page at MobileIron Community.
NOTE: Each version of the MobileIron Threat Defense Solution guide contains all MobileIron Threat
Defense features that are currently fully tested and available for use on both server and client
environments. Because of the gap between server and client releases, MobileIron releases new
versions of the MobileIron Threat Defense guide as the features become fully available.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 11

Support and Compatibility for MobileIron Core
11.1.0.0
This section includes the components MobileIron supports with this release of MobileIron Core.
NOTE: This information is current at the time of this release. For MobileIron product versions released
after this release, see that product version’s release notes for the most current support andcompatibility information.

Support policy
MobileIron defines supported and compatible as follows:

TABLE 1. DEFINITIONS FOR SUPPORTED AND COMPATIBLE
Supported productversions

The functionality of the product and version with currently supported releases was
systematically tested as part of the current release and, therefore, will be supported.

Compatible productversions

The functionality of the product and version with currently supported releases has notbeen systematically tested as part of the current release, and therefore not supported.
Based on previous testing (if applicable), the product and version is expected tofunction with currently supported releases.

MobileIron end of sale and support policy
For details on the MobileIron end of sale and support policy, go to https://community.mobileiron.com/docs/DOC1089.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 12

MobileIron Core support and compatibility
This version of MobileIron Core is supported and compatible with the following product versions:l

SAML / Identity Provider

l

LDAP

l

Hardware appliances

l

Atlas

l

Reporting databasel

Monitorl

Sentryl

AccesslAndroid

l

iOS

l

macOS

l

tvOS

l

Windows

SAML / Identity Provider
TABLE 2. SAML / IDENTITY PROVIDER SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product /Supported

Compatible

Component
SAML /
Identity Providerl

OpenSAML 3.3.0l

ADFS 3.0lOkta - Developer Account 3.6.0

lPing Identity – Trial version 1.3.0

lOneLogin – Developer AccountlShibboleth

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 13

LDAP
TABLE 3. LDAP SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product /Supported

Compatible

Windows Active Directory

Not applicableComponent
LDAP

l

l

l

Server OS: Windows Server 2003, Version: 5.2
Server OS: Windows Server 2008,
Version: 6.1
Server OS: Windows Server 2012R2,
Version: 6.3

IBM Domino ServerlServer OS: Windows Server 2008,
Version: 8.5.2

Hardware appliances
TABLE 4. HARDWARE APPLIANCES SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product /Supported

Compatible

Component
Hardwareappliancesl

M2200 (Core and Enterprise Connector)l

M2250 (Core)l

M2600 (Core)

Not applicable

Atlas
TABLE 5. ATLAS SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS

Atlas

Supported

Compatible

End of life. See

Not applicable

https://community.mobileiron.com/docs/DOC-1666

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 14

Reporting database
TABLE 6. REPORTING DATABASE SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product /Supported

Compatible

2.0.0.2

1.8.0.0, 1.8.0.2, 1.9.0.0, 1.9.1.0,

Component
Reporting
Database

2.0.0.0, 2.0.0.1

MonitorTABLE 7. MONITOR SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product /Supported

Compatible

2.0.0.2

1.1.0, 1.1.1, 1.2.0, 1.2.1, 2.0.0,

Component
Monitor

2.0.0.1

SentryTABLE 8. SENTRY SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product /Supported

Compatible

Standalone Sentry

9.12.09.8.1, 9.9.0

Integrated Sentry

6.4.0

6.2.0–6.3.0

Component

AccessTABLE 9. ACCESS SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product /Supported

Compatible

R45

Not applicable, because only the

Component
MobileIron Accesslatest version is available to all
customers.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 15

Android
TABLE 10. ANDROID SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product / Component

Supported

Compatible

Android8.0, 8.1, 9.0, 10.0, 11.0

5.0–7.1

Mobile@Work

11.0.0.0, 11.1.0.0

9.3.0.0–10.8.0.0

Tunnel (Android native, Android

4.5.0, 4.6.0

4.3.0, 4.3.2, 4.4.0

Secure Apps Manager

9.1.0.0

8.3.0.0–9.0.0.0

Email+ (Android AppConnect

2.19.0.0

2.2.0.0–2.18.3.0

and Android Enterprise)

3.9.0

3.0.0–3.8.0

Docs@Work (Android

2.13.02.0.0–2.12.0

2.5.1

2.1.0–2.4.2

End of support. See

Not applicable

Enterprise, and Samsung Knox
Workspace)

AppConnect and Android
Enterprise)
Web@Work (Android
AppConnect)
Insight

https://community.mobileiron.com/docs/DOC9343

iOS
TABLE 11. IOS SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product /Supported

Compatible

iOS

12.0.0–14.0.0

11.0.0

Mobile@Work

12.11.1, 12.11.10*

12.0.0–12.4.0

Component* Mobile@Work 12.11.10 for iOS is targeted torelease on March 3, 2021.
Tunnel4.1.0

2.4.1–4.0.0

Email+

3.16.02.6.0–3.15.1

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 16

TABLE 11. IOS SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS (CONT.)
Product /Supported

Compatible

Docs@Work

2.16.02.2.0–2.15.1

Web@Work

2.12.02.0.0–2.11.1

Apps@Work

Not supported

ComponentlContainer app
l1.1.2–1.2.0 when using
Mobile@Work 8.6.0, 9.0.1,
or 9.1.0
1.3.0 when using
Mobile@Work 9.5.0

Help@WorkNOTE: Help@Work does not work on iOS 10
through the latest release assupported by MobileIron. Use
TeamViewer App instead for
Help@Work support.

2.0.2–2.1.1

Insight

End of support

Not applicableSee
https://community.mobileiron.com/docs/DOC9343.

macOS
TABLE 12. MACOS SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product /Supported

Compatible

macOS/OS X

11.0

10.1–10.15

Tunnel

4.1.0

3.0.0, 4.0.0

Component

tvOS
TABLE 13. TVOS SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product /Supported

Compatible

13.4, 14.0

12.4–13.4

Component
tvOS

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 17

Windows
TABLE 14. WINDOWS SUPPORTED AND COMPATIBLE PRODUCTS AND COMPONENTS
Product /Supported

Compatible

Component
Windows

Windows 10 Pro, Windows 10

lEnterprise (version 20H2)

Windows 10 Pro, Windows 10 Enterprise(versions 1703, 1709, 1809, 1903, 1909,
2004)

l

Windows HoloLens (versions 1701, 1803)

Note The Following:llWith 1803, Apps@Work cannot be
pushed to the device because of aknown Microsoft issue.
MobileIron recommends that customers
stay on the 09 branches of Windows 10 toensure a longer support lifecycle. The 09
versions of the OS have a 30-month
support lifecycle from Microsoft, whilethe 03 versions only have an 18-month
support lifecycle. For more information,
see https://support.microsoft.com/enus/help/13853/windows-lifecycle-factsheet.

Apps@Work

9.6.0.256

Not applicable (all listed versions are tested andsupported)

Tunnel

1.2.3

1.2.0, 1.2.2

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 18

Supported browsers and browser resolutions
The current version of MobileIron Core has the following browser support:

TABLE 15. SUPPORTED BROWSERS AND BROWSER RESOLUTIONS
Browser

Supported

Compatible

Internet Explorer

11

9*, 10*Chrome88

85, 86, 87

Firefox85

82, 83, 84

Safari

Not supported

10.1*

Edge

Not supported

Not compatible

Chrome - iPad

Not supported

Not compatible

Safari - iPad

Not supported

Not compatible* This configuration is not covered under the MobileIron product warranty.

Supported browser resolutions
TABLE 16. SUPPORTED BROWSER RESOLUTIONS
Browser resolution

Supported

Compatible

800x600

NoNo

1024x768

No

Yes*

1280x1024

Yes

Yes

1366x768

Yes

Yes

1440x900

Yes

Yes

Higher resolutions

No

Yes

* This configuration is not covered under the MobileIron product warranty.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 19

Language support
MobileIron Core supports the following languages on devices for messages and apps:lLanguage support for MobileIron Core messageslLanguage support on Android and Android Enterprise deviceslLanguage support on iOS and macOS deviceslLanguage support on Windows devices

Language support for MobileIron Core messages
MobileIron Core supports the following languages for messages sent to devices:l

Chinese (Simplified)lChinese (Traditional)lDutch (Netherlands)lEnglishl

French (France)lGerman (Germany)l

Italian (Italy)lJapanesel

Koreanl

PolishlPortuguese (Brazilian)l

Romanian (Romania)lRussianl

Slovakl

Spanish (Latin American)

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 20

Language support on Android and Android Enterprise devices
Refer to Mobile@Work for Android Release Notes for a complete list of supported languages for Android andAndroid Enterprise devices.

Language support on iOS and macOS devices
Refer to Mobile@Work for iOS Release Notes for a complete list of supported languages for iOS and macOS
devices.

Language support on Windows devices
MobileIron Core supports the following languages in client apps on Windows devices:l

Chinese (Simplified)lChinese (Traditional)lEnglishl

French (France)lGerman (Germany)lJapanesel

KoreanlPortuguese (Brazilian)l

Russianl

Spanish (Latin American)

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 21

Resolved issues
For resolved issues provided in previous releases, see the "Resolved issues" sections in the release notes for
those releases, available in MobileIron Core Product Documentation.
This release includes the following resolved issues:lVSP-64477: There was an issue where the Apps@Work page was not displaying correctly on iOS 13.5.1
and 14.3 devices. This issue has been fixed. The Apps@Work page now displays correctly on iOS 13.5.1
and 14.3 devices.

l

VSP-64374: There was an issue where failure by the Core server to obtain an authentication token during
Android Enterprise device registration was automatically considered as a maximum number of devices
registered for the user account error. This has been fixed. A generic failure message is sent to the
Mobile@Work client if the failure to obtain the authentication token is not related to the maximum numberof devices error.

lVSP-64293: There was an issue where the Core server required a Google Play enterprise mobile
management (EMM) API call to ensure that Mobile@Work for Android Enterprise (AE) devices would
upgrade automatically. Failure of this call could lead to a failed AE registration. This issue has been fixed inCore 11.0.0.1 through the most recently released version as supported by MobileIron. The API call is nolonger required, reducing the chance of AE registration failure.

lVSP-64248: There was an issue when Google Account configuration was pushed to devices, there were
problems with the account name and account description. The issue has been fixed. Google Accountconfiguration information can be pushed to devices successfully.

lVSP-64227: There was an issue with the Apps@Work "Featured" banner not working in Apple devices
running iOS 14.2. This issue has been fixed. Devices running iOS 14.2 can see the Featured banner fromCore 11.1.0.0 through the most recently released version as supported by MobileIron.

l

VSP-64156: There was an issue where simple message service (SMS) and call log archives required a
Tomcat process restart to update. This issue has been fixed. SMS and call log archives update without
restarting.

lVSP-64065: There was an issue with a possible memory leak when sending simple message service(SMS) logs and call logs to a Simple File Transfer Protocol (SFTP) server. This issue has been fixed. You
can send SMS and call logs to an SFTP server without incident.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 22l

VSP-64029: There was an issue where a Wi-Fi configuration could not be saved or edited if it contained a
proxy variable password setting. This issue has been fixed. Wi-Fi configurations can now be saved andedited when containing a proxy variable password setting.

lVSP-63942: There was an issue with Core showing the device password status for some Android 11.0
devices as non-compliant, although the device password was compliant. This issue has been fixed. Core
correctly reports the password compliance status for these Android devices, from Core 11.1.0.0 throughthe most recently released version as supported by MobileIron.

l

VSP-63852: There was an issue with Core using hypertext transfer protocol (HTTP) for Apple iTunes
lookup and search requests. This issue has been fixed. Apple iTunes lookup and search request are now
sent using secure HTTP (HTTPS) protocol.

lVSP-63822: There was an issue where internal delays were causing the Tomcat process to time out whenrestarting Core. This issue has been fixed. Tomcat now starts up as expected when restarting.

lVSP-63749: There was an issue in which devices running iOS 14 have Wi-Fi MAC address randomization
on by default, which is not supported for Mobile@Work managed devices. This issue has been fixed.
When clients upgrade to iOS 14, a Wi-Fi configuration with MAC address randomization disabled will be repushed to the device to disable the option.

l

VSP-63746: Mobileiron Core deployments in Hybrid mode (both Android Open Source Project (AOSP) andAndroid Enterprise) were not displaying the AOSP badge for in-house apps. This issue has been fixed. The
AOSP badge now displays as expected.

lVSP-63599: There was an issue where, when a security policy was saved for the first time (with or withoutchanges), it would re-push the Wi-Fi profile and regenerate certificates. This issue has been fixed. The firsttime you save a security policy, it behaves as expected, from Core 11.1.0.0 through the most recently
released version as supported by MobileIron.

l

VSP-63588: There was an issue with out-of-date iOS system apps. This issue has been fixed. The
updated iOS system apps list can be reinstalled from Core.

l

VSP-63303: There was an issue where Core was checking for iOS operating system updates in all iOS
devices. This issue has been fixed. Core now checks for iOS operating system updates in all supervised
iOS devices.

l

VSP-62936: There was an issue where Mobile@Work clients registered to a Connected Cloud server
displayed the My Devices tab when it was not expected behavior to display. This issue has been fixed.

lVSP-46090: There was an issue where Core was not rejecting passwords longer than the value configured
for max-allowed-length (currently 32 characters). This issue has been fixed. Core checks that passwords

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 23

are not longer than the configured maximum allowed length, providing better protection against denial ofservice (DOS) attacks.

Known issues
For known issues found in previous releases, see the "Known issues" sections in the release notes for thosereleases, available in MobileIron Core Product Documentation.
This release includes the following known issues:lVSP-64632: There is an issue whereby macOS devices registered using International Roaming Expert
Group (iREG) or Apple Automated Device Enrollment (DEP) cannot subsequently register toMobile@Work, because the Wi-Fi MAC address is not reported properly to Core. There is no workaround.
NOTE: Other macOS devices are not affected.

lVSP-64566: There is an issue where Android Open Source Project (AOSP) devices are unable to set up
Email+ because a required identity certificate is not being pushed to Mobile@Work. There is no
workaround.

l

VSP-64583: There is an issue where Core 11.1.0.0 can support no more than 10,000 Lightweight Directory
Access Protocol (LDAP) group edit requests. There is no workaround. For more information about LDAP
groups, see the "Managing Users" chapter of Getting Started with MobileIron Core.

l

VSP-64521: There is an issue with Security Assertion Markup Language (SAML)-enabled devices where,
if "Anonymous" is the authentication type selected in their enrollment profile, Core incorrectly registers thedevice user as "Anonymous."
Workaround: Select either Password or PIN authentication type to avoid this error.

lVSP-64471: There is an issue where new Mobile@Work options to enable Zips anti-phishing protection on
the personal side of devices are not accessible when added as a Public App and enabled for Android
Enterprise.
Workaround: If Mobile@Work is added as an in-house app, these restrictions are displayed in Android
Open Source Project (AOSP) mode.

lVSP-64390: There is an issue where, when an LDAP configuration is associated with 10,000 or moregroups, there may sometimes be a slow response or timeout of the user interface while rendering the list.

lVSP-64375: There is an issue where Core fails to save Android device details, which could break theAndroid Enterprise, MTD activation, and other functions which rely on device details. This issue occurs

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 24when:oAn invalid license key is used in the MTD activation configurationo

A colon ( : ) character is used in the configuration nameWorkaround: Enter a valid license key for MTD, and do not use colons in the configuration file name.
l

VSP-64191: The LDAP Sync function cannot import more than 1000 organizational unit (OU) objects.
Thus, some OU objects can be missing on the LDAP user management page.
Workaround: Assign roles based on LDAP group.

l

VSP-64188: There is an issue where, if there are MobileIron Sentry devices on the network that haveattachment control enabled, Core also sends the encryption key in the Docs@Work configuration to
Sentry devices that do not have attachment control enabled.

l

VSP-64123: There is an issue where bulk enrollment of iOS devices fails after the Core to Cloud migration
service upgrade.

lVSP-63798: There is an issue in the Core App Catalog, in which only the primary "version" value of an app
displays, and the "alt_version" value does not. This can occasionally cause the App Catalog page to list
what looks like the same app twice, even though their alt_version values differ.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 25

MobileIron Core upgrade information
This section describes the following upgrade information for the current release of MobileIron Core.
NOTE: MobileIron Core and Enterprise Connector should be running the same version and the samebuild.
lSupport communityl

MobileIron Core upgrade readiness checklistslCheck disk space availabilitylMobileIron Core upgrade pathslMobileIron Core upgrade URLlBacking up MobileIron Corel

MobileIron Core end of sale and support policy

Before you begin
Read Before you upgrade .

Support community
Use the information in this section for upgrade information specific to this release. For detailed instructions on how
to upgrade MobileIron Core using this upgrade information, refer to the MobileIron Core System Manager Guide,available in MobileIron Core Product Documentation.

MobileIron Core upgrade readiness checklists
This section provides checklists to help you successfully complete the upgrade process for Core and Sentry
software. The checklists include:l

Pre-Upgrade checklistlUpgrade considerationslPost-Upgrade checklist

Pre-Upgrade checklist
Before you upgrade, we encourage you to do a pre-upgrade checklist.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 26

TABLE 17. PRE-UPGRADE CHECKLIST
Check

Tasks
Prepare and plan for
downtime
Review relevant
documentation
Check certificates

ReferenceslCore (1 - 3 hours)lSentry (5 - 20 minutes)

Core product documentation pagel

iOS Enrollment, Portal HTTPS, Client TLS certificates
NOTE: When using mutual authentication, the Portal
HTTPS certificate must be a publicly trusted
certificate from a well-known Certificate
Authority. For details, see “Mutual authentication
between devices and MobileIron Core” in the
MobileIron Core Device Management Guide.

l

MDM Certificate (check a month before expires)l

Local CA

Knowledge Base article: Renewing an expired local CA certificate.
Check Boot partition

Verify you have at least 35 MB free for /boot. See Check disk space
availability in this document for details on how to perform this check.
Knowledge Base article: Core Upgrade: Increase Boot Partition to
1GM if Avail Space is less than 35MB.

Ensure there is enoughdisk spacel

Old File System (2 GB /mi and 5 GB /mi/files)l

New File System (10 GB /mi)Knowledge Base article: Resizing Disk Partition of a Core Virtual
Machine.
Check for new system
requirements

l

l

l

l

Review your backup andhigh availability options

Minimum 80 GB hard drive
If there is insufficient storage, increase the available disk
space using the procedure outlined in Resizing Disk Partitionof a Core Virtual Machine
Call MobileIron support if issues persist when physicalappliances and VMs have the minimum required disk space
configured
Port 8443 for Summary MICS - MobileIron Configuration
Service (that is, the service that supports System Manager.)lPhysical backup: built in backup, showtech alll

VMware backup: VDMK backup, snapshotlHigh Availability: confirm HA version 2.0

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 27

TABLE 17. PRE-UPGRADE CHECKLIST (CONT.)
Check

Tasks

References
Knowledge Base article: How to tell if your Core has HA 2.0
If using HA 1.0, contact MobileIron Professional Services to upgrade
to 2.0.

Set up your proxyconfiguration (if required)

Manually set the upgrade URL and use HTTP instead of HTTPS.

Prepare test devicesllClient: Get clean test devices, open client and check-in,
check iOS log
Core: Note the watchlist and label numbers

Upgrade considerations
After the pre-upgrade planning, we recommend you review the following considerations:

TABLE 18. UPGRADE CONSIDERATIONSCheckConsiderations

References

DB Schema and Data

Run pre-validation check after downloading the repository from System
Manager. If this task fails, contact MobileIron Support.

Understand the stagesll

Leverage CLI upgradecommands (asappropriate)
Understand scenario
options

Download vs. Stage for install
Reboot when the system displays:
Reboot to install https://<serverFQDN>:8443/upgrade/status

MobileIron Core Command Line Interface (CLI) ReferencellSingle serverHigh availability:
Option 1: little downtime: 1) upgrade secondary 2) upgrade
primary
Option 2: zero downtime: 1) upgrade secondary 2) failover tosecondary 3) upgrade primary 4) re-establish sync

Download guide: MobileIron Core High Availability Management
Guide
Review section: HA Core Software Upgrade Procedures
Monitor the upgrade

l

l

l

Log into the Admin Portal
Select Logs > MDM Logs > States > Waiting xml generation
pending
Monitor upgrade status using:

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 28

TABLE 18. UPGRADE CONSIDERATIONS (CONT.)
Check

Considerations

References
https://<serverFQDN>:8443/upgrade/status

Additional reboot

Due to a kernel upgrade, an additional reboot is performed when you
upgrade. It may take longer than expected for MobileIron Core to
become available on the network.

Upgrade impact on
Windows devices

In some cases, when an administrator initiates Reset PIN for a
Windows Phone 10 device, the device does not return a new pin for thatdevice.
For more information, see the following knowledge base article:
https://help.mobileiron.com/s/article-detailpage?Id=kA134000000QxnLCAS

Ports

HTTPS/ port 443 is the default port for fresh installations, but upgradedenvironments keep the previous port open, for example, port 8080.

Post-Upgrade checklist
MobileIron recommends the following checklist after completion of the upgrade.

TABLE 19. POST-UPGRADE CHECKLIST
Check

Tasks
Testing andtroubleshooting

Referencesl

Log into the System ManagerlSelect Maintenance > Software Updates > Software VersionlVerify that the new version is listedlVerify services

Verify devices

HA system cleanup

DO NOT re-boot the system once the upgrade process has
begun

l

Call MobileIron Support for further investigationl

Log into the Admin PortallSelect Services > OverviewlClick Verify AlllRegister a new devicelRe-enroll/check-in existing devicesl

Set secondary back to secondarylConfirm sync

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 29

Check disk space availability
Before you upgrade, check disk space availability. At least 35 MB of disk space must be available in the /bootfolder for an upgrade to be successful.
If at least 35 MB of disk space is not available in the /boot folder, contact MobileIron Technical Support before
proceeding with the upgrade.
Use one of the following methods to check disk space availability:

The CLI command: show system disk
The following sample output shows the available disk space in the last line. It is 15M in this example.
CORE(8.5.0.1a-6)@host.company.com#show system disk
Filesystem Size Used Avail Use% Mounted on/dev/sda3 181G 20G 153G 12% /tmpfs 16G 4.0K 16G 1% /dev/shm/dev/sda1 95M 76M 15M 84% /bootThe System Manager
The System Manager > Maintenance > System Storage menu shows you how much Core system storage you areusing, and how much is still available.
Procedure
1. In the System Manager, go to Maintenance > System storage.
2. Click More Details next to the System Storage bar that shows percent used.
3. In this example, the available disk space is 190M.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 30

MobileIron Core upgrade paths
MobileIron recommends the following upgrade paths, which are fully tested and supported.
Supported upgrade paths to Core 11.1.0.0
l10.8.0.0 → 11.1.0.0

l10.8.0.1 → 11.1.0.0

l11.0.0.0 → 11.1.0.0

l11.0.0.1 → 11.1.0.0

l11.1.0.0 (GMRC) → 11.1.0.0

MobileIron Core upgrade URL
To upgrade MobileIron Core:
Use the following URL if you specify an alternate URL:
https://support.mobileiron.com/mi/vsp/11.1.0.0-32/mobileiron-11.1.0.0-32

Backing up MobileIron Core
MobileIron recommends you make a local backup of MobileIron Core before starting an upgrade. For more
information on backing up MobileIron Core, see the MobileIron Core System Manager Guide.

MobileIron Core end of sale and support policy
For details on the MobileIron Core end of sale and support policy, go to: https://help.mobileiron.com/s/article-detailpage?Id=kA134000000QyXYCA0

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 31

Enterprise Connector upgrade information
This section describes the following upgrade information for the current release of Enterprise Connector.
lEnterprise Connector upgrade overviewlMobileIron Enterprise Connector upgrade pathslEnterprise Connector upgrade URLlEnterprise Connector upgrade notes

Enterprise Connector upgrade overview
Use the information in this section for upgrade information specific to this release. In most cases, EnterpriseConnector is upgraded automatically after a MobileIron Core upgrade. Core upgrades include any new service
package necessary for Enterprise Connector. If Connector needs to be updated, then Core prompts Connector toaccess the new package and complete an in-place upgrade. In most cases, this process completes successfully,
and Connector restarts.
If there is a problem with the in-place upgrade, then Connector makes two additional attempts to complete theupgrade. Connector reboots before attempting to upgrade again. If the upgrade is still not successful, then
Connector reverts to the previous version and begins running in compatibility mode. In this case, you mustcomplete the manual upgrade steps detailed in the On-Premise Installation Guide.

MobileIron Enterprise Connector upgrade paths
Direct upgrade from only the following Enterprise Connector versions to version 11.1.0.0 is supported:
Supported upgrade paths to 11.1.0.0
l10.8.0.0 → 11.1.0.0

l10.8.0.1 → 11.1.0.0

l11.0.0.0 → 11.1.0.0

l11.0.0.1 → 11.1.0.0

l11.1.0.0 (GMRC) → 11.1.0.0

If you are upgrading from a version not listed here, then you need to complete one or more previous upgrades first.
See the upgrade guide for that version.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 32

Enterprise Connector upgrade URL
Use the following URL if you specify an alternate URL:
Upgrades from supported Connector releases:
https://support.mobileiron.com/mi/connector/11.1.0.0-32/mobileiron-11.1.0.0-32

Enterprise Connector upgrade notes
There are no Enterprise Connector upgrade notes for this release.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 33

Documentation errata
This section includes content updates that were made after the current version of the MobileIron Core Device
Management Guide for iOS and macOS Devices had been finalized. These updates are detailed here for reference,
and will be available in the next version of the MobileIron Core Device Management Guide.

Correction to Apple device enrollment profile settings
This section describes the changes made to the description of the "Apple device enrollment profile settings" tablein the "Managing Devices Enrolled in Apple Device Enrollment" section in the MobileIron Core Device
Management Guide for iOS and macOS Devices.

TABLE 20. INCORRECT DESCRIPTION (HIGHLIGHTED)

EnableSAML

As part of DEP profile, the MDM server provides custom enrollment URL along with standard URL
to get the MDM profile to Apple server. This URL can be used to enforce your own authentication
model or to provide any other information.
Select this to support external IdP with DEP enrollment.
This feature is applicable for iOS 13.0 and macOS 10.15 devices through the latest version as
supported by MobileIron.
Note The Following:l

You must have SAML enabled. (See "Configuring SAML/IdP support" in the MobileIron
Core System Manager Guide.) If the IdP has not been configured properly, and is notreachable, the Enable SAML check box will not display.

l

Once set up for SAML on iReg or DEP devices, you will not be able to disable SAML fromthe System Manager. You must first de-select SAML-based registration in the Device
Registration page before you can disable the IdP SAML connection in the System
Manager.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 34

TABLE 21. CORRECT DESCRIPTION (HIGHLIGHTED)

EnableSAML

As part of DEP profile, the MDM server provides custom enrollment URL along with standard URL
to get the MDM profile to Apple server. This URL can be used to enforce your own authentication
model or to provide any other information.
Select this to support external IdP with DEP enrollment.
This feature is applicable for iOS 13.0 and macOS 10.15 devices through the latest version as
supported by MobileIron.
Note The Following:l

You must have SAML enabled. (See "Configuring SAML/IdP support" in the MobileIron
Core System Manager Guide.) If the IdP has not been configured properly, and is notreachable, the Enable SAML check box will not display.

l

Once set up for SAML on iReg or DEP devices, you will not be able to disable SAML fromthe System Manager. You must first de-select Enable SAML in the Device Registration
page before you can disable the IdP SAML connection in the System Manager.

Documentation resources
MobileIron product documentation is available at https://help.mobileiron.com/s/mil-productdocumentation.

MobileIron Core and Connector 11.1.0.0 Release and Upgrade Notes| 35