MobileIron Core 11.1.0.0 Device
Management Guide
for iOS and macOS Devices
March 4, 2021
For complete product documentation see:
MobileIron Core Product Documentation Home Page

Proprietary and Confidential | Do Not DistributeCopyright © 2009 - 2021 MobileIron, Inc. All Rights Reserved.
Any reproduction or redistribution of part or all of these materials is strictly prohibited. Information in this publication
is subject to change without notice. MobileIron, Inc. does not warrant the use of this publication. For some phone
images, a third-party database and image library, Copyright © 2007-2009 Aeleeta's Art and Design Studio, is used.
This database and image library cannot be distributed separate from the MobileIron product.
“MobileIron,” the MobileIron logos and other trade names, trademarks or service marks of MobileIron, Inc.
appearing in this documentation are the property of MobileIron, Inc. This documentation contains additional trade
names, trademarks and service marks of others, which are the property of their respective owners. We do notintend our use or display of other companies’ trade names, trademarks or service marks to imply a relationshipwith, or endorsement or sponsorship of us by, these other companies.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 2

Contents

Contents
Contents3

New features and enhancements

35

Registering Devices

37

Registration methods

38

Admin invites users to register38

In-app registration38

For iOS devices

39

For macOS devices

39

Administrator tasks

39

Registration restrictions for Android devices

40

Customized registration using a URL or a QR Code42

Implementing infrastructure for QR code with device PIN

42

1. Enable the PIN code registration

42

2. Enable the QR code integration

42

Registering using a web page on a desktop computer

43

Registering using a web page on an iOS device

44

Customized registration using SAML IdP

44

Users register additional devices

45

Admin registers ActiveSync devices

45

Registering an Apple TV

46

Registration via user portal

46

Terms of service

46

Creating a terms of service agreement

47

Searching for devices by terms of service agreement criteria

48

Terms of Service for users

49

Visual privacy

50

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 3

Contents

Enabling visual privacy for devices

51

Viewing visual privacy settings in Mobile@Work

51

Privacy policy for users

53

Invite users to register55

In-app registration for iOS and Android

56

Auto-populating the MobileIron Core server name during registration

57

Auto-populating the MobileIron Core server name based on email address

57

Registering your MobileIron Core with MobileIron

57

Registering iOS and macOS devices through the web

58

Create a pending device report

61

Registering macOS devices with Core using Mobile@Work for macOS

62

What the device user sees:

62

What the administrator does

63

ActiveSync device registration

63

Managing operators and countries

64

Enabling operators

64

Enabling additional countries for registration

64

Disabling operators

65

Filtering operators

65

Searching for an operator

65

Displaying operators by country

65

Displaying operators by status

65

Specifying eligible platforms for registration

65

Setting the registration PIN code length for device user registration

66

Limit for failed attempts to enter a registration password

66

Customizing registration messages

66

Viewing registration templates

67

Editing registration messages

67

Using variables in registration messages

69

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 4

Contents

Registration message variables

69

Variables used inside registration messages

70

Scheduling reminder notifications for completing registration

71

Filtering registration messages

72

Restoring registration messages to default content

72

Configuring the default ownership for newly registered devices

72

Assign a unique attribute as a device's name73

Removing an old or expired MDM profile from an iOS or macOS device

73

Disabling analytics data collection

74

Disabling the QR code and registration URL

74

Distributing MDM Profiles with Apple Configurator

75

MDM profile distribution with Apple Configurator

75

Automatically matching Apple devices with serial numbers

75

Acquiring serial numbers

76

Bulk-registering devices

76

Exporting an MDM profile from MobileIron Core 7.0-9.0

77

Using Apple Configurator to register an Apple device with Core

77

Deleting all content and settings from an iOS device

78

Creating a Wi-Fi profile

78

Preparing devices

78

Creating and applying a blueprint

79

Managing Devices Enrolled in Apple Device Enrollment

80

Apple Device Enrollment with MobileIron Core overview

80

Changes in Device Enrollment

80

Apple Business Manager

80

Apple School Manager

81

Apple Device Enrollment features

81

Apple Device Enrollment setup

81

Best practices for managing devices in Apple Device Enrollment

81

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 5

Contents

Setting up Apple Device Enrollment with MobileIron Core

82

Editing Core roles for Apple Device Enrollment

82

Linking MobileIron Core to Apple Device Enrollment

83

Assigning devices to the Apple Device Enrollment account84

Creating Apple Device Enrollment profiles

85

Apple device enrollment profile settings

86

Example Device Enrollment Profiles for Apple School Manager

94

Assigning Apple Device Enrollment devices to an enrollment profile en masse

95

Checking for Apple Device Enrollment account updates

96

Verifying the Apple Device Enrollment status of a device

96

Updating the OS on supervised Apple Device Enrollment devices

97

Managing Apple Device Enrollment accounts

97

Viewing Apple Device Enrollment accounts in MobileIron Core

98

Editing Apple Device Enrollment account information

99

Removing or Re-assigning Apple Device Enrollment profile assignments

99

Removing Apple Device Enrollment profiles

99

Re-assigning Apple Device Enrollment profiles

99

Deleting Apple Device Enrollment profiles

100

Deleting Apple Device Enrollment accounts

100

Disowning devices enrolled in Apple Device Enrollment

100

Adding a custom Automated Device Enrollment web page

101

Workflow of the custom Automated Device Enrollment web page
User Enrollment with Apple Business Manager
Difference between standard MDM enrollment and User Enrollment

101
102
103

Standard MDM enrollment

103

User Enrollment with Apple Business Manager

104

Difference between User Enrollment vs Device Enrollment

104

Requirements for enabling User Enrollment

105

Managing Apple School Manager Devices

107

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 6

Contents

Apple School Manager account management overview

107

Apple School Manager managed entities

108

Apple School Manager device requirements

108

The Classroom app

109

Apple School Manager setup with Core: main steps

109

Best practices for managing devices in Apple School Manager

109

Creating an Apple School Manager account110

Adding school information to your Apple School Manager account111

Editing Core roles for Apple Education management

111

Configuring devices in bulk for Apple School Manager

112

Bulk-assign devices to a Teacher or Student 1:1 device enrollment profile for use with Apple Education 113
Bulk-assign devices to a Shared iPad (multi-user) enrollment profile for use with Apple Education
Connecting Core to Apple School Manager

113
115

Creating Enrollment Profiles for Apple School Manager

116

Apple device enrollment profile settings

116

Example Device Enrollment Profiles for Apple School Manager

124

Adding your enrolled devices to your MDM server

125

Creating a custom attribute to use with Apple School Manager

126

Enabling Apple Education in Core

127

Creating labels for Apple Education

130

Configuring Shared Device Cart

131

Applying a device cart to a class132

Synchronizing Core with Apple Education servers

133

Distributing apps to Apple School Manager devices

134

Disabling Apple Education in Core

136

Checking Apple Education logs

137

Managing Apple Business Manager

139

User Enrollment with Apple Business Manager
Difference between standard MDM enrollment and User Enrollment

139
139

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 7

Contents

Standard MDM enrollment

139

User Enrollment with Apple Business Manager

140

Difference between User Enrollment vs Device Enrollment

141

Requirements for enabling User Enrollment

142

Connecting Core to Apple Business Manager

142

Manage MDM Settings

143

Add the Server Token

143

Create users to enable User Enrollment for local users and LDAP users

143

Configure LDAP group members to inherit Apple User Enrollment Roles

144

Managing users that belong to multiple groups

145

Match the Location and the Account146

Distribute apps to Apple Business Manager devices

147

Configuration settings for Apple Business Manager User Enrollment

148

VPN for User-enrolled devices

148

Wi-Fi Policy for user-enrolled devices

148

Device user instructions for registering using User Enrollment

149

Using Logs for Troubleshooting

149

View reports on devices

150

Activation Error

150

App fails to install (AppAlreadyInstalled)

150

Multi-User Support

151

About multi-user support

151

Using Secure Sign-In and Sign-Out

151

Setting Secure Sign-In preferences

152

Setting unique restrictions for signed-out devices

152

Enabling Secure Sign-In

153

Customizing the multi-user secure sign-in web clip

153

Remote sign-out from a multi-user iOS device

154

Setting automatic sign-out for multi-user devices

156

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 8

Contents

Searching for Devices

158

Basic searching

158

Advanced searching

159

Searchable fields

160

Device field definitions

160

Using the query builder

176

Using a manually edited search expression

176

Using both the query builder and manual editing

176

Negative operators with advanced search

178

Examples for advanced search with negative operators

179

Clearing an advanced search

180

Searching for retired devices

180

Searching for blocked devices

180

Saving a search criterion to a label

181

Securing Devices

182

Registration-related features and tasks

183

Reprovisioning a device

183

Using self service security features

184

Retiring a device

184

Retiring and deleting unused and retired devices

185

Assigning an administrator the role to delete retired devices

185

Retiring or deleting retired devices by threshold

186

Creating a schedule to retire or delete devices

187

Managing Duplicate Devices

189

Security-related features and tasks

190

Lock

191

Unlock192

Encryption

192

Wipe

192

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 9

Contents

Cancel Wipe

193

Selective Wipe

194

Block AppTunnels

194

Lost

195

Found

195

Locate195

Reset device PIN

196

Force Device Check-In

197

Managing devices in Apple MDM lost mode

197

Enable MDM lost mode

198

Disable MDM lost mode

199

Request the MDM server to locate a device

199

Setting up background check-ins with APNs

199

Managed iBooks

200

Benefits

200

Impacts

200

Distributing managed books to iOS devices

201

Confirming receipt of managed books

202

Editing managed books

203

Searching for managed books

203

Removing managed books from a subset of devices

204

Deleting managed books

205

Viewing the list of managed books on the device

205

Personal hotspot on/off switch

208

Turning the personal hotspot on or off on iOS devices

209

Checking if the personal hotspot is turned on or off for a given device

211

Reinstalling system apps on iOS devices

211

Manually setting the wallpaper for iOS devices

212

Adding fonts to iOS devices

213

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 10

Contents

Updating the OS on supervised iOS devices

213

Updating the OS on multiple supervised iOS devices

214

Updating the OS on a single supervised iOS devices

214

What the device user sees during software upgrade

215

Restarting or shutting down supervised iOS devices

215

Reporting on managed devices

216

Exporting records to CSV

216

Export to CSV Field Options

216

Turning Bluetooth on and off on iOS and macOS devices

219

Updating OS components on a macOS device

221

Setting the time zone of a device

222

Managing Custom Attributes

223

Assigning a custom attributes role

223

Adding custom attributes to users and/or devices

224

Viewing custom attributes available for users and/or devices

225

Viewing custom attributes assigned to users

225

Viewing custom attributes assigned to devices

225

Editing custom attributes for users and/or devices

226

Searching for custom attributes for users and/or devices

226

Exporting a log of the custom attributes for users and/or devices

226

Deleting custom attributes from users and/or devices

226

Setting custom attribute values for device or users

227

Applying custom attributes to labels
Pushing label attribute changes to devices and users
Managing Policies

227
228
229

Working with default policies

230

Prompting users to change the password
Importing and exporting policies

231
232

Exporting policies or configurations

232

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 11

Contents

Importing policies or configurations

233

Viewing policy status and platform support

233

Displaying policy status

233

Displaying supported platforms for policies

234

Enabling profile encryption

234

Enabling or disabling encryption on a macOS device

235

Storing and retrieving FileVault personal recovery keys in Core (macOS)

237

Configuring a system policy managed setting

238

Configuring a system policy control setting

239

Configuring a system policy rule241

Configuring iOS and macOS software updates

242

Disable OS Updates

245Managing the activation lock for iOS devices

245

Applying an activation lock

246

Removing the Activation Lock

247

Whitelisting Wi-Fi networks

247

Configuring firewall settings for macOS devices

248

Sync policies and battery use

249Work Schedule policy

249

Adding a Work Schedule policy

250

Applying a Work Schedule policy

250Managing a Work Schedule policy

251

Setting up Work Schedule policy notifications

251

Country changes and alerts

251

iOS location-based wakeups interval and syncing with Core

251

Single-app mode policies

252

Finding the bundle ID

254

Configuring a global HTTP proxy policy
Global HTTP Proxy Policy

254
255

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 12

Contents

Cellular policies

257

Migrating devices from an APN setting to a cellular policy

258

Defining a cellular policy

258

Cellular policy settings

259

Wallpaper policies

260

Configuring a wallpaper policy

261

Wallpaper policy settings

262

Device name policies

263

Configuring a device name policy

264

Device name policy settings

264

Customizing a home screen layout

265

Customizing a lock screen message

267

Configuring notification settings

268

Working with Windows Update policies

271

Notifications of changes to the privacy policy

271

Privacy policy change notifications on iOS: the admin view

273

Privacy policy change notifications on iOS: the device user view

273

Exporting the devices in the WatchList
Managing Compliance

274
275

Managing device compliance checks

275

Setting the device compliance check interval

276

Updating device compliance status

276

Compliance triggers and actions

277

Server compliance conditions and actions

277

Local compliance conditions and actions

280

Tiered compliance282

Compliance actions policy violations

282

Default compliance actions

283

Custom compliance actions

284

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 13

Contents

Creating a compliance action

285

Add Compliance Action table

285

When the compliance action takes effect287

Viewing quarantine information

288

Viewing configurations removed due to quarantine

288

Dashboard page: Device by Compliance chart

288

Custom compliance policies

289

Assigning compliance roles

289

Managing compliance policy rules

290

Substitution variables for compliance policy rules

293Managing compliance policy groups

294

Device search fields for compliance rules

297

Managing Device Settings with Configurations

300

Management of device settings with configurations

300

Configurations page

301

Default configurations

302

Editing default iOS MDM settings

303

Restoring system web clips (iOS)305

Displaying configurations status

305

Adding new configurations

305

Editing configurations

306

Deleting configurations

306

Exporting configurations

306

Importing configurations

307

Applying configurations to labels

307

Exporting the devices in the WatchList

307

Impact of changing LDAP server variables

308

Configuring Email309

Exchange settings

309

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 14

Contents

iOS and macOS Exchange profiles and password caching

316

Configuring POP and IMAP email settings (for iOS and macOS)

317

Supported variables

321

Enabling per-message S/MIME for iOS

321

Uploading a trusted root certificate to MobileIron Core

322

Creating a user-provided certificate enrollment setting for S/MIME certificates323

Uploading user signing and encryption certificates with the User Portal

323

Uploading user certificates with the Web Services API

324

Creating an Email setting for per message S/MIME encryption

325

Creating an Exchange setting for per message S/MIME encryption

327

Pushing per-message S/MIME changes to devices

330

Enabling S/MIME encryption and signing on iOS devices

330

Configuring S/MIME encryption and signing for iOS devices
Synchronizing Google account data

331
333

Using OAuth to enable access to Google APIs

334

Uploading OAuth credentials to the Google Admin Console

335

Linking Google Apps credentials with MobileIron Core

335

Setting up your Exchange setting for access to Google Apps data

337

Renewing the Google Apps password for a given set of users

339

Synchronizing Google calendar and contacts without ActiveSync

340

Managing Wi-Fi Settings

341

Wi-Fi settings

341

Wi-Fi profiles and password caching

341

Wi-Fi authentication types

341

Open authentication

342

Shared authentication

345

WPA Enterprise authentication

349

WPA2 / WPA3 Enterprise authentication

352

WPA Personal authentication

356

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 15

Contents

WPA2 Personal authentication

358

WPA2 / WPA3 Personal authentication

360

Supported variables for Wi-Fi authentication

363

Managing VPN Settings

364

VPN settings overview

365

Configuring new VPN settings

365

Check Point Capsule

365

Proxy - None (default)

366

Proxy - Manual

367

Proxy - Automatic

369

Custom Data

371

Cisco AnyConnect (iOS only)

371

Proxy - None (default)

371

Proxy - Manual

374

Proxy - Automatic

376

On Demand Rules

379

Default Rules

381

Domains

382

Safari Domains

382

Calendar Domains

383

Contact Domains

383

Mail Domains

383

Associated Domains

383

Excluded Domains

383

Custom Data

384

Cisco Legacy AnyConnect384

Proxy - None (default)

384

Proxy - Manual

387

Proxy - Automatic390

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 16

Contents

On Demand Rules

393

Default Rules

395

Domains

396

Safari Domains

396

Calendar Domains

397

Contact Domains

397

Mail Domains

397

Associated Domains

397

Excluded Domains

397

Custom Data
F5 SSL398
398

Proxy - None (default)

398

Proxy - Manual

401

Proxy - Automatic

403

On Demand Rules

406

Default Rules

408

Domains

409

Safari Domains

409

Calendar Domains

410

Contact Domains

410

Mail Domains

410

Associated Domains

410

Excluded Domains

410

Custom Data

411

IKEv2 (iOS Only)

411

Proxy - None (default)

416

Proxy - Manual

417

Proxy - Automatic

419

On Demand Rules

420

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 17

Contents

Default Rules
Domains

422
424

Safari Domains

424

Calendar Domains

424

Contact Domains

424

Mail Domains

424

Associated Domains

424

Excluded Domains

425

IKEv2 (Windows)

425

IPSec (Blue Coat)

425

IPSec (Cisco)426

Proxy - None (default)

426

Proxy - Manual

429

Proxy - Automatic

431

Domains

434

Safari Domains

434

Calendar Domains

434

Contact Domains

435

Mail Domains

435

Associated Domains

435

Excluded Domains

435

Juniper SSL

435

Proxy - None (default)

436

Proxy - Manual

438

Proxy - Automatic

441

On Demand Rules

444

Default Rules

446

Domains
Safari Domains

447
447

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 18

Contents

Calendar Domains

448

Contact Domains

448

Mail Domains

448

Associated Domains

448

Excluded Domains

448

Custom Data

449

L2TP

449

Proxy - None (default)

449

Proxy - Manual450

Proxy - Automatic

452

MobileIron Tunnel (iOS and macOS)

454

MobileIron Tunnel (Android)

454

MobileIron Tunnel (Samsung Knox Workspace)454

MobileIron Tunnel (Windows)

454

NetMotion Mobility VPN (iOS)454

Proxy - None (default)

455

Proxy - Manual

456

Proxy - Automatic

459

Domains

461

Safari Domains

461

Calendar Domains

461

Contact Domains

461

Mail Domains

461

Associated Domains

461

Excluded Domains

462

Custom Data

462

OpenVPN

462

Palo Alto Networks GlobalProtect

462

Proxy - None (default)

463

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 19

Contents

Proxy - Manual

465

Proxy - Automatic

467

On Demand Rules

470

Default Rules

472

Domains

473

Safari Domains

473

Calendar Domains

474

Contact Domains

474

Mail Domains

474

Associated Domains

474

Excluded Domains

474

Custom Data
PPTP

475
475

Proxy - None (default)

475

Proxy - Manual

476

Proxy - Automatic

478

Pulse Secure SSL

480

Proxy - None (default)

480

Proxy - Manual

483

Proxy - Automatic

486

On Demand Rules

489

Default Rules

491

Domains

492

Safari Domains

492

Calendar Domains

493

Contact Domains

493

Mail Domains

493

Associated Domains

493

Excluded Domains

493

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 20

Contents

Custom Data

494

Samsung Knox IPsec

494

SonicWall Mobile Connect494

Proxy - None (default)

494

Proxy - Manual

496

Proxy - Automatic

498

On Demand Rules

501

Default Rules

503

Domains

504

Safari Domains

504

Calendar Domains

505

Contact Domains

505

Mail Domains

505

Associated Domains

505

Excluded Domains

505

Custom Data

506

Custom SSL

506

iOS VPN profiles and password caching

506

Proxy - None (default)

506

Proxy - Manual

509

Proxy - Automatic

511

On Demand Rules

514

Default Rules

516

Domains

517

Safari Domains

517

Calendar Domains

518

Contact Domains

518

Mail Domains

518

Associated Domains

518

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 21

Contents

Excluded Domains

518

Custom Data

519

Managing Certificates and Configuring Certificate Authorities

520

Certificates overview

520

Types of certificates

521

Managing certificates issued by certificate enrollment configurations

523

Supported certificate scenarios

523

MobileIron Core as a certificate authority

524

Using MobileIron Core as a certificate proxy

524

Using MobileIron Core as a certificate enrollment reverse proxy

525

MobileIron Core as a certificate authority

525

Configuring MobileIron Core as an independent root CA (Self-Signed)

526

Generating a self-signed certificate

526

Creating a local certificate enrollment setting

528

Configuring MobileIron Core as an intermediate CA

528

Mutual authentication between devices and MobileIron Core

529

Scenarios that can use mutual authentication

530

Core port usage with devices, with and without mutual authentication

530

The mutual authentication setting on MobileIron Core

531

When devices use mutual authentication

532

Mutual authentication identity certificate for MobileIron Core

534

Mutual authentication client identity certificate

534

Supported custom attributes for mutual authentication certificates535

New endpoint for mutual certification authentication

535

Handling client identity certificate expiration for Android devices

537

Handling client identity certificate expiration for iOS devices

538

Mutual authentication and Apps@Work

539

Enabling mutual authentication for Apple and Android devices

539

Enabling TLS inspecting proxy support when using mutual authentication

540

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 22

Contents

Migrating Mobile@Work for Android to use mutual authentication
Certificates settings

541
541

Adding a certificate setting

542

Certificate Enrollment settings

543

If Certificate Enrollment integration is not an option

543

Supported variables for certificate enrollment

544

Certificate generation time545

Early generation

545

On-demand generation

545

Certificate delivery time for AppConnect-related certificates

546

Certificate delivery for Mobile@Work 9.1 for iOS and earlier versions‫‫‬

546

Certificate delivery for Mobile@Work 9.5 for iOS

546

Performance impact

547

Configuring Blue Coat Mobile Device Security service integration

547

Overview of how to set up Core integration with the Blue Coat MDS service

548

Limitations when integrating with the Blue Coat MDS service

548

Configuring the Blue Coat certificate enrollment setting

548

Configuring the IPsec (Blue Coat) VPN setting

550

Revoking the certificate

550

Configuring a client-provided certificate enrollment setting

551

Overview of client-provided certificate enrollment settings

551

Specifying a client-provided certificate enrollment setting

552

Configuring an Entrust CA

553

Revoking the certificate

555

Configuring a GlobalSign CA

555

GlobalSign Prerequisites

555

Revoking the certificate

557

Configuring MobileIron Core as the CA
Revoking the certificate

557
558

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 23

Contents

Configuring OpenTrust CA

559

Revoking the certificate

560

Configuring a single file identity certificate enrollment setting

560

Configuring SCEP

562

X.509 Codes

564

SCEP proxy functions

564

Configuring Symantec Managed PKI

565

Prerequisites

565

Using a proxy

566

Configuring Symantec Web Services Managed PKI
Revoking the certificate

567
568

Configuring a user-provided certificate enrollment setting

569

Certificate Transparency Payload

571

Creating the certificate hash for certificates
Configuring iOS and macOS settings and restrictions
iOS and macOS settings

573
574
574

General settings (iOS and macOS)

574

CalDAV settings (iOS and macOS)

575

Supported Variables for CalDAV Settings
CardDAV settings (iOS and macOS)
Supported variables for CardDAV Settings

576
576
578

Web Clips settings (iOS and macOS)

578

Configuration profile settings (iOS, tvOS, and macOS)

579

LDAP settings (iOS and macOS)

580

Extensible Single Sign-On

581

Extensible Single Sign-On Kerberos

583

iOS / tvOS settings

586

AirPlay settings

587

AirPrint settings

588

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 24

Contents

App restrictions configuration setting

589

Whitelisting managed iOS apps

589

Blacklisting iOS apps

590

iOS and tvOS restrictions settings

591

Subscribed Calendars settings

617

APN settings

618

Provisioning Profile settings

619

Web content filter settings

620

Configuring the web content filter

620

Browser impact

622

Removing a Web content configuration from a device

623

Multiple web content configurations on a device

623

Managed App Config settings that use plists

623

Managed App Config with plist overview

624

Configuring the Managed App Config setting

624

Viewing the plist file625

Removing a Managed App Config setting from a device

625

Supported variables

626

Sample plist

626

Google Account627

Managed domains settings

628

Configuring managed domains

628

Domain formats

629

Managed domains example

630

Network usage rules settings

632

Configuring network usage for managed apps
Enterprise single sign-on account settings with Kerberos

633
636

URLs and bundle IDs in enterprise single sign-on settings

636

Identity certificates in enterprise single sign-on settings

637

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 25

Contents

Configuring a Single Sign-on Account Configuration
macOS settings

637
637

macOS Kernel Extension settings

637

macOS restrictions

638

macOS restrictions settings

639

macOS Apple App Store restrictions

653

macOS AppStore restriction options

653

Disc settings for macOS

656

Configuring Finder disc burning settings for macOS

656

Configuring the Disc Burning setting for macOS

657

Disc burning settings (macOS)

657

Media Control setting for macOS658

iOS and macOS Core settings differences

660

Running shell scripts on macOS devices

661

Shell scripts on macOS devices

661

Components required to run shell scripts on macOS devices

662

Main steps of running shell scripts on macOS devices

662

Creating certificates for your shell scripts for macOS

662

Creating a certificate authority for your macOS scripts

663

Creating a script signing identity for your macOS scripts

663

Exporting the CA public key certificate for your macOS scripts

664

Creating a shell script for macOS

664

Testing your shell script for macOS

665

Signing your shell script for macOS

665

Configuring a macOS script configuration on Core

665

Configuring a macOS script policy on Core

666

Viewing macOS script execution logs

667

Using Mobile@Work for iOS

668

Device management with the Mobile@Work My Devices tab

668

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 26

Contents

Authenticating with MobileIron Core from the My Devices tab in Mobile@Work669

Checking for MobileIron Core updates with Mobile@Work670

Re-enrolling a device with Mobile@Work

671

Retiring a device with Mobile@Work671

Unlocking a device with Mobile@Work672

Locking a device with Mobile@Work673

Wiping a device with Mobile@Work674

Viewing device details in the Mobile@Work My Devices tab

674

Locating an iOS device in the Mobile@Work My Devices tab

675Managing notifications in Mobile@Work for iOS

676

Logging and enhanced logging for Mobile@Work677

Sending Mobile@Work logs to MobileIron Support

677

Opening Mobile@Work for iOS logs in other apps

677

Encrypting device logs with your own certificate

678

Screen orientation

678

Working with Events

679

About events

679

Events page

679

Required role

679

Managing events

680

Creating an event

680

Editing an event

680

Deleting an event

680

Ensuring the alert is sent to the correct recipients

681

Applying the event to a label

682

Setting alert retries

682

Setting MobileIron SMS, email, and push notifications

682

Event settings

682

International roaming event settings

683

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 27

Contents

SIM changed event settings

685

Memory size exceeded event settings

688

System event settings

690

System event field description

690

Policy violations event settings

693

Policy violations event field description

694

Device status event settings

698

Customizing Event Center messages

701

Displaying Event Center templates

701

Adding custom Event Center messages

702

Using variables in Event Center messages

703

Variable descriptions

705

Specifying which template to use

706

Filtering Event Center messages

706

Editing Event Center messages

706

Deleting Event Center messages

706

Viewing and Exporting Events

707

Marking as Read or Unread

707

Filtering events

707

Event lifecycle and status

707

Exporting event history

708

Adding a note

708

Troubleshooting MobileIron Core and devices

709

About Core logs

709

Audit logs

710

Searching the information in the audit logs

710

Setting event time criteria in audit logs

711

Viewing audit log information

714

Specifying how long log information is saved

714

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 28

Contents

Audit log information

715

Best practices: label management

716

Device events

717

ActiveSync Device information

719

MDM events

720

Certificate events

720

App Tunnel events

721

App information

721

Policy information

722

Compliance Action events

722

Configuration events

723

Apple Device Enrollment related events

723

Admin events

723

User events

724

LDAP events

724

Other events

725

Label events

725

Sentry events

725

Content events

726

VPP events

726

Custom attributes events

726

Compliance policy events

726

Audit Logs use cases

727

Personal information is wiped from devices

727

Users are prompted for email passwords when not necessary

728

Users are prompted to create passwords

729

Devices have lost their managed apps

730

MDM Activity
Viewing Errors

730
731

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 29

Contents

Certificate Management731

How to search for certificate entries

731

How to remove a certificate

733

How to revoke a certificate

733

How to re-enroll a SCEP certificate

733

Service Diagnostic tests

733

Running Service Diagnostic tests

735

Pull client logs for client devices

735

Office 365

737

Office 365 App Protection overview

737

Prerequisites for using Office 365 App Protection

737

Office 365 App Protection window

738

Office 365 App Protection policies

738

Adding Office 365 App Protection policies

739

Editing Office 365 App Protection policies

739

Managing Office 365 App Protection policies

740

Add Office 365 App Protection policies window

740

Compliance Actions

744

Office 365 App Protection configurations

746

Creating Office 365 App Protection configurations

747

Editing a Office 365 App Protection configuration

747

Managing Office 365 App Protection configurations

747

Office 365 App Protection user groups

748

Office 365 App Protection reports

749

Office 365 App Protection reports window

749

Managing Out of Compliance Users reports

750

Managing Selective Wipe reports

750

Creating wipe requests

750

Managing wipe requests

751

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 30

Contents

Downloading App Protection reports

751

Downloading App Protection reports by user

751

App Protection User reports table

751

Downloading App Protection reports by app

752

App Protection App reports table

752

Downloading App Configuration reports

753

Downloading App Configuration reports by user

753

App Configuration User reports table

753

Downloading App Configuration reports by app

753

App Configuration App reports table

754

Office 365 App Protection settings

754

Azure Tenant

755

Overview

755

Requirements

755

Microsoft

755

MobileIron

755

Supported OS versions

756

Unsupported OS versions

756

Multiple Core support

756

Technical support

756

From the Core administrator's point of view

756

From the device user's point of view757

Apply the Intune license to device users

758

Group based assignment

758Powershell based assignment

758

Adding MobileIron as a compliance partner

758

Creating a conditional access policy in Microsoft Endpoint Manager

761

Connecting Microsoft Azure to MobileIron Core

766

What the device user sees

771

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 31Contents

Azure account activity recorded in the logs

771

Creating a partner device compliance policy

772

Device status reporting773

De-provisioning of the Azure tenant

773

Microsoft

774

MobileIron

774

Retiring a device from Azure

775

Installing Mobile@Work for iOS and Android

775

Installing MobileIron Mobile@Work for iOS

775

Installing MobileIron Mobile@Work for Android

775

Required MobileIron client device user action and use cases
Client device user action

775
776

Android client776

iOS client

776

Help@Work for iOS

777

About Help@Work for iOS

777

Prerequisites

778

TeamViewer components

778

Supported devices

778

How Help@Work for iOS works

778

Help@Work for iOS setup overview

778

Installing TeamViewer on your desktop

779

Requesting a TeamViewer account780

Creating a TeamViewer app

781

Enabling Help@Work in MobileIron Core

784

Deploying the TeamViewer QuickSupport app

785

Starting a remote control session

785

To close a remote control session from the device786

To close a remote control session from the desktop

787

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 32

Contents

For more information on using remote control

788

If you accidentally close the session

788

Language Support

789

Translated versions of MobileIron client apps

789

Selecting languages for MobileIron Core messages

789

Setting the system default language

790

Changing language selection from the Admin Portal

791

Self-service User Portal

792

User portal overview

792

Benefits of the user portal

793

Impacts of using the user portal

794

User portal authentication options

794

About registering devices in the user portal

794

Configuring the Per-User Device limit

794

Registration PIN

795

About changing device ownership in the user portal

796

Associating a certificate with a user-provided certificate enrollment setting

796

About uploading certificates in the user portal

797

About generating a one-time PIN for resetting a secure apps passcode

797

Configuration requirements to allow the user portal to generate a one-time PIN

797

Configuring the user portal to generate a one-time PIN

798

About getting Entrust derived credentials

798

Device management with the user portal

799

Before enabling device registration in the User Portal

799

Assigning user portal device management roles

800

Customizing the self-service user portal

801

MobileIron user portal default stylesheet

803

Disabling device history logs in the self-service user portal

806

Configuring an end user Terms of Service agreement

806

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 33

Contents

Admin notification email

808

Requiring user portal password change

808

Limiting devices per user by LDAP group membership

809

Editing or Deleting an LDAP group-specific device limit

811

Configuring help desk contact information

811

User portal information for your users

812

Logging in to the user portal with user name and password

813

Logging in to the user portal on a desktop computer with a certificate

813

What users see after they login

814

Welcome menu

814

If Register Device role is enabled

814

Registration instructions

816

If PIN-based registration is enabled817

If QR-code registration is enabled817

If getting an Entrust derived credential is enabled818

If Change Device Ownership role is enabled819

If generating a one-time PIN for resetting the secure apps passcode is enabled820

Trust and Untrust options

821

Uploading certificates in the user portal on a desktop computer

821

Viewing, replacing, and deleting certificates in the user portal

822

When a user-provided certificate is deleted

823

Viewing the help desk contact information

823

Viewing device history logs from the self-service user portal

824

Unlocking a macOS device

825

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 34

1
New features and enhancementslNew option to hide QR code and registration URL: A new configuration check box has been added to
the Settings > System Settings > Users & Devices > Device Registration page that allows you tochoose whether or not to show users a QR code and registration URL. This option is enabled by default.
When enabled, the QR code and registration URL display to users. For more information, see Disabling the
QR code and registration URL.

l

New option to hide self-service portal (SSP) Activity page: A new configuration check box has been
added to the Settings > System Settings > General > Self-Service Portal page that allows you tochoose whether or not to show users their activity in the SSP. This option is enabled by default. Whenenabled, the SSP Activity page displays to users. For more information, see Disabling device history logs
in the self-service user portal.

lConfirmation email sent automatically for new client registrations: When a device user accepts theTerms of Service (ToS) agreement in a registration invitation, the admin automatically receives an audit
email confirming the registration, from Core version 11.1.0.0 through the most recently released version as
supported by MobileIron.
The email consists of the following message and identifying client information:"The following user has accepted device registration terms and has attempted to enroll a new device:"
User name, display name, email address, date and time, IP address, platform, employee owned. For more
information, see Configuring an end user Terms of Service agreement.

l

OAuth endpoint for mutual certification authentication: New mutual authentication device endpoints
are available for use by iOS and Android clients. The existing (old) OAuth endpoint is not protected by 2FA
or mutual certificate authentication and is vulnerable to password spraying and DOS attacks. The
administrator can disable the original OAuth endpoint and utilize the new endpoint. This feature isapplicable on Mobile@Work for Android version 11.1.0.0 and Mobile@Work for iOS version 12.11.10
through the latest versions as supported by MobileIron. For more information, see New endpoint for mutualcertification authentication.

l

New option to parse or not parse .mobilconfig file: In the Configuration Profile Setting dialog box,
there is a new field "Send File Verbatim" that you can select if you wish to deploy a signed .mobileconfig
file, for example, Apple debug configurations via MobileIron MDM. Because Core does not expect a signed
file, it would not be able to parse it and inject a substitution variable because it would change the signatureof the signed file. Files uploaded with this option selected are sent as is to the device without parsing,validating, or signing of the file by MobileIron. For more information, see Configuration profile settings (iOS,tvOS, and macOS).

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 35

New features and enhancementsl

Two new fields have been added to Apple Per-App VPN configurations - Associated Domains
and Excluded Domains: In the Per-app VPN and in the MobileIron Tunnel configurations, administrators
can specify associated and excluded domains to be considered for association or exclusion from the perapp VPN and tunnel server connections. Applicable to iOS 14.3 and macOS 11.0 through the latest version
as supported by MobileIron. For more information, see Managing VPN Settings.

lSupport IdP-based device registrations: As part of the DEP profile, the MDM server provides Custom
enrollment URL along with a standard URL to get the MDM profile to the Apple server. This URL can beused by administrators to enforce their own authentication model or provide any other information. An
example use case would be where administrators cannot use their organization’s Identity provider "as is"for DEP authentication without heavy changes on the infrastructure. For more information, see
Customized registration using SAML IdP and Creating Apple Device Enrollment profiles.

lSupported certificate type values for iOS IKEv2 VPN configurations: iOS VPN configurations using
Internet Key Exchange version 2 (IKEv2) need to include a selected value from the following list ofcertificate types:
o

RSA

o

ECDSA256o

ECDSA384o

ECDSA512

For more information, see IKEv2 (iOS Only).

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 36

2Registering Devices
A device is available for management by MobileIron Core after it has been registered by a device user oradministrator.
The topics in this section include the following advanced topics:l

Registration methodslTerms of servicelVisual privacylInvite users to registerlIn-app registration for iOS and Androidl

Registering iOS and macOS devices through the weblRegistering macOS devices with Core using Mobile@Work for macOSl

ActiveSync device registrationlManaging operators and countrieslSpecifying eligible platforms for registrationlSetting the registration PIN code length for device user registrationlCustomizing registration messageslConfiguring the default ownership for newly registered deviceslAssign a unique attribute as a device's namelDisabling analytics data collectionlRemoving an old or expired MDM profile from an iOS or macOS devicelDisabling analytics data collection

Refer to the Getting Started with MobileIron Core for the most commonly used registration topics, such as:lSingle device registrationlBulk device registrationlTracking registration statusl

Restricting the number of devices a user registerslRegistration considerations

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 37

Registration methods

Registration methods
Registering a device designates it for management by MobileIron Core.
Before you begin
Setting the registration PIN code length for device user registration
The following registration methods are available:lAdmin invites users to registerlIn-app registrationlCustomized registration using a URL or a QR Codel

Customized registration using SAML IdPlUsers register additional deviceslAdmin registers ActiveSync deviceslRegistering an Apple TVlRegistration via user portal

The process resulting from these methods may vary by device OS.

Admin invites users to register
For users who are mobility savvy and do not require significant assistance, you can send an invitation and enable
them to register their own phones. You can send an invitation to multiple users from the Users Management
screen. The invitation includes instructions on how to log into the user portal to register phones.
The administrator needs to know the following information for the device:lphone number (if any)lcountrylplatform

Related topics
Invite users to register

In-app registration
One way to reduce the load on IT personnel is to instruct iOS and Android users to download the MobileIron app
directly from the App Store on iTunes or from Google Play and initiate registration from within the Mobile@Workapp.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 38

For iOS devices

For iOS devices
1. Go to Settings > System Settings > iOS > MDM and select the Send email to user and notification toclient if MDM profile is not installed check box.
2. Device users of iOS 12.2 and later will need to download Mobile@Work, manually navigate to Settings
view and download the MDM profile.
3. Device users then complete the registration process by responding to registration prompts. If Core detectsthat the MDM profile has not yet been installed, upon the next device check-in, Mobile@Work will display
a notification asking the device user to re-enroll.
NOTE: In iOS 13, the option to "Allow Always" was removed from the iOS Settings app. Instead, adialog box displays requesting device users to enable tracking when the Mobile@Work
app is running. Mobile@Work opens iOS Settings where device users can choose "Ask
Next Time" or "Never". MobileIron recommends device users to enable tracking. Thischange applies to all versions of iOS 13 through the latest version as supported by
MobileIron. Mobile@Work for iOS does not track device users' location without consent.

For macOS deviceslApplicable to macOS 11.0 through the most recently released version as supported by MobileIron Core.

lOnce completed, the mac device is a supervised device.

Procedure
For macOS device registration in the self-service portal, a device user must perform the following steps:
1. Log in with their credentials.
2. In the Install Management Profile page, the device user grants permission for the download of the profile.
The profile is downloaded to the device user's local system.
3. Double-click the downloaded profile (macenroll.mobileconfig) to make it visible in the device user's
System Preferences. There is limited time for the device user to install the profile before it becomes
invalid.
4. Go to System Preferences > Profiles.
5. Click Install to install the management profile.
6. Continue and finish the installation procedure. Enter the system password when prompted.

Administrator taskslThis feature depends on access to the MobileIron Gateway; therefore, the corresponding port must be
properly configured. See the Pre-Deployment Checklist in the On-Premise Installation Guide for details.
The User Portal role must be assigned to the user.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 39

Registration restrictions for Android devicesll

For iOS devices, you must enable the MDM profile in the Admin portal.
o

Go to Settings > System Settings.

oExpand iOS and select MDM. The MDM page displays.

oSelect the Enable MDM Profile check box.

oClick Save.

To auto-populate the MobileIron Core server name during registration, the following setup is required:o

The user associated with the device must be known as an LDAP user or defined as a local user.

o

To auto-populate based on the email address, you must register your VSP with MobileIron.

l

Set up the registration email template, see Customizing registration messageslSchedule email reminders, see Customizing registration messageslSend the email invitation to device users.

Registration restrictions for Android devices
From the Device Registration page, you can specify conditions that Android devices must meet to qualify forregistration. You can limit Android devices by operating system (OS) version, security patch level, or by
manufacturer and model.
Before you beginlComplete Registration methods.

Procedure
1. From the Settings > System Settings > Users & Devices > Device Registration page, scroll down to
the Restrictions for Android section. Choose from these optional filter settings:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 40

Registration restrictions for Android devices

FIGURE 1. REGISTRATION RESTRICTIONS FOR ANDROID DEVICES

2. Minimum OS version: Select a minimum OS version from the drop-down menu from Android 5.0 through11.0 (or the highest release as supported by MobileIron). The default is None.
3. Minimum Security Patch Level: Enter an integer specifying within how many days a device can be noncompliant for the minimum security patch level before rejecting the device. The default is None.
4. Allowed/Blocked devices list: The options are:l

None: The default. Do not create an Allowed or Blocked devices list.

lCreate a list of Allowed devices: Only allow devices of these makes and models to be registered.

lCreate a list of Blocked devices: Prevent devices of these makes and models to be registered.

To enter specific manufacturers and models, click Add+ to open text fields in the Manufacturer Nameand Model columns. Enter allowed or restricted device information.
5. Click Save.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 41

Customized registration using a URL or a QR Code

Customized registration using a URL or a QR CodeAs a convenience, instead of device users entering registration credentials, you can setup an infrastructure to use
a QR Code or URL link to automatically enter the registration credentials. This feature is applicable for iOS andmacOS devices.
Before you begin
The company administrator must set up an infrastructure to generate a web page containing a QR Code or URL linkfrom the credentials generated by UEM (see Implementing infrastructure for QR code with device PIN.)l

In the case where the web page generated by the company is viewed on a computer, a QR Code would beappropriate to present. When constructing the QR code, it should contain a URL and follow this format:
mirp://<server host name>&user=<Username>&pin=<PIN>

Example: mirp://your.server.rock.com&user=you@rock.com&pin=4444
NOTE: It is recommended that the web page created by the admin to provide a QR code also
provides the instructions to download the app from the iTunes App Store or Google Playand the instructions to scan the QR code.
l

In the case where the web page is viewed on the device where Mobile@Work is being registered, a URL
link would be appropriate.

Implementing infrastructure for QR code with device PIN
The below procedure works for iOS devices and utilizes the PIN code as part of the registration.
1. Enable the PIN code registration

1. Go to Settings > Users & Devices > Device Registration.
2. Select the appropriate field for the type of Android device:ll

For unmanaged Android devices, change the In-App registration requirement to Registration PIN.
For managed Android devices, change the Zero Touch and Samsung Knox Mobile Enrollment field
OR the Managed Devices / Device Owner (afw#, QR code, NFC) field to Registration PIN.

2. Enable the QR code integration

1. Go to Settings > Users & Devices > Device Registration.
2. Click on Templates tab > Registration Templates.
3. Select your language and then click the Edit button.
4. In the Registration Email section, PIN field, replace the default text with this code:<li>Registration PIN: <i>$PASSCODE$</i> (valid for $PASSCODE_TTL$ hours)<p>
Or Scan the QR Code:</p>

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 42

Registering using a web page on a desktop computer<P><img id=&#39;barcode&#39;
src="https://api.qrserver.com/v1/create-qr-code/?data=mirp%3A%2F%2F$SERVER_
URL$%26user%3D$USER_ID$%26pin%3D$PASSCODE$"
width="200"height="200" /></P>

5. Click Save.
When this code has been added, administrators can directly register a device from the Device Registration
screen in Core and / or the device user can initiate the registration from the e-mail invitation.

Registering using a web page on a desktop computer
Below is a sample implementation where the web page is viewed on a desktop computer.
Procedure
1. Core administrator sends device user an email with a link to the company's webpage.
2. In the email, the device user clicks on the link.
The link opens to the company web page displaying a QR code on it.
3. On the user's device, the user goes to the iTunes App Store or Google Play and downloads Mobile@Work.
4. User launches the phone's camera.
NOTE: The Scan QR Code page may open. Device users will need to allow access to thedevice camera for scanning the QR code. Tap on Open Settings, slide the camera on,then return to Mobile@Work.
5. User scans the QR code that is on the web page.
The Mobile@Work login page opens with the username, server address and PIN/password fields
populated.
NOTE: If the PIN field is not automatically populated, the device user will need to manuallyenter it.
6. User taps Go or Register and continues the registration process.
Note The Following:ll

On launching the Mobile@Work app, the user can tap on the QR code icon (to the right of the user namefield), and launch the in-app camera. This camera can then be used to scan the QR code and continue withthe registration process.
On devices running iOS 11.0 or later, the native camera can be used to scan the QR code. Upon scanning
the QR code, the device user is prompted to launch Mobile@Work. Tapping on the prompt launches
Mobile@Work with the device user’s credentials filled in. The device user can then tap Go or Register tocontinue with the registration process.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 43

Registering using a web page on an iOS devicel

On devices running iOS 10, the native camera lacks the ability to scan QR codes. To work around this, thedevice user can launch the Mobile@Work app, tap on the QR code icon (to the right of the user name field),and launch an in-app camera. This camera can then be used to scan the QR code and continue with theregistration process.

Registering using a web page on an iOS device
Below is a sample implementation where the web page is viewed on an iOS device.
Procedure
1. Administrator sends device user an email with a link to the company's web page.
2. In the email, the device user taps on the link.
The company's web page opens displaying two links.
3. Device user taps on the first link and downloads the Mobile@Work app from the iTunes App store or from
Google Play.
4. Device user taps on the second link, the Mobile@Work login page opens with the username, server
address and PIN/password fields populated.
NOTE: If the PIN field is not automatically populated, the device user will need to manuallyenter it.
5. User taps Go or Register and continues the registration process.
NOTE: In iOS 13, the option to "Allow Always" was removed from the iOS Settings app. Instead, adialog box displays requesting device users to enable tracking when the Mobile@Work
app is running. Mobile@Work opens iOS Settings where device users can choose "Ask
Next Time" or "Never". MobileIron recommends device users to enable tracking. Thischange applies to all versions of iOS 13 through the latest version as supported by
MobileIron. Mobile@Work for iOS does not track device users' location without consent.
Related topics
Disabling the QR code and registration URL

Customized registration using SAML IdP
As a part of the registration process, device users log into a third-party identity provider (IdP), such as Ping. Oncethe authentication is successful, the device user is prompted to download the profile, completing the registration
process.
Before you begin
You must have SAML enabled. See "Configuring SAML/IdP support" in the MobileIron Core System Manager
Guide.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 44

Users register additional devices

Procedure
1. Enable SAML in the System Manager.
2. Configure an identity provider.
3. Go to the Admin portal > Settings > Users & Devices > Device Registration page.
4. In the Apple Web-based Registration Requirement field, select SAML-based registration. If this field is
not selected, there will be no change in the registration.
NOTE: Once SAML on iReg or DEP is set, SAML configuration from the System Manager can beeither disabled or deleted. You must first de-select the "SAML-based registration" checkbox in the Device Registration page in Core before you can disable the IdP SAML
connection in the System Manager.
5. Click Save.

Users register additional devices
Once a device has been registered, an authorized user can use the user portal to register additional devices without
administrative help. This is often used with adding devices for users who do not require assistance.
PrerequisiteslUsers must have the User Portal role assigned, with the Device Registration option enabled.

l

The user needs to know the following information for the device:ophone number (if any)ocountryoplatform

Related topics
Self-service User Portal

Admin registers ActiveSync devices
If you have a MobileIron Sentry configured, then you can see the devices that are connecting to your ActiveSync
server. To incorporate these devices into your MobileIron Core inventory, you can use the Register button in the
ActiveSync Associations screen. This is often used with devices accessing email via ActiveSync.
Prerequisiteslll

MobileIron Sentry must be installed and configured.
The user (local or LDAP) associated with the device must be available for selection at the time ofregistration.
For iOS, Android, and Windows devices, the User Portal role must be assigned to the user.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 45

Registering an Apple TVl

You need to know the following information for the device:ophone number (if any)ocountry codeoplatform

Related topics
ActiveSync device registration

Registering an Apple TV
You can register an Apple TV to MobileIron Core only through Apple Configurator.
Before you begin
The Apple TV must be connected to your corporate network. You can do this by configuring Wi-Fi on the Apple TV
or connecting the Apple TV to your Ethernet.
ProcedurelFollow the instructions in Distributing MDM Profiles with Apple Configurator.

NOTE: Using the Apple TV Assistant to import the MDM profile results in an error message. Cancel out of
the Apple TV Assistant.
You can do the following when you manage an Apple TV with MobileIron Core:l

View device information.

lDistribute Wi-Fi profiles to the Apple TV.

lRetire the device.

Registration via user portal
The user portal can be used to streamline the registration process. See Self-service User Portal for more
information.

Terms of service
You can optionally define terms of service text to be displayed to users during:ldevice registration on iOS, macOS, Android, and Windows devicesllogging into AppConnect apps on iOS and Android devices

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 46

Creating a terms of service agreement

Device users must accept the terms of service before they can continue with registration or with accessing
AppConnect apps.
You can search for users by terms of service acceptance and date of acceptance. You can create one terms ofservice agreement for each supported language. The same terms of service text is used for both registration and
AppConnect app access.
Regarding terms of service during registration:lllPresenting the terms of service is part of the registration process when using Mobile@Work. Users must
accept the terms of service agreement in order to complete registration.
Configuring a terms of service agreement or updating it applies only to users who register after you
complete the configuration. Previously registered users do not accept the terms of service agreement.
However, you can require existing users to accept the terms of service agreement by retiring their devices
and requesting them to re-register.
If both custom terms of service and the privacy policy are enabled, users will have to accept the privacy
policy first.

Regarding terms of service for accessing AppConnect apps:
l

l

l

l

In addition to providing the terms of service text, you must enable terms of service on the AppConnect
global policy.
Also on the AppConnect global policy, you indicate whether:ousers must accept the terms of service each time they are prompted for their AppConnect passcode orbiometric authentication. If you update the terms of service text for a user's language, the user sees
the updated text on all subsequent AppConnect logins.

othe user must accept the terms of service only once. However, if you update the terms of service text
for a user's language, on the next AppConnect login, the user is prompted once more to accept theterms of service.

If you delete the terms of service, but do not disable it on the AppConnect global policy, users continue tobe prompted to accept the terms of service with whatever the last terms of service text was.
For information about enabling terms of service when logging into AppConnect apps, see "Configuring the
AppConnect global policy" in the MobileIron Core AppConnect and AppTunnel Guide for MobileIron Core.

Creating a terms of service agreement
Before you begin
Set up the system default language as described in Setting the system default language .
If there is no terms of service available in the primary language of a given device, or if more than one agreement isdefined for more than one device language on a device, the terms of service agreement defaults to the systemdefault language.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 47

Searching for devices by terms of service agreement criteria

Procedure
1. In the Admin Portal, go to Settings > System Settings > Users & Devices > Registration.
2. Scroll down to the End User Terms of Service section.
3. Click Add+.
4. Select the language for the terms of service.
5. For Type, select System for iOS, macOS and Android devices. Select AAD enrollment for Windows
devices.
6. Enter the text for the terms of service.
You can adjust the editor to use rich or plain text by clicking the Source Edit icon.
7. Click Save.
8. Optionally, repeat steps 3 through 6 to add a terms of service agreement for each supported language, andfor Windows devices versus iOS, macOS, and Android devices.
Note The Following:l

To edit a terms of service agreement, click the Edit link next to the relevant language.

l

To delete a terms of service agreement, click the Delete button next to the relevant language.

Searching for devices by terms of service agreement criteria
You can search for devices based on whether users have agreed to the terms of service, and the date on whichterms of service were accepted.
The following table describes the searchable criteria related to terms of service. Corresponding fields are displayedon each device's Device Details tab.

TABLE 1. SEARCHABLE CRITERIA FOR TERMS OF SERVICE
Criterion

Description

Terms of Service Accepted

A false value means the user did not accept the terms of service atregistration, which means the device was registered before a terms ofservice agreement was required, or a terms of service agreement wasnever configured.
A true value indicates the device user accepted the terms of service
agreement at registration.

Terms of Service Accepted
Date

Filters for the exact time users accepted the terms of service agreement at
registration. This search is useful if you want to locate the version of theterms of service agreement accepted by a specific user for a particulardevice.

AppConnect Terms ofService

The value DECLINED means the user did not accept the terms of service
for using AppConnect, which means the device user logged into
AppConnect before a terms of service agreement was required, or a terms

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 48

Terms of Service for users

Criterion

Descriptionof service agreement was never configured.
The value ACCEPTED indicates the device user accepted the terms ofservice agreement when logging into AppConnect.

AppConnect Terms ofService Date

Filters for the exact time users accepted the terms of service agreement
when logging into AppConnect. This search is useful if you want to locate
the version of the terms of service agreement accepted by a specific user
for a particular device.

Procedure
1. In the Admin Portal, go to Devices & Users > Devices.
2. Click Advanced Search.
3. Add one or more of the search rules regarding terms of service.
a. From the Field drop-down list, select the field of interest:lCommon Fields > Terms of Service Accepted.

lCommon Fields > Terms of Service Accepted Date.

lCommon Fields > AppConnect Terms of Service.

lCommon Fields > AppConnect Terms of Service Date.

b. Provide the appropriate value:lllTerms of Service Accepted: Select true or false in the Select Value field.
Terms of Service Accepted Date: Enter the number of units in the Value field and select theunits (such as days, weeks, or months) in the Date field.
AppConnect Terms of Service. Enter ACCEPTED or DECLINED in the Value field

AppConnect Terms of Service Date. Enter the number of units in the Value field and select theunits (such as days, weeks, or months) in the Date field.
The search criteria you selected are displayed in the search field.
l

4. Click Search.
5. The results are displayed.
6. Optionally, save your search to a label by clicking Save to Label.
7. If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click
Confirm. For more information, see Best practices: label management.

Terms of Service for users
Device users can easily scroll through and accept an administrator-defined terms of service agreement in their web
browser or Mobile@Work client, as in the following example.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 49

Visual privacy

FIGURE 2. TERMS OF SERVICE FOR USERS

Visual privacy
MobileIron Core allows you to display privacy information to device users.
Visual privacy describes to users what device information is collected and why, and what actions administrators
can take on the device, based on MobileIron Core settings. Additionally, MobileIron Core notifies users whenchanges are made to the privacy policy or MDM profile settings.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 50

Enabling visual privacy for devices

Users view the visual privacy information during registration, when they must accept the privacy policy.
NOTE: If both custom terms of service and the privacy policy are enabled, users will have to accept theprivacy policy first.

Enabling visual privacy for devices
When enabled, end-users will be able to learn more about the privacy of their data. Mobile@Work will show what
content stays private on the device, what information is collected and why, and what actions the IT administrator
can take on the debice, according to the settings on the server. This can help reduce end-user questions andconcerns.
Procedure
1. Go to Settings > System Settings > Users & Devices > Registration.
2. Select Enable privacy settings in Mobile@Work.
3. Click Save.

Viewing visual privacy settings in Mobile@Work
Procedure
1. In Mobile@Work, tap the Settings icon to open the Mobile@Work Settings menu.

2. Tap Privacy to open the main Privacy menu.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 51

Viewing visual privacy settings in Mobile@Work

3. Tap each option in the Privacy menu to view more details about privacy related to personal content, device
details accessible by your company, and actions your company can take if your device is lost or stolen.

4. Alternatively, tap the MobileIron Privacy Statement link to view the privacy policy in its entirety.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 52

Privacy policy for users

Privacy policy for users
Upon registration with MobileIron Core, a visual privacy policy is displayed in Mobile@Work. Users must tap
Continue to accept the privacy policy and continue the registration process.

FIGURE 3. PRIVACY POLICY FOR USERS

After registration, device users can view the new Privacy sub-menu from the Settings menu in Mobile@Work.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 53

Privacy policy for users

FIGURE 4. PRIVACY SUB-MENU FOR USERS

The Privacy sub-menu includes visual and text descriptions of the privacy of personal content, the device details
accessible by MobileIron Core, and the actions that can be taken by Core in the event that a user’s device is lost or
stolen.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 54

Invite users to register

FIGURE 5. PRIVACY DETAILS FOR USERS

Invite users to register
This feature is supported on macOS devices.
Administrators can invite users to perform self-service registration through the user portal. See Self-service User
Portal for information on this self-service user portal. The administrator sends invitations that provide theinstructions necessary to complete the registration process.
NOTE: Language-specific templates are not currently available for invitations.
See Registration methods for points to consider before using this registration method.
Procedure
1. Go to Devices & Users > Users.
2. Select the type of user accounts you want to work with:a. Select Authorized Users from the To drop-down list to select from local user accounts.
b. Select LDAP Entities from the To drop-down list to select users from the configured LDAP server.
3. Click the check box next to each user you want to invite.
4. Click Actions and then click Send Invitation.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 55

In-app registration for iOS and Android

5. Review the default text for the invitation and make any changes.
The text is displayed here with HTML markup. The user will receive the formatted version.
6. Click Send.
What the user sees
This registration method results in user notification via email. The email contains instructions for registering
devices via the user portal. See Self-service User Portal for information on what the user is expected to do tocomplete the registration process.

In-app registration for iOS and Android
You can ask iOS device users to download Mobile@Work fromthe iOS App Store and register by themselves.
Procedure
1. Make sure that the device user has a user record (local or LDAP) available in Core. See “Managing Users”
in Getting Started with MobileIron Core.
2. Instruct the device user on downloading the app and registering. The device user will need the following
information:luser namelpassword and/or Registration PIN

lserver (and the port number, if you did not use the default port number for TLS)

See Registration methods for points to consider before using this registration method.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 56

Auto-populating the MobileIron Core server name during registration

What the device user sees
NOTE: For iOS 12.2 through the most recently released version as supported by MobileIron, when doing
the iReg and in-app registration of the MDM profile, the device user experiences a different
registration process.
After downloading and installing Mobile@Work, the device user must register with MobileIron Core by entering
their user name, password, and server details.
NOTE: In iOS 13, the option to "Allow Always" was removed from the iOS Settings app. Instead, a dialog
box displays requesting device users to enable tracking when the Mobile@Work app is running.
Mobile@Work opens iOS Settings where device users can choose "Ask Next Time" or "Never".
MobileIron recommends device users to enable tracking. This change applies to all versions of
iOS 13 through the latest version as supported by MobileIron. Mobile@Work for iOS does not trackdevice users' location without consent.
If a customized terms of service agreement has been defined on MobileIron Core, device users will need to accept
the agreement before registering with Core.

Auto-populating the MobileIron Core server name during registration
Auto-populating the MobileIron Core server name streamlines the registration process and eliminates the need forthe device user to type it. You can auto-populate the Core server address based on the device phone number (forAndroid only) or the email address.
NOTE: This feature is not supported for devices with Android v6.0 and above.

Auto-populating the MobileIron Core server name based on email address
To auto-populate the server name based on the device user’s email address, you only need to register your
MobileIron Core with MobileIron. Additional configuration on Core is not required.
Device users must enter their full email address when prompted to enter their user name in the registration screen.
MobileIron matches the email domain to the appropriate MobileIron Core and populates the registration screen withthe correct server name.

Registering your MobileIron Core with MobileIron
To register your MobileIron Core, open a ticket on the MobileIron Support portal and provide the following
information:lyour company name (e.g. MobileIron)l

your email domain (e.g. mobileiron.com)

lyour MobileIron Core hostname for on-premise Core, or m.mobileiron.net:<appropriate port number> forConnected Cloud.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 57

Registering iOS and macOS devices through the web

If you disable Require device identifiers for enrollment, the enrollment will still proceed, but the client will notcollect the device identifier data. The device would be a "PDA" device such as a tablet.

Registering iOS and macOS devices through the web
Web-based registration is the process of registering iOS and macOS devices in bulk for large deployments. The
benefits of this style of registration include:liTunes accounts are not requiredlNo end-user interaction is required

NOTE: The MDM profile applied to macOS devices following registration is only applicable to thedevice user logged in to the device, not to the device itself. In effect, this means that devices
running macOS and registered with MobileIron Core do not allow multi-user support.
For registering macOS devices using Mobile@Work, see Registering macOS devices with Core using
Mobile@Work for macOS.
Before you begin
Because users will be informed of the registration via email before they receive the device, consider turning off user
notification when you bulk register devices. As an alternative, consider editing the registration template or informing
users that they should ignore the email. See Customizing registration messages for information on editing thetemplate.
NOTE: Web-based registration requires a Safari browser on the device.
Procedure
1. In the Admin Portal, go to Settings > System Settings > Users & Devices > Device Registration.
2. Select the device registration settings that are relevant to your devices:
Item

Description

Enable Server Name Lookup

Select to enable server name lookup during registration.

Allow registration when
password change is required

When a device user logs in for the first time, he/she will be asked
to update the password for the next login. Selecting this field
allows Core to authenticate the device user and completes
enrollment. This is limited to device registrations only. Disabled
by default.

Restrict device registrations
by enrollment type

Select this option to restrict device registrations by enrollment
type. Once checked, three additional checkboxes appear. Selectall that apply:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 58

Registering iOS and macOS devices through the web

Item

DescriptionlApple devices that are part of the Automated Device
Enrollment ProgramlAndroid devices that are part of the Google Zero TouchlAndroid devices that are part of Samsung Knox Mobile
Enrollment

Display QR Code andRegistration URL

Enabled by default. When enabled, your users have access to aregistration URL and QR code in their registration invitation.

In-App Registration
Requirement

Select an authentication option for devices registering with Corethrough Mobile@Work:• Password: Select to enable authentication throughMobile@Work using a password only.
• Registration PIN: Select to enable authentication throughMobile@Work using only a PIN.
• Password and Registration PIN: Select to enable
authentication through Mobile@Work using both a password
and a PIN.
Note The Following:• Registration PINs are valid for four hours. If a device user
launches Mobile@Work for iOS within four hours of webbased registration, the user does not need to re-enter
credentials.
• In-app registration does not apply to macOS devices.

Allow silent in-app
registration only once. (iOSonly)

Consider this extra security option if you are:• including Mobile@Work for iOS in the MobileIron Core App
Catalog and• sending an installation request to devices after device users
complete registration, such as with web-based registration.
In this case, users do not have to reenter their credentials when
they launch Mobile@Work. However, you can limit this silent
registration with Mobile@Work to one time only by selecting thisoption.

Silent in-app registration time
limit (minutes) (iOS only)

Allows the administrator to specify the silent registration grace
period. The minimum can be 1 minute, the maximum 525600
minutes (365 days). The default value is 240 minutes (4 hours).

Apple Web-Based
Registration Requirement

Select an authentication option for devices registering with Corethrough the web:• Password: Select to enable authentication through the web
using a password only.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 59

Registering iOS and macOS devices through the web

Item

Description•••

Registration PIN: Select to enable authentication throughthe web using only a PIN.
Password and Registration PIN: Select to enable
authentication through the web using both a password and a
PIN.
User and Registration PIN: Select to enable authentication
through the web using both their user name and a PIN.

NOTE: These options also apply to macOS devices.
3. Click Save.
4. Bulk register the devices on MobileIron Core.
See “Bulk device registration” in the Getting Started with MobileIron Core for information on using bulk
registration.
After these devices are registered, they will appear in the Devices & Users > Devices page with a statusof Pending.
5. Create a pending device report.
6. On each device, point the browser to the following URL:
https://<fully-qualified domain name for Core>/go
The registration screen appears.
7. Enter the requested information for the user who will receive the device.
The registration screen appears.
8. Instruct the device user to enter the requested information.
9. Instruct the device user to tap or click Register.
If a terms of service agreement has been defined, it is displayed here.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 60

Create a pending device report

10. Instruct the device user to tap or click Accept.
11. Instruct the device user to follow the on-screen instructions for installing the relevant device management
profiles.
Next steps
Create a pending device report
Related topicslAuto-populating the MobileIron Core server name during registrationlCreating a terms of service agreementl

Visual privacylLimit for failed attempts to enter a registration password

Create a pending device report
This feature is supported on macOS devices.
A pending device report is used to list the username and the PIN and/or password you will need to complete theregistration process on each user’s behalf.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 61

Registering macOS devices with Core using Mobile@Work for macOS

Procedure
1. Go to Devices & Users > Devices.
2. Open Advanced Search by clicking the advanced search icon.
3. Using the query builder, select the following:lSelect Status for Fieldl

Select Equals for OperatorlSelect Pending for Value

4. Click Search. The devices in pending state are shown in the table.
5. To download this report in CSV format, click Export To CSV. The report includes the PIN and/or
password required to complete registration, as appropriate.
Next steps
For iOS devices, proceed to In-app registration for iOS and Android.

Registering macOS devices with Core using Mobile@Work formacOS
Mobile@Work for macOS allows you to:llregister macOS devices with MobileIron Core using web-based registration (this automatically installs
Mobile@Work)run shell scripts on macOS devices.

As a convenience, instead of macOS device users manually entering registration credentials, you can set it up so
devices are automatically registered with Core.

What the device user sees:
1. Device user receives an email invitation with a link in it.
2. Device user clicks on the link.
3. The device user enters username, password and accepts the terms of service displayed in Mobile@Work
for macOS.
4. Device user then downloads the enroll.mobileconfig file. When this happens, Mobile@Work is
automatically downloaded and user registration is automatically completed.
Note The Following:
What happens after downloading the enroll.mobileconfig file varies based upon the user's browser andsettings:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 62

What the administrator doesll

If the user uses the default browser (Safari), Settings is launched with the enroll.mobileconfig file andthe user will need to go through permissions dialogs to enable MDM on the mac.
If the user is not using a default browser, the enroll.mobileconfig file is downloaded but Settings is notlaunched. This means the user will need to double-click on the enroll.mobileconfig file to continue
registration.

What the administrator does
As with other types of devices, you can configure whether you want macOS device users to enter a password,
PIN, or both during registration, as described in Setting the registration PIN code length for device user registration.
Device users can retire their macOS devices from Core by uninstalling Mobile@Work for macOS from theirdevices.
Procedure
1. Upload the PKG file for Mobile@Work for macOS to a secure server. This server must be accessible todevice users. See "Using the wizard to add an in-house macOS bundled app to the App Catalog" in the
MobileIron Apps@Work Guide.
2. Set up the email invitation template. See Customizing registration messages
3. Send the email invitation to device users.
4. Monitor devices for status in Devices & Users > Devices.
Related topics
Running shell scripts on macOS devices
Customized terms of service

ActiveSync device registration
This feature is not applicable to macOS devices.
The ActiveSync view displays the devices that are accessing ActiveSync. This view is populated only if you havea MobileIron Sentry configured. From this view, you can decide to register selected devices.
See Registration methods for points to consider before using this registration method.
Procedure
1. Go to Devices & Users > ActiveSync.
2. Select a device to be registered.
3. Click Actions > Register.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 63

Managing operators and countries

4. See “Single device registration” in the Getting Started with MobileIron Core for instructions oncompleting the registration process.

Managing operators and countries
This feature is supported on macOS devices.
MobileIron provides a default list of operators for users to select from during registration. You can enable or disable
operators to determine whether they appear in the list of operators displayed during registration of US devices andother devices having a country code of 1.
For non-US devices, country selection is an important part of the registration process. MobileIron also provides adefault list of countries enabled for registration purposes. You may need to adjust this list to enable additionalcountries.
This section explains how to customize displayed operators and countries.

Enabling operators
Enabling an operator displays it in the list of operators presented to users during registration.
Procedure
1. In the Admin Portal, go to Services >Operators. By default, the Operators screen shows only Enabled
operators.
2. Select Disabled or All from the Status drop-down.
3. Click the check box next to each operator you want to enable.
4. Click Actions > Enable.

Enabling additional countries for registration
A subset of countries are enabled for device registration by default. You should check this list and determine if anyof your users have home countries not represented in the default list.
Procedure
1. In Admin Portal, go to Settings > System Settings > Users & Devices > Registration.
2. Scroll to the Countries for Registration section.
3. Select countries from the Disabled Countries list.
4. Click the arrow button to move them to the Enabled Countries list.
5. Click Save.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 64

Disabling operators

Disabling operators
Disabling an operator removes it from the list of operators presented to users during registration.
Procedure
1. In the Admin Portal, go to Services >Operators.
2. By default, the Operators screen shows only Enabled operators.
3. Click the check box next to each operator you want to disable.
4. Click Actions > Disable.

Filtering operators
You can use filters to display only those operators you want to work with in the Operators screen. You can:l

Search for a specific operatorlDisplay operators by countryl

Display operators by status

Searching for an operator
Procedure
1. Enter a portion of the operator’s name in the Search by Name field.
2. Click the search icon to display the matching operators.
3. Click the x that appears in the search field to return to the default display.

Displaying operators by country
To narrow the list of operators by country, select a country from the Country drop-down list.

Displaying operators by status
To display operators by status, select from the Status drop-down list. The following options are available:lEnabledlDisabledlAll

Specifying eligible platforms for registration
This feature is supported on macOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 65

Setting the registration PIN code length for device user registration

In some cases, you may want to exclude from registration all devices of a particular platform. For example, if
corporate policy dictates that a particular device platform will not be supported, you may want to prevent users fromselecting the platform during self registration. Likewise, you may want to prevent help desk personnel frommistakenly registering the unsupported platform in the Admin Portal.
Procedure
1. In Admin Portal, go to Settings > System Settings > Users & Devices > Registration.
2. Scroll to the Platforms for Registration section.
3. In the Enabled Platforms list, select the platform you want to exclude.
Shift-click platforms to select more than one.
4. Click the left arrow button to move the selected platforms to the Disabled Platforms list.
5. Click Save.
All methods of registration now exclude the selected platforms.

Setting the registration PIN code length for device user
registration
This feature is supported on Android, iOS and macOS devices.
By default, device users must enter a password to register a device. You have the option to require a MobileIrongenerated Registration PIN in place of or in addition to the password.
Procedure
1. In Admin Portal, go to Settings > System Settings > Users & Devices > Registration.
2. Select a Registration PIN code Length, which is the minimum length for the PIN (6-12 characters).
3. Click Save.
For setting Android registration authentication, see Registration methods.
For iOS and macOS registration authentication, see Registering iOS and macOS devices through the web

Limit for failed attempts to enter a registration password
After the sixth failed attempt to enter a registration password, MobileIron Core locks the device user’s account for
30 seconds. The device user sees a message stating that the account is locked and will be released after the
specified interval.

Customizing registration messages
This feature is supported on iOS, macOS, Windows, and Android devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 66

Viewing registration templates

The registration process is a critical part of deployment. You can customize the registration messages involved inthis process by editing the registration templates. Registration templates enable you to specify content and basic
formatting using HTML markup.
MobileIron sends multiple messages related to registration:lregistration SMSlregistration email and reminder emaillpost registration email

These messages may vary by:lplatformllanguage

In addition, messages may vary by device type:lphonesl

PDAs

To accommodate this range of messages:lSeparate registration templates are provided for each language/platform combination.

lEach registration template contains separate text for each registration message type.

l

Each registration template contains separate text for phones and PDAs.

l

For when Core discovers device users that have not downloaded the MDM profile, reminder email
scheduling capabilities are provided

Viewing registration templates
To view MobileIron message templates:
1. In Admin Portal, click Settings > Templates.
2. Select Registration Templates.
3. Click the View link for the template you want to view.

Editing registration messages
To edit registration messages:
1. In Admin Portal, select Settings > Templates > Registration Templates.
2. Select the template you want to edit and click the Edit pencil icon.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 67

Editing registration messages

Registration messages are displayed with the HTML markup that provides the basic formatting for thecontent.
3. Make changes to the displayed registration messages.
NOTE: Do not add the <head> html tag in the registration template fields.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 68

Using variables in registration messages

4. Click the Variables Supported link in the right corner of the dialog box to display a guide to the supported
variables. See Using variables in registration messages for additional details.
5. Click Save.
Next steps
Scheduling reminder notifications for completing registration

Using variables in registration messages
Each field in a registration template has a set of supported variables, most of which are required. Supported andrequired variables also differ by OS. Use the following variables to guide your customization. You can also click the
Variables Supported link to display this information. All variables except $BRANDING_COMPANY_NAME$
are also required in the specified field.

Registration message variables
The following table gives the of variables used in types of registration messages.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 69

Variables used inside registration messages

TABLE 2. VARIABLES USED IN DIFFERENT TYPES OF REGISTRATION MESSAGES
Type

Supported Variables

Registration SMS, Phone$REG_LINK$

Registration EmailRegistration Email, Subject (Phone)$ENT_NAME$, $USER, $PHONE$

Registration Email, Subject (PDA)$ENT_NAME$, $USER, $PHONE$

Registration Email, Body(Phone)$ENT_NAME$, $BRAND_COMPANY_NAME$, $PHONE$,$INAPP_REG_STEPS$, $REG_LINK$

Registration Email, Body(PDA)$ENT_NAME$, $BRAND_COMPANY_NAME$, $REG_LINK$,$INAPP_REG_STEPS$

Registration Email, Reminder Subject(Phone)$ENT_NAME$, $USER$, $PHONE$

Registration Email, Reminder Subject(PDA)$ENT_NAME$, $USER$, $PHONE$

Registration Email, Reminder Body
(Phone)$ENT_NAME$, $BRAND_COMPANY_NAME$, $PHONE$,$INAPP_REG_STEPS$, $REG_LINK$

Registration Email, Reminder Body

$ENT_NAME$, $BRAND_COMPANY_NAME$, $REG_LINK$,$INAPP_REG_STEPS$(PDA)
Values for $INAPP_REG_STEPS$

Server$SERVER_URL$

Username$USER_ID$PIN$PASSCODE$, $PASSCODE_TTL$

Post-Registration Email

Post Registration Email, Subject (Phone)$BRAND_COMPANY_NAME$, $USER$, $PHONE$

Post Registration Email, Subject (PDA)$BRAND_COMPANY_NAME$, $USER$, $PHONE$

Post Registration Email, Body (Phones)$PHONES$, $BRAND_COMPANY_NAME$

Variables used inside registration messages
The following table gives the description of variables used inside registration messages.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 70

Scheduling reminder notifications for completing registration

TABLE 3. DESCRIPTION OF VARIABLES USED INSIDE REGISTRATION MESSAGES
Variable

Description$BRAND_COMPANY_NAME$

An internal variable.

$ENT_NAME$

The name of the organization using MobileIron Core to secure thedevice. See the field EnterpriseName in Settings > System
Settings > General > Enterprise.

$INAPP_REG_STEPS$

Combines $SERVER_URL$, the user’s LDAP password,$PASSCODE$, and $USER_ID$.

$PASSCODE$

The registration PIN generated for the device by Core.

$PASSCODE_TTL$

The number of hours that the registration PIN remains valid. See
the field Passcode Expiry in Settings > System Settings >Users & Devices > Registration.

$PHONE$The phone number associated with the device.

$REG_LINK$The URL that users access to complete the registration process(i.e., https://server name:port/i for iOShttps://server
name:port/v/passcode for Windows and other platforms).

$SERVER_URL$

The MobileIron Core server address used for registration.

$USER$The name of the user associated with the device, as displayed in
MobileIron Core.

$USER_ID$

The user ID for the user associated with the device, as defined in
the user account on Core.

Scheduling reminder notifications for completing registration
This feature works on iOS devices only.
Core detects whether device users have completed registration or not. To ensure that device users complete theirregistration, set up notifications to remind device users to complete the registration process. It is recommended
that a notification is sent to the device user every hour.
Notifications are only possible if the registration is done within the Mobile@Work registration. No reminders areneeded for Apple Device Enrollment registrations because the MDM profile is always installed as part of the Apple
Device Enrollments.
Procedure
1. In the Admin Portal, select Settings > System Settings.
2. Select iOS > MDM. The MDM page displays.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 71

Filtering registration messages

3. Select the Send email to user and notification to client if MDM profile is not installed check box.
The field expands, displaying additional fields.
4. Select how often to send a reminder email in the every hour field. If the device user registers within 8
minutes of the hour, the device user will not get a reminder until the next hour.
5. Select the Maximum Number of Emails / Notifications to be sent. A maximum of 24 emails/notifications
can be sent within a 24-hour period.
6. Click Save.
Next steps
Send the email invitation to device users. See Admin invites users to register

Filtering registration messages
In the Registration Templates page, you can filter registration messages by:llanguagelplatform

Procedure
1. If you want to restrict the templates displayed based on language, select the preferred language from theLanguage list.
2. If you want to restrict the templates displayed based on device platform, select the preferred platform fromthe Platform list.

Restoring registration messages to default content
To restore a registration message to the default content provided by MobileIron:
1. In the Settings > Registration Templates page, select the template you want to restore.
2. Click Restore to Factory Default.

Configuring the default ownership for newly registered devices
This feature is supported on macOS devices.
By default, all newly registered devices are configured as company-owned. You can change this default setting toemployee-owned (and back) on the Registration page.
Alternatively, you can change the ownership of a device after registration by:lselecting More > Change Ownership in the User Portal. For more information, see About changing
device ownership in the user portal.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 72

Assign a unique attribute as a device's namelselecting Devices & Users > Devices > Actions > Change Ownership in MobileIron Core.

Procedure
1. In MobileIron Core, go to Settings > System Settings > Users & Devices > Registration.
2. For the Default ownership for a newly registered device setting, select the relevant radio button:
Company owned
OR
Employee owned
3. Click Save.

Assign a unique attribute as a device's name
You can assign a unique attribute as the device name for a supervised iOS device using Substitution variables forcompliance policy rules. By setting the device names using the Device Name policy, the device name isautomatically applied to the iOS device when the device registers with MobileIron Core.
For more information, see Device name policies
Related topicslConfiguring a device name policy

Removing an old or expired MDM profile from an iOS or macOS
deviceIf a device has an old or expired MDM profile installed, the old or expired MDM profile may prevent the new MDM
profile from being installed, which, in turn, may prevent the device from being registered. If a device has an old or
expired MDM profile, you must remove it to enable device registration.
NOTE: When removing the MDM profile from an iOS device, Core can no longer track the apps installed
to the device. Core stores the last known state of all installed apps (at the time of MDM profile
removal) until retiring the device.
Procedure
1. Tap the Settings icon on the iOS device.
2. Tap General.
3. Scroll down to the Profiles section.
4. Tap Profiles.
5. Select the profile.
6. Tap the Remove button.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 73

Disabling analytics data collection

Procedure
1. On the macOS device, click the Apple icon.
2. Go to System Preferences.
3. Click Profiles.
4. Examine the list of device profiles for any MDM profiles that may be expired or irrelevant.
5. Select the expired profile.
6. Click the minus (-) button to remove the expired profile.

Disabling analytics data collection
MobileIron collects data to analyze the use of MobileIron Core to help us provide customer support, perform bug
fixes, improve product functionality and reliability and fulfill obligations to our customers. You can view details
about data collected in our product privacy notice: https://www.mobileiron.com/en/legal/product-privacy.
The data is collected from:l

Mobile@Workl

Apps@Work

Procedure
1. In MobileIron Core, go to Settings > System Settings > General > Analytics.
2. Select the Disable data collection from Mobile@Work and Apps@Work check box.
3. Click Save. A confirmation dialog opens.
4. Click Yes to confirm or No to cancel and allow analytics data collection.

Disabling the QR code and registration URL
When new users are invited to register with MobileIron Core, a QR code and registration URL display by default. If
your organization prefers not to show users a QR code and registration URL, an administrator can disable thefeature from the Device Registration page of the Core admin portal.
Procedure
1. Go to Settings > System Settings > Users & Devices > Device Registration page.
2. Deselect Display QR Code and Registration URL by clicking it.
3. Click Save.
Related topics
To disable the user Activity page in the self-service portal (SSP), see Disabling device history logs in the selfservice user portal.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 74

3
Distributing MDM Profiles with Apple
Configurator
This section addresses the distribution of iOS MDM profiles using Apple Configurator and bulk registration ofdevices based on serial number.
l

MDM profile distribution with Apple ConfiguratorlAutomatically matching Apple devices with serial numberslExporting an MDM profile from MobileIron Core 7.0-9.0

lUsing Apple Configurator to register an Apple device with Core

MDM profile distribution with Apple Configurator
MobileIron Core supports the distribution of iOS MDM profiles by means of Apple Configurator. In addition, you can
use bulk registration in the Admin Portal to automatically match users to devices based on serial number.
NOTE: Administrators who are experimenting or troubleshooting individual devices can also use theiPhone Configuration Utility to deploy a registration profile to a device.
Note The Following:lll

Do not assign user-specific configurations to the iOS label. Devices registered through theConfigurator are initially registered as anonymous users, so pushing user-specific configurations (such as
Exchange configurations) introduces unnecessary processing that must be repeated after MobileIron Core
matches the device to the user.
If you are using Apple Configurator to register devices that display the Setup Assistant, thenenable supervision of the devices in Apple Configurator. The Setup Assistant is the wizard-likeinterface you see when starting the device for the first time. The Setup Assistant prevents display of theregistration dialogs, causing deployment of configuration profiles to fail, unless supervision is enabled.
Consider installing the WiFi profile in a separate operation prior to installing the MDM profile.
This approach prevents the MDM profile installation from failing if the device does not acquire an IP
address (required for MobileIron Core connectivity) in a timely manner.

Automatically matching Apple devices with serial numbers
You can automatically match Apple devices with serial numbers by completing the following tasks:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 75

Acquiring serial numberslAcquiring serial numberslBulk-registering devices

Acquiring serial numbers
This step is only necessary if you want to automatically associate devices with their serial numbers in Core.
To automatically associate users to Configurator-registered devices, you must bulk-register the devices on
MobileIron Core and specify the device serial numbers in the registration spreadsheet.
Check the following sources for serial numbers:lthe back of the devicelin iOS (Settings > General > About)lon the retail and bulk device packaging (in both readable and barcode form)
For large roll-outs of devices, we recommend using a barcode scanner and the iPhone Configuration Utility
to quickly import serial numbers for tethered devices. This is particularly useful as the serial number can bycopied from IPCU and pasted into the spreadsheet. This practice is also useful if you intend to recycle andre-register devices.

Bulk-registering devices
This step is only necessary if you want to automatically associate devices with their serial numbers in Core.
Before you begin
Before you bulk-register devices with MobileIron Core, make sure you have collected the serial number for eachdevice, as described in Acquiring serial numbers.
NOTE: MobileIron Core does not support creating both a bulk enrollment record and a single device
record for the same user. Only a bulk enrollment or a single add device enrollment should be
used for a user, not both.
Procedure
1. In the Admin Portal, select Devices & Users > Devices > Add > Multiple Devices.
2. Click Sample CSV File.
3. Save the sample file to your local drive.
4. Add an entry for each device, including the serial number.
For more information on completing the bulk registration CSV file, see the “Bulk device registration” sectionin the “Registering Devices” chapter of Getting Started with MobileIron Core.
5. In the Adding Multiple Devices dialog, click Browse to select the edited CSV file.
6. Click Import File.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 76

Exporting an MDM profile from MobileIron Core 7.0-9.0

Next steps
Proceed to Exporting an MDM profile from MobileIron Core 7.0-9.0 or Using Apple Configurator to register an Appledevice with Core.

Exporting an MDM profile from MobileIron Core 7.0-9.0
Versions of MobileIron Core prior to 9.1 require exporting an iOS MDM profile prior to importing the profile into Apple
Configurator, so that the MDM profile may be applied to devices using Apple Configurator.
Procedure
1. In the Admin Portal, select Policies & Configs > Configurations.
2. Select the System - iOS MDM setting, and click Export MDM Profile.
3. Save the file to your local drive.
The file will have a .mobileconfig extension.
4. Tether the device.
5. Prepare your devices and import the MDM profile using Apple Configurator, as described in Preparing
devices.
6. Follow the steps in Creating and applying a blueprint.
7. For unsupervised devices, respond to the profile installation prompts displayed on the device.
Prompts do not display on supervised devices.
8. Confirm that the registration has been completed on MobileIron Core. The devices should be visible in the
Admin Portal after they check in.
If you did not bulk-register the devices, they will be displayed in the Admin Portal with the "<Anonymous>"
user account. When a device user installs and signs in to Mobile@Work, Core switches the device to thatuser's account.

Using Apple Configurator to register an Apple device with CoreNOTE: This procedure is incompatible with Apple School Manager iOS devices, and can only be donewith on-premise installations of Core.
Apple Configurator allows you to provision devices using mobile device management (MDM) without having to
download and manage configuration profiles. This is supported in Core 9.1 through the latest release.
Provisioning one or more devices involves the following main steps:
1. Deleting all content and settings from an iOS device
2. Creating a Wi-Fi profile

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 77

Deleting all content and settings from an iOS device

3. Preparing devices
4. Creating and applying a blueprint

Deleting all content and settings from an iOS device
You may wish to delete all content from the device before you begin. Otherwise, the device will download a newversion of iOS from Apple servers, a process that may be very time consuming.
Procedure
To remove all content from the device, select Settings > General > Reset > Erase All Content and Settings on
the iOS device.

Creating a Wi-Fi profile
MobileIron recommends creating a Wi-Fi profile so as to configure Wi-Fi for the device immediately. This allows thedevice to more quickly access MobileIron Core and receive the configurations for device enrollment.
Before you begin
Before creating a Wi-Fi profile, you must have completed Deleting all content and settings from an iOS device.
Procedure
1. Create a WiFi profile, as described in the following link:
https://help.apple.com/configurator/mac/2.3/#/cad51314d0e
2. Use the following link to define Wi-Fi settings:
https://help.apple.com/configurator/mac/2.3/#/cadbf9e6ff

Preparing devices
Preparing devices is the first step in any iOS device deployment for Apple Business Manager or Apple School
Manager. You need to prepare devices before you distribute them to users. To accomplish this task, you use thePrepare Assistant in Apple Configurator.
ProcedurellPrepare your devices for manual enrollment.
oTo prepare your devices for manual enrollment, follow the procedure described in the following link:ohttps://help.apple.com/configurator/mac/2.3/#/cad99bc2a859

For the host name or URL of the MDM server, either accept the default path populated by Apple
Configurator:
https://www.example.com/devicemanagement/mdm/dep_mdm_enroll

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 78

Creating and applying a blueprint

Or enter the full path with the following syntax:
https://www.example.com/mifs/c/i/reg/depenroll.mobileconfig

NOTE: Apple Configurator may show a message such as the following: "Unable to verify the server's
enrollment URL." If so, disregard this message.

Creating and applying a blueprint
The blueprint is an Apple Configurator feature that allows you to create a sort of template for the device, including
the URL of the MDM server (MobileIron Core) and the Wi-Fi profile you created in Creating a Wi-Fi profile. The
blueprint allows you to point to a set of configurations during setup, rather than having to specify each configuration
repeatedly.
Before you begin
Before creating a blueprint, you must have completed Creating a Wi-Fi profile.
Procedure
1. Create a blueprint, as described in the following link:
https://help.apple.com/configurator/mac/2.3/#/cad5b401e306
2. In the blueprint, specify whether you want to include an MDM profile you exported from Core, as describedin Exporting an MDM profile from MobileIron Core 7.0-9.0. This step is only necessary when using
versions of Core earlier than 9.1.
3. Select the Wi-Fi profile you created in Creating a Wi-Fi profile.
4. Tether the device to the computer:a. Use a USB cable to connect the iOS device to the computer you are using to create the blueprint inApple Configurator 2.
b. Select the tethered device.
c. Select Actions > Apply > Name of your MDM Server.
d. Repeat with any additional devices.
5. Apply the blueprint, as described in the link in step 1.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 79

4Managing Devices Enrolled in Apple Device
Enrollment
MobileIron Core supports the use of the Apple Device Enrollment with iOS, macOS, and tvOS devices.
lApple Device Enrollment with MobileIron Core overview

lSetting up Apple Device Enrollment with MobileIron CorelManaging Apple Device Enrollment accounts

Apple Device Enrollment with MobileIron Core overview
Apple Device Enrollment allows you to quickly and easily deploy a fleet of corporate-owned iOS, macOS, andtvOS devices. With Apple Device Enrollment, organizations such as universities and corporations can purchase,enroll, and manage Apple devices en masse. After purchasing Apple devices, administrators enroll devices andmanage the devices using a Mobile Device Management (MDM) server such as MobileIron Core. Apple Device
Enrollment and MobileIron Core are linked so that they can easily communicate and new devices assigned to theApple Device Enrollment account can be synchronized with Core.

Changes in Device Enrollment
The original Apple Device Enrollment portal had three sections that represented device enrollment: MDM Servers,
Device Assignments and Assignment History. These three are represented in MobileIron Core as "Apple Device
Enrollment." There are two types of device enrollment programs that Core manages: Apple Business Manager andApple School Manager. Apple no longer allows new customers to sign up for the legacy Device Enrollment
Program (DEP) portal at deploy.apple.com. New accounts with Apple Device Enrollment will be provisioned on
Apple Business Manager.

Apple Business Manager
Apple Business Manager is a place for IT teams to automate device deployment, purchase and distribute content,
and manage roles in their organizations. Working seamlessly with MobileIron Core, you can enroll devices, deploy
content, and delegate administrative privileges.
The Device Enrollment Program (DEP) and the Volume Purchase Program (VPP) are now integrated into Apple
Business Manager, so you can bring together everything needed to deploy iOS devices, Mac computers, and AppleTV into your organization. In Core, the terms "Device Enrollment Program (DEP) is now renamed to "Apple Device
Enrollment" and "Device Enrollment." "Volume Purchase Program" (VPP) has been renamed to "Apple Licenses."

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 80

Apple School Managerll

To enroll in Apple Business Manager, see the Apple Business Manager User Guide on the Apple website.
A login is required.
To enroll in User Enrollment, see User Enrollment with Apple Business Manager.

Apple School Manager
Apple School Manager is a simple, web-based portal for IT administrators to deploy iOS, macOS, and tvOS
devices all from one place. When used with MobileIron Core, you can configure device settings and buy anddistribute apps and books. Apple School Manager integrates with Student Information Systems (SISs) so you canquickly create accounts with school rosters and classes.
To enroll in Apple School Manager, see the Apple School Manager User Guide on the Apple website. A login isrequired..

Apple Device Enrollment features
Using Apple Device Enrollment for large-scale deployments, you can:ldeploy devices without having to touch themlautomate mobile device management (MDM) enrollment

lenable device supervision, including restrictionslskip some Setup Assistant screens, allowing device users to use their devices immediately

Apple Device Enrollment setup
The main steps of setting up Apple Device Enrollment are:
1. Enrolling in the Apple Business Manager or Apple School Manager programs.
2. Linking to your MDM server, in this case, MobileIron Core.
3. Assigning devices to Core. For assigning multi-user devices, see Configuring devices in bulk for Apple
School Manager.
4. Applying MDM configurations, as desired.
The MDM server you are linking to is MobileIron Core. After setting up Apple Device Enrollment, you use
MobileIron Core to secure and manage your devices, and apply MDM configurations.
NOTE: If you configure your devices to be supervised, you can apply additional restrictions throughMobileIron Core.

Best practices for managing devices in Apple Device Enrollment
Following are some best practices to keep in mind for managing enrolled devices in a Device Enrollment Program:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 81

Setting up Apple Device Enrollment with MobileIron Corell

You can enroll devices in an Apple Device Enrollment you previously registered in Core, as long as you
wipe and retire these devices first.
Use Apple Device Enrollment to purchase a large group of devices, which you can more easily manage inCore.

Related topicsl

iOS and tvOS restrictions settingslmacOS settings

Setting up Apple Device Enrollment with MobileIron Core
Setting up Apple Device Enrollment with MobileIron Core involves the following main steps:
1. Editing Core roles for Apple Device Enrollment
2. Linking MobileIron Core to Apple Device Enrollment
3. Assigning devices to the Apple Device Enrollment account
4. Creating Apple Device Enrollment profiles
5. Assigning Apple Device Enrollment devices to an enrollment profile en masse
6. Checking for Apple Device Enrollment account updates
7. Updating the OS on supervised Apple Device Enrollment devices
Before you begin
Sign up for Apple Business Manager. Apple's deprecated deployment accounts will continue to be supported by
MobileIron Core as long as Apple continues support.
For more information, see the Apple documentation for setting up an Apple Device Enrollment account.
NOTE: When using the hold feature while registering a device with Apple Device Enrollment, it ispossible for the device to get stuck in the hold screen if its Internet connectivity drops, causing
the Apple MDM server to be unable to reconnect to the device. Make sure you have a stable
Internet connection before registering a Apple School Manager device using the hold feature.

Editing Core roles for Apple Device Enrollment
Before you can set up and manage Apple Device Enrollment in Core, you must be sure your user name has thecorrect permissions for these actions. By default, user names with the administrator role will have the correct
permissions.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 82

Linking MobileIron Core to Apple Device Enrollment

Procedure
1. In the Core Admin Portal, select Admin > Admins.
2. Select the administrators whose permissions you want to edit.
3. Select Actions > Edit Roles.
4. In the Edit Roles window, select the following:
Item

Description

Admin Space

Select the space over which this administrator has administrative
control. For example, select Global to allow the administrator to use
the permissions selected here throughout Core.

Manage custom attributes

Select to allow the administrator to create custom attributes for use
with Apple Device Enrollment.

Manage device enrollment(iOS only)

Select to enable Apple Device Enrollment.
NOTE: You can use Apple Device Enrollment to manage
macOS and tvOS devices.

5. Click Save.

Linking MobileIron Core to Apple Device Enrollment
Linking your MobileIron Core server to the Apple School Manager portal allows you to use Core as the designated
MDM server for your Apple School Manager devices. You can then use Core to manage and secure your enrolled
devices.
This process involves:ldownloading a public key from MobileIron Core and uploading it to the Apple School Managerldownloading the Apple School Manager server token file and uploading it to MobileIron Core

After you upload it to the Apple School Manager, the public key certificate encrypts the authentication server token
file for secure transfer to MobileIron Core.
NOTE: If you have multiple Apple School Manager accounts for the same instance of MobileIron Core,
you can use the same certificate you download from MobileIron Core for all your Apple School
Manager accounts.
NOTE: The following procedure is applicable for only Apple School Manager. If you try to create a MDM
server using Apple Business Manager, you will not be able to connect it to Apple School
Manager.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 83

Assigning devices to the Apple Device Enrollment accountProcedure
1. In MobileIron Core, go to Devices & Users > Apple Device Enrollment.
2. Click Add+. The Add Account dialog box opens.

3. In the Add Account window, click Download Certificate. A .CRT file is downloaded to the file system.
4. Go to your Apple School Manager portal and sign in using a dedicated Apple ID.
5. Navigate to the Manage Servers page and add an MDM server using the certificate (.CRT file) downloadedin the previous steps.
6. Download the server token (.P7M file) from the Apple School Manager. The file will download to yourdefault download location.
7. Go back to MobileIron Core and in the Add Account window, click Browse next to the ServerToken field.
8. Select the server token (.P7M file) you downloaded from the Apple School Manager portal.
9. Click Open.
10. Click Save.
11. Go back to the Apple School Manager portal.
12. Click Done.
13. In MobileIron Core, click Check for Updates. Core retrieves the new devices.

Assigning devices to the Apple Device Enrollment accountAfter linking your Apple School Manager account to MobileIron Core, you must add devices to your Apple Device
Enrollment account. Devices added to Apple Device Enrollment are assigned to MobileIron Core, as this is the
MDM server you linked to in Linking MobileIron Core to Apple Device Enrollment.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 84

Creating Apple Device Enrollment profiles

Procedure
1. Go to the Apple School Manager portal and sign in using a dedicated Apple ID.
2. Navigate to the Manage Devices page and select the method by which you want to add devices, and takeaction accordingly.
Choose Devices By...

Description

Serial NumberEnter one or more comma-separated serial numbers for the devices you
want to assign.

Order Number••

Click the Order Number radio button.
Select a specific order number from the Choose an order drop-downlist.
A list of devices purchased with that order number is displayed.

••

Click the Upload CSV File radio button.
Click the Choose File link to select a CSV file listing devices byserial number.

Choose an order

Upload CSV File

3. Select Assign to Server.
4. From the Choose MDM Server drop-down list, select your instance of MobileIron Core.
5. Click OK. The devices are assigned.

Creating Apple Device Enrollment profiles
Apple Device Enrollment profiles allow you to apply a set of mobile device management (MDM) features to thedevices assigned to a given Apple deployment program account. There is no limit to the number of Device
Enrollment profiles, however, you can assign only one default enrollment profile per Apple School Manager
account.
NOTE: "Apple deployment program" means either Apple Business Manager or Apple School Manager.
The Apple Device Enrollment profile allows you to specify:
l

l

l

l

l

l

Account details, such as the department of the organization to which the Apple deployment programaccount is assigned, and the phone number device users may call for support
The default profile, indicating whether the enrollment profile is automatically assigned to all devices in theApple deployment program accountMDM features, such as enabling supervision, requiring MDM enrollment, shared iPad, and allowing
devices to pair with a host
Setup options, such as whether device users are permitted to skip screens in the Setup AssistantCertificates, such as anchor certificates (from which the chain of trust is derived) and pairing certificates(allowing the bearer of the certificate to pair with the device)
Enrollment options, such as whether to use anonymous, PIN-based enrollment

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 85

Apple device enrollment profile settings

NOTE: For tvOS, the Apple device enrollment profile does not get downloaded until AFTER the Wi-Fi isconfigured. It is advised you use ethernet for tvOS device enrollment.
Procedure
1. In the Admin Portal, go to Devices & Users > Apple Device Enrollment.
2. Select a Apple deployment program account, and then go to Actions > Add Enrollment Profile.
The Add Enrollment Profile dialog box opens.
3. Create or edit an enrollment profile.
4. Click Save.
If you have assigned the enrollment profile as the default for devices in your Apple deployment programaccount, the enrollment profile is tagged with a purple icon that reads Default.

Apple device enrollment profile settings
The following table describes the Apple device enrollment profile settings.

TABLE 4. DEVICE ENROLLMENT PROFILE
Item

Description

Profile NameEnter a name for the device enrollment profile. Required.

Description

Enter a description of the device enrollment profile.

Department

Enter the name of the department associated with the account.
Required.

Support Phone NumberEnter the support phone number for the Apple deployment programaccount. Required.

Default Enrollment Profile

Select to have all devices added to this account be automaticallyassigned to the default profile.
NOTE: If you change the default profile for your Device
Enrollment account, existing devices are notaffected. This means devices that were previously
assigned to the old default enrollment profile
continue to be assigned to the old default enrollment
profile.

Authentication Type
Password

Select to enable enrollment with a username and password. Device
users enter their username and password when prompted.

PIN

Select to enable PIN-based enrollment. MobileIron Core will prompt
the device user to enter their username and a PIN.
To enable PIN-based enrollment for an individual device:
1. Go to Devices & Users > Devices.
2. Select Add > Single Device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 86

Apple device enrollment profile settings

TABLE 4. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description
3. Search for the User.
4. Select the Device Platform. Choices are Android, iOS,
macOS or Windows.
5. If you select iOS or macOS, the Include Registration PIN
only for Apple Device Enrollment field activates. Select thischeck box.
6. Enter a username, operator, and mobile number (or select This
devices has no phone number) for the device, as you normally
would.
7. Make other selections for Device Ownership, Device
Language, and User Notification.
8. Click Register.
To enable PIN-based enrollment for multiple Apple deployment
program devices using bulk registration:• Create a CSV file containing the information you need to bulk
register a number of devices.
• Add the field Include DEP Only Registration Pin (TRUE or
FALSE) to the CSV file, with a value of TRUE for all devices
for which you want to enable anonymous Apple Device
Enrollment.
For more information about single or bulk device registration in
MobileIron Core, see the following sections in Getting Started with
MobileIron Core.
•••

Anonymous“Single device registration”“Registering multiple devices”“Bulk device registration CSV file requirements”

Select to enable device enrollment without assigning a username
and password during enrollment. After completing the Device
Enrollment, the device will be in a signed-out state (with no user
assigned).
Usernames will be assigned after devices are distributed, using the
Secure Sign In web clip. For more information about the SecureSign In web clip, see Multi-User Support.
NOTE: You cannot use the Anonymous enrollment option on
macOS devices.

Enable SAML

As part of DEP profile, the MDM server provides custom enrollment
URL along with standard URL to get the MDM profile to Apple
server. This URL can be used to enforce your own authentication
model or to provide any other information.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 87

Apple device enrollment profile settings

TABLE 4. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description
Select this to support external IdP with DEP enrollment.
This feature is applicable for iOS 13.0 and macOS 10.15 devices
through the latest version as supported by MobileIron.
Note The Following:l

You must have SAML enabled. (See "Configuring
SAML/IdP support" in the MobileIron Core System
Manager Guide.) If the IdP has not been configured
properly, and is not reachable, the Enable SAML checkbox will not display.

l

Once set up for SAML on iReg or DEP devices, you will not
be able to disable SAML from the System Manager. You
must first de-select SAML-based registration in the
Device Registration page before you can disable the IdP
SAML connection in the System Manager.

Custom Enrollment
Custom Enrollment URL(iOS 13.0+ and macOS 10.15+) Create custom enrollment web
page(s).
Specify your own custom web page (web view) to authenticate
device users during Device Enrollment. Use this page to display
custom information such as authentication type, branding, consent
text, and privacy policy. See Adding a custom Automated Device
Enrollment web page for more details.
Enter the URL, such as https://mycustomweburl.com. This URL
defines the value of the custom URL to present to the device user
in a web view.

MDM Options
Enable supervision

Select to allow Apple School Manager devices to be supervised.
Supervision allows for additional restrictions and configurations tobe applied to devices.
NOTE: If you configure your devices to be supervised, you
can apply restrictions through MobileIron Core. For
more information about applying restrictions tosupervised Apple devices, see iOS and tvOS
restrictions settings.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 88

Apple device enrollment profile settings

TABLE 4. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description

Require MDM enrollment

Select to force users to apply the enrollment profile when Setup
Assistant runs.

Allow MDM profile removal

Select to allow device users to remove the device from device
management. If you want to prohibit Apple School Manager device
users from removing MDM management, the Apple School
Manager devices must be supervised.

Allow pairing

Select to allow host pairing functions, such as iTunes
synchronization. Apple School Manager devices can only pair withhosts bearing valid pairing certificates.

Enable Shared iPad (multi-user) forApple Education

NOTE: This field displays only if you have an Apple Education
license loaded into Core.
Select to enable. Devices added to this profile will be configured as
an Apple Education shared device. Only Managed Apple IDs aspart of an Apple Education account will be allowed to log into
device.
If you opt to have shared iPads (multi-users), be sure to also selectthe following settings:• Enable supervision• Require MDM enrollment

Await device configuration during
Apple device enrollment
Wait until policies and configurations
are pushed to devices

Select to configure all iOS devices to be kept in the Setup Assistantuntil all configurations have been pushed to the devices. This step
is optional, but it can reduce support calls.
When registering a Apple School Manager device, the device will
be held in the Setup Assistant screen until MobileIron Core
receives confirmation that the profiles and configurations for thatdevice have been pushed to the device. The Apple School Manager
device is then released from the Setup Assistant screen.
Alternatively, the device is released from the Setup Assistant
screen after the specified time limit has passed and Core has notreceived acknowledgment that the profiles and configurations havebeen pushed to the device.
If a Apple School Manager device checks in with MobileIron Core,
and Core detects this device is still awaiting its profiles andconfigurations, Core sends a command to release the Apple School
Manager device from the Setup Assistant, if a command has notalready been sent. This option applies to iOS devices only.
Time Limit (Minutes) - Enter the number of minutes for which you

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 89

Apple device enrollment profile settings

TABLE 4. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description
want to hold all iOS devices in the Setup Assistant. The default is 1
minute.
NOTE: For macOS devices, selecting Await device
configuration during Apple device setup has theeffect of allowing account setup during the Apple
Device Enrollment process.

Setup Options
Skip All Options (Applicable to iOS
13.0, macOS 10.14, and macOS 10.15
through the most recently released
version as supported by MobileIron.
Default setting is disabled.)
Skip Location Services
Skip Restore from Backup
Skip Move from Android
Skip signing in to Apple ID and
iCloudSkip Terms and Conditions
Skip passcode creation
Skip Siri

Select the screens to be skipped when Setup Assistant runs on
Apple School Manager or Apple Business Manager devices.
Note The Following:• Selecting Skip signing in to Apple ID and iCloud autoselects the Skip Apple Pay Setup option.
• Selecting Skip passcode creation auto-selects the SkipApple Pay Setup and Skip Touch ID Setup options.
• Selecting Skip Touch ID Setup auto-selects the Skip Apple
Pay Setup option.
• Skip on-boarding informational screens - The information inthis screen is used for user education, for example: CoverSheet, Multitasking & Control Center.
You can choose to skip or enable as many screens as you like.
Device users will be able to set up skipped features later.

Skip automatically sending
diagnostic information
Skip Registration Screen (macOS
only)
Skip Touch ID Setup
Skip Apple Pay Setup
Skip Zoom Setup
Skip FileVault Setup Assistant Screen(macOS only)
Skip DisplayTone Setup
Skip the Home Button screen
Skip iCloud Storage
Skip the Tap To Set Up option inAppleTV (tvOS only)
Skip the Aerial Screensavers Setup in
AppleTV (tvOS only)

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 90

Apple device enrollment profile settings

TABLE 4. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description

Skip the Aerial Screensavers Setup in
AppleTV (tvOS only)
Skip on-boarding informational
screens
Skip the screen for Apple Watch
migration
Skip iCloud Analytics screen (macOS
only)
Skip Apple TV home screen layout
sync screen (tvOS only)
Skip the Apple TV provider sign inscreen (tvOS only)
Skip the Where is this Apple TV?
screen (tvOS only)
Skip the Privacy screen
Skip the iMessage and FaceTime
screenSkip the Screen Time screen(Applicable to macOS 10.15 through themost recently released version as
supported by MobileIron.)
Skip the Mandatory software update
screenSkip the Add cellular plan screen
Skip the Choose Your Look screen(Applicable to iOS 13.0 and macOS
10.14 through the most recently released
version as supported by MobileIron.)
Skip Express Language Setup pane
(Applicable to iOS 13.0 through the mostrecently released version as supported
by MobileIron.)
Skip Preferred Language Order pane
(Applicable to iOS 13.0 through the mostrecently released version as supported
by MobileIron.)
Skip Get Started pane(Applicable toMobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 91

Apple device enrollment profile settings

TABLE 4. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description

iOS 13.0 through the most recently
released version as supported by
MobileIron.)
Skip the Accessibility pane (Applicableto macOS 11.0 through the most recently
released version as supported by
MobileIron.) If the Mac is connected to
Ethernet and the Device Enrollment
profile is downloaded, skips theAccessibility pane.
Skip the Restore Completed pane
(Applicable to iOS 14.0 through the mostrecently released version as supported
by MobileIron.)
Skip the Software Update Complete
pane (Applicable to iOS 14.0 through themost recently released version as
supported by MobileIron.)
Show custom text on the Login page

Select to show customized text on the login page when users log into their Apple School Manager devices.
In the text field that appears when selecting this option, enter yourcustomized text. You can enter up to 50 characters.

Anchor Certificates

Click Browse, to select an anchor certificate. Click Add to add an
additional anchor certificate.
The anchor certificate allows the device to trust the connection to
MobileIron Core. This is the certificate from which the chain of trust
is derived.
NOTE: Certificate files must be in DER or PEM format.

Pairing Certificates

Click Browse, to select a pairing certificate. Click Add to add an
additional pairing certificate. The pairing certificate allows thedevice to securely pair with a host possessing this certificate when
Allow Pairing is disabled.
NOTE: Certificate files must be in DER or PEM format.

macOS account creation
Users must enroll macOS devices in the Apple School Manager with an administrator account. You can prompt

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 92

Apple device enrollment profile settings

TABLE 4. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description

users to create an administrator account for themselves, or you can create an administrator account in Core,
which Core then pushes to macOS Apple School Manager devices.
Prompt primary account setup to
users

Select to prompt the device user to set up a primary account for themacOS Apple School Manager device.
You can prompt the user to create a regular account or an
administrator account. If you prompt users to create a regularaccount, you will still need to create an administrator account forenrolling macOS devices in Apple School Manager. This isbecause device enrollment on macOS devices requires the use ofan administrator account.
• Regular user: The device user is prompted to create a regularuser account. If you select this option, you must still create anadministrator account for use on the Apple School Manager
device in the Setup Managed macOS Admin Accountsection.
• Admin user: The device user is prompted to create anadministrator account to be used when enrolling the device in
Device Enrollment. You can create an additional administrator
account that Core synchronizes with Apple School Manager
devices by selecting the Create a new admin user accountoption.
NOTE: For macOS devices, be sure to select Await device
configuration during DEP setup, as this option has theeffect of allowing account setup during the Apple
Device Enrollment process.

Skip primary account setup

Apple School Manager device user will not be prompted to setup an
account when enrolling the device in Device Enrollment. You createan administrator account in Core instead, so that an administrator
account exists on the device when the user enrolls in Device
Enrollment.
Select to create a new user with administrator privileges for use
when configuring the Apple School Manager device.
As there is no primary account that can be used as an admin user,
you must create an admin user in the next section of this window.

Create a new admin user accountSelect to enable the creation of an administrator account.
Device Enrollment on macOS devices requires the use of an
administrator account.

Setup Managed macOS Admin Account
UsernameEnter the username of the macOS device. This is the name that isdisplayed when logging on to the device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 93

Example Device Enrollment Profiles for Apple School Manager

TABLE 4. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description
The administrator account you create will be associated with themacOS device bearing this username.

Full NameEnter the name of the macOS device as defined in macOS under
Settings > Sharing > Computer Name.
The administrator account you create will be associated with themacOS device bearing this name.

Password

Enter a password for the administrator account and confirm it.

Hide managed administrator accountin Users & Groups

Select this option to hide the administrator account from device
users. When selecting Settings > Users & Groups on a macOSApple School Manager device, the administrator account will behidden from view.

Example Device Enrollment Profiles for Apple School Managerlll

Teacher Profile - create a single profile that meets your teacher requirements.
Student Profile (1:1) - Create a single profile that meets your student requirements for student 1:1 devices(not multi-user).
Shared iPad Profile (Multi-User)a. Create a new Add Enrollment Profile and ensure that it has the following settings selected:lEnable SupervisionlRequire MDM EnrollmentlEnable Shared iPad (multi-user) for Apple Educationb. Click Save. The Shared iPad profile displays in the Device Enrollment page. The profile is marked as"Multi--user" and from this point forward, any devices that get this enrollment profile will automatically be
set for multi-user.

Next stepsll

For Apple Business Manager, continue to Assigning Apple Device Enrollment devices to an enrollment
profile en masse.
For Apple School Manager, continue to Adding your enrolled devices to your MDM server.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 94

Assigning Apple Device Enrollment devices to an enrollment profile en masse

Assigning Apple Device Enrollment devices to an enrollment profile en masse
After linking MobileIron Core to a Apple Device Enrollment account, the devices assigned to this account are
displayed in the Core Admin Portal. The Apple Device Enrollment devices are organized so that clicking thenumber in the Devices column for an account shows the devices assigned to that account. To manage yourdevices in Apple Device Enrollment, it can help to assign multiple devices to an enrollment profile. You can do thatby:lselecting the devices and adding themlcreating a CSV file containing the relevant devices and uploading the file to Core

You can also assign custom attributes to the devices using a CSV file. This happens when you assign thesedevices to an enrollment profile.
If you have already created an enrollment profile and assigned it as the default for all Apple Device Enrollment
devices associated with your Apple School Manager account, then your devices have already been assigned anenrollment profile, and you can skip this step. Continue on to Checking for Apple Device Enrollment account
updates.
Note The Following:
l

l

l

l

The CSV file can contain up to 5,000 devices.
Assigning devices and profiles with a CSV file containing UTF-8 characters may cause errors due toinvalid encoding.
When adding a custom attribute to a CSV file, the column header must match the name of the custom
attribute exactly. For multi-users in shared device carts, be sure the CSV file you upload has a new column
for the custom attribute created when you enabled Apple Education and connected to the MDM server.
Each of these devices must be pre-assigned to a device cart.
The value of a custom attribute must match the data type of the custom attribute. For example, a boolean
type custom attribute can only have a boolean value. For Apple Education Managed Apple ID and Apple
Education Device Cart attributes, string is the only valid data type.

Procedure
1. Go to Apple School Manager and sign in using your Apple ID.
2. Select Device Enrollment Program in the sidebar.
3. Select Manage Servers, then click the name of the server.
4. In the Server Details window, click Download Serial Numbers to download a comma-separated value(CSV) file that contains the serial numbers of all assigned devices.
5. After you download the CSV file, click OK.
6. Open the CSV file in an editor.
7. Remove the column next to the serial numbers. This column may be called MODEL.
8. Optionally, you can assign a custom attribute to the devices listed in the CSV file by editing the CSV file.
The custom attribute is assigned to devices when the devices are assigned to the enrollment profile.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 95

Checking for Apple Device Enrollment account updatesa. Add a column to the file and name it.
b. The name of the column is the name of the custom attribute.
c. Enter a value for the custom attribute in each device row.
d. Optionally, add more custom attributes and values.
9. Save your changes.
10. In Core, select Devices & Users > Apple Device Enrollment.
11. Find the Apple School Manager account you want to use, and click the number in the Enrollment Profiles
cell. Core displays the available enrollment profiles.
12. Select the device enrollment profile you want to use.
13. Select Actions > Assign Devices to Profile.The Assign Devices to Profile dialog box opens.
14. Click Upload, and browse for the CSV file you downloaded from the Apple School Manager Portal.
15. Click Assign.

Checking for Apple Device Enrollment account updates
As devices are added to the Apple Device Enrollment account on the Apple School Manager portal, and not on
MobileIron Core, it is recommended to occasionally check for Device Enrollment account updates in Core. Core
will synchronize with the Apple School Manager portal, and any devices that have been added or removed will bereflected in the Core Admin Portal. If an enrollment profile has been configured as the default for the Apple Device
Enrollment account, the default enrollment profile will be applied to all newly assigned Apple School Manager
devices.
Procedure
1. In Admin Portal, go to Devices & Users > Apple Device Enrollment.
2. Click Check for Updates.

Verifying the Apple Device Enrollment status of a device
Two values in the Device Details tab indicate the status of a device:
1. Apple School Manager Devicell

A value of true indicates the device was purchased from Apple as a Apple School Manager device.
The device itself may or may not be enrolled via Apple School Manager.
A value of false indicates the device is either not a Apple School Manager device, or the device was aApple School Manager device that was later removed from the Apple School Manager portal.

2. Apple Device Enrolledll

A value of true indicates the device is enrolled in the Apple School Manager. Alternatively, the device
is enrolled in the Apple School Manager and registered with Core, but the device has been removed
from the Apple School Manager portal.
A value of false indicates the device is not currently enrolled via Apple School Manager.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 96

Updating the OS on supervised Apple Device Enrollment devices

If a Apple School Manager device is not enrolled in Apple Device Enrollment, you can retire and wipe the device so
as to re-purpose the device for another user.
Procedure
1. In the Admin Portal, select Devices & Users > Devices.
2. Find the device whose enrollment details you want to examine, and click the carat (^) next to it.
3. Click the Device Details tab.
4. Examine the values for DEP Device and DEP Enrolled.

Updating the OS on supervised Apple Device Enrollment devices
MobileIron Core can update the iOS on supervised Apple School Manager devices, when updates are available.
NOTE: This feature is supported on supervised devices running iOS 9 through the most recently released
version of iOS as supported by MobileIron.
Procedure
1. Log into MobileIron Core.
2. Select Devices & Users > Devices.
3. Select a supervised iOS Apple School Manager device.
4. Click Actions.
5. Select iOS Only > Update OS Software:
6. The Confirmation window appears.
7. Click Confirm.

Managing Apple Device Enrollment accounts
After adding one or more Apple Device Enrollment accounts to a MobileIron Core instance, several actions areavailable to help manage the accounts, including:lViewing Apple Device Enrollment accounts in MobileIron Corel

Editing Apple Device Enrollment account informationlRemoving or Re-assigning Apple Device Enrollment profile assignmentslDeleting Apple Device Enrollment profileslDeleting Apple Device Enrollment accountslDisowning devices enrolled in Apple Device Enrollment

For instructions on how to set up a Device Enrollment profile, see Setting up Apple Device Enrollment with
MobileIron Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 97

Viewing Apple Device Enrollment accounts in MobileIron Core

Viewing Apple Device Enrollment accounts in MobileIron Core
After setting up Apple Device Enrollment accounts in a MobileIron Core instance, you can view the status of theseaccounts.
Procedure
1. In Admin Portal, go to Devices & Users.
2. Click Apple Device Enrollment to display the list of accounts enrolled on the MobileIron Core instance.
NOTE: If you have not added an Apple Device Enrollment account to a particular MobileIron
Core instance, a message is displayed instead of an Apple Device Enrollment accountlist. The message explains that no Apple Device Enrollment accounts are associated withthis MobileIron Core instance yet.
The information available for each Apple Device Enrollment account is listed in the following table:
Item

Description

Account Name

Name assigned to account.

Admin Apple ID

Administrator ID received from Apple.

Organization Name

Name that you provide to Apple for the organization
associated with the Device Enrollment account. Apple
uses this name when displaying messages about theaccount.

Description

Description that you provide to Apple for the organization
associated with the Apple Device Enrollment account.

Status

Account status can be one of three states:• Active, indicates the MobileIron Core instance isassociated with one or more active Apple Device
Enrollment accounts.
• Invalid Token, indicates the Apple server token iseither expired or invalid.
• Inactive, indicates the MobileIron Core instance isassociated with a deleted Apple Device Enrollment
account.

Expires

Date the server token expires.

DevicesNumber of devices in the Apple Device Enrollment
account. Click the number to view the devices in the
Devices page.

Enrollment Profiles

Number of enrollment profiles defined for the Apple
Device Enrollment account. Click the number to list theenrollment profiles (see Creating Apple Device
Enrollment profiles.)MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 98

Editing Apple Device Enrollment account information

Editing Apple Device Enrollment account information
Most Apple Device Enrollment account information is derived from Apple, and cannot be edited in MobileIron Core.
To edit the Apple-derived device account information, log in to your Apple School Manager and make the changes.
When the server token associated with the account is expiring, you can then change the server token by editing the
MobileIron Core Apple Device Enrollment account in Core.
Procedure
1. In Admin Portal, go to Devices & Users > Apple Device Enrollment, and then select an account.
2. Go to Actions > Edit Account.
3. (Optional) To change the server token, click Browse, locate the file, select it, and then click Open.
4. (Optional) To change the account description, edit the text in Account Description.
5. Click Save.

Removing or Re-assigning Apple Device Enrollment profile assignments
This section addresses the removal or re-assigning of Apple Device Enrollment profiles.

Removing Apple Device Enrollment profiles
Removing Apple Device Enrollment devices from an enrollment profile removes the MDM and setup options fromthe devices.
NOTE: After Apple Device Enrollment profile assignments are pushed to devices and the devices
complete setup, removing the Apple Device Enrollment profile assignments or changing thedevice profiles has no effect on existing devices until the device is wiped or reset.
Procedure
1. In Admin Portal, go to Devices & Users > Apple Device Enrollment.
2. In the row of the desired account, click the number in the Enrollment Profiles column.
MobileIron Core lists the defined enrollment profiles for that account.
3. Click the number in the Devices column within the selected enrollment profile.
4. Select the profile and then select Actions > Remove Enrollment Profile. Alternately, you can reassign
the device to a new profile by selecting Actions > Assign Enrollment Profile.
5. When prompted, click Yes to remove the devices from the enrollment profile or No to cancel the deletion.

Re-assigning Apple Device Enrollment profiles
1. In Admin Portal, go to Devices & Users > Apple Device Enrollment.
2. In the row of the desired account, click the number in the Devices column within the selected enrollment

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 99

Deleting Apple Device Enrollment profiles

profile.
3. Select the profile and then select Actions > Assign Enrollment Profile.

Deleting Apple Device Enrollment profiles
Deleting an Apple Device Enrollment profile allows you to remove a set of mobile device management (MDM)features associated with the devices assigned to a given Apple Device Enrollment account. When there is a
default device enrollment profile and you try to delete a different enrollment profile, Core re-assigns the device tothe default device enrollment profile instead of deleting it.
Procedure
1. In Admin Portal, go to Devices & Users > Apple Device Enrollment.
2. Select an account and click the number in the Enrollment Profiles column for that account.
MobileIron Core lists the defined enrollment profiles for that account.
3. Select the enrollment profile to delete, and then go to Actions > Delete.
4. When prompted, click Yes to delete the profile or No to cancel the deletion.

Deleting Apple Device Enrollment accounts
If you delete a MobileIron Core Apple Device Enrollment account, you are deleting the mapping between Core andthe Apple MDM servers. Deleting a Device Enrollment account from Core does not have any affect on the Apple
Device Enrollment account.
Procedure
1. In Admin Portal, go to Devices & Users > Apple Device Enrollment, and then select one or moreaccounts.
2. Go to Actions > Delete Account.
3. When prompted, select Yes to delete the chosen accounts or No to cancel the action.

Disowning devices enrolled in Apple Device Enrollment
If a device enrolled in Apple Device Enrollment is sold, lost or damaged beyond repair, you can remove that device
from the Apple Device Enrollment portal through the MDM server. Removing the device is called "release device"or "disown device" depending upon what portal you are looking at.
NOTE: Once a device enrolled in Apple Device Enrollment is disowned, MobileIron cannot add it back.
The Disown action is disabled by default and is not included in the list of actions for devices inApple Device Enrollment. To add Disown to Actions into the Apple Device Enrollment page, call
Customer Support.
Related topics
Setting up Apple Device Enrollment with MobileIron Core

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 100

Adding a custom Automated Device Enrollment web page

Adding a custom Automated Device Enrollment web page
Applicable to: iOS 13.0 and macOS 10.15 and later versions as supported by MobileIron Core.
In the Custom Enrollment section, you can specify your own custom web page (web view) to authenticate users
during Automated Device Enrollment. Use this page to display custom information such as authentication type,
branding, a corporate message, consent text, and privacy policy.
NOTE: When using LDAP for registration, the device user needs to be authorized in MobileIron Core or
be bulk enrolled. Device users that are not in MobileIron Core will not be recognized andregistration will fail.
Procedure
1. In the Admin portal, go to Devices & Users > Apple Device Enrollment.
2. Find and select the name of the server you created on the Apple site.
3. Select Actions > Add Enrollment Profile.
4. In the Custom Enrollment URL field, enter the URL, such as https://mycustomweburl.com. This URL
defines the value of the custom URL to present to the user in a web view loaded during the initial setup of a
new Device Enrollment device or an erased device. Use this field to define your own authentication UI withauthentication method. After the user is authenticated, the MDM enrollment profile is downloaded.

Workflow of the custom Automated Device Enrollment web page
This section elaborates the behavior of the custom Automated Device Enrollment web page and the procedure tocreate the custom web page (web view).
When the custom web page specified in the Custom Enrollment URL field loads initially:ll

The configuration web URL has an HTTPS scheme and is a GET request. The web page should use apublicly trusted certificate.
A custom header x-apple-aspen-deviceinfo is appended to the GET request by the Apple device on which
enrollment is initiated. It contains a base64 encoding of a CMS (Cryptographic Message Syntax) envelopethat contains a plist with device attributes. This is the same information, in the same format, as provided in
the initial GET request with token-based device enrollments.

When the custom web page loads subsequently:ll

The device user interacts with the web page (web view) until the administrator's host server provides acustom.mobileconfig file to the client. The MobileIron Core server returns byte code of the MDM profile. In
the administrator's host server, the custom.mobileconfig file should be set with a MIME type of
application/x-apple-aspen-config so that the MDM profile for the device is downloaded and installed on thedevice.
To get the MDM profile for that device and its related user, the administrator's host web server shouldmake a GET call to the MobileIron Core server URL. It should contain basic authentication using a
MobileIron Core user ID with admin rights. For example,
https://miCoreDomain.com/mifs/rs/api/v2/external/mdm/config/DEPMDMProfile). With parameters

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 101

User Enrollment with Apple Business Manager

deviceInfo and principal, where:odeviceInfo is the "x-apple-aspen-deviceinfo" data Apple sentoprincipal is the Core user to associate to the Device Enrollment profile's device

NOTE: If the principal user does not exist, the Device Enrollment profile must allow theanonymous authentication type in order to associate the device to an anonymous user.
If the Anonymous Authentication type is not set, the GET call will fail. To set theanonymous authentication, select "Anonymous" in the Authentication Type field in the
Device Enrollment profile.
llHere are the additional details:oWhen a device hits the custom web URL configured in the Device Enrollment profile, administrator's
host web server should capture the header "x-apple-aspen-deviceinfo" presented by the device.
Between the initial GET with the x-apple-aspen-deviceinfo and the return response with the x-appleaspen-config, the third party host has control. After the return response, Apple gets control back. The
reason for this is the response has to come from the third party host due to the SSL certificate
negotiations, as Apple will only trust the response from the third party host.

oAfter the administrator's host web server receives the byte code, the third party host should respondby setting response headers, Content-Disposition = attachment;filename="profile.mobileconfig" andContent-Type = application/x-apple-aspen-config.

The web view closes and the OS attempts to install the profile, which must be an MDM enrollment profile.

NOTE: MobileIron Core does not authenticate the user ID for which the MDM profile is returned.
Therefore, administrators should perform the necessary authentication for the user ID before
requesting for the MDM profile.
For iOS, this workflow is supported during initial setup of an erased device. For macOS, this workflow is supported
both within Setup Assistant and also via the Profiles preference pane, if Automated Device Enrollment wasskipped during Setup Assistant.
For developer information related to creating a custom web page, see the following Apple documentationreferences:
Web Views
Authenticating Through Web Views
Sample code to implement a simple iPad web browser that can view either the desktop or mobile version of a
websiteUser Enrollment with Apple Business Manager
Apple Business Manager is a place for IT teams to automate device deployment, purchase and distribute content,
and manage roles in their organizations. Apple Business Manager implements User Enrollment - an enrollment
option designed for companies implementing BYOD (Bring Your Own Device). User Enrollment is a modified

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 102

Difference between standard MDM enrollment and User Enrollment

version of the MDM protocol with a much greater focus on user privacy, implemented with a level of security thatenterprises need.
User Enrollment allows the administrator to:lInstall and remove managed applicationslInstall and remove network configurationslInstall a partial VPN scoped to managed apps and accountslRequire the usage of a password

User Enrollment registration is supported on Mobile@Work. When the administrator assigns the device user toUser Enrollment mode, the In-App registration will download the User Enrollment Profile to the device.
User Enrollment applies to unsupervised devices with iOS 13.0 through the latest version as supported by
MobileIron. Devices lower than iOS 13.0 will be considered "device enrollment" regardless if the device user has
been enabled for User Enrollment. User Enrollment utilizes the user's managed Apple ID, which is required andassociated with all enterprise apps and data on the device and in MobileIron Core.

Difference between standard MDM enrollment and User Enrollment
This section addresses the difference between standard MDM enrollment and User Enrollment with Apple
Business Manager.

Standard MDM enrollment
Below is what a Core server can do in a standard MDM enrollment, but will not be able to do in User Enrollment
mode in iOS 13.0.
The MDM server:lCannot erase the device.

l

Does not see the personal apps the device user has installed on the device.

l

Cannot convert user-installed apps into MDM-managed apps.

lCannot clear the device passcode (i.e. unlock the device).

l

Cannot set a long, complex device passcode requirement.

l

l

l

Cannot configure a device-wide VPN or Wi-Fi proxy, nor can it do any management of the cellularfunctionality.
Cannot see device identifiers like the UDID, serial number, or IMEI.
Cannot apply many device-wide restrictions (such as restricting the app content rating), block iCloud, andapply any the supervised restrictions.

NOTE: When retiring and re-registering devices from Core, devices are registered as Standard MDM.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 103

User Enrollment with Apple Business Manager

User Enrollment with Apple Business Manager
In User Enrollment, the MDM server can still do everything needed to manage enterprise apps, accounts, and data.
User Enrollment can:lInstall in-house apps or apps via user-based (Apple) Apps & Books licenseslEnforce passcode payload settings:oallowSimple = falseoforcePIN = trueominLength = 6lQuery data related to enterprise-managed apps, certificates, and profileslConfigure a per-app VPN for apps, mail, contacts, and calendars that have been installed by MDMl

Enforce some restrictions, like managed open in, managed contacts, managed data on the lock screen,and several others

Enterprise data is stored in a separate Apple File System (APFS) volume, which is created at enrollment, andencrypted separately from device user data. This volume contains data stored by managed apps; enterprise Notes;
enterprise iCloud Drive docs; enterprise Keychain entries; managed mail attachments and bodies; and calendar
attachments. Un-enrolling from MDM destroys the volume and the keys.
The final requirement of User Enrollment is the user’s managed Apple ID that must be associated with allenterprise apps and data on the device and in iCloud Drive. Managed Apple IDs were first utilized by Apple School
Manager and are now utilized by Apple Business Manager for User Enrollment.
All third-party apps can only be either a personal app or a managed app through Core. The MDM service cannot
start managing apps that the device user has already installed. In this case, the administrator will need to request
the device user to delete the personal app before installing the app through MDM. The MDM service cannot start
managing apps that the user has already installed. However, some system apps like Notes and Files will support
both work and personal accounts.

Difference between User Enrollment vs Device Enrollment
This section covers the difference between User Enrollment and device enrollment. User Enrollment applies todevices iOS 13.0 and macOS 10.15 through the latest version as supported by MobileIron.
Devices lower than iOS 13.0 will be considered "device enrollment" regardless if the device user has been enabledfor User Enrollment.
NOTE: User Enrollment for Apple Business Manager does not allow for wipe or unlock. However, the user
portal will still have those options available even though they will not work.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 104

Requirements for enabling User Enrollment

TABLE 5. USER ENROLLMENT VS DEVICE ENROLLMENT
Functionality

User Enrollment

MAM

Device Enrollment

DEP

No

No

Yes

Yes

No

No

Yes

Yes

No

No

Yes

Yes

No

No

Yes

Yes

Apply supervised restrictions

No

No

Yes*

Yes

Can install and configure apps and

Yes

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

No

Yes

Yes

Yes

No

Yes

Yes

Erase the device and see user's
personal apps
Convert managed to unmanaged orvice versa
Clear device passcode, configure
device-wide VPN or Wi-Fi proxynor manage cellular functionality
See device identifiers like serial
number, IMEI

accounts
Can configure a per-app VPN forapps, mail, contacts, andcalendars that have been installedby MDMCan enforce some restrictions, likemanaged open in, managed
contacts, managed data on thelock screen, and several others
Can query data related toenterprise-managed apps,
certificates, and profiles
NOTE: The "Apply supervised restrictions option" will work for Device Enrollment if the device issupervised using Apple Configurator, otherwise it is unsupported.

Requirements for enabling User Enrollment
Below are the requirements for enabling User Enrollment:ll

An Apple Business Manager accountManaged Apple ID - Managed Apple ID to be associated with each enrolled device. This Managed Apple
ID provides authentication for MDM management and app licensing. When the MDM pushes down apps
and media, necessary Apple licenses are assigned to the Managed Apple ID associated with the device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 105

Requirements for enabling User EnrollmentlDevice users who are synced to LDAP are to be assigned to a device management role and associatedwith a Managed Apple ID.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 106

5Managing Apple School Manager Devices
This section addresses Apple School Manager and Apple Education.
Apple School Manager account management overview
Best practices for managing devices in Apple School Manager
Creating an Apple School Manager account
Adding school information to your Apple School Manager account
Editing Core roles for Apple Education management
Configuring devices in bulk for Apple School Manager
Connecting Core to Apple School Manager
Adding your enrolled devices to your MDM server
Creating a custom attribute to use with Apple School Manager
Enabling Apple Education in Core
Creating labels for Apple Education
Configuring Shared Device Cart
Synchronizing Core with Apple Education servers
Distributing apps to Apple School Manager devices
Disabling Apple Education in Core
Checking Apple Education logs

Apple School Manager account management overview
Apple School Manager is a service for schools that allows IT departments at educational institutions to manage
school devices and deploy apps to these devices. With Apple School Manager, you create and assign roles tostudents and staff that define the permissions and restrictions applied to groups of users. Apple School Manager
uses mobile device management (MDM) solutions, such as Core, to manage Apple School Manager devices.
Core uses the following to manage your Apple School Manager devices:ll

an Apple Device Enrollment account, to more easily purchase and enroll devices in bulk
a Apple License account, to manage and distribute apps to teacher and student devices with a devicebased license

NOTE: In Core's user interface, the term "Apple Education" is used. "Apple School Manager portal" refers
to the Apple portal (school.apple.com.)Using Apple Device Enrollment, you can purchase and enroll devices in bulk. You then create an Apple School
Manager account to which you assign your devices. Apple School Manager synchronizes with supported thirdparty vendor Student Information Systems (SIS) to retrieve student, teacher, and class data. Finally, you connect
Apple School Manager to Core to manage school devices and use the Apple Licenses to distribute apps to

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 107

Apple School Manager managed entities

teachers and students alike (such as the Apple Classroom app for teachers only, and other apps you may wish to
deploy to student devices).
NOTE: You can only use one Apple School Manager account in Core.
For more information about using Apple School Manager, refer to the following documents from Apple (an Apple
login is required):l

Education Deployment GuidelApple School Manager Helpl

Deployment Resources

Apple School Manager managed entities
The entities you manage in an Apple School Manager account include:lStudents and teachers -You can add students to your Apple School Manager account using your Student
Information System (SIS). You can also manually add students, teachers, and classes to your Apple
School Manager account.
NOTE: Apple School Manager does not synchronize user roles with Core, meaning students andteachers can only be distinguished by context, such as the name of the user teaching aclass.

l

l

l

l

l

Class - A class requires students and teachers at minimum.
Courses - A unit of study associated with students and teachers. You can only view courses in Core after
synchronizing with Apple School Manager servers.
Locations - You can add one location and multiple sub-locations to your Apple School Manager account.
You can only view locations in Core after synchronizing with Apple School Manager servers.
Devices - When using Apple School Manager, Core supports supervised iPad devices running iOS 9.3
through the most recently released version of iOS as supported by MobileIron.
Managed Apple ID. A managed Apple ID allows users to log in to a device and access services such as
Apple School Manager, iCloud courses, and iTunes U courses. The Apple School Manager accountcontrols the Managed Apple IDs associated with that account, enabling account administrators to reset
passwords, set roles and permissions, and so on. A Managed Apple ID restricts certain services such as
the user’s ability to make purchases on the Apps, iBooks, and iTunes stores. When you add users to yourApple School Manager account, a Managed Apple ID is created at the time of account creation.

Related topics
For more information, see "What are Managed Apple IDs?" in the Apple School Manager User Guide. An Apple
login is required.

Apple School Manager device requirements
Devices you manage with Apple School Manager must:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 108

The Classroom applbe supervisedlrun iOS 9.3 through the most recently released version of iOS as supported by MobileIron

MobileIron recommends using Apple Device Enrollment devices with Apple School Manager for ease ofmanagement, and beginning with fresh devices. If you are re-purposing a device, MobileIron recommends you wipe
and then retire the device before using it with Apple School Manager.

The Classroom app
Classroom is an iPad app that allows teachers to share documents and learning modules with students, as well as
manage student devices. Teachers can use Classroom to launch apps or a textbook on student iPads and share or
project documents or work.
You can use Core to distribute the Classroom app to teacher devices and configure whether students can control
whether teachers can view their screens.
For more information about Classroom, see the following Apple links (an Apple login is required):lGetting Started with ClassroomlClassroom HelpApple School Manager setup with Core: main steps
The main steps required to set up Apple School Manager with Core are as follows:
1. Creating an Apple School Manager account
2. Adding school information to your Apple School Manager account
3. Setting up your administrators in the Apple School Manager portal
4. Editing Core roles for Apple Education management
5. Creating a custom attribute to use with Apple School Manager
6. Configuring devices in bulk for Apple School Manager
7. Connecting Core to Apple School Manager
8. Creating Apple Device Enrollment profiles
9. Adding your enrolled devices to your MDM server
10. Enabling Apple Education in Core
11. Synchronizing Core with Apple Education servers
12. Distributing apps to Apple School Manager devices

Best practices for managing devices in Apple School Manager
Following are some best practices to keep in mind for managing enrolled devices in Apple School Manager:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 109

Creating an Apple School Manager account

l

l

l

l

l

l

l

Distribute the Classroom app to teacher devices using Apple Licenses and a label you create for teacher
devices. Distribute any apps you want on student devices using Apple Licenses as well, and a label you
create for student devices. Use device-based Apple licenses.
You can enroll devices in an Apple Device Enrollment you previously registered in Core, as long as you
wipe and retire these devices first.
Use Apple Device Enrollment to purchase a large group of devices, which you can more easily manage inCore.
MobileIron recommends against using anonymous enrollment.
Using a CSV file automates the process of applying a Managed Apple ID for each device, preparing thedevices for use with Apple School Manager. When enrolling devices in bulk with Apple Device Enrollment:o

Use a modified CSV file listing both device serial numbers and the Managed Apple ID as a custom
attribute value for each device.

o

For multi-users in shared device carts, be sure the CSV file you upload has a new column for thecustom attribute created when you enabled Apple Education and connected to the MDM server. Eachof these devices must be pre-assigned to a device cart.

It is best to assign only one role to a given Managed Apple ID, as only one type of profile can be pushed toan Apple School Manager device (either teacher or student). If a Managed Apple ID is associated with botha teacher and a student, then the profile pushed to the device will always be a teacher profile.
Apple's School Manager program sometimes uses the terms "leader" and "member" to indicate teacher
and student, respectively.

Creating an Apple School Manager accountContact Apple to request an Apple School Manager account. When you contact Apple, give them your current
Apple Device Enrollment and Apple License accounts so that Apple can link to your Apple School Manager
account. Alternatively, you can request new Apple Device Enrollment and Apple License accounts from Apple.
Note The Following:ll

At this time, only educational institutions are allowed to enroll.
Core continues to support multiple Apple Device Enrollment accounts but only one account can be usedwith MobileIron Core's Apple Education feature.

Next stepsl

Optionally, add managers to your Apple School Manager account. Managers are essentially administrators
who can add students, teachers, classes, and other information to your Apple School Manager account.
For details, refer to "Add Managers" in the Apple School Manager User Guide on the Apple website. A login
is required.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 110

Adding school information to your Apple School Manager account

Adding school information to your Apple School Manager
account
You can add your school information to your Apple School Manager account using a Student Information System(SIS) supported by Apple.
Before you begin
Contact Apple about creating an Apple School Manager account, as described in Creating an Apple School
Manager account.
Procedure
For detailed information about adding school information to your Apple School Manager account, refer to thefollowing Apple documentation:lIntegrate with your Student Information System (SIS)lFind people in your Student Information System (SIS)lView and edit SIS informationlCreate Managed Apple IDs in the Apple School Manager HelplCreate Managed Apple IDs Apple documentation

Next steps
You will need to set up your administrators in the Apple School Manager portal. Once you have finished, continue toEditing Core roles for Apple Education management.

Editing Core roles for Apple Education management
Before you can set up and manage an Apple School Manager account, you must be sure your user name has thecorrect permissions for these actions. By default, user names with the administrator role will have the correct
permissions.
Before you begin
You should have set up your administrators in the Apple School Manager portal.
Procedure
1. In the Admin Portal, select Admin > Admins.
2. Select the administrators whose permissions you want to edit.
3. Select Actions > Edit Roles.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 111

Configuring devices in bulk for Apple School Manager

4. In the Edit Roles window, select the following:
Section

Item

Description

Admin Space

Select the space over which this administrator
has administrative control. For example, selectGlobal to allow the administrator to use thepermissions selected here throughout Core.

View Apple
Education

Select to allow the administrator to view theApple Education page.

Manage Apple
Education

Select to allow the administrator to view theApple Education page and sync with Apple
School Manager servers.

Setup Apple
Education

Select to allow the administrator to view theApple Education page, sync with Apple School
Manager servers, toggle the Apple Education
feature on/off, and set up an Apple School
Manager account. Select to also create, delete,
and apply to Class and remove classes fromthe Device Cart.

Settings and Services
Management

Manage custom
attributes

Select to allow the administrator to createcustom attributes for use with Apple School
Manager.

Device Management

Manage device
enrollment (iOS only)

Select to enable Apple Device Enrollment.

Apple Education
Management

5. Click Save.

Configuring devices in bulk for Apple School Manager
After you have added your devices to Apple School Manager, you must add them to Core. Teacher and student
iPads must use Device Enrollment. In addition, the teacher and student 1:1 iPads must have the “Managed AppleID” custom attribute pre-defined and Shared iPads must have the “DeviceCartName” custom attribute predefined.
Assigning the devices to the correct Apple Device Enrollment Profile and setting the appropriate custom attributes
can be done easily in bulk.
Before you begin
Complete the procedure in Editing Core roles for Apple Education management.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 112

Bulk-assign devices to a Teacher or Student 1:1 device enrollment profile for use with Apple Education

Bulk-assign devices to a Teacher or Student 1:1 device enrollment profile for use
with Apple Education
Procedure
1. From your Apple School Manager account, go to the MDM server configured for Apple Education in
MobileIron Core and download the list of serial numbers. Only devices assigned to this MDM server can beused with the bulk-assign feature.
2. Create a CSV file to pre-assign the Managed Apple ID to the appropriate serial numbers:
a. Using the CSV file in step 2, remove serial numbers that are not teacher or student 1:1 devices.
b. Remove the column “DEVICE_TYPE”.
c. Add a column for the column name of your Managed Apple ID custom attribute. This could besomething like “ManagedAppleID” and is based on what you chose when Enabling Apple Education in
MobileIron Core. You can view this attribute name at the top of your Apple Education page under thelabel “Managed Apple ID Attribute Name.”d. (Optional) Add any other custom attribute you want to the CSV file by creating a new column for theattribute and entering a value for that attribute for each device. Any custom attribute you create here
must match the custom attribute you have already created in Core.
e. For each row, add the appropriate Managed Apple ID for the teacher or student in the column createdin step c above. This will be something like "jdoe@school.com," and should match an individual inyour Apple Education > Individuals tab.
f. Save the CSV file and close it.
3. Navigate to Devices & Users > Device Enrollment and, in the row of your Device Enrollment account,select the number link in the Enrollment Profiles column. The list of enrollment profiles for your Apple
School Manager account displays.
4. Select an existing profile that is a “multi-user” profile and then select Actions >Assign Devices toProfile.
5. In the Assign Devices to Profile dialog box, click Upload and choose the CSV file you created above andthen click Assign. The devices will be assigned to this enrollment profile with the appropriate individuals
pre-assigned to the devices.

Bulk-assign devices to a Shared iPad (multi-user) enrollment profile for use withApple Education
Procedure
1. From your Apple School Manager account, go to the MDM server configured for Apple Education in
MobileIron Core and download the list of serial numbers. Only devices assigned to this MDM server can beused with the bulk-assign feature.
2. Create a CSV file to pre-assign the Managed Apple ID to the appropriate serial numbers:
a. Using the CSV file in step 2, remove serial numbers that are not Shared iPads.
b. Remove the column “DEVICE_TYPE”.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 113

Bulk-assign devices to a Shared iPad (multi-user) enrollment profile for use with Apple Educationc. Add a column for the column name of your Device Cart custom attribute. This could be something like
“DeviceCart” and is based on what you chose when Enabling Apple Education in MobileIron Core. You
can view this attribute name at the top of your Apple Education page under the label “Shared Device
Cart Attribute Name.”d. (Optional) Add any other custom attribute you want to the CSV file by creating a new column for theattribute and entering a value for that attribute for each device. Any custom attribute you create here
must match the custom attribute you have already created in Core.
e. For each row, add the appropriate device cart name in the column created in step c above. This will besomething like "History101Cart," and should match an individual in your Apple Education > Shared
Device Carts tab.
f. Save the CSV file and close it.
3. Navigate to Devices & Users > Device Enrollment and, in the row of your Device Enrollment account,select the number link in the Enrollment Profiles column. The list of enrollment profiles for your Apple
School Manager account displays.
4. Select an existing profile that is a “multi-user” profile and then select Actions >Assign Devices toProfile.
5. In the Assign Devices to Profile dialog box, click Upload and choose the CSV file you created above andthen click Assign. The devices will be assigned to this enrollment profile with the appropriate individuals
pre-assigned to the devices.
When you assign your Apple School Manager devices to your Apple Device Enrollment profile using the modified
CSV file, Core automatically assigns the custom attribute (and its value) to each device upon registration.
The above steps can be done multiple times and can include partial lists of serial numbers. Only serial numbers in
the uploaded CSV file will be edited. If you wish to remove a custom attribute for a particular device, upload the filewith the column name of the custom attribute and leave the value blank.
Note The Following:ll

If you assign a device cart to a device that was not registered with a multi-user device enrollment profile,the device will be configured incorrectly and will not function as a Shared iPad.
Core will reject a CSV file that has invalid serial numbers, invalid custom attribute column names, or has
invalid CSV syntax.

What happens on the device
Core sends the Apple Device Enrollment profile to the relevant devices. When the device is in setup mode, thedevice will be prompted to apply the configuration and be given a login to the MDM enrollment.
Related topics
For details about creating the custom attribute, see Creating a custom attribute to use with Apple School Manager.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 114

Connecting Core to Apple School Manager

Connecting Core to Apple School Manager
Add your Apple School Manager account to Core on the Apple Device Enrollment page.
NOTE: You can use a previously created Apple Device Enrollment account for with Apple Education,
regardless of whether that Device Enrollment account was originally associated with Apple
School Manager. Whatever Apple Device Enrollment account you use must be associated withApple School Manager so that it successfully retrieves Apple School Manager data. You can
associate an Apple Device Enrollment account when you contact Apple to create your Apple
School Manager account.
Before you beginll

Make sure you have added your school information to your Apple School Manager account. For details,
see Adding school information to your Apple School Manager account.
Configuring devices in bulk for Apple School Manager

Procedure
1. Log in to your Apple School Manager account.
2. Navigate to the MDM Servers page on the Apple School Manager portal.
3. Click Add MDM server link on the lower right.
4. In the dialog box that opens, enter a name for your MobileIron Core server.
5. Switch to another browser window, and open the MobileIron Core Admin Portal.
6. In the Core Admin Portal, select Devices & Users > Apple Device Enrollment
7. Click Add+.
8. In the Add Account window, click Download Certificate.
A file type called .CRT is downloaded to the file system.
9. Switch back to the Apple School Manager portal.
10. Under Upload Your Public Key, click Upload File, and browse for the .CRT file you downloaded fromCore.
11. Click Save MDM Server.
12. The Apple School Manager portal prompts you to download a server token file. Download the server token
file.
13. In MobileIron Core, Devices & Users > Apple Device Enrollment dialog box, click Browse next to theServerToken field.
14. Select the .P7M file you downloaded from the Apple School Manager portal.
15. Click Open.
16. Click Save.
Core displays a summary of the MDM server you added.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 115

Creating Enrollment Profiles for Apple School Manager

Creating Enrollment Profiles for Apple School Manager
Apple Device Enrollment profiles allow you to apply a set of mobile device management (MDM) features to thedevices assigned to a given Apple deployment program account. There is no limit to the number of Device
Enrollment profiles, however, you can assign only one default enrollment profile per Apple School Manager
account.
NOTE: "Apple deployment program" means either Apple Business Manager or Apple School Manager.
The Apple Device Enrollment profile allows you to specify:
l

l

l

l

l

l

Account details, such as the department of the organization to which the Apple deployment programaccount is assigned, and the phone number device users may call for support
The default profile, indicating whether the enrollment profile is automatically assigned to all devices in theApple deployment program accountMDM features, such as enabling supervision, requiring MDM enrollment, shared iPad, and allowing
devices to pair with a host
Setup options, such as whether device users are permitted to skip screens in the Setup AssistantCertificates, such as anchor certificates (from which the chain of trust is derived) and pairing certificates(allowing the bearer of the certificate to pair with the device)
Enrollment options, such as whether to use anonymous, PIN-based enrollment

NOTE: For tvOS, the Apple device enrollment profile does not get downloaded until AFTER the Wi-Fi isconfigured. It is advised you use ethernet for tvOS device enrollment.
Procedure
1. In the Admin Portal, go to Devices & Users > Apple Device Enrollment.
2. Select a Apple deployment program account, and then go to Actions > Add Enrollment Profile.
The Add Enrollment Profile dialog box opens.
3. Create or edit an enrollment profile.
4. Click Save.
If you have assigned the enrollment profile as the default for devices in your Apple deployment programaccount, the enrollment profile is tagged with a purple icon that reads Default.

Apple device enrollment profile settings
The following table describes the Apple device enrollment profile settings.

TABLE 6. DEVICE ENROLLMENT PROFILE
Item

Description

Profile NameEnter a name for the device enrollment profile. Required.

Description

Enter a description of the device enrollment profile.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 116

Apple device enrollment profile settings

TABLE 6. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description

Department

Enter the name of the department associated with the account.
Required.

Support Phone NumberEnter the support phone number for the Apple deployment programaccount. Required.

Default Enrollment Profile

Select to have all devices added to this account be automaticallyassigned to the default profile.
NOTE: If you change the default profile for your Device
Enrollment account, existing devices are notaffected. This means devices that were previously
assigned to the old default enrollment profile
continue to be assigned to the old default enrollment
profile.

Authentication Type
Password

Select to enable enrollment with a username and password. Device
users enter their username and password when prompted.

PIN

Select to enable PIN-based enrollment. MobileIron Core will prompt
the device user to enter their username and a PIN.
To enable PIN-based enrollment for an individual device:
1. Go to Devices & Users > Devices.
2. Select Add > Single Device.
3. Search for the User.
4. Select the Device Platform. Choices are Android, iOS,
macOS or Windows.
5. If you select iOS or macOS, the Include Registration PIN
only for Apple Device Enrollment field activates. Select thischeck box.
6. Enter a username, operator, and mobile number (or select This
devices has no phone number) for the device, as you normally
would.
7. Make other selections for Device Ownership, Device
Language, and User Notification.
8. Click Register.
To enable PIN-based enrollment for multiple Apple deployment
program devices using bulk registration:• Create a CSV file containing the information you need to bulk
register a number of devices.
• Add the field Include DEP Only Registration Pin (TRUE or
FALSE) to the CSV file, with a value of TRUE for all devices
for which you want to enable anonymous Apple Device
Enrollment.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 117

Apple device enrollment profile settings

TABLE 6. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description
For more information about single or bulk device registration in
MobileIron Core, see the following sections in Getting Started with
MobileIron Core.
•••

Anonymous“Single device registration”“Registering multiple devices”“Bulk device registration CSV file requirements”

Select to enable device enrollment without assigning a username
and password during enrollment. After completing the Device
Enrollment, the device will be in a signed-out state (with no user
assigned).
Usernames will be assigned after devices are distributed, using the
Secure Sign In web clip. For more information about the SecureSign In web clip, see Multi-User Support.
NOTE: You cannot use the Anonymous enrollment option on
macOS devices.

Enable SAML

As part of DEP profile, the MDM server provides custom enrollment
URL along with standard URL to get the MDM profile to Apple
server. This URL can be used to enforce your own authentication
model or to provide any other information.
Select this to support external IdP with DEP enrollment.
This feature is applicable for iOS 13.0 and macOS 10.15 devices
through the latest version as supported by MobileIron.
Note The Following:l

You must have SAML enabled. (See "Configuring
SAML/IdP support" in the MobileIron Core System
Manager Guide.) If the IdP has not been configured
properly, and is not reachable, the Enable SAML checkbox will not display.

l

Once set up for SAML on iReg or DEP devices, you will not
be able to disable SAML from the System Manager. You
must first de-select SAML-based registration in the
Device Registration page before you can disable the IdP
SAML connection in the System Manager.

Custom Enrollment
Custom Enrollment URL(iOS 13.0+ and macOS 10.15+) Create custom enrollment web

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 118

Apple device enrollment profile settings

TABLE 6. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description
page(s).
Specify your own custom web page (web view) to authenticate
device users during Device Enrollment. Use this page to display
custom information such as authentication type, branding, consent
text, and privacy policy. See Adding a custom Automated Device
Enrollment web page for more details.
Enter the URL, such as https://mycustomweburl.com. This URL
defines the value of the custom URL to present to the device user
in a web view.

MDM Options
Enable supervision

Select to allow Apple School Manager devices to be supervised.
Supervision allows for additional restrictions and configurations tobe applied to devices.
NOTE: If you configure your devices to be supervised, you
can apply restrictions through MobileIron Core. For
more information about applying restrictions tosupervised Apple devices, see iOS and tvOS
restrictions settings.

Require MDM enrollment

Select to force users to apply the enrollment profile when Setup
Assistant runs.

Allow MDM profile removal

Select to allow device users to remove the device from device
management. If you want to prohibit Apple School Manager device
users from removing MDM management, the Apple School
Manager devices must be supervised.

Allow pairing

Select to allow host pairing functions, such as iTunes
synchronization. Apple School Manager devices can only pair withhosts bearing valid pairing certificates.

Enable Shared iPad (multi-user) forApple Education

NOTE: This field displays only if you have an Apple Education
license loaded into Core.
Select to enable. Devices added to this profile will be configured as
an Apple Education shared device. Only Managed Apple IDs aspart of an Apple Education account will be allowed to log into
device.
If you opt to have shared iPads (multi-users), be sure to also selectthe following settings:• Enable supervision• Require MDM enrollment

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 119

Apple device enrollment profile settings

TABLE 6. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description

Await device configuration during
Apple device enrollment
Wait until policies and configurations
are pushed to devices

Select to configure all iOS devices to be kept in the Setup Assistantuntil all configurations have been pushed to the devices. This step
is optional, but it can reduce support calls.
When registering a Apple School Manager device, the device will
be held in the Setup Assistant screen until MobileIron Core
receives confirmation that the profiles and configurations for thatdevice have been pushed to the device. The Apple School Manager
device is then released from the Setup Assistant screen.
Alternatively, the device is released from the Setup Assistant
screen after the specified time limit has passed and Core has notreceived acknowledgment that the profiles and configurations havebeen pushed to the device.
If a Apple School Manager device checks in with MobileIron Core,
and Core detects this device is still awaiting its profiles andconfigurations, Core sends a command to release the Apple School
Manager device from the Setup Assistant, if a command has notalready been sent. This option applies to iOS devices only.
Time Limit (Minutes) - Enter the number of minutes for which you
want to hold all iOS devices in the Setup Assistant. The default is 1
minute.
NOTE: For macOS devices, selecting Await device
configuration during Apple device setup has theeffect of allowing account setup during the Apple
Device Enrollment process.

Setup Options
Skip All Options (Applicable to iOS
13.0, macOS 10.14, and macOS 10.15
through the most recently released
version as supported by MobileIron.
Default setting is disabled.)
Skip Location Services
Skip Restore from Backup
Skip Move from Android
Skip signing in to Apple ID and
iCloudSkip Terms and Conditions

Select the screens to be skipped when Setup Assistant runs on
Apple School Manager or Apple Business Manager devices.
Note The Following:• Selecting Skip signing in to Apple ID and iCloud autoselects the Skip Apple Pay Setup option.
• Selecting Skip passcode creation auto-selects the SkipApple Pay Setup and Skip Touch ID Setup options.
• Selecting Skip Touch ID Setup auto-selects the Skip Apple
Pay Setup option.
• Skip on-boarding informational screens - The information inthis screen is used for user education, for example: CoverSheet, Multitasking & Control Center.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 120

Apple device enrollment profile settings

TABLE 6. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description

Skip passcode creation

You can choose to skip or enable as many screens as you like.
Device users will be able to set up skipped features later.

Skip Siri
Skip automatically sending
diagnostic information
Skip Registration Screen (macOS
only)
Skip Touch ID Setup
Skip Apple Pay Setup
Skip Zoom Setup
Skip FileVault Setup Assistant Screen(macOS only)
Skip DisplayTone Setup
Skip the Home Button screen
Skip iCloud Storage
Skip the Tap To Set Up option inAppleTV (tvOS only)
Skip the Aerial Screensavers Setup in
AppleTV (tvOS only)
Skip the Aerial Screensavers Setup in
AppleTV (tvOS only)
Skip on-boarding informational
screens
Skip the screen for Apple Watch
migration
Skip iCloud Analytics screen (macOS
only)
Skip Apple TV home screen layout
sync screen (tvOS only)
Skip the Apple TV provider sign inscreen (tvOS only)
Skip the Where is this Apple TV?
screen (tvOS only)
Skip the Privacy screen
Skip the iMessage and FaceTime
screenSkip the Screen Time screen

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 121

Apple device enrollment profile settings

TABLE 6. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description(Applicable to macOS 10.15 through themost recently released version as
supported by MobileIron.)
Skip the Mandatory software update
screenSkip the Add cellular plan screen
Skip the Choose Your Look screen(Applicable to iOS 13.0 and macOS
10.14 through the most recently released
version as supported by MobileIron.)
Skip Express Language Setup pane
(Applicable to iOS 13.0 through the mostrecently released version as supported
by MobileIron.)
Skip Preferred Language Order pane
(Applicable to iOS 13.0 through the mostrecently released version as supported
by MobileIron.)
Skip Get Started pane(Applicable to
iOS 13.0 through the most recently
released version as supported by
MobileIron.)
Skip the Accessibility pane (Applicableto macOS 11.0 through the most recently
released version as supported by
MobileIron.) If the Mac is connected to
Ethernet and the Device Enrollment
profile is downloaded, skips theAccessibility pane.
Skip the Restore Completed pane
(Applicable to iOS 14.0 through the mostrecently released version as supported
by MobileIron.)
Skip the Software Update Complete
pane (Applicable to iOS 14.0 through themost recently released version as
supported by MobileIron.)

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 122

Apple device enrollment profile settings

TABLE 6. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description

Show custom text on the Login page

Select to show customized text on the login page when users log into their Apple School Manager devices.
In the text field that appears when selecting this option, enter yourcustomized text. You can enter up to 50 characters.

Anchor Certificates

Click Browse, to select an anchor certificate. Click Add to add an
additional anchor certificate.
The anchor certificate allows the device to trust the connection to
MobileIron Core. This is the certificate from which the chain of trust
is derived.
NOTE: Certificate files must be in DER or PEM format.

Pairing Certificates

Click Browse, to select a pairing certificate. Click Add to add an
additional pairing certificate. The pairing certificate allows thedevice to securely pair with a host possessing this certificate when
Allow Pairing is disabled.
NOTE: Certificate files must be in DER or PEM format.

macOS account creation
Users must enroll macOS devices in the Apple School Manager with an administrator account. You can prompt
users to create an administrator account for themselves, or you can create an administrator account in Core,
which Core then pushes to macOS Apple School Manager devices.
Prompt primary account setup to
users

Select to prompt the device user to set up a primary account for themacOS Apple School Manager device.
You can prompt the user to create a regular account or an
administrator account. If you prompt users to create a regularaccount, you will still need to create an administrator account forenrolling macOS devices in Apple School Manager. This isbecause device enrollment on macOS devices requires the use ofan administrator account.
• Regular user: The device user is prompted to create a regularuser account. If you select this option, you must still create anadministrator account for use on the Apple School Manager
device in the Setup Managed macOS Admin Accountsection.
• Admin user: The device user is prompted to create anadministrator account to be used when enrolling the device in
Device Enrollment. You can create an additional administrator
account that Core synchronizes with Apple School Manager
devices by selecting the Create a new admin user accountoption.
NOTE: For macOS devices, be sure to select Await device

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 123

Example Device Enrollment Profiles for Apple School Manager

TABLE 6. DEVICE ENROLLMENT PROFILE (CONT.)
Item

Description
configuration during DEP setup, as this option has theeffect of allowing account setup during the Apple
Device Enrollment process.

Skip primary account setup

Apple School Manager device user will not be prompted to setup an
account when enrolling the device in Device Enrollment. You createan administrator account in Core instead, so that an administrator
account exists on the device when the user enrolls in Device
Enrollment.
Select to create a new user with administrator privileges for use
when configuring the Apple School Manager device.
As there is no primary account that can be used as an admin user,
you must create an admin user in the next section of this window.

Create a new admin user accountSelect to enable the creation of an administrator account.
Device Enrollment on macOS devices requires the use of an
administrator account.

Setup Managed macOS Admin Account
UsernameEnter the username of the macOS device. This is the name that isdisplayed when logging on to the device.
The administrator account you create will be associated with themacOS device bearing this username.

Full NameEnter the name of the macOS device as defined in macOS under
Settings > Sharing > Computer Name.
The administrator account you create will be associated with themacOS device bearing this name.

Password

Enter a password for the administrator account and confirm it.

Hide managed administrator accountin Users & Groups

Select this option to hide the administrator account from device
users. When selecting Settings > Users & Groups on a macOSApple School Manager device, the administrator account will behidden from view.

Example Device Enrollment Profiles for Apple School Managerlll

Teacher Profile - create a single profile that meets your teacher requirements.
Student Profile (1:1) - Create a single profile that meets your student requirements for student 1:1 devices(not multi-user).
Shared iPad Profile (Multi-User)

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 124

Adding your enrolled devices to your MDM servera. Create a new Add Enrollment Profile and ensure that it has the following settings selected:lEnable SupervisionlRequire MDM EnrollmentlEnable Shared iPad (multi-user) for Apple Educationb. Click Save. The Shared iPad profile displays in the Device Enrollment page. The profile is marked as"Multi--user" and from this point forward, any devices that get this enrollment profile will automatically be
set for multi-user.

Next steps
Adding your enrolled devices to your MDM server.

Adding your enrolled devices to your MDM server
After completing your Device Enrollment, you must add devices to your MDM server.
Before you begin
Complete the procedure in Creating Apple Device Enrollment profiles.
Procedure
1. Log in to the Apple School Manager portal.
2. Select Devices > Device Assignments.
3. On the Manage Devices page, select the method by which you want to add devices, and take action
accordingly.
Choose Devices By...

Description

Serial NumberEnter one or more comma-separated serial numbers for the devices you
want to assign.

Order Number••

Click the Order Number radio button.
Select a specific order number from the Choose an order dropdown list.
A list of devices purchased with that order number displays.

••

Click the Upload CSV File radio button.
Click the Choose File link to select a CSV file you created for thedevices you want to assign.

Choose an order

Upload CSV File

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 125

Creating a custom attribute to use with Apple School Manager

4. Select Assign to Server.
5. From the Choose MDM Server drop-down list, select your instance of Core.
6. Click Done.
The devices are assigned.
7. Switch to the Core Admin Portal.
8. Select Devices & Users > Apple Device Enrollment.
9. Click Check for Updates.
Core retrieves the new devices.
Related topics
For more information, see the Apple School Manager User Guide on the Apple website. A login is required.
Next steps
Enabling Apple Education in Core

Creating a custom attribute to use with Apple School Manager
NOTE: This step is optional, as you can create the custom attribute when you turn on the Apple
Education feature, as described in Enabling Apple Education in Core . If you prefer to create
your own custom attribute when enabling Apple Education, skip this procedure and continue on
to Enabling Apple Education in Core .
Apple Education requires the creation of custom attributes so that devices can be assigned to either an individual(teacher or student) or to a device cart. Each device can be either a teacher device, student device, or multi-user
student device (shared iPad.) These education roles are determined by the values entered into the custom
attributes on a device.
NOTE: You can have a total of 300 custom attributes in Core.
When using Apple Education, there are two custom attributes used to determine the above education roles. The
first custom attribute is used to link a device to an individual. These devices are called 1:1 (one to one) devices andare linked via the Managed Apple ID as shown in Apple School Manager and in the Apple Education “Classes” tab.
The second custom attribute is optional and is only used if you want to enable the use of Shared iPads. This
custom attribute is the device cart name and it is what is used to link the device to the device cart.
You can setup these custom attributes prior to enabling Apple Education in MobileIron Core in order to helporganize existing teacher / student 1:1 devices. Devices in device carts will need to be wiped and restarted after
enabling Apple Education in MobileIron Core. Once that is done, you can set up the device carts and Multi-userDevice Enrollment Profiles.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 126

Enabling Apple Education in Core

It is not advisable to have a custom attribute value that has a Managed Apple ID associated to both a teacher and a
student. It will result in the device being associated to an Apple Education role of Teacher. If Core has insufficient
data to associate a device with a relevant class, then the Apple Education role for that device is None.
NOTE: Devices with an Apple Education role of None will not receive a valid Apple Education role,
which precludes these devices from participating in Classroom app activities.
Before you begin
Complete the procedure in Adding your enrolled devices to your MDM server.
ProcedurellFollow the procedure for adding a device custom attribute in Adding custom attributes to users and/or
devices.
Assign your custom attribute the value type string.

Enabling Apple Education in Core
When you enable Apple Education in Core, the following occurs:
l

l

l

l

Core creates components required to synchronize with Apple School Manager, such as a certificate
enrollment profile. Creating an Apple enrollment device profile makes it easier to manage Apple School
Manager devices.
You select a previously created custom attribute or create a new custom attribute to correlate the devices
in Core with the devices in your Apple School Manager account. The custom attribute matches theManaged Apple ID assigned to each user in Apple School Manager or device cart, and must be of typestring.
Core checks existing devices for values in the defined custom attribute column, and associates relevant
devices with courses from the synchronized Apple School Manager data.
Core evaluates devices to determine whether the devices have a value for the custom attribute you
created. Values should match either the Managed Apple ID for that device or the device cart name forshared iPads.

When enabling Apple Education for the first time, Core creates the following entities:l2 local certificate authorities (CA)l

2 certificate enrollmentsl1 Apple Education configuration (only one auto-generated Apple Education configuration can exist in Core)l

1 label: All Education

NOTE: MobileIron does not recommend editing the certificate enrollment settings and the local CAs.
There is no need to apply labels to these automatically-created settings, as Core automaticallyapplies the "All Education" label to them.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 127

Enabling Apple Education in Core

Before you beginl

Be sure to read Apple School Manager account management overview.

lCreate the Apple Device Enrollment account. See Connecting Core to Apple School Manager.

lComplete the procedure in Adding your enrolled devices to your MDM server.

l(Optional) Complete the procedure in Creating a custom attribute to use with Apple School Manager.

llWhen using Apple School Manager, Core supports supervised iPad devices running iOS 9.3 through themost recently released version of iOS as supported by MobileIron. See Apple School Manager device
requirements.
IMPORTANT: Before devices are registered with MobileIron Core, ensure that the devices areassociated either to a Managed AppleID or to a device cart. See <add link toShared devices cart>

In Apple Education, there are three types of device users. Each device used in Apple School Manager must be
mapped to one of these device usertypes:lllTeacher using 1 device (1:1)
oTeacher iPads are required to be assigned directly to the teacher. This assignment is done throughsetting the teachers' device's custom attribute for the managed Apple ID to the teachers' Managed
Apple ID.

o

Example scenario of Teacher 1:1 device usage: At the beginning of class, the teacher will open theClassroom app and start the class enabling the teacher to see all the students' activity.

Student using 1 device (1:1)
oOne student gets an iPad. This iPad is associated to a Managed Apple ID. After this device has been
associated to classes, the device is ready for use.

oExample scenario of Student 1:1 device usage: At the beginning of the school session, a student is
assigned an iPad for use in classes. This iPad is associated to their Managed Apple ID through theApple Education's Managed Apple ID custom attribute for that device. This device will stay with thestudent throughout the school session.

Students sharing a device (multi-user)o

Two students share the same iPad and that iPad is associated to a device cart. If a device belongs toa student or a teacher, do not select this field.

oExample scenarios of shared devices cart usage:One device cart will be associated to Room 32 in a
local high school. There are 15 iPads associated to that device cart. Throughout the day, Room 32
cycles through a History class and an English class. At the beginning of the History class, one student
picks up an iPad, logs in using a Managed Apple ID and uses it during the class time. At the end of
History, the student returns the iPads to the device cart. When English class starts a student picks up
an iPad, logs in using a Managed Apple ID and uses it during class. At the end of class, the student
returns it to the device cart.

Procedure
1. Select Devices & Users > Apple Education.
A toggle button on the page reads Off.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 128

Enabling Apple Education in Core

2. Click the toggle button to enable Apple Education.
The toggle now reads On.
3. Enter the information in the following table:
Item

Description

Apple Device
Enrollment AccountClick the drop-down list and select the Apple Device Enrollment account.
NOTE: Make sure to select only an Apple Device Enrollment
account associated with Apple School Manager.

CustomAttributes

Select the custom attribute you created to map devices enrolled in Apple
School Manager. You can have a total of 300 custom attributes in Core.
lManaged Apple ID Attribute Name - (Required) Use this field for 1:1
devices, which can be teachers or students. Select from the drop-downor enter a name that you have determined use when configuring thecustom attribute for the device. This will link the device to the individualuser. An example of a Managed Apple ID Attribute Name would beAppleEduID .

NOTE: Teachers can only be 1:1 devices whereas students caneither be 1:1 or multi-user. One device can belong to only
one individual and that connection using custom attributes is
associated to the name of the attribute you enter here.
lShared Device Cart Attribute Name- (Optional) This custom attributeis used to create a mapping between a device and a cart. Enter a namethat you will use to assign devices to specific device cart via custom
attributes or select the custom attribute name you created. If a shareddevice cart name is not entered, the device cart tab and links in Apple
Education are not shown. One shared device can belong to only one
device cart and that connection using custom attributes is associatedto the name of the attribute you enter here. An example of a
Shared Device Cart Attribute Name would be DeviceCart .

NOTE: The Shared Device Cart Attribute Name must be different
from the Managed Apple ID Attribute Name.
Restrictions

Shared Observation Modification Controlll

Not selecting this check box allows the device user privacy, as per the
General Data Protection Regulation (GDPR) in Europe.
If you want to allow the teacher to remotely control the students'
screens, select this check box. Once selected, this check box cannot
be disabled.

4. Click Save.
A sync to the Apple Education data located in the Apple School Manager begins and the data (classes,
individuals, shared device carts, etc.) downloads into Apple Education. The "Sync Status" field at the topof the Apple Education page displays the status of the sync. The page automatically refreshes andMobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 129

Creating labels for Apple Education

reloads.
Once the sync is done, you can view your courses in Apple Education and begin managing them.
Related topicsll

For details about assigning a custom attribute to Apple School Manager devices later in bulk, see
Configuring devices in bulk for Apple School Manager.
For more information about Shared Device Cart, see <Configuring Shared Device Cart>.

Creating labels for Apple Education
Labels can be assigned to a class, location, course, or type of device. Use the Apple Education labels to assign
apps and configurations, like WiFi and Restrictions. For example, you may decide to have a Label for eachlocation's WiFi. Or you may have the WiFi configuration based on location and type of device, as Teachers may beable to access more hosts than students. In addition, you will want to have a teacher label and assign that label to
the Classroom App.
Procedure
1. Click on Devices & Users > Devices.
2. Click Advanced Search.
The Advanced Search dialog box expands.
3. Click the drop-down arrow and expand Apple Education.
4. Use these guidelines to complete your search criteria using the query builder or by manually editing theexpression.
Field

Description

ExampleApple
Education
EnabledEnter a unique name that clearly identifies the
purpose of the label.

"apple_education.apple_education_
in_use" = true

Class IDEnter the unique class ID. An example, class
ID could be: 02015a85-2815-4939-b6e0-"apple_education.class_id" starts
with "02015a"b29334cad952

Course ID

Enter the unique course ID, for example, ahistory class that runs June 2018.

"apple_education.course_id" starts
with "CA12@314"

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 130

Configuring Shared Device Cart

Field

Description

ExampleLocation ID

Enter the unique location ID. You areassigned one location for your Apple School
Manager account. Through the Apple School
Manager portal, you can add additional
locations.

"apple_education.location_id" = "[CA12@314]"

Apple
Education
Role

Enter the unique teacher's ID name / number.

Common uses:"apple_education.role" equals"Teacher""apple_education.role" equals"Student""apple_education.role" equals"Student (MultiUser)""apple_education.role" starts with"Student"

5. Click Save to label.
6. Type a name and description for the new label.
7. If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click
Confirm. For more information, see Best practices: label management.

Configuring Shared Device Cart
When Apple Education is enabled, the Shared Device Carts tab is populated with all the potential device carts
based on the unique values stored in the custom attributes for the device cart. From this tab, an admin can selectone or more device carts and assign them to a class.
NOTE: It is very important that before devices are turned on, you have all Shared iPads associated to a
device cart. You want all the profiles to be ready for the device before logging into the device.
Once a device is logged into using an Apple ID, all the relevant course information will be
downloaded onto the device.
Procedure
1. Select Shared Device Cart tab.
2. The tab displays four columns:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 131

Applying a device cart to a class

Field

Description

Device Cart

Clicking on the name of the Device Cart allows you to re-name the device
cart.

Classes

The number of classes associated to the device cart displays. Clicking on thenumber opens the Class List dialog box. When finished viewing the class
information, click OK.

Registered Devices

Clicking on View Devices opens the Device List dialog box. When finishedviewing the device information, click OK.

Actions

Clicking on the X in the relevant Action row deletes the Device Cart. You will
get a confirmation prompt.

3. Click Add New Device Cart.
The Add New Device Cart dialog box opens.
4. Enter a name into the Device Cart Name field and then click Add.
The new name displays in the Shared Device Carts tab.
NOTE: Be aware of making changes to Shared Device Carts during school hours. Changing devicecarts, classes and associations will cause profiles to be re-evaluated and pushed to the devices.
This can cause the devices to be slow. It is advised that you make chages during after school
hours or on weekends.
Next steps
Proceed to Applying a device cart to a class.
Related topics
For multi-users in shared device carts, it is useful to upload a CSV file with all the devices pre-assigned to a device
cart into a Apple Device Enrollment profile. For more information, see Configuring devices in bulk for Apple School
Manager.

Applying a device cart to a class
Applying a class to a device cart displays a new class dialog list.
NOTE: The class list is searchable and sortable. A class requires students and teachers at minimum.
Classes without a student or teacher should not be assigned to device carts as that will cause
invalid configurations.
Procedure
1. Click the Shared Device Carts tab.
2. Select a cart and then click Apply to Classes.
The Apply Cart to Classes dialog box opens.
TIP: To view the classes that are already in the cart, click on the Selected tab.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 132

Synchronizing Core with Apple Education servers

3. In the All tab, select the class(es) you want to associate to that device cart and then click Apply.
4. To remove a class, click Remove from Classes.
The Remove Cart from Classes dialog box opens.
5. Selecting the box next to the Class Name field selects all classes. Alternately, select the individualclasses you want to remove.
6. Click Remove.
7. Repeat steps if you want to remove additional classes from a Device Cart.
8. Once you have all your devices mapped, click on the Sync button or wait for the automiatic sync.
Core automatically syncs every 24 hours (since the last scheduled sync.)
Note The Following:ll

In Shared iPad mode, the iPad cannot be reset/erased by the end user. To reset the device, send the Wipe
command to the device. Then on the device, login with any Managed Apple ID that is part of that EDU
account. When the device is logged in, it will get the Wipe MDM command. DO NOT retire the device until
it has been reported as wiped and is no longer in "Wipe Pending" state.
If you toggle Apple Education to OFF, the students' names, device carts, class information, etc., will bedeleted. The custom attributes and device values will remain.

Synchronizing Core with Apple Education servers
Synchronizing Core with Apple Education servers allows you to view the most recent information in your Apple
Education account. Core synchronizes with Apple School Manager daily. This option is available to synchronize on
demand as needed.
The Last Sync time stamp indicates the last time and date Core synchronized Apple Education data. Sync Statusindicates the synchronization progress, success, or failure.
NOTE: Synchronizing with Apple Education servers can take some time.
Before you begin
Complete the procedure in Enabling Apple Education in Core
Procedure
1. Select Devices & Users > Apple Education. The Apple Education page displays.
2. Under Apple Education, click the Sync button.
When Core has completed the synchronization attempt, the Sync Status indicates whether thesynchronization was successful.
3. Optionally, click the status to view more information about the status of the synchronization.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 133

Distributing apps to Apple School Manager devices

For example, if the synchronization failed, click Failed. A pop-up window is displayed, indicating that thesynchronization with Apple School Manager failed, the error that caused the failure, and the time stamp ofwhen the synchronization attempt began.
4. If the sync fails, click Sync again.
Alternatively, wait for Core to automatically sync with Apple School Manager servers. Core attempts tosync with Apple School Manager every 24 hours.
What happens in Core
After synchronizing with Apple School Manager, you can see the complete list of individuals, classes, locations,and so on, including the role of the individual, such as teacher or student. Core extrapolates roles based on classand individual information, which includes course, location, teacher, and students.
To view the number of teachers and students:lSelect Policies & Configs > Configurations > System - Apple Education Configuration.

lClick Details to view the number of teachers and students.

What happens on the device
If the device has a value for the Managed Apple ID custom attribute and that ID is not associated to a class (aseither a student or teacher), Core shows a value of none for the Role column in the table of Apple School Manager
data. In this case, that device shows an error for the Apple Education configuration.
If a class lacks a teacher or students, then Core shows an error indicating that the configuration is not set.

Distributing apps to Apple School Manager devices
You can distribute apps to teachers and students. The simplest way to do this is to use Apple Licenses and a label
for teachers and students. Typically, you would distribute the Classroom app to teachers, and other apps tostudents. You will need to apply device-based Apple licenses to the iOS apps you distribute to Apple School
Manager devices.
NOTE: Using a device-based Apple License allows Apple School Manager users to install and use the
iOS apps you distribute to them, regardless of the account they use on the device. By
configuring any distributed apps to automatically install to the device after the device isregistered to Core, you ensure your users have the requisite apps.
NOTE: Shared iPad logged-in users are not allowed to install apps via the Apple App Store and are
required to be installed through MDM.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 134

Distributing apps to Apple School Manager devices

Before you beginll

You need to set up Apple Licenses on Core before distributing iOS apps to Apple School Manager devices.
For more information, see "Importing licensed apps from Apple Licenses account" in the MobileIron
Apps@Work Guide.
Complete the procedure in Synchronizing Core with Apple Education servers.

Procedure
NOTE: For detailed instructions on adding importing apps for use in Apple Education, see the "Using the
wizard to import iOS apps from the Apple App Store" section in the MobileIron Apps@Work Guide.
1. In the Admin Portal, go to Apps > App Catalog.
2. Click Add+.
3. Click iTunes.
4. Search for the app by name, for example enter Classroom to search for the Classroom app.
5. Select the app and then click Next.
6. Enter the basic information into the screen. The Application Name and Min. OS Version fields are readonly.
7. Select Next.
8. Select Send installation request or send convert unmanaged to managed app request (iOS 9 andlater) on device registration or sign-in so that after device registration is complete, the device user is
prompted to install this app. If the app is already installed as an unmanaged app, the app will be converted
to a managed app.
9. Select Enforce conversion from unmanaged to managed app (iOS 9 or later) to allow the app to beconverted from an unmanaged app to a managed app in Apps@Work on devices running iOS 9 through themost recently released version supported by MobileIron. The unmanaged app will not require uninstall, as it
will be converted directly to a managed app.
10. Click Finish.
The app displays in the App Catalog.
11. Repeat the preceding steps for any student apps you want to distribute to student devices.
12. Create two labels, one for teachers, and one for students.
a. Go to Device & Users > Labels and click Add Label.
b. Enter a unique name for the label, such as teachers or students .
c. For the label type, select Filter.
d. In the Criteria field, enter a search expression for the label.
For the teachers label, enter: "apple_education.role = "teacher"
For the students label, enter: "apple_education.role = "student"
e. Click Save.
f. Repeat these steps so that you have one label for teachers and one label for students.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 135

Disabling Apple Education in Core

13. Apply a device-based Apple license to the app or apps.
a. Select Apps > App Catalog.
b. Use the check box to select the app or apps to which to apply Apple License device-based licensing.
c. Select Manage Licenses from the Actions menu.
d. In the License Summary page, select the desired license account.
e. In the Account Details page, expand License Type, select Device-based License, and then click
Save.
f. Expand License Label Management and select the desired labels so that target devices that request
the selected app receive device-based VPP licenses. This applies to devices running iOS 9.0 throughthe most recently released version as supported by MobileIron.
14. Apply the apps to the relevant labels.
a. Select Apps > Apps Catalog, and check the box next to the Classroom app.
b. Click Actions > Apply to Labels.
c. Select the teachers label you created and click Apply.
d. Repeat these steps with the students label, and any apps you want to distribute to students.

Disabling Apple Education in Core
When disabling Apple Education in Core, Core deletes all Apple School Manager data from its database, including:lApple Education entities, such as courses, classes, teachers, and studentslCertificate policies

Core does not delete:llabels associated with Apple School Managerlassignmentslcustom attributes

llocal CAs and certificates

Before you begin
Before disabling Apple Education in Core, you must do the following:
1. Retrieve all Apple School Manager devices.
2. Make sure no devices are in lost mode.
3. Wipe all Apple School Manager devices.
4. Retire all Apple School Manager devices from Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 136

Checking Apple Education logs

Procedure
1. Select Devices & Users > Apple Education.
A toggle button on the page reads On.
2. Click the toggle button to disable Apple Education.
Core shows a warning message.
3. Click Disable Apple Education.
The toggle now reads Off.
Related topicsl

For details about wiping a device, see Wipe.

l

For details about retiring devices, see “Retiring Devices” in the Getting Started Guide.

Checking Apple Education logs
You can check the audit logs in Core for the status of actions related to Apple Education.
You can check the following filters to view the status of actions related to Apple Education:lDisable iOS EducationlEnable iOS EducationlSync iOS Education with ASM

Procedure
1. Select Logs > Audit Logs.
2. From the filters on the left, expand DEP.
3. Select any or all of the filters related to Apple Education:lDisable iOS EducationlEnable iOS EducationlSync iOS Education with ASM

4. Click Search.
Core shows any actions related to the filters you select, including the following details:lAction

l

State

l

Performed byl

Action DatelCompleted At

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 137

Checking Apple Education logslPerformed OnlDetails

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 138

Managing Apple Business Manager

Managing Apple Business Manager
This section addresses Apple Business Manager.
lUser Enrollment with Apple Business ManagerlConnecting Core to Apple Business Manager

User Enrollment with Apple Business Manager
Apple Business Manager is a place for IT teams to automate device deployment, purchase and distribute content,
and manage roles in their organizations. Apple Business Manager implements User Enrollment - an enrollment
option designed for companies implementing BYOD (Bring Your Own Device). User Enrollment is a modified
version of the MDM protocol with a much greater focus on user privacy, implemented with a level of security thatenterprises need.
User Enrollment allows the administrator to:lInstall and remove managed applicationslInstall and remove network configurationslInstall a partial VPN scoped to managed apps and accountslRequire the usage of a password

User Enrollment registration is supported on Mobile@Work. When the administrator assigns the device user toUser Enrollment mode, the In-App registration will download the User Enrollment Profile to the device.
User Enrollment applies to unsupervised devices with iOS 13.0 through the latest version as supported by
MobileIron. Devices lower than iOS 13.0 will be considered "device enrollment" regardless if the device user has
been enabled for User Enrollment. User Enrollment utilizes the user's managed Apple ID, which is required andassociated with all enterprise apps and data on the device and in MobileIron Core.

Difference between standard MDM enrollment and User Enrollment
This section addresses the difference between standard MDM enrollment and User Enrollment with Apple
Business Manager.

Standard MDM enrollment
Below is what a Core server can do in a standard MDM enrollment, but will not be able to do in User Enrollment
mode in iOS 13.0.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 139

User Enrollment with Apple Business Manager

The MDM server:lCannot erase the device.

l

Does not see the personal apps the device user has installed on the device.

l

Cannot convert user-installed apps into MDM-managed apps.

lCannot clear the device passcode (i.e. unlock the device).

l

Cannot set a long, complex device passcode requirement.

l

l

l

Cannot configure a device-wide VPN or Wi-Fi proxy, nor can it do any management of the cellularfunctionality.
Cannot see device identifiers like the UDID, serial number, or IMEI.
Cannot apply many device-wide restrictions (such as restricting the app content rating), block iCloud, andapply any the supervised restrictions.

NOTE: When retiring and re-registering devices from Core, devices are registered as Standard MDM.

User Enrollment with Apple Business Manager
In User Enrollment, the MDM server can still do everything needed to manage enterprise apps, accounts, and data.
User Enrollment can:lInstall in-house apps or apps via user-based (Apple) Apps & Books licenseslEnforce passcode payload settings:oallowSimple = falseoforcePIN = trueominLength = 6lQuery data related to enterprise-managed apps, certificates, and profileslConfigure a per-app VPN for apps, mail, contacts, and calendars that have been installed by MDMl

Enforce some restrictions, like managed open in, managed contacts, managed data on the lock screen,and several others

Enterprise data is stored in a separate Apple File System (APFS) volume, which is created at enrollment, andencrypted separately from device user data. This volume contains data stored by managed apps; enterprise Notes;
enterprise iCloud Drive docs; enterprise Keychain entries; managed mail attachments and bodies; and calendar
attachments. Un-enrolling from MDM destroys the volume and the keys.
The final requirement of User Enrollment is the user’s managed Apple ID that must be associated with allenterprise apps and data on the device and in iCloud Drive. Managed Apple IDs were first utilized by Apple School
Manager and are now utilized by Apple Business Manager for User Enrollment.
All third-party apps can only be either a personal app or a managed app through Core. The MDM service cannot
start managing apps that the device user has already installed. In this case, the administrator will need to request
the device user to delete the personal app before installing the app through MDM. The MDM service cannot start

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 140

Difference between User Enrollment vs Device Enrollment

managing apps that the user has already installed. However, some system apps like Notes and Files will support
both work and personal accounts.

Difference between User Enrollment vs Device Enrollment
This section covers the difference between User Enrollment and device enrollment. User Enrollment applies todevices iOS 13.0 and macOS 10.15 through the latest version as supported by MobileIron.
Devices lower than iOS 13.0 will be considered "device enrollment" regardless if the device user has been enabledfor User Enrollment.
NOTE: User Enrollment for Apple Business Manager does not allow for wipe or unlock. However, the user
portal will still have those options available even though they will not work.

TABLE 7. USER ENROLLMENT VS DEVICE ENROLLMENT
Functionality

User Enrollment

MAM

Device Enrollment

DEP

No

No

Yes

Yes

No

No

Yes

Yes

No

No

Yes

Yes

No

No

Yes

Yes

Apply supervised restrictions

No

No

Yes*

Yes

Can install and configure apps and

Yes

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

No

Yes

Yes

Yes

No

Yes

Yes

Erase the device and see user's
personal apps
Convert managed to unmanaged orvice versa
Clear device passcode, configure
device-wide VPN or Wi-Fi proxynor manage cellular functionality
See device identifiers like serial
number, IMEI

accounts
Can configure a per-app VPN forapps, mail, contacts, andcalendars that have been installedby MDMCan enforce some restrictions, likemanaged open in, managed
contacts, managed data on thelock screen, and several others
Can query data related toenterprise-managed apps,

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 141

Requirements for enabling User Enrollment

TABLE 7. USER ENROLLMENT VS DEVICE ENROLLMENT (CONT.)
Functionality

User Enrollment

MAM

Device Enrollment

DEP

certificates, and profiles
NOTE: The "Apply supervised restrictions option" will work for Device Enrollment if the device issupervised using Apple Configurator, otherwise it is unsupported.

Requirements for enabling User Enrollment
Below are the requirements for enabling User Enrollment:lll

An Apple Business Manager accountManaged Apple ID - Managed Apple ID to be associated with each enrolled device. This Managed Apple
ID provides authentication for MDM management and app licensing. When the MDM pushes down apps
and media, necessary Apple licenses are assigned to the Managed Apple ID associated with the device.
Device users who are synced to LDAP are to be assigned to a device management role and associatedwith a Managed Apple ID.

Connecting Core to Apple Business Manager
This section covers enabling User Enrollment for Apple Business Manager:
1. Manage MDM Settings
2. Add the Server Token
3. Create users to enable User Enrollment for local users and LDAP users
4. Configure LDAP group members to inherit Apple User Enrollment Roles
5. Match the Location and the Account
6. Distribute apps to Apple Business Manager devices
7. Configuration settings for Apple Business Manager User Enrollment
8. Wi-Fi Policy for user-enrolled devices
Once you have completed the above steps, then you can proceed to:l

Device user instructions for registering using User Enrollment

lUsing Logs for Troubleshooting

For instructions on using Federated authentication, see the Apple Business Manager User Guide on the Apple
website. A login is required.
Before you beginl

You must have an Apple Business Manager account. See business.apple.com.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 142

Manage MDM Settings

Manage MDM Settings
You will need to make some settings on the MDM page.
Procedure
1. In the Admin portal, click Settings > iOS > MDM.
2. Select the Enable User Enrollment check box and then click Save.
3. Check that your certificate is valid. If not valid, on the MDM page, click the Install MDM Certificate
button.
The MDM Certificate Generation dialog box opens.
4. Click Download Certificate Signing Request.
5. Click Upload MDM Certificate.
The Upload MDM Certificate dialog box opens.
6. Browse to the certificate, select it and then click Upload Certificate.

Add the Server Token
Download the server token from Apple Business Manager.
Procedure
1. Login to Apple Business Manager.
2. Click Settings > Apps and Books.
3. Download the server token for your location.

Create users to enable User Enrollment for local users and LDAP users
This section covers creating local and LDAP users and setting the User Enrollment for unsupervised Appledevices. User Enrollment will not work on supervised devices or devices enrolled in Apple's Device Enrollment
Program.
Procedure
1. In the Admin portal, go to Devices & Users > Users.
2. Click Add > Local New User.
Enter the new user information. For more information on how to create a user, see "Add New User window"
in the Getting Started with MobileIron Core.
3. Select a user and click Actions > Assign Roles.
The Assign Roles dialog box opens.
4. Select Use Apple User Enrollment (For Apple unsupervised device only).
A text field displays.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 143

Configure LDAP group members to inherit Apple User Enrollment Roles

5. Enter the Managed Apple ID for the user.
6. Click Save.

Configure LDAP group members to inherit Apple User Enrollment RolesYou can configure LDAP group members to inherit Apple User Enrollment roles. This gives all the users in thatgroup the Apple User Enrollment setting.
Before you begin
Create your LDAP groups. For instructions, see "Configuring the set of LDAP groups" in Getting Started with
MobileIron Core.
Procedure
1. In the Devices & Users > Users page, set the search criteria in the To field to: LDAP Entries and theCategory field to: Authorized LDAP Groups. You can also choose different categories in your search.

The search results display in the Users page.
2. Select a group and click Actions > Assign Role(s).
The Assign Roles dialog box opens.
3. Select Use Apple User Enrollment (For Apple unsupervised device only) and add the email addressfor User Enrollment and Managed Apple ID. You can also use standard substitution variables, for example:$USERID$@mobileiron.com.
NOTE: Substitution variables are allowed for use with LDAP Groups only and not for LDAP Users.

TABLE 8. SUPPORTED SUBSTITUTION VARIABLES FOR USER ENROLLMENT
Substitution variable

More information

Sample of substituted value$USERID$

Login ID (email addressformat)jdoe@myCompany.com$EMAIL$

Email address

jdoe@myCompany.com$EMAIL_DOMAIN$

The domain part of the email
address (part after the ‘@’)myCompany.com$EMAIL_LOCAL$

The local part of the email
address (part before the ‘@’)jdoe

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 144

Managing users that belong to multiple groups

TABLE 8. SUPPORTED SUBSTITUTION VARIABLES FOR USER ENROLLMENT (CONT.)
Substitution variable

More information

Sample of substituted value$FIRST_NAME$First name

Jane

$LAST_NAME$

Last nameDoe$DISPLAY_NAME$

Display nameJane Doe, CEO$USER_DN$Distinguished Name

CN=Jane Doe,OU=NA,OU=Users,
OU=XY,
DC=myCompany,
DC=com$USER_UPN$

The Microsoft
userPrincipalName attributejdoe@myCompany.com$USER_LOCALE$

Localeen_US$USER_CUSTOM1$

Custom field defined for
LDAP

The value of the variable as definedin LDAP settings.

$USER_CUSTOM2$

Custom field defined for
LDAP

The value of the variable as definedin LDAP settings.

$USER_CUSTOM3$

Custom field defined for
LDAP

The value of the variable as definedin LDAP settings.

$USER_CUSTOM4$

Custom field defined for
LDAP

The value of the variable as definedin LDAP settings.

$CN$

Common Name (CN)attribute extracted from thedistinguished nameJane Doe$OU$

Organizational Unit (OU)
attribute extracted from thedistinquished name

XY

$SAM_ACCOUNT_NAME$The Microsoft
sAMAccountName attribute

jdoe$REALM$

The domain component of an
LDAP entry

mycompany.com

4. Click Save.
Managing users that belong to multiple groups

If a device user belongs to multiple groups (or nested groups) and is assigned a managed Apple ID substitution
variable for various groups, this means there are more than one option available for each user. Core cannot

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 145

Match the Location and the Accountdetermine which option to use. This results in Core creating an audit log entry (Logs > Audit Logs > filter byManaged Apple ID) with the error message: “More than one LDAP Group managed Apple ID option.”
To resolve this, assign the concrete Managed Apple ID for the specific LDAP user by using the following
instructions.
Procedure
1. Go to Devices & Users > Users page, set the following parameters:l

To: LDAP EntitieslCategory: LDAP userslsearch for: your LDAP user

2. Select a user, click Actions > Assign Role(s).
The Assign Roles dialog box opens.
3. Select Use Apple User Enrollment (For Apple unsupervised device only) and add a unique email
address for User Enrollment and Managed Apple ID.
NOTE: Apple ID substitution variables are not valid for individual users or local users. Use a valid,managed Apple ID, for example, joesmith@mobileiron.com.
4. Click Save.

Match the Location and the AccountIn order for the User Enrollment to work in Core, the Apple App License Account needs to be part of the same Apple
Business Manager account. Within Apple Business Manager, if you have an account listed in Locations, you needto have an Apps and Books matched to the same location. You may need to add a new location (EXAMPLE: West
Coast.)
NOTE: Apple may change their Apple Business Manager software without notice.
Procedure
If you have an Apple license account (VPP from Apple Business Manager) that is in the same Apple Business
Manager account as the Managed Apple IDs that you will be using, you can skip steps 2 and 3.
1. Go to Apple Business Manager and log in.
2. In Apple Business Manager, go to Settings > Apps and Books.
3. Add a New Location, enter in the information and then click Save.
NOTE: It may take several minutes for the new location to display.
4. Go to Accounts and search for the user name.
5. Select the user and click Edit.
6. Give the user Content Manager permissions for the (new) location, for example, West Coast.)

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 146

Distribute apps to Apple Business Manager devices

7. Sign out of Apple Business Manager to allow the permissions to take effect. It is recommended you wait
several minutes before going to the next step.
8. Log into Apple Business Manager.
9. Go to Locations and confirm the new location is displaying.

Distribute apps to Apple Business Manager devices
You can search for iOS apps on the Apple App Store and add them to the App Catalog for distribution to Apple
Business Manager devices. You can also add your own in-house apps for iOS and macOS.
For more information, see "Importing licensed apps from Apple Licenses account" in the MobileIron Apps@Work
Guide.
NOTE: Apple User Enrolled devices will not report unmanaged apps and are unable to convert an
unmanaged app to a managed app. Please adjust compliance actions accordingly.
Before you begin
Purchase your apps in Apple Business Manager.
ProcedureNow you need to import the apps you just purchased into Core.
1. In the Admin portal, go to Apps > Apple Licenses.
2. Select the account name and then click Actions > Update licenses.
The Update licenses dialog box opens.
3. Select the applications you wish to import into Core and then click Import. It may take a few minutes toimport into Core.
4. Go to Apps > App Catalog and import the apps.
5. Select a newly-imported app, for example, MobileIron Mobile@Work, and then click Actions > Manage
Licenses.
The License Summary page displays.
6. Click on the link of the license.
The detailed license page displays.
7. In the License Label management section, click Apply To labels.
The Apply to Labels dialog box opens.
8. Select the desired label and click Apply.
NOTE: For License Type, it does not matter which option you select (user-based or devicebased), it will always be a user-based license when the device was registered with Apple
User Enrollment. If this app is shared with other types of enrollment, device-based would
be the suggested setting so that your device user will not need to enter their
iTunes/Apple credentials before installing the app.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 147

Configuration settings for Apple Business Manager User Enrollment

From here, you can take optional actions:llInstall apps - see "Using the wizard to import iOS apps from the Apple App Store" in the MobileIron
Apps@Work Guide.
Apply labels - see "Managing Labels" in Getting Started with MobileIron Core.

Configuration settings for Apple Business Manager User Enrollment
This section covers additional configuration settings required for Apple Business Manager User Enrollment: VPN
and Wi-Fi.
VPN for User-enrolled devices

User Enrolled devices can only have Per-App VPNs and can no longer have VPNs configured for the whole device.
It is recommended that you create one or more VPN configurations specifically for User Enrollment. Now
whenever the app is installed, the appropriate VPN configuration will also be installed automatically.
It is recommended that when assigning labels to VPN configurations, the labels should not include devices that areUser Enrolled. Using a filter label, you can filter out user enrolled devices by setting in the filter:"ios.apple_user_enrolled_device"= false

Procedure
The below steps ensure when the app is installed on the user device, the appropriate VPN configuration will also be
automatically installed.
1. Follow the instructions in Managing VPN Settings to setup a new VPN. Be sure to select Per App VPN as
part of your configuration.
2. Go to Apps > App Catalog.
3. Click the link of an app and then click Edit.
4. In the Per-App VPN Settings section, select the newly-created VPN and move it to the panel on the right.
5. Click Save.
From here, you can optionally apply a label to your Apple license. See "Applying an Apple license label to an app" in
the MobileIron Apps@Work Guide.
NOTE: MobileIron recommends that administrators modify labels for VPN configurations to exclude User
Enrolled Devices if the VPN is not supported on User Enrollment. This can be done using thedevice detail "ios.apple_user_enrolled_device" and including it in the label definition, e.g.: AND"ios.apple_user_enrolled_device" = true

Wi-Fi Policy for user-enrolled devices
You need a Wi-Fi policy specifically for user-enrolled devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 148

Device user instructions for registering using User Enrollment

1. In the Admin portal, go to Policies & Configs > Policies.
2. Click Add New > Wi-Fi.
The New Wi-Fi Setting dialog box opens.
3. Enter the information. In the Proxy Type field, select Auto. This is the only proxy type that can be used foruser-enrolled devices.
For more information about Wi-Fi, see Wi-Fi settings.

Device user instructions for registering using User Enrollment
This section addresses the actions the device user needs to take for registering Apple User Enrollment. The below
steps will work with any app your company purchased - the example app used is the MobileIron client app,
Mobile@Work.
Procedure
1. On the iOS device, open Safari (never Chrome) and type in the URL for Mobile@Work:registrations.company.com/go.
2. The Mobile@Work login displays. The device user is to log in using their MobileIron local user or LDAP
credentials.
The registration page displays with a message saying the profile was downloaded.
NOTE: You must complete registration within 10 minutes or you will have to start registration
process over.
3. Tap Settings. The Settings page displays.
4. Tap Enroll in [Your Company Name].
5. The User Enrollment page displays.
6. Tap Enroll My iPhone.
If you tap Cancel and Delete Profile, you will have to start the registration process all over again.
7. You will be presented with a login for either Apple or your Federated account. Enter the password for yourManaged Apple ID. (The Managed Apple ID will be listed at the top of your login page.)
8. You may be presented with the option to stay signed in, make a selection.
9. A page displays stating the "Enrollment is Successful.”Using Logs for Troubleshooting
To troubleshoot errors or issues for a User Enrolled device, start by reviewing the device MDM logs.
Procedure
1. In the Admin portal, go to Devices & Users > Devices.
2. Click on the device to open up the Device Details page.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 149

View reports on devices

3. Select the Logs tab.
A list of available logs display.
4. Select the MDM Activity link to display the list of MDM actions performed on the device.
5. From the MDM Activity page, you can filter the actions based on a date range, the state of the action (forexample, Error) or the action itself (for example, Install Managed Application.)If the action is in the Error state, a View Error link displays. Click this link to see more details about theerror.
View reports on devices

You can see a report on devices by selecting the device , clicking the Log tab and then clicking the MDM Activity
link.
Activation Error

Errors occur when the device is supervised. Users cannot use a supervised device for User Enrollment. There is
no remedy for this as supervised devices cannot be used with User Enrollment.
App fails to install (AppAlreadyInstalled)

The most common Install Managed Application error is AppAlreadyInstalled. This error occurs when thedevice has the app installed in the private space. Since the MDM service is unable to see private apps and isunable to convert the app to managed, an Install Managed Application command sent for an already-installed app
will get this error message.
Procedure
1. Instruct the device user to remove the app from the device.
2. Instruct the device user to tap “Install” for the app within Mobile@Work.
Procedure(Alternate)
Alternatively, you can send a new installation request to the device for that application.
1. Navigate to Apps > App Catalog.
2. Select the check box next to the app.
3. Click Actions and select Send Installation Request.
4. Select the option to Send request for new installations.
5. Under Actions, choose Select devices to send message and then click Apply.
6. Search for the device, select the check box and then click Send.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 150

7Multi-User Support
This section addresses multi-user access for devices including secure sign-in and sign-out settings.
lAbout multi-user supportlUsing Secure Sign-In and Sign-Outl

Setting Secure Sign-In preferencesl

Setting unique restrictions for signed-out deviceslEnabling Secure Sign-InlCustomizing the multi-user secure sign-in web cliplRemote sign-out from a multi-user iOS devicelSetting automatic sign-out for multi-user devices

About multi-user support
MobileIron Core supports multi-user access for iOS devices. This feature enables multiple employees to use thesame device. The Secure Sign-In feature ensures that the profiles and apps are removed when the device user
signs out and reinstalled when the next user signs in. Options enable you to specify whether Wi-Fi settings andpasscodes are removed. Each app is handled based on how that app is configured for quarantine.
NOTE: When setting up email for devices with multi-user sign-in, the exchange profile must always use auser-based certificate. The user-based certificate will ensure secure access to email for all users.
Using a device-based certificate can result in one user sending or receiving emails for anotheruser. When configuring the user-based certificate, select the Proxy enabled and Storecertificate keys on MobileIron Core options. This allows the user certificate and private key tobe delivered each time they log in on the shared device.

Using Secure Sign-In and Sign-Out
Devices configured for multi-user support receive a Secure Sign-In web clip.
Procedure
1. Tap Secure Sign-In.
The Secure Sign-In page displays
2. Enter a valid username and password and then tap Sign-In.
After successfully signing in, Core sends to the device the profiles configured for the signed-in user.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 151

Setting Secure Sign-In preferences

3. To sign out, tap Secure Sign Out.
Core removes the profiles assigned to the signed-out device user.
Optionally, Core can remove the managed apps assigned to the signed-out device user. The setting for thisis in the "Remove app when device is quarantined or signed out" field. For more information, see "Using
the wizard to import iOS apps from the Apple App Store" in the MobileIron Apps@Work Guide.
NOTE: Web content filters can affect the Secure Sign-in web clip. Ensure your web content filters do notblock access to Core. Blocking access to Core disables the secure sign-in web clip. For more
information, see Web content filter settings.

Setting Secure Sign-In preferences
For multi-user devices, you can determine whether Wi-Fi settings are removed upon user sign out.
WARNING: If you remove Wi-Fi settings on sign out for Wi-Fi only devices, these devices will be unable toconnect to any network after the first user signs out.
Procedure
1. In the Admin Portal, go to Settings > System Settings > Users & Devices > Multi-User.
2. Select one of the following settings to specify how to handle Wi-Fi settings when device users sign out:lKeep Wi-Fi settingslRemove Wi-Fi settings for cellular-enabled deviceslRemove Wi-Fi settings for cellular-enabled and Wi-Fi-only devices

3. If you want to clear the passcode on the device when the device user signs out, select the Clear
passcode option.
4. Click Save.

Setting unique restrictions for signed-out devices
The Signed-Out label enables you to specify more stringent restrictions for multi-user devices when a user signs
out. This is a dynamic label that applies automatically to any multi-user iOS device that does not have a signed-in
user.
Specifying restrictions involves the following main steps:
1. Create the restrictions that you want applied when a user signs out.
For example, you might want to disable access to YouTube when an authorized user is not signed in.
2. Apply each policy and configuration to the Signed-Out label.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 152

Enabling Secure Sign-In

Suppose you want iPads to be restricted to basic web use when an authorized user is not signed in. You would
need to create a Restrictions configuration to lock down the camera, inappropriate content, screen captures, app
installation, and so on.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > iOS / tvOS > Restrictions. The New Restrictions Setting dialog box opens.
3. Assign a Name to the configuration.
4. Clear the check boxes for the items you want to restrict.
5. Click Save.
6. Select the new configuration.
7. Select Actions > Apply To Label.
8. Select Signed-Out.
9. Click Apply.
Core sends the new restriction settings to multi-user devices upon sign-out.

Enabling Secure Sign-In
NOTE: If you intend to distribute certificates to multi-user devices, MobileIron recommends using user
certificates instead of device certificates. This practice ensures that email is configured for thecorrect user.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select the System - Multi-User Secure Sign-In configuration.
3. Select Actions > Apply To Label.
4. Select the label or labels that represent the devices to be configured for multi-user sign-in.
5. Click Apply.

Customizing the multi-user secure sign-in web clip
You can change the look and feel of the multi-user secure sign-in web clip for iOS devices.
Possible changes include:la customized touch icon for the web cliplremoving the icon from iOS screenslrunning the web clip in full-screen mode (except when using MobileIron Tunnel or VPN Safari domain rules)

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 153

Remote sign-out from a multi-user iOS devicelenabling a pre-composed web clip touch icon, so that devices running versions of iOS prior to iOS 7 will
display the icon, as designed, without any additional effects imposed on touch icons on versions of iOS
prior to 7

Procedure
1. Go to Policies & Configs > Configurations.
2. Select the System - Multi-User Secure Sign-In configuration. The Configuration Details pane displayson the right.
3. Click Edit. The Modify Web Clips Setting window displays.
4. Click the Secure Sign-In web clip link. The Edit Web Clip dialog box opens.
5. Use the Secure sign-in web clip window to edit the web clip as desired.
6. Click Save.
7. In the Edit Web Clip Setting window, click Save.
Item

Description

Name

Do not modify the name of the web clip.

Address/URL

This URL points to the default multi-user sign-in page that is included with
MobileIron Core. The page is located at https://<your hostname>/mifs/c/multiuser.html . Modify the URL if you wish to point to acustomized multi-user sign-in page.

Icon

By default, this points to the multi-user sign-in web clip touch icon shown inUsing Secure Sign-In and Sign-Out.
To upload a customized touch icon:
1. Click Browse.
2. Select the customized icon.
3. Click Open.

Removable

Select to allow iOS device users to remove the multi-user web clip.

Full Screen

Select to enable the web clip to display in full screen mode on iOS devices.
NOTE: Full screen mode will not work for web clips when devices
running iOS 8 through the most recently released version as
supported by MobileIron use MobileIron Tunnel or Safari
domain VPN rules.

Precomposed

Select to use a precomposed icon for the web clip. Precomposed icons will
display on iOS 6 through iOS 7 devices as designed, without the imposingof iOS visual effects.

Remote sign-out from a multi-user iOS device
You can use the Admin Portal to remotely sign out users from multi-user devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 154

Remote sign-out from a multi-user iOS device

Procedure
1. Go to Devices & Users > Devices.
2. Select the device in the Devices page.
3. Select Actions > iOS Only > Sign out.
The following table lists the items removed from a multi-user device when remotely signing out a user.

TABLE 9. ITEMS REMOVED BY MOBILEIRON CORE ON SIGN OUT FROM A MULTI-USER IOS DEVICE
Item

Remove on sign-out?

Apps@Work access

Yes

Docs@Work access

Yes

Passcode

Optional

Restrictions

No

Wi-Fi

Optional

VPN, Per-app VPN, VPN on Demand

Yes

Email

Yes

Exchange

Yes

LDAP

Yes

CalDAV

Yes

CardDAV

Yes

Subscribed Calendars

Yes

Web Clips

No

Credentials (Certificates)

Yes

SCEP

Yes

Mobile Device Management

No

APN

No

Single-App Mode

Yes

Global HTTP ProxyYes

Generic Configuration Profiles

No

Provisioning Profiles (Configurations)No

Provisioning Profiles (App Distribution)

No

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 155

Setting automatic sign-out for multi-user devices

Item

Remove on sign-out?

GeneralNo

AirPlayNo

AirPrint

No

Network Usage Rules

No

Web Content Filter

No

Managed App Config

Yes

Single Sign-on AccountYes

Setting automatic sign-out for multi-user devices
You can configure MobileIron Core so that a user on a multi-user device is automatically signed out of Core. The
user is signed-out after an iOS device is locked and a configured time period has elapsed since AppConnect app
activity. This feature requires that you are using AppConnect for iOS apps on the device and Mobile@Work 11.0
for iOS through the most recently released version as supported by MobileIron.
If you configure automatic sign-out to occur after a configured time period, the following scenario occurs:
1. A user locks a device which is configured for multi-user access or the user switches to a non-AppConnectapp.
2. The configured period elapses.
3. A user unlocks the device and opens an AppConnect app, or the user switches back to an AppConnect
app from a non-AppConnect app.
4. Control switches to Mobile@Work for iOS, which sends a sign-out command to MobileIron Core.
The user is signed out of Core.
Procedure
1. Go to Policies & Configurations > Policies.
2. Select the AppConnect Global policy that is applied to the multi-user devices.
3. In the Device Details page, click Edit. The Modify AppConnect Global Policy dialog box opens.
4. In the AppConnect field, select Enable.
5. In the iOS portion of the AppConnect Security Controls on Device section, select Enable multi-user
auto sign-out after X minutes of inactivity.
6. Enter a value between 5 and 120 for the number of minutes of inactivity before the automatic sign-out
occurs.
7. Click Save.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 156

Setting automatic sign-out for multi-user devices

Related topics"Configuring the AppConnect global policy" in the MobileIron Core AppConnect and AppTunnel Guide for
MobileIron Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 157

8
Searching for Devices
The Devices page in the Admin Portal, offers both basic and advanced searching features. The basic searchfeatures provide a way to find devices or users using a limited set of criteria. The Advanced search features allow
you to create complex search queries using the full set of available criteria. You can also apply advanced search
criteria to a new or existing/unassigned or existing/unused label.
The topics in this chapter include the following advanced topics:l

Basic searchinglAdvanced searchinglUsing the query builderlUsing a manually edited search expressionlUsing both the query builder and manual editingl

Negative operators with advanced searchlClearing an advanced searchlSearching for retired deviceslSearching for blocked devicesl

Saving a search criterion to a label

Refer to the Getting Started with MobileIron Core for the most commonly used topics for managing devices, suchas:lUsing the DashboardlCreating custom attributeslDeleting retired devices

NOTE: The features described in this section are supported on macOS devices.

Basic searching
You can quickly search for devices based on the following criteria:
l

Label

l

iOS MAC Addressl

iOS Serial Numberl

iOS UDID

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 158

Advanced searchinglUser Principal/IDl

User Email AddresslUser First/Last Name

To search by label, you can:lselect the appropriate label name from the Labels list.

lenter the initial letters of the label name in the Labels list.
The list changes to show only label names containing the letters you entered.

FIGURE 6. SEARCH BY LABEL

To search by the other criteria, select any label in the Labels list then use the following syntax in the Search byUser or Device field:lmac:<iOS MAC Address>lsn:<iOS Serial Number>ludid:<iOS UDID>luid:<User Principal/ID>

lmail:<User Email Address>l

name:<User First/Last Name>

NOTE: The prefixes mail: and name: are optional. All others are required. For example, to find thedevices registered with the email address jdoe@mobileiron.com, you can enter the following:
mail:jdoe@mobileiron.com
or justjdoe@mobileiron.com

Advanced searching
As data sets get larger, it is increasingly important to have a powerful search. You can use advanced search tobuild complex queries using the full set of available criteria. You can also create a new label using the advanced
search criteria.
To access advanced search:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 159

Searchable fields

1. Log into the Admin Portal.
2. Go to Device & Users > Devices.
3. Click the Advanced Search button located at the top right, above the table to display the query builder.
4. Enter search criteria using the query builder, or type the search expression directly. See Device fielddefinitions.
5. Click Search. Verify your results.
6. (Optional) Click Save to Label button. This will save your new search query as a new label and in Devices& Users > Labels, you can utilize this new label as a filtered label.
7. If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click
Confirm. For more information, see Best practices: label management.

Searchable fields
To see the complete list of searchable fields in the query builder:
1. Click Field to see the categories
2. Click Expand All.
The fields are organized alphabetically into the following categories for convenience:l

Device fields: apply to device type based on their operating system.

lOS-specific fields: apply to devices of the selected platform.

lUser fields: apply to the device’s user, including LDAP fields for groups and custom attributes.

Device field definitions
This section covers the device field definitions found in the Devices & Users > Devices page. They also display
in the Advanced Search field on the same page.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 160

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS
Device Type

Field

Description

Android Fields

Admin ActivatedTrue / false if device activated by admin.

Android AutomatedEnrollment

Once automated Android registration is completed, thefollowing values display:• Google Zero Touch• Knox Mobile Enrollment• Non Zero Touch AE Enrollment - this is for Managed
Devices / Device Owner types (afw#, QR code, NFC)
• Unknown - this value displays if versions before Core
10.6.0.0 were used. This means the "In-App Registration
Requirement field in Settings > System Settings > Users& Devices > Device Registration was used. It can alsomean that an old client was used with Core version
10.6.0.0 or later.

(This field is valid forCore 10.6.0.0 through thelatest version as
supported by MobileIron.)

Android Client Version
Code

Version code of the client.

Android for WorkCapableTrue if the device is Android Enterprise capable, otherwise

Attestation

Result of Samsung Attestation.

Brand

Brand of the device.

C2DM Token

C2DM token of the device if present, otherwise blank.

Code Name

Code name of the Mobile@Work client

Developer Mode

True if the Android device has Developer mode enabled,

false.

otherwise false. This is reported on all Android device
configurations and also on KNOX.
DeviceBrand name of device, for example, Mako.

Device Encryption
StatusDevice encryption status.

Device Roaming Flag

True if the device is roaming, otherwise false.

File encryption

True if the Android device has enabled file encryption,otherwise false. This is reported on all Android device
configurations and also on KNOX.

GCM/FCM Token

GCM token of the device if present, otherwise blank.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 161

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Present
Google Device AccountPresent

True if the device has a Google Device Account (eg: Android

ICCID

Integrated Circuit Card Identifier number.

Kiosk EnabledTrue if the device is kiosk enabled, otherwise false.

Manufacturer OS Version

Manufacturer OS version.

MDM EnabledTrue if MDM is enabled, otherwise false.

Media Card Capacity

Amount of memory capacity of the media / SD card.

Media Card Free

Amount of free memory on the media / SD card.

Multi MDM

Indicates true/false.

OS API Level

The Android OS API level. See

Enterprise), false otherwise.

https://developer.android.com/studio/releases/platforms formore details.
This number is used so administrators can use a numericalcomparison of OS versions.
OS Build Number

OS build number.

OS Update Path

OS Update Path.

OS Update Status

OS Update Status.

OS Version

Lists the OS version of the device.

Password/PIN Days

Represents the number of days before the password / PIN

Before Expiring

will expire. This numerical value is controlled by the Security
policy's Maximum Password Age field value. This field is a
dynamic field, its value decreases every day by 1 until the
password / PIN is renewed. At renewal, the value returns to
the original number stated in the Maximum Password Agefield and starts a new daily count-down. See Working withdefault policies.

Platform Flags

Internal string representing the capabilities of the
Mobile@Work application.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 162

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Registration Status

Registration status of the device. Registration Status can beused as part of a dynamic label evaluation and criteria for tiercompliance.
In the Select Type drop-down, select one of these options:
•
•
•
•
•
•
•

Device Admin
Device Admin Not Required
Work Managed Device
Managed Device with Work Profile
Work Profile
Work Profile for Company Owned Device
Unknown

VersionRepresents the Samsung Knox v3 license key for DualDAR.
Lists the Samsung DualDAR version if client is enabled. If notclient enabled or device is in Device Owner mode, lists as"Unsupported."

SafetyNet EnabledTrue if SafetyNet is enabled, false otherwise.

SafetyNet Exception

SafetyNet exception during error.

SafetyNet Status

SafetyNet status if enabled and no error.

SafetyNet Timestamp

Timestamp of when last SafetyNet check was run.

Samsung Carrier CodeSamsung Carrier code.

Samsung E-FOTA
CapableTrue if the device supports Samsung E-FOTA, false

Samsung KNOX Version

Knox version, if present.

Samsung Model Number

Samsung Model Number.

Samsung SAFE Version

Samsung Safe Version.

Screenlock PIN Change

Indicates if device user was prompted to change the device's

Prompt – Showing

screen lock password / PIN and the device user skipped theSamsung DualDAR

otherwise.

prompt. Values are:•••Unknown - If coming from an older client device, value is
unknown.
True - Indicates the PIN is to expire in 7 days or less.
False - (default) Indicates the device user is not being

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 163

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description
prompted to change the password / PIN (it has notreached its 7-day expiration window.)
The value listed stays until the device user successfullychanges the password /PIN on the device. See Working withdefault policies.

Secure Apps EnabledTrue if Secured Apps / AppConnect is enabled, otherwise
false.

Secure Apps Encryption
Enabled

True if Secured Apps Encryption is enabled, otherwise false.

Secure Apps Encryption
ModeType of Secured Apps / AppConnect Encryption.

Security Detail

Reason for security failure if it occurs.

Security Patch Level

Security Patch Level string or timestamp.

Security Patch Level
Date

Date of the Security Patch Level of the OS.

Security Reason

Reason device is considered jailbroken.

USB Debugging

True if USB debugging is enabled, otherwise false.

Wear OS Client installed

True only if one or more paired-watches have Mobile@Work
installed on the Wear OS device.

Wear OS Device isPairedTrue if one or more Wear OS device is paired to device via
Bluetooth.

Zebra Build Fingerprint

Fingerprint of the firmware build currently present on the Zebra
device.

Zebra Device Build Id
Zebra Device System
UpdateCurrent Build ID of the Zebra device.
lll

Unknown - Not supported by client or OS version
Current - The most current update is installed.
Applicable to Android 8 through the most recently
released version as supported by MobileIron.
Applicable to Zebra 6 through the most recently
released version as supported by MobileIron.
Pending - The client has accepted a system update
configuration, but the update is not yet downloaded or
installed. Applicable for Zebra 6 through the most

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 164

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description
recently released version as supported by MobileIron.
ll

Zebra OTA Capable

Downloading - An update is being downloaded.
Applicable for Zebra 6 through the most recently
released version as supported by MobileIron.
Available - An update is available (Android 8 throughthe most recently released version as supported by
MobileIron) or downloaded (Zebra 6 through the mostrecently released version as supported by MobileIron)
but is not yet installed.

True if the device supports Zebra OTA (Over The Air),otherwise false.

Zebra Patch Version

The version of firmware for the Zebra device to be upgraded
to. This is the target firmware version of the firmware applied
to the Zebra device through firmware policy.

CommonFieldsAPNS Capable

Only true if there is an APNS token for the Mobile@Work
client, otherwise false.

AppConnect Term s ofServiceTrue/false for if the AppConnect Terms of Service was

AppConnect Terms ofService Date

Represents the date/time the AppConnect Terms of Service

Authenticator Only

True/false if the device is registered in Authenticator Only

accepted.

was accepted.

mode.
Azure Client Status

Indicates whether device is connected to Azure. The possible

Codevalues are:l

Success - Able to retrieve device ID.

lInternal_Error - An unrecoverable error occured either
within the client or on server side.

lWorkplace_Join_Required - Registration of device
required. Device user can mitigate this status.

lInteraction_Required - An interactive log-in isrequired. Device user can mitigate this status.

lServer_Declined_Scopes - Some scopes were not

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 165

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description
granted access to.
lServer_Protection_Policies_Required - The
requested resource is protected by an Intune
Conditional Access policy.

lUser_Canceled -The device user cancelled the web
Auth session by tapping the "Done" or "Cancel"
button in the web browser.

l

Account_logged_out - Account logged out.

Azure Device

Lists the device's compliance status in Azure. Possible

Compliance Reportvalues are:

Statusl

In-progresslSuccessfullFailedAzure Device

The time Core reported the device compliance status toCompliance Report Time

Microsoft Intune. A blank field indicates one of the following:lbecause that feature is disabledlCore just received the data and has yet to call theMicrosoft APIlthere is an error such as user_Cancelled or Internal
Error so server will not report the device to Microsoft

Azure Device

Indicates Azure account has been deactivated or the device

Compliance Status

is not in compliance. Possible values are: Compliant / Not
Compliant.

Azure Device Identifier

The device ID reported by Microsoft to the iOS or Android
device. For example: 007c8232-9489-4074-9b35345b16f0a72d. This is Microsoft’s ID for that device. Core
receives this device ID as device users are required toregister to Microsoft Authenticator application in order to use
this feature.
If unable to retrieve the Device ID, this field is left blank.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 166

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Background Status

True if iOS background status is enabled, otherwise false.

Battery Level

Percentage of battery left.

Block Reason

A list of reasons why the device is blocked.

Blocked

True if the device is blocked, otherwise false.

Cellular Technology

GSM, CDMA, or blank if the device does not support cellular.

Client Build Date

The build date of the client, if registered with Mobile@Work
client.

Client Id

The unique client ID if the device was registered with
Mobile@Work client.

Client Last Check-in

Date/Time of last check-in.

Client Migration Status

Status of Mobile@Work client migration from Core to Cloud(true/false).

Client Name

The name of the client, if registered with Mobile@Work client.

Client Version

The version of the client, if registered with Mobile@Work
client; otherwise, false.

Cloud Migration Status

Status of device migration from Core to Cloud (true/false).

Comment

A field that the admin uses to add their own comments for thedevice.

CompliantTrue if the device is in compliance, otherwise false.

Creation Date

The creation date of this device record.

Current Country CodeCurrent country code of the device.

Current Country Name

Current country name of the device.

Current Operator Name

Short name of the cellular carrier, if there is a cellular service.

Current Phone Number

Current phone number of device, if the device has cellular
service.

Device Admin EnabledTrue if device admin (Android) is enabled, otherwise false.

Device Encrypted

True if the device is encrypted, otherwise false.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 167

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Device is Compromised

True if the device is compromised, for example, jailbroken.

Device Locale

Locale of the device.

Device Owner

Company or Personal.

Device Space

Name of the space the device belongs to.

Device UUID

Unique ID of the device generated from Core.

Display Size

Size of device's display.

EAS Last Sync Time

Exchange ActiveSync last sync time.

Ethernet MAC

Ethernet MAC ID.

Home Country CodeHome (Initial) country code of the device.

Home Country Name

Home country name of the device.

Home Operator Name

Home Operator Name.

Home Phone NumberHome Phone Number.

IMEI

IMEI (International Mobile Equipment Identity) number.

IMSI

ISMI (International Mobile Subscriber Identity) number.

IP Address

Current IP address of the device.

Language

Language of the device.

Last Check-in

Last check-in time of the device.

Manufacturer

Manufacturer of the device.

MDM Last Check-in

Last MDM check-in time of the device.

MDM Managed

True if the device is MDM managed, otherwise false.

Memory Capacity

Memory capacity of the device.

Memory Free

Amount of free memory in the device.

MobileIron Threat
Defense Status

MobileIron Threat Defense Status.

MobileIron Tunnel App
Installed

True / false if the MobileIron Tunnel app was installed.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 168

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Model

Model of the device.

Model Name

Model name of the device.

Modified Date

Date/Time for last updates to device details.

MTD Anti-Phishing
StatusMTD Anti-Phishing Status.

Non-compliance Reason

Reason why the device is not in compliance.

OS Version

OS version number string.

Passcode

Contains registration PIN for a preregistered device, empty ifnone exists.

Passcode ExpirationTime

The expiration time for the registration pin for a prereigstered

Platform

Operating system of the device.

Platform Name

Operating system and OS version of the device.

Processor Architecture

Architecture of the processor for the device.

Quarantined

True if the device is quarantined, false otherwise.

Quarantined Reason

Reason for quarantined, empty if the device is notdevice, empty if none exists.

quarantined.
Registration Date

Registration date of the device.

Registration IMSI

Registration of ISMI (international mobile subscriber identity)
number.

Registration UUID

Unique ID when registering from the client.

Retired

True if the device is retired, otherwise false.

Roaming

True if the device is roaming, otherwise false.

SD Card Encrypted

True/faise if SD card is encrypted.

Security State

Security state of the device.

Serial Number

Serial number of the device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 169

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device TypeiOS Fields

Field

Description

StatusStatus of the device.

Storage Capacity

Total storage capacity, in bytes, of the device.

Storage Free

Number of bytes of free storage on the device.

Terms of Service
Accepted

True if the End user Terms of Service was accepted,

Terms of Service
Accepted Date

Date for when the End User Terms of Service was accepted,

Wi-Fi MAC

Wi-FI MAC address of the device.

Activation Lock Bypass
Code

Code to bypass activation lock.

Activation Lock is
Enabled

True if Activation Lock is enabled on the device, otherwise

APNS Token

Mobile@Work client APNS wakeup token. Applicable to iOS.

Apple Device Mac
Address

iPhone (media access control address) MAC address.

Apple Device Version

iPhone version code. Applicable to iOS and OS X.

Apple OS Update
Product Key

Available OS update product key. Applicable to iOS andApple OS Update
Product Version

Available OS update product version. Applicable to iOS andmacOS.

Apple OS Update Status

OS update status. Applicable to iOS and macOS.

Bluetooth MAC

Bluetooth MAC address. Applicable to and OS X.

Build Version

MDM build version. Applicable to iOS and OS X.

Carrier Settings Version

Carrier settings version. Applicable to iOS.

Current Mobile Country
Code

Current mobile country code. Applicable to iOS.

Current Mobile Network
Code

Current mobile network code. Applicable to iOS.

otherwise false.

otherwise blank.

false. Applicable to iOS.

Applicable to iOS and OS X.

macOS.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 170

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Data Protection

Applicable to iOS.

Data Roaming EnabledTrue if device is data roaming enabled, otherwise false.
Applicable to iOS.

DEP Device

True if the device is Apple Device Enrolled, otherwise false.
Applicable to iOS, macOS, and tvOS.

DEP Enrolled

True if the device is Apple Device Enrolled, otherwise false.
Applicable to iOS.

Device Locator Service
is EnabledTrue if device locator service is enabled, otherwise false.

Device Name

Name of the device. Applicable to iOS and OS X.

Do Not Disturb is in
EffectTrue if Do Not Disturb is enabled, otherwise false. Applicable
to iOS.

Force Encrypted Backup

True if backups are forced to be encrypted, otherwise false.

Applicable to iOS.

Applicable to iOS.
Full Disk Encryption
Enabled

True if full disk encryption is enabled, otherwise false.

Full Disk Encryption Has
Institutional Recovery
Key

True if full disk encryption has institutional recovery key,

Full Disk Encryption Has
Personal Recovery Key

True if full disk encryption has personal recovery key,otherwise false. Applicable to macOS 10.9+.

Hardware Encryption
Caps

Hardware encryption capabilities. Applicable to iOS.

iCloud Backup is
Enabled

True if Cloud backup is enabled, otherwise false. Applicable

iOS Background Status

True if iOS background status is enabled, otherwise false.
Applicable to iOS.

iOS ICCID

Device's integrated circuit card identifier number. Applicable

Applicable to macOS 10.9+.

otherwise false. Applicable to macOS 10.9+.

to iOS.

to iOS.
IT Policy Result

Applicable to iOS.

iTunes Store Account

iTunes Store Account Hash.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 171

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Hash
iTunes Store Account is
ActiveTtrue if iTunes Store Account is active, otherwise false.
Applicable to iOS.

Languages

Language of the device. Applicable to tvOS.

Last Acknowledged LockPIN

PIN to unlock a locked macOS device. Applicable to macOS.

Last Acknowledged
Wipe PIN

PIN to proceed after wiping a macOS device. Applicable toLast iCloud Backup Date

Last iCloud backup date. Applicable to iOS.

Last MTD Sync Time

Last MTD check-in time. Applicable to iOS.

Locales

Locale of the device. Applicable to tvOS.

macOS User ID

macOS user ID. Applicable to OS X.

macOS User Long NamemacOS user's long name. Applicable to OS X.

macOS User Short
Name

macOS user's short name.Applicable to OS X.

Maximum Resident
Users

Only for use with iOS Education Shared iPads. Tells themacOS.

device how many users will have their data cache on thedevice. When the device reaches this number, the next
logged-in user that is not already present will be cached andone of the cached users will be removed from the cache (up toApple which user.) Applicable to iOS.

MDM Lost Mode EnabledTrue if MDM Lost Mode is enabled, otherwise false.
Applicable to iOS.

MDM Service Enrolled

True if the device is was enrolled via MDM Service (non-overair Apple Device Enrollment), otherwise false. Applicable to
iOS.

MEID

Mobile Equipment Identity Number.

Modem Firmware
Version

Modem firmware version. Applicable to iOS.

Network Tethered

True if the device was reported as currently network tethered,otherwise false. Applicable to macOS.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 172

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Organization Info

Organization for the device. Applicable to iOS.

Passcode Compliant

True if passcode is in compliance, otherwise false. Applicable
to iOS.

Passcode Compliant
with Profiles

True if passcode is compliant with rules specified from

Passcode Present

True if Passcode is present on device, otherwise false.

profiles. Applicable to iOS.

Applicable to iOS.
Personal Hotspot
Enabled

True if Personal Hotspot is enabled, otherwise false.

Product CodeiPhone Product code. Applicable to iOS and OS X.

Product Name

Product name. Applicable to iOS and OS X.

Security Reason Code

Security reason code. Applicable to iOS.

SIM Label 1, 2, 3

SIM label associated to the phone number.

SIM MCC 1, 2, 3

SIM card mobile country code associated to the phone
number.

SIM MNC 1, 2, 3

SIM card mobile network code associated to the phone
numberSIM Phone Number 1, 2,
3

The phone number associated with the SIM card / eSIM.

SIM EID 1, 2, 3

The SIM ID of the carrier assigned to the SIM of a specific

Applicable to iOS.

device. The EID will be included in the response of thesimdetails API call. (For more information, see the

MobileIron Core V2 API Guide.)
In the Device Details page, clicking on the number in the field
opens the SIM Information dialog box allowing theadministrator to see SIM information, including the EID.
Applicable to iOS 14.0 through the latest version of
MobileIron.
SIMs

•
•
•

Lists the number of SIMs associated to the device. This
includes embedded SIMs (eSIM) and physical SIMs.
There can be multiple SIMs associated with the eSIM.
For eSIMs in iPhone XS, iPhone XS Max, or iPhone XR

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 173

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description
with iOS 12.1 or later through the most recently released
version as supported by MobileIron.

User Fields

Subscriber Carrier
Network

SIM card subscriber carrier network. Applicable to iOS.

Subscriber MCC

SIM card mobile country code. Applicable to iOS.

Subscriber MNC

SIM card mobile network code Applicable to iOS.

Supervised

True if the device is MDM supervised, otherwise false.
Applicable to iOS.

Time Zone

Lists the time zone applied to the device.

UDID

iPhone unique device identifier. Applicable to iOS and OS X.

Voice Roaming EnabledTrue if voice roaming is enabled, otherwise false. Applicable
to iOS.

VPN IP Address

VPN IP address. Applicable to iOS and tvOS.

Wakeup Status

Device Wakeup status.

Display Name

The display name of the device user.

Email Address

Device user's email address.

First Name

Device user's first name.

Last Admin Portal Login
Time

Date of admin's last log in into Core.

Last Name

Device user's last name.

LDAP > Attribute
Distinguished Name

The Attribute Distinguished Name for an LDAP user.

LDAP > Groups >LDAP GroupDistinguished Name

LDAP Users who are members of an LDAP group with a
specific group distinguished name.

LDAP > Groups > Name

LDAP Users who are members of an LDAP group with a
specific group name.

LDAP > LDAP User
Distinguished Name

The LDAP distinguished Name of the user.

LDAP > LDAP User
LocaleAn LDAP User who are members of a specific locale.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 174

Device field definitions

TABLE 10. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

LDAP > Principal

Value of the attribute specified as the User ID in the LDAP
server configuration.

LDAP > upn

Value of the attribute specified as the User Principal Name in
the LDAP server configuration.

LDAP > User AccountControl > AccountDisabled

Indicates whether the LDAP user account is disabled(true/false).

LDAP > User AccountControl >Indicates whether the LDAP user account is locked out(true/false).

Locked Out
LDAP > User AccountControl >Indicates whether the LDAP user 's password has expired(true/false).

Password Expired
LDAP > User Attributes>

The value of the LDAP user attribute is defined in Services >LDAP.

custom1
LDAP > User Attributes>

The value of the LDAP user attribute is defined in Services >LDAP.

custom2
LDAP > User Attributes>

The value of the LDAP user attribute is defined in Services >LDAP.

custom3
LDAP > User Attributes>

The value of the LDAP user attribute is defined in Services >LDAP.

custom4
LDAP > User Attributes>

The value of the LDAP user attribute is defined in Services >LDAP.

memberOf
SAM Account Name

The security account name. This was the login name forearlier versions of Windows.

User ID

The LDAP user ID.

User UUID

The LDAP Universally Unique Identifier.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 175

Using the query builder

For Windows field definitions, see https://docs.microsoft.com/en-us/windows/clientmanagement/mdm/healthattestation-csp.

Using the query builder
To use the query builder:
1. Select a field on which to search. Hint: you can type a few letters of the field name to see a short list ofmatching fields, or press Expand All within the field list to see all the fields.
For example, if you select Status, the search engine provides only values available for Status.
2. Select an operator, such as Equals.
3. Click in the Value field to enter a value you want to search.
4. Some fields have predetermined values that you can select.
5. Select additional fields and criteria as needed.
6. Click All to combine the criteria with a logical AND or click Any to combine the criteria with OR.
7. Click Search to display the matching devices and their owners.
NOTE: To include retired devices in the results, uncheck the check box to the left of the Search button.

Using a manually edited search expression
To enter a search expression directly into the expression field:
1. Type or paste the search criteria into the expression field. The automatic syntax check displays a status
icon next to the expression field. A green icon indicates that the syntax is correct, and a red icon if
incorrect.
2. When the syntax is correct, click Search to display the matching devices and their owners.

Using both the query builder and manual editing
Use the query builder to start an expression, look up field syntax, and select predetermined values. Then, edit theexpression directly as needed.
1. Select fields and criteria.
2. Click All to combine multiple criteria with a logical AND or Any to combine multiple criteria with OR. You
can manually edit individual logical operators in the expression field.
3. In the expression field, edit the expression directly.
4. For example, you can add parentheses, change logical operators, or manually edit field names or values.
5. The automatic syntax check displays a status icon next to the expression field. A green icon indicates that

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 176

Using both the query builder and manual editing

the syntax is correct, and a red icon if incorrect.
6. When the syntax is correct, click Search to display the matching devices and their owners.
Once you manually edit the expression, the query builder is covered with a gray box to indicate it no longer
represents the current state of the expression. Click the Reset link to remove your manual edits and continue using
the query builder.
Example: Find all iOS or Android devices that use AT&T as their service operator.

FIGURE 7. SERVICE OPERATOR IN QUERY BUILDER

Build the expression to match the above example.
1. Click Advanced Search to open the query builder.
2. Select Platform in the first field, select Equals for the operator, then select iOS as the platform.
3. Click the plus icon to add another row for criteria.
4. Select Platform, Equals, and Android as the field, operator, and platform value, respectively.
5. Click the plus icon to add a third row for criteria.
6. Select Home Operator Name for the field and Equals for the operator.
Notice that the value field adjusts automatically to display service operator values by country.
7. Accept the first value field and select AT&T in the second value field.
Manually edit the expression.
1. Replace the first AND with OR.
The syntax is checked automatically as you type. Note a red icon indicating incorrect syntax while you edit
the expression.
2. Add parentheses around the phrase to read:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 177

Negative operators with advanced search("common.platform" = "iOS" OR "common.platform" = "Android") AND“common.home_operator_name” = “ATT&T”

Note a green icon indicating correct syntax has replaced the red icon. Your advanced search will look thesame as the original image (see below).

To revert to the original expression without your manual edits, click the Reset link to the right of theexpression.
3. Click Search to display the matching devices and their owners.

Negative operators with advanced search
Using negative operators enables you to create filters that exclude devices instead of including them. For example,
you can search for:l

Devices that use any platform other than iOSl

Devices with a current country code other than US

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 178

Examples for advanced search with negative operators

TABLE 11. NEGATIVE OPERATORS WITH ADVANCED SEARCH
Operator

ActionExampleDoes not equal

Returns a list of devices that do
not match the criteria specified in
the value field for the selected
field.

Select:• Home Country Name as the field• Does not equal in Operator• United States in Country Name
The search returns a list of devices that do not have
United States as their home country name.

Does not contain

Returns a list of devices that do
not contain the string specified in
the selected field.
• Used only with strings.
• Available only in theexpression field.

Select or enter:• Go to Common Fields and select Device
Space.
• In the expression field, enter:
does not contain• Place the cursor between the two quote marks inthe expression field and enter:
GlobalThe search returns a list of devices that are notassigned to the Global space.

Examples for advanced search with negative operators
To display a list of devices that have countries other than the United States as the assigned home country, createan advanced search expression that provides the necessary information.
1. Go to Device & Users > Devices.
2. Click the large magnifying glass icon located at the top right to initiate an advanced search.
3. In Field, select Common Fields.
4. Select Home Country Name.
5. Select Does not equal from the list in Operator.
6. Select United States from the list of countries in Country Name.
7. Click Search.
8. Optional: To save the search to a label, click Save to Label and then provide an existing label name or a
new label name and description.
9. If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click
Confirm. For more information, see Best practices: label management.
Suppose you want to list users within an LDAP group that have a Home Country Code other than the United States(US).
To create the advanced search expression that provides the needed list:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 179

Clearing an advanced search

1. Go to Device & Users > Devices
2. Click the large magnifying glass icon located at the top right to initiate an advanced search.
3. In the expression field enter the following, including quote marks:“user.ldap.groups.name” = “Corp_Users” AND “common.home_country_code” != “US”
4. Click Search.
5. Optional: To save the search to a label, click Save to Label and then provide a new label name anddescription.
6. If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click
Confirm. For more information, see Best practices: label management.

Clearing an advanced searchl

In the advanced search, click the Clear link, orlApply a different search by entering a basic search.

Closing the advanced search query builder does not clear the search.

Searching for retired devices
By default, retired devices are excluded from search results. To include them, uncheck the Exclude Retired
Devices From Search Results check box, located to the left of the Search button in advanced search.
To find only retired devices:
1. Uncheck the check box to exclude retired devices
2. Select the following in the advanced search query builder:lField: RetiredlOperator: EqualslValue: true

3. Click Search.
The matching records are displayed.

Searching for blocked devices
You can search for devices for which the status field value is Blocked, which means that the device is blockedfrom accessing the ActiveSync server. However, the Status column does not show the value Blocked. Instead,the ActiveSync Association view shows this information. See “Viewing ActiveSync associations” in the MobileIron
Sentry Guide.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 180

Saving a search criterion to a label

Saving a search criterion to a label
Once you create a search criterion, you can save it to a label. Click the Save To Label button in advanced searchto create a new label using the search criterion. Type a new label name in the Label field and type a description.
The new filter label is created with the advanced search criterion applied.

FIGURE 8. SAVING A SEARCH CRITERION TO A LABEL

If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click Confirm.
For more information, see Best practices: label management.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 181

9Securing Devices
Securing devices is at the heart of MobileIron Core. The topics in this chapter include the following advanced
topics:lRegistration-related features and tasksl

Reprovisioning a devicelUsing self service security featureslRetiring a devicelDeletion of retired deviceslSecurity-related features and tasks

l

Lock

l

Unlockl

Encryption

l

Wipe

l

Cancel Wipel

Selective WipelBlock AppTunnels

l

Lost

l

Found

l

LocatelReset device PINlForce Device Check-InlManaging devices in Apple MDM lost modelSetting up background check-ins with APNslManaged iBooksl

Personal hotspot on/off switchl

Reinstalling system apps on iOS deviceslManually setting the wallpaper for iOS deviceslAdding fonts to iOS deviceslUpdating the OS on supervised iOS devicesl

Restarting or shutting down supervised iOS deviceslReporting on managed devices

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 182

Registration-related features and taskslTurning Bluetooth on and off on iOS and macOS deviceslUpdating OS components on a macOS devicelSetting the time zone of a device

Refer to the Getting Started with MobileIron Core for the most commonly used topics for managing devices, suchas:lDisplaying device assetslRestricting the number of devices a user registers

Registration-related features and tasks
The following table summarizes features and tasks related to registration.

TABLE 12. REGISTRATION-RELATED TASKS
FeatureDescription

Use Case

Reprovisioning a device

Restarts the MobileIron provisioning
process for the device

Troubleshooting incomplete
registration

RetireEnds the registration (and MobileIron
management) for a device

Moving devices out of inventory

Reprovisioning a device
This feature is not supported on macOS devices.
Select Re-provision Device to restart the MobileIron provisioning process without repeating the whole registration
process. For example, you might want to do this if the initial attempt was interrupted, leaving the registration in thePending state.
NOTE: This action applies only to devices in the Pending or Verified state. To reinstall the MobileIron
Client for devices in the Active state, you can either restore from a backup snapshot or retire thedevice and re-register it. To reinstall the MobileIron Client for devices in the Wiped state, youmust re-register the device.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Select Actions > Re-provision Device.
4. The same registration settings are used.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 183

Using self service security features

Using self service security features
Users can perform lock, unlock, wipe and retire functions on devices on which they are registered from the new My
Devices page on the device.
Procedure
1. Open the Mobile@Work app on the device.
2. Click the menu icon in the upper left corner of the landing page.
3. Click My Devices.
4. You are prompted to login. Login is required when accessing the page for the first time.
5. Click Continue.
A list of the devices on which the user is registered is displayed on the My Devices page.
6. Select the device. The Device Details page is displayed.
7. Choose to Lock Device or Unlock Device.
When Lock Device or Unlock Device is selected the user is prompted to enter their password andconfirm the action.
8. Click the menu icon on the upper right to select Wipe or Retire the device.
When Wipe or Retire is selected the user is prompted to enter their password and confirm the action.

Retiring a device
Retiring a device archives the data for that device and removes the configurations and settings applied by
MobileIron Core (no personal information or settings on the device are impacted). The entry for the device no longer
appears in the Device & Users page (unless you specifically search for retired devices), and the user is notified
that the software has been removed.
If the retired device is also in the ActiveSync Association view, it remains there. However, because the device isretired, it can no longer access the ActiveSync server. You can manually remove the device from the ActiveSync
Association page. See “Removing ActiveSync phones” in the MobileIron Sentry Guide.
Retiring an iOS device removes AppConnect app data.
This feature is supported on macOS devices.
If you have duplicate devices, see Managing Duplicate Devices.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Click Actions > Retire.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 184

Retiring and deleting unused and retired devices

The Retire dialog appears.
4. In the Retire dialog, confirm the user and device information and enter a note.
5. Click Retire.
The user receives notification of the action.
To see a list of retired devices, see “Searching for retired devices” in the Getting Started with MobileIron
Core.

Retiring and deleting unused and retired devices
As device users leave your enterprise or change to new devices, more and more devices in the MobileIron Core
database are retired or never activated. When you retire a device, MobileIron Core de-registers it and no longer
manages or secures the device. All the configurations and settings that Core had applied to the device areremoved. The device can no longer access enterprise data or apps.
However, MobileIron Core retains retired and unregistered devices in its database. Deleting these devices from thedatabase improves Core performance and frees up disk space. Although Core also provides a web services API
and a CLI command to delete these devices, using the Admin Portal display is easier. It also provides an easy way
to automatically delete or retire devices on a regular schedule.
With this Admin Portal display, you can:lEasily navigate to lists of unregistered and retired devices.

l

Retire or delete devices that have been retired or not checked in for more than a specified number of days.

lConfigure Core to automatically retire or delete devices daily, weekly, or monthly.

NOTE: You can use this display only if you are assigned to the global space and you are assigned theadmin role Delete retired device. Otherwise, the actions on this display are disabled.
When Core retires or deletes retired devices due to your actions on this display, it records Delete Retired Device
events in the audit log. Personal data related to retired devices can be deleted by deleting the local user. However,
LDAP users cannot be permanently deleted unless the LDAP server or group has been deleted, in which case the
LDAP users become local users and can be deleted. If a user is deleted on the LDAP server, the user is
automatically removed from MobileIron Core during the next LDAP sync.
This feature is supported on macOS devices.

Assigning an administrator the role to delete retired devices
If you are a super administrator, you can assign another administrator the capability to delete retired devices. You
are a super administrator if you are:MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 185

Retiring or deleting retired devices by thresholdlAssigned to the global space.

lAssigned the role Manage administrators and device spaces.

Procedure
1. In the Admin Portal, go to Admin > Admins.
2. Select an administrator.
3. Select Actions > Edit roles.
4. For Admin Space, select Global.
5. Select the Device Management role Delete retired device.
6. Click Save.

Retiring or deleting retired devices by threshold
A common task, although not necessarily a daily task, is retiring unused or deleting retired devices. You can retiredevices that have not checked in or delete retired devices by a threshold amount of time. Deleting these devices
from the database improves Core performance and frees up disk space.
Prerequisites
Make sure you are assigned the required admin role. To delete or retire devices, you must be:lAssigned to the global spacelAssigned the admin role Delete retired device

Procedure
1. From the Admin Portal, go to Settings > System Settings.
2. Select Users & Devices > Retire and Delete Retired Devices. The Retire and Delete Retired Devices
configuration page opens.
The settings to retire unused devices (top half of the page) are identical to the settings to delete retired
devices (bottom half of page). The following steps are correct for either task, and all are optional steps,
except saving the configuration.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 186

Creating a schedule to retire or delete devices

3. Specify the number of days after which devices should be retired/deleted, or accept the default of 30 days.
4. Specify the maximum number of devices to retire/delete in each session, or accept the default of 100
devices.
5. To set up a regular schedule for retiring/deleting devices, click Automatically Retire Devices on a
Schedule or Automatically Delete Retired Devices on a Schedule to configure the schedule. See
Creating a schedule to retire or delete devices.
6. Click Retire Now or Delete Now to retire or delete the devices that meet the new criteria.
7. Click Save to save the configuration.
NOTE: If the Retire Now/Delete Now button is disabled, only an administrator who is a “superadministrator” can assign you to the global space and assign the Delete retired device adminrole to you. The procedure for the super administrator and definition of a super administrator are
in Assigning an administrator the role to delete retired devices.

Creating a schedule to retire or delete devices
You can enable a regular schedule to retire unused devices and delete retired devices. The schedule tool works
identically for each task.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 187

Creating a schedule to retire or delete devices

Procedure
1. In the Admin portal, navigate to Settings > System Settings > Users & Devices > Retire and Delete
Retired Devices.
2. Click Automatically Delete Retired Devices on a Schedule, or Automatically Retire Devices on a
Schedule. The Schedule Configuration opens.
3. Frequency: Select Daily, Weekly, or Monthly.
a. Daily: Select the run time from the At: drop-down menu. The default is midnight.

b. Weekly: Select the day and time for the clean up. Default value is Sunday at midnight.

c. Monthly: Select the time for a first-day-of-the-month schedule frequency. Default is first day of themonth at midnight.

4. Click Save.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 188

Managing Duplicate Devices

Managing Duplicate Devices
This section is applicable to iOS andWindows 8 devices.
Before Core version 10.6, duplicate devices with an "active" state were retired. From Core version 10.6 through thelatest version as supported by MobileIron, administrators can set duplicate active devices to the “Unknown” statusby selecting Enable managing duplicate devices.
Removal of device records from the Core database applies to the following retired device types:lActive Devices with no device details (iOS andWindows 8 devices)l

Devices with no subject holder (iOS andWindows 8 devices)l

Devices with the below statuses (iOS Only)o

Enrollment VerifiedoEnrollingoEnrolled

Core also supports Daily, Weekly and Monthly options for scheduling this feature.
Procedure
1. In the Admin portal, go to Settings > System Settings.
2. Expand Users & Devices and then click Manage Duplicate Devices.
The Manage Duplicate Devices page displays.
3. Select Enable managing duplicate devices.
The page expands to display more options.
NOTE: To disable this feature, simply de-select this field.
4. Make your settings using the guidelines below.
5. Click Save.

TABLE 13. MANAGING DUPLICATE DEVICES SETTINGS
Item

Description

Scan Schedule Frequency

Select the appropriate radio button and make the setting:•••

Device Action

Daily - Select the time of the scan of the duplicate device. This is the timeon the Core server.
Weekly - Select the day and time of the of the duplicate device. This is thetime on the Core server.
Monthly - Select the time of the scan of the duplicate device to occur on
the first day of the month. This is the time on the Core server.

Select one option:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 189

Security-related features and tasks

TABLE 13. MANAGING DUPLICATE DEVICES SETTINGS (CONT.)
Item

Description••

Retire the old device - (default)Mark the old device as "Unknown"

Related topics
Retiring a device

Security-related features and tasks
The following table summarizes the features and tasks related to security.

TABLE 14. SECURITY-RELATED FEATURES AND TASKS
FeatureDescription

Use Case

Lock

Forces the user to enter a password
before accessing the device

Dealing with lost and stolen devices

UnlockReverses the Lock function

Accessing the device when thepasscode has been forgotten orreassigning the device to a different
user

NOTE: The unlock feature is notsupported on macOS
devices. You can,however, unlock anmacOS device using a
different processdescribed in Unlocking amacOS device.
Unlock AppConnect
Container

NOTE: For security reasons, it isinadvisable to execute thiscommand on lost or stolen
devices.

This feature is not supported formacOS devices.

This feature is not supported for macOS
devices.

This feature is not supported for iOS
devices.

This feature is not supported for iOS
devices.

Device Encryption Status

Displays the encryption status of
the device in the Device Details tab.

Dealing with lost and stolen devices.

Wipe

Removes content and settings toreturn the device to factory default
settings.

Dealing with lost and stolen devices

Attempts to cancel a wipe action fordevices.

Reversing an inadvertent Wipe
command.

Cancel Wipe

Preparing a device for a different user

NOTE: Wipe cannot be reversed

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 190

Lock

TABLE 14. SECURITY-RELATED FEATURES AND TASKS (CONT.)
FeatureDescription

Use Case
after it completes.

Block AppTunnels

This feature is not supported on
macOS devices.
Immediately blocks access to all
AppTunnels for all AppConnect
apps on a device.

Dealing with lost and stolen devices
Immediately removing access toservers behind the firewall

Lost

Flags a device as lost

Dealing with lost and stolen devices

Found

Flags a device as foundDealing with lost and stolen devices

LocateThis feature is not supported on
macOS devices.

Dealing with lost and stolen devices

Reports the last known location for adeviceReset PIN

This feature is not supported onAndroid, iOS, or macOS devices.

Related topics
Samsung Knox Dual Encryption (DualDAR) support

Lock
Locking a device forces the user to enter a password to access the device and prevents the user from reversing
this restriction. The user is informed of this action via email. If the user has set a password for the device, then thatpassword must be entered.
This feature is supported on macOS devices.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Select Lock from the Actions menu.
The Lock dialogue for an iOS device displays additional options for you to enter a contact number and a message.
The Lock Message field allows you enter up to 500 characters. The contact number and the message appear on
the screen for the device you locked. The device user can call the number displayed on the locked device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 191

Unlock

UnlockUnlocking the device passcode is supported as follows:
NOTE: The unlock feature is not supported on macOS devices. You can, however, unlock an macOS
device using a different process described in Unlocking a macOS device.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Click Actions > Unlock.

Encryption
The encryption status for a device is now reported on the device details tab.
This feature is supported on macOS devices.
To check the encryption status of a device:
1. Log into the Admin Portal.
2. Go to Device & Users > Devices > Device Detail.
The device encryption status displays as Activating, Active, Active Per User, Active Default Key,
Inactive, Unsupported, or None.

Wipe
NOTE: This feature is only supported on macOS devices that have FileVault 2 (FDE) enabled.
When wiping a device, MobileIron Core informs the user of this action via email.
Starting with version 11.1.0.0, administrators can wipe the device in Direct Boot mode in all Android Enterprisemodes.
WARNING: Wiping a device returns it to factory defaults, which can result in loss of data.
Required Role: The Device Management: Wipe device role is required to use this feature.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device to be wiped.
3. Click Actions > Wipe.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 192

Cancel Wipe

4. Optionally, select one or more of the following options:lllPreserve data plan (iOS 11 and later devices only) - Select this option to retain the data plan on
devices running iOS 11, if one exists.
Skip Proximity Setup (iOS 11.3 and later devices only) - Select this option to skip the proximity
setup pane in the iOS Setup Assistant.
Send Notification of wipe to registered user - Select (default) to allow an email / notification to be
automatically generated when a Wipe command is sent. The Send Notification of wipe to registereduser field is useful for users that have multiple devices. An email / notification will be automaticallygenerated when the Wipe command is sent and prevents confusion to device users who may thinkCore is wiping their current, active device De-select the check box to suppress notification when the
Wipe command is used.
NOTE: To customize the email notification, go to System Settings > Settings > Templates >Other. Select the template type Action on Device.

5. Click Wipe.
Related topics
Cancel Wipe

Cancel Wipe
Cancel Wipe attempts to cancel or reverse a wipe command for one or more devices. The ability to cancel a device
wipe action helps you avoid mistakes that can be difficult and costly to fix.
A device wipe action does not take effect until the device checks in with MobileIron Core. Using Cancel Wipe, you
may be able to stop or reverse the wipe action.
Cancel Wipe is supported for iOS devices with the status of Wipe pending, Wiped.
A successful Cancel Wipe action sets the device state to Active.
NOTE: This feature is only supported on macOS devices with FileVault 2 enabled.
Procedure
1. In the Admin Portal, go to Device & Users > Devices.
2. Check the status of the devices for which you need to cancel the device wipe.
3. Select the devices you do not want to wipe that have status Wipe pending or Wiped.
4. Click Actions > Cancel Wipe.
5. In the Cancel Wipe dialog box, select the Send Notification of wipe to registered user check box. The
Send Notification of wipe to registered user field is useful for users that have multiple devices. An email /MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 193

Selective Wipe

notification will be automatically generated when the Cancel Wipe command is sent and prevents
confusion to device users who may think Core is wiping their current, active device. De-select the checkbox to suppress notification when the Cancel Wipe command is used.
NOTE: To customize the email notification, go to System Settings > Settings > Templates >Other. Select the template type Action on Device.
6. Click Cancel Wipe.
The Cancel Wipe action sets the device state to Active.
If an iOS device is wiped before the Cancel Wipe action can stop it, you can restore the device contentsfrom the most recent device backup.
If the device backup includes the MDM profile, the device is able to check in with MobileIron Core andreceive updates
NOTE: If you attempt to restore an iOS device without using Cancel Wipe, the device will be
wiped again when it checks in with MobileIron Core.
Related topics
Wipe

Selective Wipe
The Selective Wipe command is no longer supported, however, the functionality is available using the following
methods:ll

Selective wipe of email is accomplished through security compliance actions, removing the device fromthe associated label, or retiring the device.
Using MobileIron Sentry and ActiveSync

Block AppTunnels
NOTE: This feature is not supported on Mac OS devices.
You can manually block the AppTunnel feature (standard and Advanced) in AppConnect apps on a device. The
authorized AppConnect apps remain authorized, but the apps will no longer be able to access the web sites
configured to use the AppTunnel feature.
To manually block the AppTunnel feature in AppConnect apps on a device:
1. Go to Device & Users > Devices.
2. Select the check box for the device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 194

Lost

3. Select Actions > Block App Tunnels from the Actions menu to open the Block AppTunnels dialog.
4. Add a note and click Block AppTunnels.

Lost
When a user reports a lost device, you can set its status to Lost. Setting this status does not have a functional
effect on the phone. It just flags the phone as lost for tracking purposes and to ensure that it appears in the Lost
Phones screen.
This feature is supported on macOS devices.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Select Actions > Lost from the Actions menu.
4. In the displayed dialog, confirm the user and device information and enter a note.
5. Click Lost.
The entry for this device will appear with a status of “Lost.” Use the Found action to undo this status. See
Found

Found
If a user reports that a lost phone has been found, you can use the Found action to remove the Lost indicator fromthe entry for the phone. Setting this status does not have a functional effect on the phone.
This feature is supported on macOS devices.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Select Actions > Found from the Actions menu.
4. In the displayed dialog, confirm the user and device information and enter a note.
5. Click Found to return the entry for this device to Active status.

LocateiOS devices use cell towers to locate the device. This feature is not supported on Mac OS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 195

Reset device PIN

Most registered phones can be located on a map using cell tower IDs. When locating a device via cell tower IDs,
Mobile@Work records tower data until the next time data is synchronized between Mobile@Work and MobileIron
Core. See “Sync policies” in Getting Started with MobileIron Core for information on changing the Sync Interval
setting. Using the Force Device Check-in in the Admin Portal or in Mobile@Work will result in immediatesynchronization.
Required role
The Privacy Control: Locate device role is required to use this feature.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Click Actions > Actions > Locate.
4. Click the phone icon on the map to display the date and time stamp of the last known location of the phone.

Reset device PIN
NOTE: This feature is not supported on macOS iOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 196

Force Device Check-In

Force Device Check-In
You can use the Force Device Check-in feature to force the device to connect to the MobileIron Core. You might
use this feature if Mobile@Work has not connected for some time, or you want to override a long sync interval todownload updates.
You can use this feature to troubleshoot MobileIron operations.
NOTE: The Force Device Check-in feature on the Admin Portal does not sync the policies and settings
related to AppConnect. The app check-in interval on the AppConnect global policy controls
updates to those policies and settings. See the MobileIron Core AppConnect and AppTunnel
Guide for MobileIron Core. However, in the Mobile@Work for iOS app on the device, the Checkfor Updates option does sync the policies and settings related to AppConnect.
This feature is supported on macOS devices.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Click Actions > Force Device Check-in.
4. The Force Device Check-In dialog appears.
In the dialog, confirm the user and device information and enter a note.
5. Click Force Device Check-in.

Managing devices in Apple MDM lost mode
You can place a supervised device in MDM lost mode through MobileIron Core. This means you report the device
as lost to Apple servers, allowing you to retrieve the last recorded location of the device, as well as disable lostmode if the device is found.
MobileIron Core allows you to carry out the following MDM lost mode tasks:lEnable MDM lost modelDisable MDM lost modelRequest the MDM server to locate a device

Note The Following:l

MDM lost mode and all related features are supported on supervised devices only running iOS 9.3 throughthe most recently released version as supported by MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 197

Enable MDM lost modell

MobileIron recommends using the MDM lost mode features on devices with working SIM cards andcellular connections. Before enabling MDM lost mode, note for future reference the iCloud login used on
the device.
MDM lost mode is different from MobileIron Core lost mode, as described in Lost.

Enable MDM lost mode
You can report a lost device to Apple servers by placing the device in MDM lost mode.
After you have placed a device in lost mode:l

If the device is retired, you cannot disable lost mode.

l

If the device is wiped, you cannot locate or track the device.

To enable MDM lost mode:
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Select Actions > iOS Only > Lost Mode.
4. In the Lost Mode window, enter the following:
Item

Description

Enable Lost Mode

Select to place the iOS device in MDM lost mode.

Message to display on lockscreenOptionally enter a message to be displayed on the locked
screen of the lost device.

Contact number to display onlock screen:

Optionally enter a contact number to be displayed on thelocked screen of the lost device. If someone finds the device,
they can call the number to report it.

Footnote (Message to display inplace of “Slide to Unlock”):

Optionally enter the text you would like to appear at thebottom of the locked screen. .

Play Lost Mode Sound

Select this option to play a sound on a device when thedevice is in lost mode. The sound plays until you disable lostmode or a user disables the sound at the device.
This option is available only for supervised devices running
iOS 10.3 through the most recently released version as
supported by MobileIron.

5. Click SendRequest.
The lost mode message, contact number, and footnote are shown on the lost device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 198

Disable MDM lost mode

Disable MDM lost mode
If a device in MDM lost mode is retrieved, or MDM lost mode was enabled in error, you can disable MDM lostmode.
NOTE: If the lost device is retired from MobileIron Core, disabling MDM lost mode will not work.
To disable MDM lost mode:
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Select Actions > iOS Only > Lost Mode.

Request the MDM server to locate a device
You can determine the last recorded location of a given supervised device using the Request Device Location
feature. The device location request is sent to Apple, but MobileIron Core shows the last recorded location and timestamp before receiving a response from Apple. It may take some time for Apple servers to respond to Core. Toview the latest device location response from Apple, execute the device location request again.
NOTE: If the device is wiped, you will not be able to locate the device.
To request the location of a device:
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Select Actions > iOS Only > Request Device Location.
4. In the window that opens, click Map It to view the last recorded device location.

Setting up background check-ins with APNs
Background check-ins allow MobileIron Core to communicate with devices in the background throughMobile@Work. To do this, Core wakes up Mobile@Work by sending a silent Apple Push Notification service(APNs) message to Mobile@Work by way of the APNs server. Core uses background check-ins to provide
accurate jailbreak detection or policy updates without relying on device location changes, for example. As opposed
to relying on location changes, using APNs for background check-ins uses less device battery power while using
more predictable update intervals.
The sync interval defined in the sync policy applied to a device determines how often MobileIron Core sends acheck-in notification for iOS devices.
Procedure

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 199

Managed iBooks

1. Go to Policies & Configs > Policies.
2. Select the sync policy name.
3. Click Edit. The Modify Sync Policy dialog box opens.
4. Set the Sync Interval to the preferred number of minutes. The default interval is 240 minutes. If you wantto make more frequent checks for certain policy changes or jailbreak indicators, decrease the value. Morefrequent checks will have a greater effect on device battery life.
5. Click Save.

Managed iBooks
This feature is not supported on macOS devices.
The iBooks feature allows you to distribute iBooks, Kindle books (ePub), and PDF files to iOS devices managed byCore. You can also edit and delete managed books, and search for particular managed books.
Managing iBooks on iOS devices includes the following:l

BenefitslImpactsl

Distributing managed books to iOS deviceslConfirming receipt of managed bookslEditing managed bookslSearching for managed bookslRemoving managed books from a subset of deviceslDeleting managed bookslViewing the list of managed books on the device

Benefits
The iBooks feature allows administrators to distribute useful material to device users, such as end-user guides forapps or marketing collateral. Administrators can also edit and delete managed books.

Impacts
Distributing iBooks to iOS devices involves adding the book file to MobileIron Core and applying the relevantlabels.
MobileIron Core distributes managed books to the iOS devices with the relevant labels applied. Managed iBooks
are displayed in the iBooks app on iOS devices. The managed device profile includes a list of managed iBooks
associated with that profile.
Note The Following:
MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 200

Distributing managed books to iOS devicesllRemoving a device from management also removes the managed books from that device.
After a book has been opened on a device, the book title reflects the title in the book’s metadata,
regardless of the title entered for the book in MobileIron Core. To avoid confusion, be sure to use the title
shown in the metadata of a given book when entering the title in the Admin Portal. This behavior is due toApple’s implementation of iBooks.

Distributing managed books to iOS devices
Distributing managed books to iOS devices is a two step process: add the book to MobileIron Core, then apply therelevant labels such that MobileIron Core sends the book to the relevant devices. You can add ePub, iBook, and
PDF files to the list of managed books.
To distribute iBooks to iOS devices:
1. In the Admin Portal, go to Apps > iBooks.
2. In the Add Content window, enter the URL of the iBook, PDF, or ePub file you want to distribute to iOS
devices. Alternatively, click Browse to select the file from the file system.

3. Use the following table as a guide for filling in the form.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 201

Confirming receipt of managed books

FieldsDescription

Document Type•

Select URL to obtain the file from the web.

Or:
• Select File to browse for and upload a file.
File/URL

Required. The file extension must match the selected file format. For
example, if you are uploading an ePub file, you must select ePub as the fileformat.
• If you selected File for the document type, click Browse to select the file
you want to upload to MobileIron Core.
• If you selected URL for the document type, enter the URL of the file youwant to upload to MobileIron Core.

Title

Enter the title of the iBook, ePub, or PDF. Required.

AuthorEnter the name of the author in the space provided. Optional.

File Format

Select ePub, iBooks, or PDF for the file format. Required.
The file extension is automatically selected to match the format of the file. For
example, if you are uploading an ePub file, then ePub is automaticallyselected as the file format.

4. Click Save.
The book is added to the managed iBooks on MobileIron Core.
5. In the iBooks window, select the managed book you just created.
6. Go to Actions > Apply to Label.
7. Select the relevant labels.
8. Click Apply.
MobileIron Core distributes the books to the relevant devices during the next sync, as defined by your sync
policy.
9. To confirm receipt of the managed book, see Confirming receipt of managed books.

Confirming receipt of managed books
You can confirm that MobileIron Core has sent a given book to the relevant iOS devices, as described inDistributing managed books to iOS devices.
To confirm distribution of managed books:
1. In the Admin Portal, go to Apps > iBooks.
2. Locate the managed book whose distribution you want to confirm.
3. Examine the Devices Installed column for the book.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 202

Editing managed books

A number greater than zero indicates that the book has been distributed, assuming the label you applied
includes one or more devices.
4. Click the number in the Devices Installed column to see a list of devices to which the book has been sent.

Editing managed books
NOTE: If you edit the name of a managed book, device users may still see the old book name.
Procedure
1. In the Admin Portal, go to Apps > iBooks.
2. Select the managed book you want to edit.
3. Go to Actions > Edit.
4. Edit as desired.
NOTE: If you clear the existing file and browse for a different file, make sure the new file is of thesame type as the old file. For example, you can only replace an ePub file with another
ePub file. You cannot change the file type of the managed book.
5. Click Save.
The edited book is updated on devices at the next sync.

Searching for managed books
You can search for a particular book in the list of managed books.
Procedure
1. In the Admin Portal, go to Apps > iBooks.
2. In the Filters pane on the left, enter the search criteria you want to use.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 203

Removing managed books from a subset of devices

3. Use the following criteria for your search:lbook titlelauthorlfile nameldate added to MobileIron Core (or date range)

4. Click Search.
5. After examining the search results, click Reset to remove the search filters and show all managed books.

Removing managed books from a subset of devices
You can remove managed books from particular devices while still keeping the books in the catalog of managed
books on MobileIron Core. This is done by removing the books from the label or labels to which they are applied.
NOTE: If you remove a label from a device, all managed books associated with that label are removed
from the device.
Procedure
1. In the Admin Portal, go to Apps > iBooks.
2. Select the managed book you want to remove from users’ devices.
3. Go to Actions > Remove from label.
4. Select the labels you want to remove from the book.
5. Click Remove.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 204

Deleting managed books

Deleting managed books
You can delete a managed book from the catalog of managed books on MobileIron Core. Doing so deletes the
managed book from the relevant devices.
NOTE: Device users cannot effectively delete managed books from their devices. If they do, MobileIron
Core simply sends the deleted books back to the devices.
Procedure
1. In the Admin Portal, go to Apps > iBooks.
2. Select the managed book you want to delete from the catalog of managed books on Core.
3. Go to Actions > Delete.
4. When a prompt displays asking if you want to delete the book, click Yes.
The book is deleted from both the catalog of managed books and relevant user devices.

Viewing the list of managed books on the device
For troubleshooting purposes, administrators and technical support can direct users to view the complete list of
managed books on the device. This list is separate from the book list in iBooks, as it includes only those managed
books associated with the MobileIron device management profile.
Procedure
1. On the device, go to Settings > General > Device Management.
2. Tap the MobileIron device management profile.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 205

Viewing the list of managed books on the device

3. Tap Books to view the list of managed book titles.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 206

Viewing the list of managed books on the device

4. Tap a managed book to view the restrictions applied to it.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 207

Personal hotspot on/off switch

Personal hotspot on/off switch
This feature is not supported on macOS devices.
MobileIron Core enables you to turn personal hotspots on or off for iOS devices. While you can turn the personal
hotspot on or off, device users can turn their personal hotspots back on or off again.
Overage fees for personal hotspots can be expensive for your organization, particularly when employees use theirdevices while traveling abroad. Turning off personal hotspots on iOS devices can help your organization reduce thecost of your employees’ mobile data plans.
Turning the personal hotspot on or off for iOS devices involves simply changing the hotspot setting in the list ofdevices under Devices & Users > Devices. This sends an MDM command to devices requesting the personal
hotspot to be switched on or off. The command is queued from MobileIron Core, and executes on the device at thediscretion of iOS. Device users can see if their personal hotspot has been switched on or off by going to Settings >Personal Hotspot on their devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 208

Turning the personal hotspot on or off on iOS devices

Before you begin
Make sure you have selected the View dashboard, device page, device details line item under the device
management role.
Procedure
1. In MobileIron Core, go to Admin > Admins.
2. Select the administrator who will be managing personal hotspot settings.
3. Go to Actions > Edit roles.
4. Select View dashboard, device page, device details.

5. Click Save.

Turning the personal hotspot on or off on iOS devices
NOTE: If a device user enables their personal hotspot at the same time that the MobileIron Coreadministrator is disabling their personal hotspot through Core, then the device user’s setting
takes precedence over the command sent by the administrator. This is standard iOS behavior.
Procedure
1. In MobileIron Core, go to Devices & Users > Devices.
2. Select the device or devices whose personal hotspot settings you want to turn on or off.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 209Turning the personal hotspot on or off on iOS devices

3. Go to Actions > iOS Only > Update Personal Hotspot Setting.

4. Use the following table as a guide for filling in the form:
Item

Description

Enable Personal Hotspot

Select to turn on the personal hotspot feature on the device or
devices.

Disable Personal Hotspot

Select to turn off the personal hotspot feature on the device or
devices.

Note

Optionally, add a note regarding this setting.

5. Click Update to save your changes.
6. On the Devices page, select the device or devices for which you switched on or off the personal hotspot.
7. To verify that the command worked, go to Actions > Force Device Check-In.
8. Check if the personal hotspot has been turned on or off for a given device, as described in Checking if thepersonal hotspot is turned on or off for a given device.
NOTE: While you can turn the personal hotspot on or off for a given device or set of devices,
device users can still change the setting for the personal hotspot even after you send thecommand. If you have turned off a device’s personal hotspot, it is possible for the deviceuser to turn it back on again immediately after.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 210

Checking if the personal hotspot is turned on or off for a given device

Checking if the personal hotspot is turned on or off for a given device
You can check whether the personal hotspot was turned on or off for a given device as of the latest device checkin.
Procedure
1. In MobileIron Core, go to Devices & Users > Devices.
2. Click the caret symbol (^) next to the device whose settings you want to check.
3. The Device Details tab is displayed.

4. Scroll down and find Personal Hotspot Enabled.
ll

If the value of Personal Hotspot Enabled is false, the hotspot was turned off as of the most recent
device check-in.
If the value of Personal Hotspot Enabled is true, the personal hotspot was turned on as of the mostrecent device check-in.

Reinstalling system apps on iOS devices
You can reinstall system apps on iOS devices when they have been deleted by the user. This action is useful
because most system apps are not available in the Apple App Store for users to reinstall themselves.
This feature is supported on iOS 11.3 through the most recently released version as supported by MobileIron.
When you select a system app to reinstall:l

If the system app is not on the device, the latest version is installed.

l

If an older version of the app is on the device, the app is upgraded.

l

If the same version of the app is on the device, the app is not reinstalled.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 211

Manually setting the wallpaper for iOS devices

Procedure
1. In MobileIron Core, go to Devices & Users > Devices.
2. Select the device or devices for which you want to reinstall deleted system apps.
3. Go to Actions > iOS Only > Reinstall iOS System Apps.
The Reinstall iOS System Apps window is displayed.
4. Select the system apps that you want to reinstall.
5. If you want to use different images for the home and locked screens:
6. Click Reinstall Apps.
The apps will be reinstalled when each device next checks in.

Manually setting the wallpaper for iOS devices
You can set the wallpaper of the home and locked screens of supervised iOS devices to images of your choice.
You can perform this manual action at any time on devices that are already registered. You can choose the sameimage or different images for the home screen and locked screen.
This feature is useful in a kiosk setting, or shared device environment in a retail setting.
Note The Following:lll

To set the wallpaper automatically when a device registers, use the wallpaper policy.
Before choosing an image file, browse the Apple website for the latest recommended image resolution by
device type and screen size.
The file must be either a PNG or JPG file.

Procedure
1. In MobileIron Core, go to Devices & Users > Devices.
2. Select the device or devices whose wallpaper you wish to set.
3. Go to Actions > iOS Only > Set Wallpaper.
The Set Wallpaper window is displayed.
4. If you want to use the same image for both home and locked screens:lSelect Use same image for Home Screen and Lock Screen.

lClick Choose File to select an image file.

5. If you want to use different images for the home and locked screens:lUnder the Home Screen section, click Choose File to select an image file.

l

Under the Lock Screen section, click Choose File to select an image file.

6. Click Send Request.
MobileIron Core sends the wallpaper request to the selected devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 212

Adding fonts to iOS devices

Related topics
Wallpaper policies

Adding fonts to iOS devices
You can push a font to managed iOS devices by defining a configuration and applying it to the relevant labels. The
font configuration is sent to devices upon the next sync with Core.
After the new font arrives, device users will be able to select the font if they wish. You can create additional fontconfigurations to push more fonts to devices. Each configuration includes one font.
Note The Following:ll

Font configurations are not encrypted.
Large font files can have unpredictable performance impact on MobileIron Core. The performance impact isdue to Core requiring multiple device check-ins to apply the font to all devices. The performance impact
depends on the size of the font file and on the number of devices impacted. To avoid performance impact,
manage your labels to limit the number of devices impacted by a configuration with a large font file.

Procedure
1. In the Admin Portal, select Policies & Configs > Configurations.
2. Select Add New > Apple > iOS / tvOS > Fonts. The New Fonts Configuration dialog box opens.
3. Enter your specifications using the table below as guidance.
Item

Description

Name

Enter a name for the font configuration.

Description

Enter a description for the font configuration.

Upload Fonts

Click Browse and select your .ttf or .otf font file. The maximum file size fora font file is 40MB.

4. Click Save.
5. Select the font configuration.
6. Click Actions > Apply to Label, and select the labels to which you want to apply the font.
7. Click Save.

Updating the OS on supervised iOS devices
You can use MobileIron Core to update the operating system on supervised iOS devices running iOS 10.3 throughthe most recently released version of iOS as supported by MobileIron. Devices do not need to be unlocked for the
OS update to succeed.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 213

Updating the OS on multiple supervised iOS devices

NOTE: In the case of devices running up to iOS 10.2.1, you can successfully execute the Update OS
Software command only if the devices are both supervised and managed by the Apple School
Manager or the Apple Business Manager.
MobileIron Core presents different update options depending on whether you select only one supervised iOS
device or multiple supervised iOS devices.

Updating the OS on multiple supervised iOS devices
Before you begin
Be sure you have configured your iOS software update policy. See Configuring iOS and macOS software updates.
Procedure
1. Go to Devices & Users> Devices.
2. Select the devices whose operating system you wish to update.
3. Select Actions > iOS and macOS > Update OS Software.
A confirmation dialog box opens.
4. Click Confirm.
MobileIron Core sends the OS update command to devices. Core shows the status of the command in theUpdate OS Software window.
5. Click OK.

Updating the OS on a single supervised iOS devices
Procedure
1. Go to Devices & Users > Devices.
2. Select the one device whose operating system you wish to update.
3. Select Actions > iOS and macOS > Update OS Software.
The Update OS Software dialog box opens.
4. Select one of the following:lUpdate to the latest iOS Version availableoSelect this option to update the device with the latest iOS version that the device supports.

oClick Confirm.

lScan for updates and choose the version based on available iOS versionsoClick Continue.

o

The Update OS Software window displays, showing the possible iOS versions to update the device
to if a scan had already been done. If no scan had been done, or if you want an up-to-date scan, click
Scan for Updates. Because a scan can take a long time, you can close the window, and return to it
later to see the results and the date of the scan.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 214

What the device user sees during software upgradeo

The Update OS Software window displays, showing the possible iOS versions to update the device
to if a scan had already been done. If no scan had been done, or if you want an up-to-date scan, click
Scan for Updates. Because a scan can take a long time, you can close the window, and return to it
later to see the results and the date of the scan.

oSelect the iOS version you want.

oClick Confirm.
This option is useful if you have used the iOS restriction setting to delay iOS updates. For example,
consider the scenario in which you delayed iOS updates to confirm that iOS 11.4 meets your needs.
While running your tests, iOS 11.4.1 and iOS 12 release. This option allows you to make sure thedevice updates only to iOS 11.4.

lUpdate with the specific iOS Product VersionoEnter the iOS version number, such as 11.4.1 for example, that you want to update the device to.

oClick Confirm.

What the device user sees during software upgrade
After a new iOS is released, the iOS device checks and becomes aware that a new version of iOS software isavailable. If the device is locked with a passcode, the next time the device is unlocked, the device is able to begin
to download the new iOS in the background without device user notification. After the download, on the Software
Update screen, there is an indication that new version of iOS has been downloaded and the device user has theoption to “Install Now”. If the device user taps "Later", the Software Update will keep requesting to install the
update. After 3-4 attempts to install the new iOS software upgrade, no more deferring of the software update will beallowed. The user is required to input their passcode and that passcode is saved and used to update the device.
Related topics
Configuring iOS and macOS software updates
iOS / tvOS settings

Restarting or shutting down supervised iOS devices
You can use MobileIron Core to restart or shut down supervised iOS devices running iOS 10.3 through the mostrecently released version of iOS as supported by MobileIron. If you attempt to restart or shutdown a device runningprior iOS versions, Core displays an error message.
Procedure
1. Go to Devices & Users.
2. Select the devices which you want to restart or shutdown.
3. Select Actions > iOS Only > Restart/Shutdown Devices.
A confirmation window displays. By default, the device passcode is cleared on restart or shutdown.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 215

Reporting on managed devices

4. (Optional) Clear the device passcode on restart or shutdown.
If the passcode is not cleared, the device will require a passcode and will not be connected to Wi-Fi after itis restarted.
5. Click Send Request.
MobileIron Core sends the iOS restart or shutdown command to devices.
6. Click OK.

Reporting on managed devices
MobileIron provides a Web Services API that enables you to create reports for many aspects of your managed
devices. See the MobileIron API documentation for information. You can create reports in the following ways:l

Exporting records to CSVlUsing APIs for reportingl

For details, refer to the Feature Usage and Get Last Sync Time and State of ActiveSync Devices
sections in the MobileIron Core v2 API Guide.

This feature is supported on macOS devices.

Exporting records to CSV
The enhanced Export to CSV feature provides access to numerous additional device attributes that werepreviously unavailable. The attributes are organized into platform-specific groups to make it easy to report on therelevant attributes for the devices you’re working with.
Procedure
1. In the Admin Portal, go to Device & Users > Devices.
2. Use the Advanced Search feature or select a label to filter the devices you are interested in. All of thedevices in the table will appear in the exported file.
3. Click Export to CSV to open the Export CSV Spreadsheet dialog.
4. Select the information to export. The exported fields for each selection are listed below.
5. Click Export. to export the DeviceSearchResult.csv file is to your computer.

Export to CSV Field Options
Below describes what is contained inside a .CSV file.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 216

Export to CSV Field Options

TABLE 15. EXPORT TO CSV FIELD OPTIONS
TypeSupported Variables

Registration SMS (Phones)$REG_LINK$

Registration Email
Subject (Phones)$ENT_NAME$, $USER$, $PHONE$

Subject (PDAs)$ENT_NAME$, $USER$, $PHONE$

Body (Phones)$ENT_NAME$, $BRAND_COMPANY_NAME$, $PHONE$,$INAPP_REG_STEPS$, $REG_LINK

Body (PDAs)$ENT_NAME$, $BRAND_COMPANY_NAME$, $PHONE$,$INAPP_REG_STEPS$, $REG_LINK$

Reminder Subject (Phones)$ENT_NAME$, $USER$, $PHONE$

Reminder Subject (PDAs)$ENT_NAME$, $USER$, $PHONE$

Reminder Body (Phones)$ENT_NAME$, $BRAND_COMPANY_NAME$, $PHONE$,$INAPP_REG_STEPS$, $REG_LINK$

Reminder Body (PDAs)$ENT_NAME$, $BRAND_COMPANY_NAME$, $PHONE$,$INAPP_REG_STEPS$, $REG_LINK$$INAPP_REG_STEPS$
Server$SERVER_URL$

Username$USER_ID$

Password$PASSCODE$, $PASSCODE_TTL$

Post Registration Email
Subject (Phones)$BRAND_COMPANY_NAME$, $USER$, $PHONE$

Subject (PDAs)$BRAND_COMPANY_NAME$, $USER$, $PHONE$

Body (Phones)$BRAND_COMPANY_NAME$, $PHONE$

Body (PDAs)$BRAND_COMPANY_NAME$, $PHONE$

Include Only Basic Device
Information

User ID, Device UUID, Current Country Name, Current Operator
Name, Current Phone Number, Device Owner, Display Name, Email
Address, Home Country Name, Language, Last Check-In,
Manufacturer, Model, Passcode, Passcode Expiration Time, Platform
Name, Registration Date, Status

Include all device data, including
the following options below.

(Select one or more options below)

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 217

Export to CSV Field Options

TABLE 15. EXPORT TO CSV FIELD OPTIONS (CONT.)Type

Supported Variables

User Attributes

User ID, Device UUID, account_disabled, Attribute DistinguishedName, custom1, custom2, custom3, custom4, Display Name, Email
Address, First Name, Last Admin Portal Login Time, Last Name,
LDAP Group Distinguished Name, LDAP User Distinguished Name,
LDAP User Locale, locked_out, memberOf, Name, password_expired,Principal, sam_account_name, upn, User UUIDNOTE: If defined in LDAP settings, custom attributes appear
here also.

Common Device Attributes

User ID, Device UUID, APNS Capable, Background Status, Battery
Level, Block Reason, Blocked, Cellular Technology, Client Build Date,
Client Id, Client Last Check-in, Client Name, Client Version,
Comment, Compliant, Creation Date, Current Country Code, Current
Country Name, Current Operator Name, Current Phone Number,
Device Admin Enabled, Device Encrypted, Device Is Compromised,
Device Locale, Device Owner, Device Space, Display Size, EAS Last
Sync Time, Ethernet MAC, Home Country Code, Home Country
Name, Home Operator Name, Home Phone Number, IMEI, IMSI, IP
Address, Language, Last Check-In, Manufacturer, MDM Managed,
Memory Capacity, Memory Free, Model, Model Name, Modified Date,
Non-compliance Reason, OS Version, Passcode, Passcode
Expiration Time, Platform, Platform Name, Processor Architecture,
Quarantined, Quarantined Reason, Registration Date, Registration
IMSI, Registration UUID, Retired, Roaming, SD Card Encrypted,
Security State, Serial Number, Status, Storage Capacity, Storage
Free, Terms of Service Accepted, Terms of Service Accepted Date,
Wi-Fi MAC

iOS Attributes

User ID, Device UUID, Activation Lock Bypass Code, Activation Lock
is Enabled, APNS Token, Apple Device Mac Address, Apple Device
Version, Bluetooth MAC, Build Version, Carrier Settings Version,
Current Mobile Country Code, Current Mobile Network Code, Data
Protection, Data Roaming Enabled, DEP Device, DEP Enrolled,
Device Locator Service Is Enabled, Device Name, Do Not Disturb Is In
Effect, Force Encrypted Backup, Full Disk Encryption Enabled, Full
Disk Encryption Has Institutional Recovery Key, Full Disk Encryption
Has Personal Recovery Key, Hardware Encryption Caps, iCloud
Backup Is Enabled, iOS Background Status, iPhone ICCID, iPhone
Mac Address, iPhone Product, iPhone UDID, iPhone User ID, iPhone
User Long Name, iPhone User Short Name, iPhone Version, IT Policy
Result, iTunes Store Account Hash, iTunes Store Account Is Active,
Languages, Last Acknowledged Lock PIN, Last Acknowledged Wipe
PIN, Last iCloud Backup Date, Locales, MacOS User ID, MacOS
User Long Name, MacOS User Short Name, Maximum Resident

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 218

Turning Bluetooth on and off on iOS and macOS devices

TABLE 15. EXPORT TO CSV FIELD OPTIONS (CONT.)Type

Supported Variables
Users, MDM Lost Mode Enabled, MDM Service Enrolled, Modem
Firmware Version, Network Tethered, Organization Info, OS Update
Status, Passcode Compliant, Passcode Compliant with Profiles,
Passcode Present, Personal Hotspot Enabled, Product Code, ProductName, Security Reason Code, Subscriber Carrier Network, Subscriber
MCC, Subscriber MNC, Supervised, UDID, Voice Roaming Enabled,
VPN IP Address, Wakeup Status

Turning Bluetooth on and off on iOS and macOS devices
MobileIron Core enables you to turn Bluetooth on or off for iOS and macOS devices. As this is a discrete action,rather than a restriction, administrators and users can turn Bluetooth back on or off after taking this action.
Turning Bluetooth on or off for iOS and macOS devices involves simply changing the Bluetooth setting in the list ofdevices under Devices & Users > Devices. This sends a command to devices, requesting Bluetooth to be
switched on or off. The command is queued from MobileIron Core, and executes on the device at the discretion of
iOS or macOS. Device users can see if their Bluetooth has been switched on or off by going to Settings >Bluetooth on their devices.
Before you begin
Make sure you have selected the View dashboard, device page, device details line item under the device
management role.
1. In MobileIron Core, go to Admin > Admins.
2. Select the administrator who will be managing personal hotspot settings.
3. Go to Actions > Edit roles.
4. Select View dashboard, device page, device details.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 219

Turning Bluetooth on and off on iOS and macOS devices

5. Click Save.
Procedure
1.
2.
3.
4.

In MobileIron Core, go to Devices & Users > Devices.
Select the device or devices whose Bluetooth you want to turn on or off.
Select Actions > iOS and macOS > Update Bluetooth Setting.
Use the following table as a guide for filling in the form:
Item

Description

Enable Bluetooth

Select to turn on Bluetooth for the device or devices.

Disable Bluetooth

Select to turn off Bluetooth for the device or devices.

Note

Optionally, add a note regarding this setting.

5. Click Update to save your changes.
6. On the Devices page, select the device or devices for which you switched Bluetooth on or off.
7. To issue the command immediately, select Actions > Force Device Check-In.
NOTE: While you can turn Bluetooth on or off for a given device or set of devices, device users can stillchange the Bluetooth setting on their device even after you send the command. If you haveturned off a device’s Bluetooth, it is possible for the device user to turn it back on again
immediately after.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 220

Updating OS components on a macOS device

Updating OS components on a macOS device
You can use MobileIron Core to update the operating system components on a macOS device running macOS
10.12.6 through the most recently released version of macOS as supported by MobileIron. This functionality isavailable only when you select a single macOS device.
Procedure
1. Go to Devices & Users.
2. Select the macOS device whose system components you wish to update.
3. Select Actions > iOS and macOS > Update OS Software.
The Update OS Software window is displayed. If a scan of the device had already been done, theavailable system component updates are displayed, along with the date the scan was done. Otherwise, noavailable updates are displayed.
4. Click Scan for Updates if you would like to scan the device for an up-to-date list of available systemcomponent updates.
MobileIron Core sends a request to the device to send Core the available system component updates.
When Core receives the response, it populates the display as described in the table below. Because ascan can take a long time, you can close the window, and return to it later to see the results and the date of
the scan.
Item

Description

Update Name

The name of the macOS component that can be
updated.

Version

The new version of the macOS component.

Size

The size in megabytes or gigabytes of the update.

Restart required

Whether applying this update requires a restart on thedevice.

Critical

Whether Apple considers the update critical.

Config Data

Whether the update impacts configuration data on thedevice.

Firmware

Whether the update impacts firmware on the device.

5. Select the components that you want to update on the device.
6. Click Confirm.
Core sends a request to the device to update the selected components.
NOTE: The device details for the selected device indicates update information in the fields
App OS Update Product Key, App OS Update Product Version, and Apple OS Update Status. To
see the device details, click the carat (^) next to the relevant device on Devices & Users >Devices.
MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 221

Setting the time zone of a device

Related topics
Configuring iOS and macOS software updates

Setting the time zone of a device
This feature is applicable to: iOS 14.0 and tvOS 14.0 devices through the latest version as supported by MobileIron
Core. This feature is applicable for supervised devices only and does not require Location Services.
l

The time zone device action is also displayed in the Device Details page of a device.

lTime zone changes made in the device will also reflect in the MobileIron Core server.
NOTE: This device action triggers an error if the Force automatic Date & Time restriction isenabled in iOS Restrictions configuration.

lAdministrators can search for a time zone. See Advanced searching.

Procedure
1. Go to Devices & Users > Devices.
2. Select one or more devices.
3. Click Actions > iOS Only > Set Time Zone for the selected device(s).
4. Enter the timezone string in the Olson Time Zone ID format, such as Pacific / Midway.
5. Click Set Time Zone.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 222

10Managing Custom Attributes
This section addresses all components relating to custom attributes.
lAssigning a custom attributes rolelAdding custom attributes to users and/or deviceslViewing custom attributes available for users and/or deviceslViewing custom attributes assigned to userslViewing custom attributes assigned to deviceslEditing custom attributes for users and/or deviceslSearching for custom attributes for users and/or devicesl

Exporting a log of the custom attributes for users and/or deviceslDeleting custom attributes from users and/or deviceslSetting custom attribute values for device or usersl

Pushing label attribute changes to devices and users

NOTE: The features described in this section are supported on macOS devices.

Assigning a custom attributes role
An administrator the assigned role of Manage custom attributes, can add, view, edit, search, or remove custom
user or device attributes. Custom attributes is a role for the global admin space.
Procedure
1. Log into the Admin Portal.
2. Go to Admin > Admins.
3. Select an administrator to assign the custom attributes role.
This role is for the Global admin space.
4. Select one of the following options for the selected administrator:lActions > Assign to Space > Global if the global space has not been assignedlActions > Edit Roles if the global space has been assigned

5. Scroll down to the Settings and Services Management section.
6. Click the Manage custom attributes option and click Save.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 223

Adding custom attributes to users and/or devices

Adding custom attributes to users and/or devices
You can add up to 300 custom attributes for users and 300 custom attributes for devices.
Procedure
1. Log into the Admin Portal.
2. Go to Settings > System Settings > Users & Devices > Custom Attributes.
3. In the Custom Device Attributes section, click Add+.
4. Enter the information for the custom attribute for devices, including:Field

Description

Attribute NameEnter a name for the custom attribute.
For Apple School Manager, use on the 1:1 (one-to-one) device usecase and label it, for example, “ManagedAppleId”. This name can bewhatever you choose, however, make note of it since you will selectthis custom attribute name when turning on Apple Education.

Attribute Description

Enter a meaningful description for the custom attribute.

Value Type

Select one of three value types: boolean, integer or string.
For Apple School Manager, use the string value type.

Variable Name

This field is read-only and displays the machine-generated name ofthe device that is used as a substitution variable in policies andconfigurations. For example, the substitution variable$USERNAME$ is replaced with the actual device username.

Actions

Click Save. The new custom device attribute is created and displaysin the table.

5. (Optional) For Apple School Manager, click Add+and create a new Custom Device Attribute for devicecarts, for example, DeviceCartName, and choose the string value type. Remember this custom attributename as you will need it when you turn on Apple Education in Core.
NOTE: When assigning values to these two custom attributes “ManagedAppleID” and“DeviceCartName”, do not assign the device to both values. A device can either be a
1:1 device or it can be a Shared iPad (multi-user). If a device is given both values, Core
will display an error on the Apple Education policy or configuration. If a device is assigned
to a device cart that is unknown or to a Managed Apple ID that is unknown, the device
details Education Role will display as "None." If the device is given a known Managed
Apple ID, but that ID is not assigned to any classes as either a teacher or a student, thedevice details will display the Apple Education Role as "None". If the device has a validManaged Apple ID and that Apple ID is assigned to at least one class as a teacher, theApple Education Role will be “Teacher”. If the device has a valid Managed Apple ID andthat Apple ID is not assigned to a class as a teacher and is assigned to the class as a
student, the Apple Education Role will be “Student”. If there is a value entered in the

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 224

Viewing custom attributes available for users and/or devices

custom attribute for “DeviceCartName”, the Apple Education Role will be “Student(multi-user)”.
6. In the Custom User Attributes section, click Add+.
7. Referring to the table above, enter the information for the custom user attributes.
8. Click Save. The new custom user attribute is created and displays in the table.
9. (Optional) Repeat the steps, as needed.
Next steps
Enabling Apple Education in Core

Viewing custom attributes available for users and/or devices
Procedure
1. Log into the Admin Portal.
2. Go to Settings > System Settings > Users & Devices > Custom Attributes.
3. View all available custom attributes for users and/or devices.
Search for the attribute, if necessary, to see all available attributes.

Viewing custom attributes assigned to users
Procedure
1. Log into the Admin Portal.
2. Go to Devices & Users > Users.
3. Locate a single user and expand the details.
4. Click the Custom Attributes tab.

Viewing custom attributes assigned to devices
Procedure
1. Log into the Admin Portal.
2. Go to Devices & Users > Devices.
3. Locate a single device and expand the details.
4. Click the Custom Attributes tab.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 225

Editing custom attributes for users and/or devices

Editing custom attributes for users and/or devices
Procedure
1. Log into the Admin Portal.
2. Go to Settings > System Settings > Users & Devices > Custom Attributes.
3. Locate the attribute you want to edit.
Search for the attribute, if necessary.
4. Click in the ATTRIBUTE DESCRIPTION field and modify the description.
This field has a 255 characters limit.
5. Click Save.

Searching for custom attributes for users and/or devices
Procedure
1. Log into the Admin Portal.
2. Go to Settings > System Settings > Users & Devices > Custom Attributes.
3. Enter the search criteria for the name or description.

Exporting a log of the custom attributes for users and/or
devices
Procedure
1. Log into the Admin Portal.
2. Go to Logs.
3. Scroll down the list of filters to Custom Attributes.
4. Click the number link of the custom attributes to display the complete list in the details pane.
5. Click Export to CSV to export all records to a single file.

Deleting custom attributes from users and/or devices
You can delete an attribute if it has only been assigned to a user or a device. An attempt to delete a custom
attribute assigned to a label will prompt an error message that provides a list of labels to which it has been
assigned.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 226

Setting custom attribute values for device or users

Procedure
1. Log into the Admin Portal.
2. Select Settings > System Settings > Users & Devices > Custom Attributes.
3. Locate the attribute you want to remove.
Search for the attribute, if necessary.
4. Click Delete.

Setting custom attribute values for device or users
Setting custom attribute values for device or user requires Edit custom device attribute values and Edit custom
user attribute values roles.
To set custom attributes for devices:
1. Log into Admin Portal.
2. Select Devices & Users > Devices.
3. Check the box next to one or more devices.
4. Click Actions > Set Custom Attributes.
5. Set the value for attributes and click Save.
You can also clear the value for an attribute by checking the Clear Value box and save.
To set custom attributes for users:
1. Log into Admin Portal.
2. Go to Devices & Users > Users.
3. Check the box next to one or more users.
4. Click Actions > Set Custom Attributes.
5. Set the value for attributes and click Save.
You can also clear the value for an attribute by checking the Clear Value box and save.
NOTE: If you choose a single device or user when setting attribute values, the current attributevalues are displayed. If you choose multiple devices or users, the current attribute values
are not displayed.

Applying custom attributes to labels
Applying custom attributes to labels, requires Label Management permissions.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 227

Pushing label attribute changes to devices and users

Procedure
1. Log into the Admin Portal.
2. Go to Devices & Users > Labels.
3. Click Add Label > Filter.
4. Locate the attribute using one of the following options:lSearch for it in the Field, Operator, or Value fields.

lExpand Field > Custom Attributes > Device Attributes.

lExpand Field > Custom Attributes > User Attributes.

For more information about field definitions, see Device field definitions.
5. Complete the criteria.
6. Click Save.

Pushing label attribute changes to devices and users
Changing attribute values for a user or device label does not trigger an automatic update. If you have changed theattribute values for a label, by default, changes will take effect:l

For devices: the next time the device checks inl

For users: the next scheduled LDAP sync

If you want the changes to go into effect immediately, take the following action:ll

For devices: force a device check-in. See Force Device Check-In.
For users: force an LDAP sync. See "Synchronizing with the LDAP server" in Getting Started with
MobileIron Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 228

11Managing Policies
MobileIron Core uses policies to regulate the behavior of the devices it manages. Each policy consists of a set ofrules. You can create multiple policies for each policy type, but only one active policy of each type can be applied toa specific device.
Refer to Getting Started with MobileIron Core for information on the most commonly used policy topics, such as:lDefault policieslSecurity policieslPrivacy policieslLockdown policieslSync policies

The topics in this chapter include the following advanced topics:lWorking with default policieslImporting and exporting policieslViewing policy status and platform supportlEnabling profile encryptionlEnabling or disabling encryption on a macOS devicel

Storing and retrieving FileVault personal recovery keys in Core (macOS)l

Configuring iOS and macOS software updateslConfiguring notification settingslConfiguring a system policy managed settinglConfiguring a system policy control settinglConfiguring a system policy rulelManaging the activation lock for iOS deviceslWhitelisting Wi-Fi networkslConfiguring firewall settings for macOS deviceslSync policies and battery uselWork Schedule policylCountry changes and alertsl

iOS location-based wakeups interval and syncing with CorelSingle-app mode policies

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 229

Working with default policieslConfiguring a global HTTP proxy policylCellular policieslWallpaper policieslDevice name policieslCustomizing a home screen layoutlCustomizing a lock screen messagelNotifications of changes to the privacy policylExporting the devices in the WatchList

Related topics
For information on MobileIron Threat Defense, including the MTD Local Actions policy, see the MobileIron Threat
Defense Solution Guide for Core.

Working with default policies
NOTE: The features described in this section are supported on macOS devices.
Default policies are the policies applied to a device automatically when it is registered. Default policy values arealso used as a starting point when you create a custom policy. MobileIron provides the values for each default
policy specification. It is recommended that you create your own policies. You can use the settings in the default
policies as a starting point. If you do edit a default policy’s values (not recommended), those new values become
the starting point when you create a new custom policy.
Unlike configurations, a device can have only one policy of each type.
MobileIron Core provides defaults for the following policy types:lSecurity (Refer to Getting Started with MobileIron Core for details.)lPrivacy (Refer to Getting Started with MobileIron Core for details.)lLockdown (Refer to Getting Started with MobileIron Core for details.)lSync (Refer to Getting Started with MobileIron Core for details.)lActiveSync (See “Working with ActiveSync policies” in the .)l

AppConnect global policy (Refer to the MobileIron Core AppConnect and AppTunnel Guide for MobileIron
Core.)

NOTE: You cannot delete default policies.
The default settings for each policy type are listed in the section for each type.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 230

Prompting users to change the password

Prompting users to change the password
You can configure the default security policy to force users to change their passwords when a device is discovered
to be non-compliant.
NOTE: Consider notifying users of the new specifications before making changes to the policy.
ProcedureThis procedure applies to macOS 10.13 or later.
1. In the Admin portal, go to Policies & Configs > Policies > Add New > Security or modify the default
security policy.
The New Security Policy dialog box opens.
2. Enter the Name of the policy.
3. In the Priority field:
a. for mandatory password changes, select Lower Than and choose Security Policy Omega (1) fromthe drop-down.
b. for optional password changes, select Lower Than and choose Security Policy Sigma (45) from thedrop-down.
4. In the Password field, chose Mandatory or Optional.
a. Select Mandatory.
l

Select the Enforce Password Rule at Next Login check box.

b. Select Optionall

Select the Enforce Password Rule at Next Login check box.

lSelect User Channel if you want all device users to change their password.

lSelect Device Channel if you want all users to change their password, including the admin user.

NOTE: For iOS devices, if a security policy is edited and the Password field is set to Optional,
then the security policy will not be pushed to devices. This results in an inaccurate
count in your WatchList on the Policies & Configurations > Policies page. MobileIron
recommends you have the Password field set to Mandatory.
5. Click Save.
6. If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click
Confirm. For more information, see Best practices: label management.
Upon the next time a macOS device user logs in, the user is prompted to change the password.
NOTE: When creating a new security policy and you have either user channel or device channel
chosen, you must apply a label to the policy in order for the security policy to be pushed to user
devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 231

Importing and exporting policies

Importing and exporting policies
NOTE: The features described in this section are supported on macOS devices.
You can import and export policies from one deployment of MobileIron Core to another. Topics in this section
include:lExporting policies or configurationslImporting policies or configurations

NOTE: This feature is supported when importing or exporting policies or configurations between Coreinstances that are running the same version.

Exporting policies or configurations
Exporting policies and configurations help reduce errors when you have multiple instances of MobileIron. You canexport a configuration .json file for an existing policy, modify it, then import it to another policy. The export/importfeatures allow you to do this.
Procedure
1. Select Policies & Configs > Policies or Policies & Configs > Configurations.
All available policies are listed in the policies table.
All available configurations are listed in the configurations table.
2. Select a single policy or configuration to export.
You can sort, as necessary, to find the one you want to export.
3. Click Export to create an export .json file.
No application-related information is captured when exporting a policy or configuration.
4. Enter an export password and confirm it in the two password fields.
This password encrypts sensitive configuration data during export (including passwords and certificates).
The same password is required to import the exported data to another MobileIron Core server.
5. Check Remember password for this session if you want to re-use the password during a session.
A session is defined as the length of a single login. The session ends when you log out or when you havebeen logged out by the system.
6. Locate the .json file, open, modify, and save it, as necessary.
NOTE: Review this file before reusing it as values are not verified before importing them. For
instance, If a security policy .json file has a minimum password length of 2000, theimported profile will have a minimum password length of 2000 and, when pushed todevices, it will enforce all the devices to have such a big password. The encrypted hashof the sensitive data is displayed in the .json file, but the sensitive data is not displayed inplain text format in the .json file.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 232

Importing policies or configurations

Importing policies or configurations
Importing policies and configurations help reduce errors when you have multiple instances of MobileIron. You canexport a configuration .json file for an existing policy, modify it, then import it to another policy. The export/importfeatures allow you to do this.
Procedure
1. Select Policies & Configs > Policies or Policies & Configs > Configurations.
2. Click Import to locate a saved exported .json file.
3. Enter the name of the file or click Browse to locate it.
4. Enter the password created when the file was exported.
See Step in Exporting policies or configurations.
5. Check Remember password for this session if you want to re-use the password during a session.
A session is defined as the length of a single log-in. The session ends when you log out or when you havebeen logged out by the system.
6. Read the warning message and click the I Agree check box.
7. Click Import to add the new policy to the policy table.
If you import a policy that already exists, you can override the policy or cancel the import. If an exported
policy has child object/s (such as app control rules and compliance actions), MobileIron creates themduring import. If the child objects already exist, they are overridden.

Viewing policy status and platform support
NOTE: The features described in this section are supported on macOS devices.
For any given device, you can view the status of a policy you have applied to that device, such as Pending, Sent,
or Applied. For any given policy, you can view a list of supported platforms, such as Android, iOS, and Windows.
Topics in this section include:lDisplaying policy statusl

Displaying supported platforms for policies

Displaying policy status
The Device Details pane on the Device & Users > Devices page displays status for the following tasks:lapply lockdown policieslapply security policies

The categories of status you will see in the Policies tab are:MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 233

Displaying supported platforms for policieslPending: The process of applying the policy has been started.

l

Sent: The policy has been successfully sent to the device.

llApplied: MobileIron Core has confirmed that the verifiable settings appear to have been applied to thedevice.
Partially Applied: One or more settings may have been rejected by the device. This can mean that thefeature is not supported by the device.

Displaying supported platforms for policies
To clarify which policies are supported on specific platforms, “Platforms Supported” links are included in the policy
dialogs. For example:

FIGURE 9. PLATFORMS SUPPORTED LINK

Each link displays a table outlining the platform support for each policy feature.

Enabling profile encryption
Profile encryption is enabled by default. The administrator has the option to disable this setting. This allows theadministrator to control encryption of the backup to iTunes. If profile encryption is enabled, the backup to iTunes isalso encrypted. If profile encryption is disabled, the backup to iTunes is not encrypted.
NOTE: If you disable profile encryption, backup to iTunes continues to be encrypted for devices that are
already registered. The backup to iTunes will be unencrypted for devices that registered after
the setting change.
Turning off encrypted backups results in compromised certificates on iOS devices, and disabling SCEP.
MobileIron does not recommend turning off encrypted backups, as this compromises system security.
Procedure
1. Go to Settings > System Settings > iOS > MDM.
2. Check or uncheck the Enable Profile Encryption setting.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 234

Enabling or disabling encryption on a macOS device

3. Unchecking disables profile encryption, and checking the setting enables profile encryption.
4. Click Save.

Enabling or disabling encryption on a macOS device
You can encrypt macOS devices using FileVault 2. FileVault 2 can be used to perform full XTS-AES 128
encryption on the contents of a volume. Core enables you to create FileVault 2 policies that you can use to control
the encryption of managed macOS devices. You can apply a single FileValut 2 policy to a device.
The FileVault 2 policy also includes recovery keys. Users can employ recovery keys to unlock the disk, in casethey forget the password for that purpose.
There are two types of recovery keys:llPersonal recovery key: FileVault 2 automatically generates a personal recovery key at the time ofencryption. A personal key is unique to the machine being encrypted. If an encrypted macOS is decrypted
and then re-encrypted, the existing personal recovery key is invalid. FileVault 2 would then generate a new
personal recovery key during re-encryption.
Institutional recovery key: An institutional recovery key is used for the same purpose as a personal
recovery key, but is the same for all macOS devices within an organization. You can use FileVault 2 togenerate and install an institutional recovery key to your system before enabling encryption. This common
key is used to unlock any managed, encrypted macOS device.

NOTE: FileVault 2 policies are supported on devices running macOS 10.10 through the most recently
released version as supported by MobileIron.
Procedure
1. Select Policies & Configs > Policies.
2. Select Add New > iOS and macOS > macOS > FileVault 2.
3. Use the guidelines in the table below to complete this form.

Item

Description

Name

Enter a name for the policy.

StatusSelect the relevant radio button to indicate whether the policy
is Active or Inactive.
Only one active policy can be applied to a device.

Priority

Specifies the priority of this policy relative to the other custom
policies of the same type. This priority determines which
policy is applied if more than one policy is available.
Select Higher than or Lower than, then select an existing

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 235

Enabling or disabling encryption on a macOS device

Item

Description
policy from the drop-down list.
For example, to give Policy A a higher priority than Policy B,
you would select “Higher than” and “Policy B”.

Description

Enter an explanation of the purpose of this policy.

Enable FileVault 2

Select to enable encryption.

FileVault User Settings
Defer FileVault until the designated user logs out:
Always prompt user to enable FileVault

Select to prompt the user to enable FileVault on the macOS
device. The user sees the prompt when logging in to themacOS device. When selecting this option, users cannot
bypass enabling the encryption option.

Maximum number of times a user can bypass
enabling FileVault

Select to configure a limit to the number of times the user canignore the prompt to enable FileVault.
Click up or down to select the maximum number of times.
The user sees the prompt when logging in to the macOS
device. When selecting this option, users can choose to skip
enabling the encryption option as many times as specified
here.

Do not request enabling FileVault at user
logout time

Select so that users are not prompted to enable FileVault
when they are trying to log out of the device.

Output PathEnter the path to which the recovery key .plist file will be
stored.
For example:/Library/Keychains/recovery.plist

Personal Recovery KeyCreate a personal recovery key

Select to create a personal recovery key. A personal recovery
key will be generated when encryption (FileVault) is enabled.
This private key can be used later to unlock the startup disk ofthe specific macOS device, in case the device user name andpassword are not available to unlock the device.

Institutional Recovery Key
Enable institutional recovery key

Select to enable an institutional recovery key.
The institutional recovery key can be used to unlock thestartup disk of any macOS device that uses the same
FileVault 2 master keychain.
The keychain should be available at the following location

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 236

Storing and retrieving FileVault personal recovery keys in Core (macOS)

Item

Description
before enabling FileVault 2 on the macOS device:/Library/Keychains/FileVaultMaster.keychain

Certificate

Enter your certificate information. If you selected Enableinstitutional recovery key without entering a certificate, thenthe master keychain(/Library/Keychains/FileVaultMaster.keychain) is used when
the institutional recovery key is added.

4. Click Save.
5. Apply the policy to a macOS label.
Next steps
You can verify that encryption is enabled on a given device by checking the device details for that device. SelectDevices & Users > Devices, and click the carat (^) next to the relevant macOS device. In the Device Details tab,look for the following fields:lFull Disk Encryption EnabledlFull Disk Encryption Has Institutional Recovery Keyl

Full Disk Encryption Has Personal Recovery Key

Storing and retrieving FileVault personal recovery keys in Core
(macOS)The FileVault 2 Retrieve Personal Recovery Key setting allows you to store and retrieve personal recovery keys
used to encrypt disk volumes with FileVault 2. Core stores the personal recovery keys for each device in an
encrypted form in its database.
When necessary, you can decrypt and display the key on your screen, allowing you to decrypt the associatedmacOS device.
This feature is supported on macOS 10.12 through the most recently released version of macOS as supported by
MobileIron.
NOTE: When upgrading a macOS device from 10.12 to 10.13, you need to apply this setting to devices
again. Do this by creating two policies with two different labels, one for devices running macOS
10.12, and another for devices running macOS 10.13.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 237

Configuring a system policy managed setting

Procedure
1. Select Policies & Configs > Policies.
2. Select Add New > iOS and macOS > macOS Only > FileVault 2 Retrieve Personal Recovery Key.
3. In the New FileVault 2 Retrieve Personal Recovery Key dialog box, use the guidelines to complete thisform.
4. Click Save.
5. Apply the policy to a macOS label.

Item

Description

Name

Enter a name for the policy.

StatusSelect the relevant radio button to indicate whether the policy is Active or Inactive.
Only one active policy can be applied to a device.

Priority

Specifies the priority of this policy relative to the other custom policies of the same
type. This priority determines which policy is applied if more than one policy isavailable.
Select Higher than or Lower than, then select an existing policy from the dropdown list.
For example, to give Policy A higher priority than Policy B, you would select“Higher than” and “Policy B”.

Description

Enter an explanation of the purpose of this policy.

Store Recovery Key toCoreEnables the storage of the recovery key to MobileIron Core. This option is enabled
by default when you create a FileVault 2 policy, and cannot be disabled.

Configuring a system policy managed settingThis setting allows you to disable the contextual menu that macOS users can display in the Finder application. The
contextual menu allows macOS users to bypass system policy restrictions, such as rules regarding whichapplications macOS users can install, execute, or open through a contextual menu
Only one policy is allowed per macOS device. You can define multiple policies and assign a priority level to each,such that Core can determine which policy it sends to macOS devices.
NOTE: This policy is supported on devices running macOS 10.10 through the most recently released
version as supported by MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 238

Configuring a system policy control setting

Procedure
1. Select Policies & Configs > Policies.
2. Select Add New > iOS and macOS > macOS > System Policy Managed.
3. Use the guidelines in System policy managed settings to complete this form.
4. Click Save.
5. Apply the policy to a macOS label.

TABLE 16. SYSTEM POLICY MANAGED SETTINGS
Item

Description

Name

Enter a name for the policy.

StatusSelect the relevant radio button to indicate whether thepolicy is Active or Inactive.
Only one active policy can be applied to a device.

Priority

Specifies the priority of this policy relative to other custom
policies of the same type. This priority determines which
policy is applied if more than one policy is available.
Select Higher than or Lower than, then select an existing
policy from the drop-down list.
For example, to give Policy A a higher priority than Policy B,
you would select “Higher than” and “Policy B”.

Description

Enter an explanation of the purpose of this policy.

Disable override

Select to disable the contextual menu in the Finder
application.

Related topicslSystem Policy Managed Payload in the Apple Configuration Profile ReferencelConfiguring a system policy control settinglConfiguring a system policy rule

Configuring a system policy control setting
The system policy control setting allows you to manage macOS Gatekeeper functionality. Gatekeeper secures themacOS operating system by enforcing code signing and verifying applications downloaded from the web before
allowing users to run them. The goal of Gatekeeper is to reduce the likelihood of accidentally running malware.
The system policy control setting you define in Core is analogous to the options available on macOS under System
Preferences > Security & Privacy > General.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 239

Configuring a system policy control setting

Only one policy is allowed per macOS device. You can define multiple policies and assign a priority level to each,such that Core can determine which policy it sends to macOS devices.
NOTE: This policy is supported on devices running macOS 10.10 through the most recently released
version as supported by MobileIron.
Procedure
1. Select Policies & Configs > Policies.
2. Select Add New > iOS and macOS > macOS > System Policy Control.
3. Use the guidelines in the table below to complete this form.
Item

Description

Name

Enter a name for the policy.

StatusSelect the relevant radio button to indicate whether thepolicy is Active or Inactive.
Only one active policy can be applied to a device.

Priority

Specifies the priority of this policy relative to the othercustom policies of the same type. This priority
determines which policy is applied if more than one
policy is available.
Select Higher than or Lower than, then select anexisting policy from the drop-down list.
For example, to give Policy A a higher priority than
Policy B, you would select “Higher than” and “Policy B”.

Description

Enter an explanation of the purpose of this policy.

Application Assessment

Select to enable the Gatekeeper applicationassessment functionality. Gatekeeper will assess
every application macOS users download from theweb.

Allow Identified Developers

Select to allow only those applications with proper codesignatures.

4. Click Save.
5. Apply the policy to a macOS label.
Related topicslSystem Policy Control Payload in the Apple Configuration Profile ReferencelAbout GatekeeperlConfiguring a system policy managed settinglConfiguring a system policy rule

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 240

Configuring a system policy rule

Configuring a system policy rule
The system policy rule setting allows you to control Gatekeeper rules. Gatekeeper secures the macOS operating
system by enforcing code signing and verifying applications downloaded from the web before allowing users to run
them. The goal of Gatekeeper is to reduce the likelihood of accidentally running malware.
The options in this setting are also available in the macOS command-line utility spctl . The spctl utility manages
the security assessment policy subsystem on macOS. This subsystem evaluates rules you define that determine
whether the macOS device allows the installation, execution, and contextual menu opening of applications on thedevice. The system policy rule setting requires the system policy control in order to work.
For example, if you want to allow applications developed by a company called Salesapps on macOS devices, you
would need to do the following:
1. Create a system policy control setting enabling Gatekeeper.
2. Disable the option that allows all applications by identified developers.
3. Create a system policy rule setting with the following syntax:
identifier com.salesapps

The system policy rule and control would allow the execution of all applications developed by the Salesapps
company on macOS devices. However, macOS device users would still be able to download other apps.
Only one policy is allowed per macOS device. You can define multiple policies and assign a priority level to each,such that Core can determine which policy it sends to macOS devices.
NOTE: This policy is supported on devices running macOS 10.10 through the most recently released
version as supported by MobileIron.
Procedure
1. Select Policies & Configs > Policies.
2. Select Add New > iOS and macOS > macOS > System Policy Rule.
3. Use the guidelines in System policy rule settings to complete this form.
4. Click Save.
5. Apply the policy to a macOS label.

TABLE 17. SYSTEM POLICY RULE SETTINGS
Item

Description

Name

Enter a name for the policy.

StatusSelect the relevant radio button to indicate whether thepolicy is Active or Inactive.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 241

Configuring iOS and macOS software updates

Item

Description
Only one active policy can be applied to a device.

Priority

Specifies the priority of this policy relative to the othercustom policies of the same type. This priority determines
which policy is applied if more than one policy is available.
Select Higher than or Lower than, then select an existing
policy from the drop-down list.
For example, to give Policy A a higher priority than Policy B,
you would select “Higher than” and “Policy B”.

Description

Enter an explanation of the purpose of this policy.

Policy requirement

Enter your desired spctl command.
The code you enter here must follow the rules delineated in
the Code Signing Requirement Language.
NOTE: You cannot enter the expiration date oroperation type in the spctl command you
enter here. The expiration date and operation
type must be entered or selected in the fieldand drop-down list below.

Comment

Enter any comments regarding the rule or command.

Expires onEnter an expiration date for the rule.

Operation type

Select an operation type for the rule.
• EXECUTE• INSTALL• LSOPEN

Related topicslSystem Policy Rule Payload in the Apple Configuration Profile Referencel

Code Signing Requirement LanguagelAbout GatekeeperlConfiguring a system policy managed settinglConfiguring a system policy control setting

Configuring iOS and macOS software updates
The software update policy specifies what kind of system updates iOS or macOS devices should receive andwhen they should receive them. This policy allows you to keep the system software consistent on all your Apple
iOS and macOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 242

Configuring iOS and macOS software updates

Only one software update policy is allowed per device. You can define multiple policies and assign a priority level toeach, such that MobileIron Core can determine which policy it sends to iOS and macOS devices.
NOTE: If the device is not registered with the device enrollment program, macOS software updates arelimited to only checking if a new version is available.
When a device checks in, Core checks:l

if a software update policy is applied to the devicelthe time window of the policyl

if an update is available for that devicel

if the available update is applicable for the device's hardware

Note The Following:
In order to utilize the iOS Software Update policy, the device users with the following iOS versions will be required
to upgrade to iOS 11.3 through the latest version as supported by MobileIron:l

iOS 9.2l

iOS 9.3l

iOS 10.0liOS 10.1l

iOS 10.2l

iOS 10.3l

iOS 11.0l

iOS 11.1l

iOS 11.2

You can make this setting in "Update OS Software" action from Devices & Users> Devices > Actions > iOS
and macOS.
Procedure
1. Select Policies & Configs > Policies.
2. Depending upon the device, select one:a. For iOS devices, select Add New > iOS and macOS > iOS Only > iOS Software Update.
b. For macOS devices, select Add New > iOS and macOS > macOS Only > macOS Software
Update.
3. Use the guidelines in the Update Software Settings table below to complete the new Add Updates dialog
box.
4. Click Save.
5. Apply the policy to a iOS or macOS label.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 243

Configuring iOS and macOS software updates

TABLE 18. UPDATE SOFTWARE SETTINGS
Item

Description

Name

Enter a name for the policy.

StatusSelect the relevant radio button to indicate whether the policy
is Active or Inactive.
Only one active policy can be applied to a device.

Priority

Specifies the priority of this policy relative to other custom
policies of the same type. This priority determines which
policy is applied if more than one policy is available.
Select Higher than or Lower than, then select an existing
policy from the drop-down list.
For example, to give Policy A a higher priority than Policy B,
you would select “Higher than” and “Policy B”.

Description

Enter an explanation of the purpose of this policy.

Set device update to

Select one:

(iOS only)

Update to the latest version - applicable to any iOS device
prior to iOS 11.3.
Update to a specific version- a field displays for you toenter the iOS version you want to update (for iOS 11.3
through the most recently released version as supported by
MobileIron.) This field allows you to push the policy for
updating a specific version of iOS to supervised devices.

Critical Updates(macOS only)

Select All critical updates if updates requiring a device
restart are acceptable.
Otherwise, select Only critical updates that do not
require restart.

Configuration Data Updates(macOS only)

Select All configuration data updates if updates requiring adevice restart are acceptable.
Otherwise, select Only configuration data updates that
do not require restartFirmware Updates(macOS only)

Select All firmware updates if updates requiring a device
restart are acceptable.
Otherwise, select Only firmware updates that do not
require restart

Update Hours

Select the timezone for the update times you select in thefields that follow.
For each day of the week, select the time of day and duration
to apply the update. The duration indicates the time period in
the local time zone specified by the policy. The update is

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 244

Disable OS Updates

TABLE 18. UPDATE SOFTWARE SETTINGS (CONT.)
Item

Description
initiated on each device when it checks in during the selected
time period.
If you do not select any days of the week, no updates are
initiated for a device, even if updates are available for thedevice.
If you select at least one day, but a device has no network
access during that time period, no update is initiated for thedevice.
If a device does not have a iOS/macOS software update
policy applied to it, updates are not initiated for the device.

Disable OS Updates
By default, Core uses the Available OS Updates command to poll Apple devices. You can disable this feature, thus
stopping the Available OS Updates commands to iOS devices. To continue to have this feature disabled, for every
Core upgrade, you will need to de-select the Enable Available OS Updates calls field.
Procedure
1. Go to Settings > System Settings.
2. Click on iOS > MDM. The MDM page opens.
3. De-select the Enable Available OS Updates calls field.
4. Click Save.
Related topicslUpdating OS components on a macOS devicelmacOS settings

Managing the activation lock for iOS devices
The activation lock feature:l

is designed to prevent anyone from using a lost or stolen device.

lprovides administrators with more options for deterring theft of supervised devices.

lenables administrators to reclaim supervised devices and reassign them to other employees.

A security policy option enables the Activation Lock on newly registered phones. Enabling this option prompts
MobileIron Core to acquire the bypass code for the devices. When you configure an iOS device as supervised, you

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 245

Applying an activation lockcan generate a device-specific Activation Lock bypass code which you can later use to remove the Activation
Lock. The Send Activation Lock Bypass action in the Devices page sends the necessary code to the target
devices.
NOTE: You must have a connection between MobileIron Core and Apple's Activation Lock Bypass
server to be able to store bypass codes for supervised, managed devices. The server’s URL is:
https://deviceservices-external.apple.com/deviceservicesworkers/escrowKeyUnlocklll

Per Apple policy, the Activation Lock bypass code works once per device. The device must be reset
before another bypass code will work.
Per Apple policy, MobileIron Core can acquire the bypass code only when the device is first registered.
For supervised devices already registered with MobileIron Core, select Actions > Send Activation Lock
Bypass to acquire the bypass codes for these devices.

Applying an activation lockAs soon as Find My iPhone is turned on, a mapping between this iCloud account and a hardware identifier for thisdevice is saved to Apple’s activation servers. From that point, no one can turn off Find My iPhone, erase thedevice, or reactivate it without entering the existing Apple ID and password. If someone other than you wiped yourdevice and then tried to re-activate and use it, they would be prompted for your Apple ID and password in Setup
Assistant.
If you have a BYOD deployment, no action is required. The device user owns the asset, so they can lock thedevice with their personal Apple ID. Any resulting issues would be addressed by the user and Apple Care.
If you have a corporate-liable deployment, and your devices are supervised, activation lock is disabled forsupervised devices by default, and device users cannot turn it on. Most corporate administrators are likely to leave
the Activation Lock disabled, as it is primarily a consumer feature. Should you decide to enable the feature:

TABLE 19. ACTIVATION LOCKS
ActionWhat to Do

Enable Activation Lock

Complete the following steps prior to device registration:
1. Turn on Find My Phone.
2. In the Security policy, select Enable Activation Lock.
3. Register the device.
MobileIron Core acquires the bypass code at this time.
Note that it can take some time before the device reports that the activation
lock has been enabled.

Send Activation Lock
Bypass Code

1. In the Device page, select the iOS device.
2. Click Actions > Send Activation Lock Bypass Code.

If you have a corporate-liable deployment, and your devices are unsupervised, activation lock will beenabled as soon as the end-user signs in to iCloud with their Apple ID and turns on Find My Device. MDM servers,

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 246

Removing the Activation Lockincluding MobileIron Core, cannot control activation lock on unsupervised devices. Supervision is the flag thatsays this device is corporate owned. Device users can lock activation with their personal credentials, leaving you
no recourse should they leave the company. For this scenario, MobileIron recommends the following process:l

Add the removal of the Activation Lock to your employee agreement.
You should not consider the device returned unless the Activation Lock is removed.

lConfirm that the Activation Lock has been removed when the device is returned to you.

l

Contact Apple Enterprise Support if the Activation Lock has not been removed.

Removing the Activation LockIf the device has not been wiped, and the user is willing to enter the Apple ID password:
1. Launch the Settings app on the device.
2. Go to the iCloud screen.
3. Turn off Find My Device.
4. Have the device user enter the Apple ID password.
Another option is to have the user erase all content and settings.
If the device has already been wiped, and the user is willing to enter the Apple ID password:
1. Follow the steps in Setup Assistant.
2. If the Activation Lock screen is displayed, have the device user enter the Apple ID and password or ask
the user to remove the device from their account in iCloud.
If you have an enterprise support contract with Apple, you can contact them to request an activation lock removal.

Whitelisting Wi-Fi networks
You can limit the Wi-Fi networks iOS devices can join only to those Wi-Fi networks installed by profiles. This
option enhances security, in that the Wi-Fi networks installed by profiles on iOS devices are secure, trusted
networks. You enable this option in the security policy pushed to iOS devices.
This feature applies only to supervised devices running iOS 10.3 through the most recently released version as
supported by MobileIron.
Note The Following:lAfter you push the Wi-Fi whitelist restriction to devices, the restriction will work only if Core has pushed atleast one Wi-Fi network configuration to iOS devices using an MDM profile. The MDM profile with Wi-Fi
configuration can only be pushed to devices through Core (and not through any other means, such as
Apple Configurator).

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 247

Configuring firewall settings for macOS devicesll

If Core removes all Wi-Fi configurations from the device, then the Wi-Fi whitelist restriction is removed aswell.
Enabling and disabling this feature causes Core to push Wi-Fi configurations to devices. As such, try tominimize enabling and disabling this feature.

Procedure
1. Go to Policies & Configs > Policies.
2. Select the security policy for which you want to enable this feature.
3. Click Edit.
4. Select Only join Wi-Fi networks installed by profiles (iOS 10.3 and later with supervised devices
only).
5. Click Save.

Configuring firewall settings for macOS devices
You can use Core to configure a macOS firewall setting for macOS devices. You use the firewall configuration tocontrol connections made to managed macOS devices from other devices on your network on a per-applicationbasis. The firewall configuration prevents managed macOS devices from accepting inbound connections fromparticular apps or services.
The application firewall is designed to work with TCP and UDP, without having any effect on AppleTalkconnections. While you can disable ICMP pings by enabling stealth mode, you can still use earlier ipfw technology
from the command line.
Procedure
1. Select Policies & Configs > Configurations.
2. Select Add New > Apple > macOS only > Firewall.
3. Use the guidelines in the table below to complete this form.
Item

Description

Name

Enter a name for the configuration.

Description

Enter an explanation of the purpose of thisconfiguration.

Enable Firewall

Select to enable the firewall configuration for macOS
devices.

Block all incoming connections

Select to prevent all sharing services from receiving
incoming connections on macOS devices, such as
screen sharing or file sharing.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 248

Sync policies and battery use

Item

Description
The following system services may still receive
incoming connections:• configd, which implements DHCP and othernetwork configuration services• mDNSResponder, which implements Bonjour• racoon, which implements IPSec

Enable stealth mode

Select to prevent macOS devices from responding to
probing requests. Managed macOS devices still answer
incoming requests for authorized apps, while ignoring
unexpected requests, such as ICMP (ping).

Applications

Select specific apps for which you want to receive
incoming connections on macOS devices.
Click Add+ to add a row to the list of apps. Click thecell under Bundle ID to select the app whose incoming
connections you want to explicitly allow. Select thecheck box in the Allow Connections cell to allow
incoming connections from the selected app.

4. Click Save.
5. Apply the policy to a macOS label.

Sync policies and battery use
If users note significant battery impact on their devices after installing the MobileIron client (Mobile@Work),
consider reviewing and optimizing your sync policies.

Work Schedule policy
This policy allows administrators to set work schedules for device users. After the scheduled work time, users areblocked from accessing specified apps and services, which include:lExchange Active Sync serviceslAppConnect-enabled appslManaged apps that use MobileIron Tunnel on Sentry

After the scheduled work time-period, users are unable to open any of these apps or services. In its place, users
see a message indicating that access is not available. Message can vary, depending on the app or service theyattempt to use. The policy starts and ends after the next scheduled sync following the specified start time andduration period.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 249

Adding a Work Schedule policy

This section contains the following procedures:lAdding a Work Schedule policylApplying a Work Schedule policylManaging a Work Schedule policylSetting up Work Schedule policy notifications

Adding a Work Schedule policy
Use this procedure to add a policy that sets a work schedule and blocks apps and services outside of thescheduled time.
NOTE: Enforcement of this policy requires Standalone Sentry 9.0.0.
Procedure
1. Log into the Admin Portal.
2. Select Policies & Configs > Policies > Add New > Work Schedule.
3. Enter the policy name in the Name field.
4. Select Active to enable the schedule.
Select Inactive to disable the policy.
5. Select Higher than or Lower than in the Priority option, then select the other priority.
This option is available only if you have two or more Work Schedule policies. Use it to select the priority on
one policy over the other in cases of conflicts.
6. Use the drop down to select a Timezone, which defines the start and end times for the policy.
7. Set up the weekly work schedule.
The policy treats unchecked days as a time period outside of the work schedule, blocking affected apps
and services for that 24-hour period.
8. Click Save to add the policy to the Policies page.

Applying a Work Schedule policyCore sends the policy to Sentry and Sentry enforces the policy. When you apply the policy to a label, any device
associated with the selected label will receive the policy during the next sync between the Sentry and the device.
Procedure
1. Log into the Admin Portal.
2. Select Policies & Configs > Policies.
3. Select the work schedule policy.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 250

Managing a Work Schedule policy

4. Select Actions > Apply to Label.
5. Select one or more labels and click Apply.

Managing a Work Schedule policy
Use this procedure to modify or delete a work schedule policy.
Procedure
1. Log into the Admin Portal.
2. Select Policies & Configs > Policies.
3. Select the work schedule policy you want to manage.
a. Click Edit to modify the work schedule, then click Save.
b. Select Actions > Delete to delete the policy.

Setting up Work Schedule policy notifications
Use this procedure to modify or delete a work schedule policy.
Procedure
1. Log into the Admin Portal.
2. Select Logs > Event Settings.
3. Select Add New > Device Status Event.
4. Complete the form and check Work schedule policy applied.
See the “Working with Events” section for details.
5. Click Save.

Country changes and alerts
Country changes are monitored by the MobileIron client. Assuming that the Sync While Roaming option is not set
to No Sync, each country change causes Mobile@Work to send the change to MobileIron Core. If Mobile@Work
can connect, then the Event Center generates the configured alerts, regardless of the sync interval. If connectivity
is not established, then Mobile@Work generates a local alert, if configured.

iOS location-based wakeups interval and syncing with Core
Location-based wakeup intervals enable MobileIron Core to periodically wake Mobile@Work for iOS, which thenreports any critical changes to MobileIron Core. This feature allows changes to be communicated to Core without
having to manually start Mobile@Work.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 251

Single-app mode policies

Independent of the location-based wakeup interval, iOS may wake Mobile@Work based on changes in cell tower
location. In this case, the app determines whether device details have been sent to Core within the specified iOS
location-based wakeup interval. If device details have not been sent during that interval, then Mobile@Work sends
device details to Core. If Mobile@Work wakes up and determines that the device has been compromised or the
SIM state has changed, this information is immediately sent to Core.

Single-app mode policies
Single-app mode enables you to configure an iOS device for kiosk use, restricting use of the device to thedesignated app. For example, you might want to configure an iPad for use as an electronic catalog. The Home
button and features such as taking a screenshot or receiving notifications are disabled. The device returns to thespecified app automatically when it wakes or is rebooted.
Note The Following:
l

l

l

l

Single-app mode policy applies only to supervised devices running iOS 6 and later through the mostrecently released version as supported by MobileIron.
AppConnect apps or in-house apps developed with the AppConnect wrapper (including AppConnect apps
available on the Apple App Store, such as Email+ for iOS and Web@Work for iOS) cannot run in singleapp mode.
The single-app mode policy is different from the single-app mode restriction, which allows you to whitelist
apps capable of autonomously running in single-app mode. For more information about the single-app
mode restriction, see iOS / tvOS settings.
Make sure to install the app you want to use in single-app mode before placing your devices in single-app
mode, otherwise, the device will get stuck in single-app mode without an app.

Procedure
1. Select Policies & Configs > Policies > Add New > iOS and macOS > iOS Only > Single-App
Mode.
2. In the New Single-App Mode Policy dialog box, use the following guidelines to complete this form:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 252

Single-app mode policies

Item

Description

Name

Required. Enter a descriptive name for this policy. This is the text thatwill be displayed to identify this policy throughout the Admin Portal. This
name must be unique within this policy type.
It is recommended to use unique names across policy types to allow forclearer log entries.

StatusSelect Active to enable the policy, or Inactive to disable it.
Only one active single-app mode policy can be applied to a device. You
can define two single-app mode policies and send them to supervised
devices, for example, as long as only one of the policies is active. You
can easily switch policies by inactivating the policy you want to disable
and then forcing a device check-in. Supervised devices can have any
number of policies that you can activate at any time, but only one policy
is active.

Priority

Specifies the priority of this policy relative to the other custom policies ofthe same type. This priority determines which policy is applied if morethan one policy is available.
Select Higher than or Lower than, then select an existing policy fromthe drop-down list.
For example, to give Policy A a higher priority than Policy B, you would
select “Higher than” and “Policy B”.

Description

Enter an explanation of the purpose of this policy.

IdentifierEnter the bundle ID of the app to be used in single-app mode. Example:
com.apple.mobilesafari.

Settings (These settings apply only to supervised devices running iOS 7 through iOS 9.3.)
Auto Lock

Select to enable iOS to put the screen to sleep after a set period.

Device Rotation

Select to enable device rotation.

Mono Audio

Select to play all audio through a single mono channel.

Ringer Switch

Select to enable the ringer switch so that device users can use it to mutethe sound on the device.

Sleep/Wake Button

Select to enable the Sleep/Wake button so that device users can put tosleep or wake their devices.

Speak Selection

Select to enable speak selection.

Touch Screen

Select to enable basic touch controls, such as tapping and pinching.

Volume Buttons

Select to enable volume adjustments using the volume buttons.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 253

Finding the bundle ID

Item

Description

User Enabled Settings

EnableAssistive Touch

Select to enable Assistive Touch so that device
users can modify their screen interactions and use
a compatible adaptive accessory.

Invert Colors

Select to enable the use of invert colors. Invert
color displays are high contrast, and can be helpful
for visually impaired device users.

Voice Over

Select to enable Voice Over controls used to entertext or perform other tasks using voice, such as
the device reading aloud artifacts that a deviceuser taps.

Zoom

Select to allow device users to magnify thescreen.

Aside from
activating thesesettings on
supervised
devices, you canalso enable device
users to manage
these options forthemselves.
Select Enable foreach setting you
want device users
to control
themselves.

3. Click Save.
4. Apply the policy to the relevant labels.

Finding the bundle ID
To determine the bundle ID:
1. Sync your device to your iTunes library.
2. On your PC or Mac, open the Mobile Applications folder in the iTunes library.
3. Duplicate the app file and assign a .zip extension.
4. Open the iTunesMetadata.plist file in the zip file.
5. Find the softwareVersionBundleId key in the list.

Configuring a global HTTP proxy policy
By imposing a global HTTP proxy policy on supervised iOS 6 through iOS 9.3 devices, you can ensure that HTTP
traffic is redirected to the proxy server you specify. You can manually enter the proxy server URL and port number,or the URL for the relevant PAC (proxy auto-configuration) file, which automatically determines the correct proxy
server to use for a given URL. If the policy does not include a URL to the PAC file, then the policy uses WPAD
(web proxy auto-discovery) to attempt to locate the PAC file.
The global HTTP proxy policy can include two features that provide solutions on-the-fly for when devices cannot
access the proxy server:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 254

Global HTTP Proxy PolicyllDirect connection: For circumstances where the PAC file is unreachable, you can specify that the policy
create a direct connection to the requested URL, bypassing the proxy server altogether. This option
applies only to automatic proxy connections.
Proxy bypass: You can configure the policy to bypass the proxy server altogether when a device attempts
a connection to a captive network such as a wifi hotspot at a coffee shop or a hotel. Selecting this option
allows the device to connect directly to the captive network. Device users establish uninterrupted wifi
internet access by logging in through the captive portal before the policy redirects them to the proxy server.

If your organization uses a proxy server to provide data leak protection or content filtering, for example, a global
HTTP proxy policy allows you to direct HTTP traffic to and from supervised iOS 6 through iOS 9.3 devices to theproxy server of your choice.
The direct connection and proxy bypass features allow supervised iOS 7 through iOS 9.3 devices to continue
accessing the internet even if:lthe PAC file referenced in their global HTTP proxy policy is unavailable
ORlthey must first log in to a captive portal before accessing a wifi hotspot.

NOTE: The direct connection and proxy bypass options apply only to supervised iOS 7 through iOS 9.3
devices.
IMPORTANT: Confirm that you have specified the correct proxy information, and the proxy is reachable.
An invalid or unreachable proxy server will make the device unreachable by the network.
In this case, physical access is required to reset the device.
Procedure
1. Go to Policies & Configs > Policies.
2. Select Add New > iOS and macOS > iOS Only > Global HTTP Proxy.
3. In the New Global HTTP Proxy Policy dialog box, use the guidelines in Global HTTP Proxy Policy tocomplete this form.
4. Click Save.
5. Apply the policy to the appropriate labels.

Global HTTP Proxy Policy
Below are the setting definitions for the New Global HTTP Proxy Policy dialog box.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 255

Global HTTP Proxy Policy

TABLE 20. GLOBAL HTTP PROXY POLICY
Items

Description

Name

Required. Enter a descriptive name for this policy. This is the text that will be
displayed to identify this policy throughout the Admin Portal. This name must
be unique within this policy type.
Tip: Though using the same name for different policy types is allowed (e.g.,
Executive), consider keeping the names unique to ensure clearer log entries.

StatusSelect Active to turn on this policy. Select Inactive to turn off this policy.
Why: Use the Status feature to turn a policy on or off across all phones
affected by it. The policy definition is preserved in case you want to turn it on
again.

Priority

Specifies the priority of this custom policy relative to the other custom policiesof the same type. This priority determines which policy is applied if more than
one policy is associated with a specific device. Select Higher than or Lower
than, then select an existing policy from the drop-down list. For example, togive Policy A a higher priority than Policy B, you would select “Higher than” and“Policy B”. Because this priority applies only to custom policies, this field is notenabled when you create the first custom policy of a given type.

Description

Enter an explanation of the purpose of this policy.

Proxy Type: Manual
ManualIf you select Manual, specify the proxy server address and port through which
all HTTP traffic will be directed. Optionally, enter values for the username andpassword used for devices to authenticate with the proxy server. If you doenter a value for the password, go to Settings > System Settings > Users& Devices > Registration > Save User Password Preferences and selectSave User Password.
If you do not enter values for the proxy server username and password,supervised device users will need to enter a username and password every
time they access the proxy server.

Proxy ServerEnter the network address for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

User Name

Optional. Enter the user name for authenticating with the proxy server.
You can use any of the following variables for the username value: $USERID$ ,$EMAIL$ , $USER_CUSTOM1$ , $USER_CUSTOM2$ , $USER_CUSTOM3$ , $USER_CUSTOM4$ . You can also combine text with variables, such as$USERID$:$USER_CUSTOM1$ or $USERID$_$USER_CUSTOM1$ . Custom attribute
variable substitutions are supported.

Proxy Password

Optional. Enter the password for authenticating with the proxy server.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 256

Cellular policies

TABLE 20. GLOBAL HTTP PROXY POLICY (CONT.)
Items

Description
You can use any of the following variables for the password value:$PASSWORD$ , $USER_CUSTOM1$ , $USER_CUSTOM2$ , $USER_CUSTOM3$ , $USER_CUSTOM4$ . You can also combine text with variables, such as$PASSWORD$:$USER_CUSTOM1$ or $PASSWORD$_$USER_CUSTOM1$ . Custom
attribute variable substitutions are supported.

Allow bypassing proxy toaccess captive networks

Selecting this feature allows the device to display the login page for captive
networks (such as a LAN at a coffee shop which customers access throughwifi), bypassing the proxy server altogether. Deselected by default.
NOTE: This feature applies only to iOS 7 through iOS 9.3 devices.

Proxy Type: AutoAuto

If you select Auto, enter the URL of the PAC (proxy auto-configuration) file,which specifies the location of the proxy server. The PAC file enables web
browsers and user agents to automatically select the correct proxy server for
any requested URL.

Proxy PAC URL

Optional. Enter the URL for the proxy auto-configuration (PAC) file. If you leavethis field blank, the device will use the web proxy auto-discovery (WPAD)
protocol to guess the location of the PAC file.

Allow direct connection if
PAC is unreachable

Selecting this feature allows the supervised device to access the requested
URL directly (without the proxy server), if the proxy auto-configuration filecannot be reached. Deselected by default.
NOTE: This feature applies only to iOS 7 through iOS 9.3 devices.

Allow bypassing proxy toaccess captive networks

Selecting this feature allows the device to display the login page for captive
networks (such as a LAN at a coffee shop which customers access throughwifi), bypassing the proxy server altogether. Deselected by default.
NOTE: This feature applies only to iOS 7 through iOS 9.3 devices.

Related topicsl“Impact to tunneling when using a global HTTP proxy” in the MobileIron Core AppConnect and AppTunnel
Guide for MobileIron Core.

Cellular policies
NOTE: Apple disabled APN settings in iOS 9.0, but re-enabled APN settings in iOS 9.0.1. MobileIron
strongly recommends creating a cellular policy for new configurations.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 257

Migrating devices from an APN setting to a cellular policy

MobileIron Core provides a cellular policy that defines the network path for cellular data connectivity, or the Access
Point Name (APN). It is possible to configure a cellular data policy using an APN setting or a cellular policy,
depending on the version of iOS running on a given device.
The cellular policy allows you to define a customized APN for devices without disrupting device users’ cellularconnectivity. The cellular policy in MobileIron Core supports Apple’s configuration profile com.apple.cellular
payload.
The cellular policy includes the following information:la name and descriptionlactive or inactive statusla username and password for connecting to the cellular networklpriority, if more than one cellular policy is defined in MobileIron Corelthe preferred method of authenticating with the cellular networklan Access Point Name (APN), which defines the gateway between the mobile network and your computer
network

Note The Following:ll

Cellular policies can be applied to devices running iOS 7 through the most recently released version of iOS
as supported by MobileIron.
Only one cellular policy can be used on a device at any given time. A cellular policy cannot co-exist with an
APN setting on the same device. If you upgrade a device from iOS 8 to iOS 9, for example, you must
remove the APN setting and apply a cellular policy.

Migrating devices from an APN setting to a cellular policy
If you are managing devices with an APN setting applied, you will need to migrate these devices to a cellularpolicy.
1. Make sure the devices are connected to a Wi-Fi network.
2. Apply the relevant iOS devices to a label, and remove the APN setting from that label.
3. Ensure the APN setting has been removed from iOS devices in the label.
4. Apply the new cellular policy to the label applied to the iOS devices.

Defining a cellular policy
If you define more than one cellular policy, you can set the priority of each policy in relation to the others. For
instance, if you define three policies, you can configure each policy to take precedence over the next, such thatpolicy 1 would take priority over policy 2, which, in turn, would take priority over policy 3. Note that the most recent
priority setting overrides the previous. For example, if you edit policy 3 to take higher priority than policy 2, then theorder of priority shifts to policy 1, policy 3, policy 2.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 258

Cellular policy settings

FIGURE 10. CELLULAR POLICY WINDOWAll things being equal, this means that policy 1 will be applied to devices. If, however, policy 1 is only applied tolabel 1, this means that policy 3 will be applied to label 2.
Procedure
1. Go to Policies & Configs > Policies.
2. Click Add New.
3. Select iOS and macOS > iOS Only > Cellular.
The New Cellular Policy dialog box opens.
4. Use the table in Cellular policy settings as a guideline for filling out the form.
5. Click Save.
6. Go to Actions > Apply To Label.
7. Select the label or labels to apply from the Apply To Label dialog.
8. Click Apply.

Cellular policy settings
The following table describes the settings available in the New Cellular Policy window. For more information about
creating a cellular policy, see Defining a cellular policy.

TABLE 21. CELLULAR POLICY SETTINGS
Item

Description

Name

Enter a name for the cellular policy.

StatusSelect Active to enable the policy, or Inactive to disable it.

Priority

Set the priority of cellular policies if there is more than one cellularpolicy.
If you want to place greater priority on this cellular policy thananother, select Higher than, and then select the cellular policy overwhich this policy will take priority.
If you want to place lesser priority on this cellular policy thananother, select Lower than, and then select the cellular policy thatwill be used before the one you are defining.

Description

Enter a description of the cellular policy.

User NameEnter a user name for authentication.

Password

Enter a password for authentication.

Authentication Type

Select CHAP to use Challenge-Handshake Authentication Protocol

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 259

Wallpaper policies

TABLE 21. CELLULAR POLICY SETTINGS (CONT.)
Item

Description(CHAP) to authenticate the user with the cellular carrier.
Select PAP to use Password Authentication Protocol (PAP) toauthenticate the user with the cellular carrier.

Protocol Mask

Select the version of Internet Protocol you would like to enable forthis cellular policy: IPv4, IPv6, or Both.

APN Configurations

Click + to configure the name of the gateway between a mobile
network and your computer network.
NOTE: Currently, iOS only uses the first APN setting from thelist of APN settings.
For each APN, enter the following values:• Name: Enter a name for the APN.
• User Name: Enter a username for authenticating with thecellular network.
• Password: Enter a password for authenticating with the cellular
network.
• Proxy server: Enter the URL of the proxy server on the cellular
network.
• Port: Enter the port number for the proxy server.
• Default Protocol Mask: Select the default IP version to use forthis cellular policy: IPv4, IPv6, or Both.
• Roaming Protocol Mask: Select the IP version to use forroaming in the context of this cellular policy: IPv4, IPv6, orBoth.
• Domestic Roaming Protocol Mask: Select the default IP
version to use for domestic roaming in the context of thiscellular policy: IPv4, IPv6, or Both.

Wallpaper policies
Use the wallpaper policy to set the wallpaper of the home and locked screens of supervised iOS devices to imagesof your choice. By setting the wallpaper using the wallpaper policy, the wallpaper is automatically applied to thedevice when the device registers with MobileIron Core.
This feature is useful in a kiosk setting, or shared device environment in a retail setting.
In the wallpaper policy you can choose:lImages for iPhone and iPod deviceslImages for iPad devices

In both cases, you can choose the same image or different images for the home screen and locked screen.
MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 260

Configuring a wallpaper policy

Note The Following:
l

l

l

l

You can also set the wallpaper manually on a device that is already registered by using the Admin Portal
action Set Wallpaper.
Before choosing an image file, browse the Apple website for the latest recommended image resolution by
device type and screen size.
After a wallpaper policy is applied to a device, the wallpaper settings are not removed from the device if
you delete the policy or remove the device’s label from the policy.
You cannot export, import, or make a copy of (save as) a wallpaper policy.

Related topicslConfiguring a wallpaper policylWallpaper policy settingslManually setting the wallpaper for iOS devices

Configuring a wallpaper policy
Configure a wallpaper policy so that the home and locked screens of supervised iOS devices use images of yourchoice. The wallpaper is automatically applied when a device registers with MobileIron Core.
Procedure
1. Go to Policies & Configs > Policies.
2. Click Add New.
3. Select iOS and macOS > iOS only > Wallpaper.
The Wallpaper Policy window is displayed.
4. See Wallpaper policy settings as a guideline for filling out the form.
5. Click Save.
6. Go to Actions > Apply To Label.
NOTE: Wallpaper policies are supported on supervised devices and should be associated to a"Supervised" label.
7. Select the label or labels to apply from the Apply To Label dialog box.
8. Click Apply.
NOTE: The files that you upload when creating the policy are listed in the Policy Details pane that
displays when you select the policy’s row in Policies & Configs > Policies. However, when you
edit a wallpaper policy, the files are not listed in the Wallpaper Policy screen.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 261

Wallpaper policy settings

Related topicslWallpaper policieslWallpaper policy settingslManually setting the wallpaper for iOS devices

Wallpaper policy settings
The following table describes the settings available in the wallpaper policy.

TABLE 22. WALLPAPER POLICY SETTINGS
Item

Description

Name

Enter a name for the wallpaper policy.

StatusSelect Active to enable the policy, or Inactive to disable it.

Priority

Set the priority of wallpaper policies if there is more than one
wallpaper policy.
If you want to place greater priority on this wallpaper policy thananother, select Higher than, and then select the wallpaper policy
over which this policy will take priority.
If you want to place lesser priority on this wallpaper policy thananother, select Lower than, and then select the wallpaper policythat will be used before the one you are defining.

Description

Enter a description of the wallpaper policy.

iPhone/iPod Wallpaper
Use same image for Home Screen andLock Screen

Select this option to use the same image for both the home screen
and the lock screen on iPhone and iPod devices.
When selected, the display changes to allow you to upload only
one file.

Home Screen

Choose the file for the home screen image.
File requirements:• either PNG or JPG format• less than 5 MB*

Lock Screen

Choose the file for the lock screen image.
File requirements:• either PNG or JPG format• less than 5 MB*

iPad Wallpaper
Use same image for Home Screen and

Select this option to use the same image for both the home screen

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 262

Device name policies

Item

Description

Lock Screen

and the lock screen on iPad devices.
When selected, the display changes to allow you to upload only
one file.

Home Screen

Choose the file for the home screen image.
File requirements:• either PNG or JPG format• less than 5 MB*

Lock Screen

Choose the file for the lock screen image.
File requirements:• either PNG or JPG format• less than 5 MB** 5 MB are acceptable and are applied to the devices with the appropriate labels. However, larger files can have
unpredictable performance impact on MobileIron Core. The performance impact is due to Core requiring multiple
device check-ins to apply the wallpaper to all devices. The performance impact depends on the size of the file andon the number of devices impacted. Note that the wallpaper file size does not impact any other actions that Core
performs on device check-in.
Related topicslWallpaper policieslConfiguring a wallpaper policylManually setting the wallpaper for iOS devices

Device name policies
Use the Device Name policy to set the name of supervised iOS devices of your choice. By setting the device
names using this policy, the device name is automatically applied to the iOS device when the device registers with
MobileIron Core.
This feature is useful in a kiosk setting, or shared device environment in a retail setting.
In the device name policy you can set the name using substitution variables that may be used to dynamicallycreate a device name. Editing this name will result in all iOS supervised device names being updated. For any
supervised iOS device with the policy, when the device checks in, Core will check the current device name andcompare it with the resolved desired device name. If the names are different, Core will send a command to change
the device name and queue a check-in at a later time.
Note The Following:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 263

Configuring a device name policy

l

l

l

l

After a device name policy is applied to a device, the device name settings are not removed from thedevice if you delete the policy or remove the device’s label from the policy.
If the device user changes the device name, at every sync, Core will check to see if the device name is the
expected one for the policy assigned and, if it does not match, enforce / resend the device namecommand. Core will continue to do this as long as the policy is assigned.
You cannot export, import, or make a copy of (save as) a device name policy.
Advanced search and labels supports iOS device names, i.e., ios.DeviceName, so administrators must be
careful how they use the device name as a label since the device user could change the device namethemselves, thus making the device fall out of the label until the device name was changed back.

l

If the device's attribute is set to NULL, the Device Name policy will remain in a pending state.

lWhen the device belongs to the device name policy, it displays as Applied in the Device Details page.

Related topicslConfiguring a device name policylDevice name policy settings

Configuring a device name policy
Configure a device name policy so that the supervised iOS devices use names of your choice. The device namepolicy is automatically applied when a device registers with MobileIron Core.
Procedure
1. Go to Policies & Configs > Policies.
2. Click Add New.
3. Select iOS and macOS > iOS only > Create Device Name.
The Add Device Name Policy dialog box opens.
4. See Device name policy settings as a guideline for filling out the form.
5. Click Save.
6. Go to Actions > Apply To Label.
NOTE: Device name policies are supported on supervised devices and should be associated toa "Supervised" label.
7. Select the label or labels to apply from the Apply To Label dialog box.
8. Click Apply.

Device name policy settings
The following table describes the settings available in the device name policy.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 264

Customizing a home screen layout

TABLE 23. WALLPAPER POLICY SETTINGS
Item

Description

Name

Enter a name for the device name policy.

StatusSelect Active to enable the policy, or Inactive to disable it.

Priority

Set the priority of device name policies if there is more than one
device name policy.
If you want to place greater priority on this device name policy thananother, select Higher than, and then select the device namepolicy over which this policy will take priority.
If you want to place lesser priority on this device name policy thananother, select Lower than, and then select the device namepolicy that will be used before the one you are defining.

Description

Enter a description of the device name policy.

Device Name

Type $ to see list of variables that may be used to dynamicallycreate a device name. Editing this name will result in all iOS
supervised device names being updated.
Examples:ll

Device Name: $EMAIL$'s device resolves tojsmith@mobileiron.com's device
Device Name: $USERID$ - $MODEL$ device resolves tojsmith - iPad device.

For more information about substitution variables, see Substitution
variables for compliance policy rules.

Customizing a home screen layout
You can customize the layout of the home screen on managed devices. You can define multiple home screen
layout policies, and prioritize the use of each. This allows for a unified look and feel across devices, or groups ofdevices.
Customized components of the home screen layout include the dock and additional home page screens, if desired.
The dock can include MobileIron Core App Catalog apps, whereas customized home pages can include custom
folders, as well as apps.
Note The Following:lThis feature is supported on supervised devices running iOS 9.3 through the most recently released
version as supported by MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 265

Customizing a home screen layout

Procedure
1. Go to Policies & Configs > Policies.
2. Click Add New.
3. Select iOS and macOS > iOS Only > Home Screen Layout.
4. The Add Home Screen Layout Policy dialog box opens.
5. Define a home screen layout policy, using the following table as a guideline.
Item

Description

Name

Enter a name for the home screen layout policy.

StatusSelect Active to enable the home screen layout policy, orInactive to disable it.

Priority

Set the priority of the home screen layout policies if there ismore than one policy.
If you want to place greater priority on this home screen
layout policy than another, select Higher than, and thenselect the home screen layout policy over which this policy
will take priority.
If you want to place lesser priority on this home screen layout
policy than another, select Lower than, and then select thehome screen layout policy that will be used before the one
you are defining.

Description

Enter a description for the home screen layout policy.

6. Click the Add button below the Dock table to add apps to the dock.
A new row is added to the Dock table.
7. Use the following table as a guideline for adding an app or webclip to the dock.
Item

Description

Type

Click the drop-down list to select the type of item you want to
add to the dock: Application.

App Name

If you are adding an app to the dock, click the drop-down list
and select an App Catalog app.

Bundle ID/URL

After you select an app, the bundle ID or web clip URL is
automatically filled in.

Actions

Click the x button to delete an app or web clip.

8. Click the Add button below the Page 1 table to add apps, webclips, and folders to the first home screen
page after the dock.
A new row is added to the Page 1 table.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 266

Customizing a lock screen message

9. Use the following table as a guideline for adding an app, web clip, or folder to the home screen page.
Item

Description

Type

Click the drop-down list to select the type of item you want to
add to the dock: Application or Folder.

App Name

Click the drop-down list and select an App Catalog app.

Bundle ID/URL

After you select an app, the bundle ID or web clip URL is
automatically filled in.

Actions

Click the x button to delete an app, web clip, or folder.
Click the Edit button to edit a folder name.

10. If you want to add more pages to the home screen layout policy:lClick Add New Page. A new page appears.

l

Add apps or folders, as described in the previous step.

11. Click Save.
12. Go to Actions > Apply To Label.
13. Select the label or labels to apply from the Apply To Label dialog.
14. Click Apply.

Customizing a lock screen message
You can customize the lock screen message for supervised devices running iOS 9.3 through the most recently
released version as supported by MobileIron.
Lock screen messages can include:l

Lost device message: Instructions regarding the return of the device if lost.

l

Asset tag information: A unique identifier for the device.

You can create more than one lock screen message, and prioritize the application of each.
NOTE: This feature is supported on supervised devices running iOS 9.3 through the most recently
released version as supported by MobileIron.
Procedure
1. Go to Policies & Configs > Policies.
2. Click Add New.
3. Select iOS and macOS > iOS Only > Lock Screen Message.
The New Lock Screen Message Policy dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 267

Configuring notification settings

4. Define a lock screen message policy, using the following table as a guideline.
Item

Description

Name

Enter a name for the lock screen message.

StatusSelect Active to enable the lock screen message, or Inactive
to disable it.

Priority

Set the priority of the lock screen message policies if there ismore than one policy.
If you want to place greater priority on this lock screen
message policy than another, select Higher than, and thenselect the lock screen message policy over which this policy
will take priority.
If you want to place lesser priority on this lock screen
message policy than another, select Lower than, and thenselect the lock screen message policy that will be used
before the one you are defining.

Description

Enter a description for the lock screen message policy.

Lost Device Message

Enter the text you want to be displayed on the lock screen
and login window, for example “If found, return to Acme Inc.”

Asset Tag Information

Enter a unique identifier for the device. This identifier will be
displayed on the lock screen.
You can use variables, such as the following:• $DEVICE_SN$• $DEVICE_ID$• $DEVICE_UUID$• $DEVICE_UDID$• $CUSTOM_DEVICE_Atributename$
You can also use text or variable combinations, such as thefollowing:• $DEVICE_ID$:$DEVICE_UUID$• $DEVICE_ID$_$DEVICE_UUID$

5. Click Save.
6. Go to Actions > Apply To Label.
7. Select the label or labels to apply from the Apply To Label dialog.
8. Click Apply.

Configuring notification settings
For each app installed on an iOS device, you can configure notification settings, such as whether to display alerts
in the iOS Notification Center and on the locked screen.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 268

Configuring notification settings

NOTE: This feature is supported on supervised devices running iOS 9.3 through the most recently
released version as supported by MobileIron.
Procedure
1. Go to Policies & Configs > Policies.
2. Select Add New > iOS and macOS > iOS Only > Notification Settings.
The New Notification Settings Configuration dialog box opens.
3. Define the status and priority of the notification setting, using the following table as a guideline.
Item

Description

Name

Enter a name for the notification message, for example,"Lock Screen message."

StatusSelect Active to enable the notification settings
configuration, or Inactive to disable it.

Priority

Set the priority of the notification settings configuration if
there is more than one policy.
If you want to place greater priority on this lock screen
message policy than another, select Higher than, and thenselect the lock screen message policy over which this policy
will take priority.
If you want to place lesser priority on this lock screen
message policy than another, select Lower than, and thenselect the lock screen message policy that will be used
before the one you are defining.

Description

Enter a description for the lock screen message policy.

4. Under the Notification Settings header, select The settings specified for the first app will be applied
to all apps added after it. This means that whatever notification settings you set for the first app added
become the default setting for all subsequent apps. Once saved, any edits to the first app will not impact
the second or third saved apps.
5. Click Add+ to configure notification settings for an app.
The New App Notification Settings Configuration dialog box opens.
6. In the Bundle Identifier drop-down, select an app whose notifications you want to configure. Alternately,
type in the app name into the field.
7. Select the Notifications Enabled check box. The notification settings become enabled.
8. Choose the notification features you want to enable for the app, using the following table as a guideline.
iOS version

Item

Description

iOS All Versions

Show in Notification
Center

Select to show notifications for this app in
the Notification Center on iOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 269

Configuring notification settings

iOS version

iOS 12Item

Description

Sounds Enabled

Select to allow notifications to produce an
audible alert on iOS devices.

Badges Enabled

Select to allow notification to be displayedon the app icon in badge form.

Show in Lock Screen

Select to display notifications for this app
when the iOS device screen is locked.

Alert TypeClick the drop-down to select the type of
notification you want to be displayed forthe app: None, Banner, or Alert.

Allow critical alerts to beenabled (ignore "Do Not
Disturb")

Select to mark the notification as criticaland to ignore Do Not Disturb and ringer
settings. Applicable for iOS 12 through themost recently released version as
supported by MobileIron.

Show critical alert whenusing CarPlay

Select to indicate the critical alert displays
when device user is using CarPlay.
Applicable for iOS 12 through the mostrecently released version as supported by
MobileIron.

Group Type

Select from the drop-down the type ofgrouping for this notification:• Automatic: Notifications from eachapp will appear in groups based on app
alerts. For example, if the device user
has multiple iMessage conversations
going on with people, the notifications
might be grouped by app (iMessage)
but separated by person.
• By App: All notifications from eachapp will be grouped into single
expandable alerts. This means all
incoming notifications from a specific
app are grouped together rather thanintelligently separated.
• Off: Notifications appear in the order
they are received, without grouping.
This setting disables Notification
Grouping for the selected app entirely,
which means the devuce user's
incoming notifications for that app will
all come in individually, like they did in

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 270

Working with Windows Update policies

iOS version

Item

Description
iOS 11.
Applicable for iOS 12 through the mostrecently released version as supported by
MobileIron.

iOS 14Preview Type

Select to preview type to display in device
notification message previews.
lNone - No setting selected. The
device user controls the display
message previews as per user
settings for the apps on the device.

l

Always (default) - Display message
previews.

lWhen Unlocked - Display message
previews only when a device isunlocked.

lNever - Prevent apps from displaying
message previews in Notifications.

9. In the App Notifications Settings dialog box, click Apply. In the New Notifications Settings Configurations
dialog box, the new notification setting displays in the Bundle Identifier section.
10. Add+ any additional apps to the Bundle Identifier section.
11. In the New Notification Settings Configuration dialog box, click Save.
12. Go to Actions > Apply To Label.
13. Select the label or labels to apply from the Apply To Label dialog box.
14. Click Apply.

Working with Windows Update policies
This feature is not supported on iOS devices.
This feature is not supported on macOS devices.

Notifications of changes to the privacy policy
Device users receive notifications when you make changes to the privacy policy and the MDM enrollment profile in
MobileIron Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 271

Notifications of changes to the privacy policy

FIGURE 11. PRIVACY POLICY WINDOWS

Device users will receive a privacy policy change notification under the following circumstances:ll

any changes to the iOS Installed App Inventory option in the privacy policy settings on MobileIron Core,
except for changes to the list of managed appschanges to the Location option in the privacy policy settings in MobileIron Core, including changes to the
iOS location-based wake-up policy.
When making changes to the location settings, bear in mind that the location of an iOS device is always
accessible by the company, except under the following circumstances:olocation sync is disabled, and location-based wake-ups are disabled,ORolocation sync is disabled, and location-based wake-ups are enabled for iOS 5 through iOS 6 devices.
NOTE: If the device user declines MobileIron Core access to their location, they will receivea notification regarding changes to the privacy policy.

ll

applying or removing privacy policies from a label, only if this results in changes to the privacy policies
applied to the device.
enabling the following MDM Profile Setting access rights:oAllow device eraseoAllow device lock and passcode removaloAllow query of device informationoAllow inspection of installed applications

NOTE: Changes involving only the removal of line items from policies will not produce user notifications.
For example, if you remove Allow Device Erase from the MDM Profile Setting, users will notreceive a notification of changes to the privacy policy.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 272

Privacy policy change notifications on iOS: the admin view

Privacy policy change notifications on iOS: the admin view
When making changes that will result in a user notification, MobileIron Core shows a message letting you knowthat users will receive privacy policy change notifications. The message asks you to confirm or cancel the change.

FIGURE 12. PRIVACY POLICY CHANGED WINDOW

Click Save to go ahead with the change or Cancel to leave the privacy policy as is.

Privacy policy change notifications on iOS: the device user view
When changes are made to the privacy policy, device users receive a notification such as the following:

FIGURE 13. MOBILE@WORK IOS DEVICE

Notifications are displayed when the app is in the foreground or background. When the app is in the foreground, thenotification is always displayed in modal alert style. When the app is in the background, the notification format iscontrolled by iOS Notification Center settings, where users can disable these notifications if desired.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 273

Exporting the devices in the WatchList

Exporting the devices in the WatchList
The number in the WatchList field indicates the number of devices for which the configuration is still in queue.
This feature is supported on macOS devices.
To export the WatchList:
1. In the MobileIron Core Admin Portal, go to Policies & Configs > Configurations.
2. Click the number in the WatchList field for the configuration for which you want to export the WatchList.
The Pending Devices window appears. The window displays a list of devices for which the configuration isqueued.
3. Click Export to export the list of devices.
4. The list is downloaded as .CSV file.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 274

12Managing Compliance
MobileIron Core uses compliance policies to ensure that managed devices comply with security and administratordefined compliance policies. Actions you define in policies, such as placing a device in quarantine, take effectwhen a device is non-compliant.
Refer to the following technical note for more information on compliance:
https://help.mobileiron.com/s/article-detail-page?Id=kA134000000QyFvCAK
The topics in this chapter include the following advanced topics:lManaging device compliance checkslTiered compliancelCompliance actions policy violationslViewing quarantine informationlViewing configurations removed due to quarantinelCustom compliance policies

NOTE: The features described in this section are supported on macOS devices.

Managing device compliance checks
Devices are checked for compliance with assigned policies each time they check in with MobileIron Core. In
addition, Core checks all devices for compliance at regular intervals to detect out-of-compliance devices that havenot checked in with Core.
Using MobileIron Core, you can:lupdate device compliance status at any timelset the timing for device compliance checkslupdate the device last check-in and policy update time

NOTE: Core receives information regarding device compliance status and last check-in only after
devices actually check-in with Core. While you can request a device check-in using the Admin
Portal, many factors can affect whether a device actually checks in, such as network
connectivity, or whether a device is switched on or off.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 275

Setting the device compliance check interval

Setting the device compliance check interval
By default, all devices are checked for policy compliance every 24 hours. You can change the time between
compliance checks. The Compliance Check Interval setting applies to compliance checks by the server only. Outof compliance conditions include:lDevice is out of contact for the time limit you set.

lDevice’s root detection logic has found an issue.

lDevice Admin privileges have been lost.

lDevice has been decrypted.

lDevice OS version is below the expected version.

NOTE: It is best to run LDAP Sync and the compliance check at different times to avoid any potential
Core performance problems.
Procedure
1. In the Admin Portal, go to Policies & Configs > Compliance Actions.
2. Click Preferences.
3. In Edit Compliance Preferences, select one of the timings for Compliance Check Interval (2, 4, 8, 12
or 24 hours).
NOTE: Checking the compliance status of all devices every two or four hours may impact Core
performance.
4. Click Save.

Updating device compliance status
You can manually request a device check-in to update device compliance status for one device, several devices,or all the devices registered to Core. Updating device compliance status enables:llladministrators to update the compliance status of any device without waiting for the scheduled compliancecheck to run
users to return to productive work when a compliance check is resolved, rather than wait for the nextscheduled compliance checkadministrators to update the following information about a device:o

Last check-in, updated when the device checks inoPolicy update time

Without the ability to update device status, the device in the following example could be locked for almost 24 hours
after complying with the defined security policy:la device status is jailbreak when Monday’s daily compliance check is done (the compliance check is set
for 24 hours)

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 276

Compliance triggers and actionslthe device is blocked when this status is detected, due to the defined security policylthe device is brought back into compliance two hours after Monday’s compliance checklthe user cannot use the device until the Tuesday daily compliance check is run 22 hours from the time thedevice is back in compliance

Procedure
1. In the Admin Portal, go to Device & Users > Devices.
2. Select one or more devices to update.
3. Select Actions > Check Compliance.
4. A message is displayed, letting you know that the compliance check has begun.
NOTE: The compliance status of the chosen devices may not change for one to two minutes after
selecting Check Compliance.
To update device compliance information for all devices:
1. In the Admin Portal, go to Policies & Configs > Compliance Actions.
2. Click Check Compliance to display a message asking if you want to update compliance status for all
devices.
3. Click Yes to check compliance status for all devices or click No to cancel the action.
NOTE: The compliance status of the devices may not change for one to two minutes after selecting
Check Compliance.

Compliance triggers and actions
Compliance actions, configured by the administrator, may be implemented locally on the device by Mobile@Work
when certain system events have occurred that cause a compliance verification check, and only when the Enforce
Compliance Actions Locally on Devices check box is selected for compliance action. Compliance verification
checks also occur at the device check-in interval. Out of compliance conditions include:lOut of Contact: the device has had no communication with the MobileIron Core server for greater than thetime period selected which is specified in days.

lCompromised: the device is suspected to be rooted or an app has been installed for rooted devices.

l

Device Admin lost: the device administration privileges have been revoked.

lDecrypted: it has been detected that the device is no longer encryptedl

OS Version: the version of the operating system on the device is below the expected version

Server compliance conditions and actions
Server compliance actions resulting from compliance conditions are listed in the table below.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 277

Server compliance conditions and actions

TABLE 24. SERVER COMPLIANCE CONDITIONS AND ACTIONS
Action and OS

Out ofContact

Compromised

Device Admin
lost

Decrypted

OS Version

Wipe

Wipe theWipe the device

The device

Wipe theWipe the(Android only,
when enabling
Android custom
ROM)

device when it

when the device

cannot be

device when it

device whenhas been out ofhas been

wiped when thehas been

the OS version

contact.

compromised.

administrator

detected thatis less thanprivileges havethe device has

expected.

been removed.

been
decrypted.

Alert• Android• iOS

Send an alert

Send an alert

Send an alert

Send an alert

Send an alert

when thewhen the device

when

when it has

when the OS

device is out ofhas been

administrator

been detectedversion is lesscontact.

compromised.

privileges havethat the device

than expected.

been removed.

as beenYou can send

You can sendalerts to device

alerts to device

You can send

users, admins,

users, admins,

alerts to device

You can send

users, admins,

or both users

or both users

users, admins,

alerts to device

or both users

and admins,

and admins,

or both users

users, admins,

and admins,

using SMS,

using SMS,

and admins,

or both users

using SMS,

push

push

using SMS,

and admins,push

notifications, ornotifications, or

push

using SMS,

notifications, oremail.

email.

notifications, or

push

email.

email.

notifications, ordecrypted.

You can sendalerts to device

email.
Remove Apps
• Android• iOS
Removal ofapps is only possible if the MDM
profile is sent byCore and ispresent on thedevice OR if theapp settings
have the"Remove app
when device isquarantined ofsigned-out"
check box selec-

RemoveRemoveManaged apps

RemoveRemovemanaged apps

managed appscannot be

managed apps

managed apps

when thewhen the device

removed when

when thewhen the OS

device is out ofhas been

administrator

device hasversion is lesscontact.

compromised.

privileges havebeen

than expected.

been removed.

decrypted.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 278

Server compliance conditions and actions

Action and OS

Out ofContact

Compromised

Device Admin
lost

Decrypted

OS Version

Quarantine All• Android• iOS

Remove all

Remove All

Remove All

Remove All

Remove All

configurations

configurations

configurations

configurations

configurations

when thewhen the device

when

when thewhen the OS

All Android
Enterprise apps
and functionality
are hidden,
exceptDownloads,
Google PlayStore, andMobile@Work.

device is out ofhas been

administrator

device hasversion is lesscontact.

compromised.

privileges havebeen

than expected.

been removed.

decrypted.

ted.

(Applicable only
if the"Quarantine app
when device isquarantined"
check box isselected.)
Quarantine All
Except Wi-Fi• Android• iOS• macOS

Remove all

Remove all

Remove all

Remove all

Remove allconfigurations

configurations

configurations

configurations

configurations

except for Wi-

except for Wi-Fi

except for Wi-

except for Wi-

except for Wi-

Fi.

when

Fi whenFi when theFi when the OS

compromised.

administrator

device hasversion is lessprivileges havebeen

than expected.

been removed.

decrypted.

(For Android
Enterprise apps,
this isapplicable only
if the"Quarantine app
when device isquarantined"
check box isselected.)
Quarantine All
Except Wi-Fi
on Wi-Fi Only
• Android• iOS• macOS(Applicable only

Remove all

Remove all

Remove all

Remove all

Remove allconfigurations

configurations

configurations

configurations

configurations

except for Wi-

except for Wi-Fi

except for Wi-

except for Wi-

except for Wi-

Fi on Wi-Fi only

on Wi-Fi only

Fi on Wi-Fi only

Fi on Wi-Fi only

Fi on Wi-Fi only

devices.

devices whendevices whendevices whendevices whencompromised.

administrator

the device has

the OS version

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 279

Local compliance conditions and actions

Action and OS

Out ofContact

Compromised

if the"Quarantine app
when device isquarantined"
check box isselected.)
Block or retire
AppConnect
apps
• iOS
"Block" means
blocking accessto AppConnect
apps.

not applicable

Block(unauthorized) or
retire(unauthorize andwipe)
AppConnect
apps

Device Admin
lost

Decrypted

OS Version

privileges havebeen

is less thanbeen removed.

decrypted.

expected.

not applicable

not applicable

not applicable

Local compliance conditions and actions
Local compliance actions do not apply to MobileIron Threat Defense functionality included with Mobile@Work
clients. There are also no local compliance actions for Mobile@Work for macOS devices.
Local compliance enforcement actions resulting from compliance conditions are listed in the table below.

TABLE 25. LOCAL COMPLIANCE CONDITIONS AND ACTIONS
Situation

OS

ActionWhen the device cancommunicate with
Core to perform aCompliance Check

Alert• Android• iOS

Send an alert when the device is out ofcontact.

Block AppConnect apps
• Android• iOS

Blocks access to AppConnect apps.

Quarantine• iOS

When the device is out of contact, allconfigurations, managed apps and iBooks
content are removed. New app downloads are
disallowed.

(Applicable only if the"Quarantine app when device isquarantined" check box isselected.)
Quarantine• Android

Alerts are sent to device users, admins, orboth users and admins, using SMS, push
notifications, or email.

When the device is out of contact, allconfigurations and managed apps are
removed. New app downloads are disallowed.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 280

Local compliance conditions and actions

Situation

OS

Action(Applicable only if the"Quarantine app when device isquarantined" check box isselected.)

When the device canNOT communicate
with Core to perform aCompliance check

Quarantine• Android Enterprise

All Android Enterprise apps and functionality
are hidden, except Downloads, Google PlayStore, and Mobile@Work.

Alert• Android• iOS

Send an alert when the device is out ofcontact.

Block AppConnect apps
• Android• iOS

Blocks access to AppConnect apps.

Quarantine• iOS

When the device is out of contact, allconfigurations, managed apps and iBooks
content are removed. New app downloads are
disallowed.

(Applicable only if the"Quarantine app when device isquarantined" check box isselected.)
Quarantine• Android(Applicable only if the"Quarantine app when device isquarantined" check box isselected.)

Alerts are sent to device users, admins, orboth users and admins, using SMS, push
notifications, or email.

Quarantine action requires all appConnect
apps to be re-installed after the device is backin compliance.
When the device is out of contact, allconfigurations and managed apps are
removed. New app downloads are disallowed.

Quarantine• Android Enterprise

All Android Enterprise apps and functionality
are hidden, except Downloads, Google
settings, Google Play Store, andMobile@Work.

Retire• Android Enterprise

The work profile is deleted or the managed
device will be factory reset.
NOTE: This action is not reversible.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 281

Tiered compliance

Tiered compliance
Administrators can apply multiple compliance actions over time on violating devices using tiered compliance. The
following example describes a possible 3-tiered compliance action:
1. Send device users a warning message that their device is out of compliance, and give them time to fix theviolation.
2. If the device is violating the same policy 24 hours later, Core sends users a second message and blocks
the device.
3. If the device continues to violate the same policy another 24 hours later, Core sends users a third message
and quarantines the device.
The increasing penalties over time allow a user that is unintentionally violating a policy to get back undercompliance before punitive measures are taken, rather than immediately pulling email configurations, for example,
off the device and interrupting normal work flow.
NOTE: Tiers beyond the first one are only used by compliance policy rules, and are not used for security
policies.
Tiered compliance behaviorlllTiered compliance checks do not run based on delay times. For example, if the delay time is 4 hours, Core
does not automatically run a tiered compliance check after 4 hours. Instead, the next compliance check
will occur in one of the following cases:oDevice Check-inoCompliance check from the Devices pageo

Periodic compliance check (if the device has not checked in since the last periodic compliance check)

If a device check-in or compliance check occurs during the interval between two tiers, Core will not takeaction based on the next tier. Core will only take action for the next tier after the delay time between tiers
has elapsed.
Delays between tiers are cumulative. For example, if the delay for tier 2 is 4 hours, and 8 hours for tier 3,then Core takes tier 3 action after 12 hours.

Compliance actions policy violations
You can assign compliance actions for security policy violations and for compliance policy violations. When you
configure access control in either type of policy, you can select default compliance actions that are provided with
MobileIron Core. You can also select custom compliance actions that you create.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 282

Default compliance actions

FIGURE 14. COMPLIANCE ACTIONS POLICY VIOLATIONSNOTE: To create the custom compliance actions, see Custom compliance actions.

Default compliance actions
The following table describes the default compliance actions:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 283

Custom compliance actions

TABLE 26. DEFAULT COMPLIANCE ACTIONS TABLE
Default compliance action

Description

Send Alert

Sends alert that you configured for the policy violation.
To configure the alert, see Policy violations event settings.

Block Email, AppConnect
Apps And Send Alert••

Sends alert that you configured for the policy violation.
Restricts access to email via ActiveSync if you are using a Standalone
Sentry for email access.

NOTE: If you manually block, allow, or wipe a device on the
ActiveSync Associations page, blocking email access in acompliance action has no impact. The manual action
overrides Core's automatic decision-making about access toemail via ActiveSync. See "Overridding and re-establishing
MobileIron Core management of a device" in the MobileIron
Sentry Guide.
• Immediately blocks access to the web sites configured to use thestandard and Advanced AppTunnel feature.
This action blocks tunnels that AppConnect apps and iOS managed appsuse.
• Unauthorizes AppConnect apps.
AppConnect apps become unauthorized when the next app checkinoccurs. When launched, an AppConnect app displays a message andexits. Some iOS AppConnect apps that have portions that involve only
unsecured functionality can allow the user to use only those portions.
AppConnect apps become unauthorized when the next device checkinoccurs. When the device user tries to launch an AppConnect app, theSecure Apps Manager displays a small pop-up message with the reason
the app is unauthorized.
This action impacts AppConnect apps, as well as third-party AppConnect
for Android apps.
Customized complianceactions

These actions can contain 4 tiers of actions. Tiers 2-4 are only used incompliance policies; they are not used by legacy security policies. Security
policies only perform the action defined in tier 1.

Custom compliance actions
You can customize the compliance actions that you want to take for the settings on the Compliance Actions pageunder Policies & Configs. After you create your customized compliance actions, the actions you created appear ina drop-down list in the Access Control section of your security policies.
Custom compliance actions enable you to specify combinations of the following actions:lSend alertl

Block email access and AppConnect apps (includes blocking app tunnels)

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 284

Creating a compliance actionlQuarantine: block email access, block app tunnels, block AppConnect apps, and wipe AppConnect app
datal

Remove configurations (i.e., profiles)lSpecify exceptions for Wi-Fi-only devicesl

iOS 5.0 through the most recently released version as supported by MobileIron: remove managed apps,
and block new downloads

Once you create a set of these actions, you can select that set from the drop downs in the Access Control sectionof security policies.

Creating a compliance action
With custom compliance actions, you can create actions to better manage access control. With tiered complianceactions, you can customize them to include up to 4 levels of action to better manage compliance actions.
NOTE: Access control for macOS devices does not control email.
Procedure
1. Log into the Admin Portal.
2. Go to Policies & Configs > Compliance Actions.
3. Click Add+ to open the Add Compliance Action dialog box.
4. Select the appropriate fields as described in the Add Compliance Action table.
5. If you want to add another set of actions, click the plus (+) button and select the fields, as necessary, tocomplete the second compliance action.
6. If you want to add another set of actions, click the plus (+) button and select the fields, as necessary, tocomplete the third compliance action.
7. Click Save to add the new compliance action for access control and compliance actions.
8. You can select them by going to:ll

Policies & Configs > Policies > policy > Edit > Access Control section (1 tier only).
Policies & Configs > Compliance Policies > Add+ > Compliance Policy Rule > Compliance
Actions drop-down (1-4 tiers).

Add Compliance Action table
The following table describes the Add Compliance Actions options:

TABLE 27. ADD COMPLIANCE ACTION FIELDS
Item

Description

Name

Enter an identifier for this set of compliance actions. Consider specifying theresulting action so that the action will be apparent when you are editing asecurity policy.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 285

Add Compliance Action table

Item

Description

Enforce Compliance
Actions Locally on
DevicesThis feature is not supported on macOS devices.

ALERT: Send acompliance notification oralert to the user

Select if you want to trigger a message indicating that the violation has occurred.
Core sends alerts to users, administrators, or both.

BLOCK ACCESS: Blockemail access andAppConnect apps

This feature is not supported on macOS devices.

Select this to enable the Mobile@Work app to enforce compliance actions on
the device for security violations without requiring action from Core. Core also
continues to enforce compliance actions.

To configure the alert, see Policy violations event settings.

Selecting this option has the following impact to the device:• Restricts access to email via ActiveSync if you are using a Standalone
Sentry for email access.
NOTE: If you manually block, allow, or wipe a device on the ActiveSync
Associations page, blocking email access in a complianceaction has no impact. The manual action overrides MobileIron
Core’s automatic decision-making about access to email via
ActiveSync. See “Overriding and re-establishing MobileIron Core
management of a device” in the MobileIron Sentry Guide.
• Immediately blocks access to the web sites configured to use the standard
and Advanced AppTunnel feature.
This action blocks tunnels that AppConnect apps and iOS managed appsuse.
• Unauthorizes AppConnect apps.
AppConnect apps become unauthorized when the next app checkin occurs.
When launched, an AppConnect app displays a message and exits. SomeiOS AppConnect apps that have portions that involve only unsecured
functionality can allow the user to use only those portions.
AppConnect apps become unauthorized when the next device check inoccurs. When the device user tries to launch an AppConnect app, theSecure Apps Manager displays a small pop-up message with the reason theapp is unauthorized.
This action impacts AppConnect apps, as well as third-party AppConnect forAndroid apps.

QUARANTINE:
Quarantine the device(Select this check box todisplay the other
Quarantine options.)

This feature is not supported on macOS devices.
Selecting this option has the following impact to the device:• Immediately blocks access to the web sites configured to use the standard
and Advanced AppTunnel feature.
This action blocks tunnels that iOS managed apps use.
• AppConnect apps are retired, which means they become unauthorized andtheir secure data is deleted (wiped).
AppConnect apps become unauthorized and their secure data is wiped when
the next app checkin occurs. When launched, an AppConnect app displays

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 286

When the compliance action takes effectItem

Description
a message and exits. Some iOS AppConnect apps that have portions thatinvolve only unsecured functionality can allow the user to use only thoseportions.

QUARANTINE:
Remove All
Configurations and SaaS
Sign-on Policy

Select if you want to remove the configurations (i.e., profiles) that provide
access to corporate resources. Requires AppConnect apps to be re-installed
after the device is back in compliance.

QUARANTINE:
Do not remove Wi-Fi
settings for Wi-Fi only
devices

Select if you want to retain the Wi-Fi configurations devices that do not havecellular access. Select this option to ensure that you can still contact thesedevices.

QUARANTINE:
Do not remove Wi-Fi
settings for all devices(iOS and Android only)This feature is not supported on macOS devices.

QUARANTINE:
Remove iBooks content,
managed apps, and block
new app downloads

This feature is not supported on macOS devices.

Retire:Retire the Work profile orfactory reset the managed
deviceThis feature is not supported on macOS devices.

The iOS version determines how MobileIron decides whether a device supports
Wi-Fi only. Prior to iOS 4.2.6, the device model (e.g., iPod) is used.

Select this option to retain the Wi-Fi configurations for any device, regardless ofwhether it has cellular access. You might select this option to preserve limited
network access despite the policy violation.

Select this option to remove iBooks content and Managed Apps from the device
as well as block access to Apps@Work when the device is not compliant.

When the compliance action takes effect
When you first apply a security policy, several factors affect the amount of time required to communicate thechanges to targeted devices:lsync intervalltime the device last checked inlbattery levellnumber of changes already queuedlthe app check in interval for AppConnect for iOSlwhether Enforce Compliance Actions Locally on Devices is selected.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 287

Viewing quarantine information

Once the change reaches the device, MobileIron Core checks the device for compliance. If the device is out ofcompliance, then the action is performed.
If the action for a security violation can be enforced locally on the device, and that option is selected in the
Compliance Action dialog, then Mobile@Work initiates the compliance action without requiring contact with
MobileIron Core.

Viewing quarantine information
Devices that have had configurations removed due to policy violations are considered quarantined. You can view
quarantine information in the following places:lDevice & Users > Devices pagel

Policies & Configs > Configurations pagel

Dashboard page

Procedure
1. Go to Device & Users > Devices.
2. Click Advanced Search
3. Enter the search phrase: “common.quarantined” = true
4. Click Search.
To view information about an individual quarantined device:
1. Go to Device & Users > Devices.
2. Note devices that have been highlighted and appear with a quarantine icon.
3. Expand the device details for a quarantined device.
4. Click the Configurations tab in the device details panel to see which configurations have been removed
due to quarantine.

Viewing configurations removed due to quarantine
You can view the configurations that MobileIron Core has removed due to quarantine on the Configurations page.
1. Go to Policies & Configs > Configurations.
2. Click a number link in the Quarantined column to display a list of devices that have had the configuration
removed.

Dashboard page: Device by Compliance chart
To see how many devices are quarantined:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 288

Custom compliance policies

1. Go to Dashboard.
2. View the Device by Compliance chart. (If the chart is not visible, click Add to add it.)
3. To see a list of all quarantined devices, click the quarantined category.

Custom compliance policies
Core provides security policies for 10 static definitions to mark a device as non-compliant. These policies have
limited customization options, but are a quick and easy way to begin to set up compliance policy rules. The
Compliance Policies feature allows administrators to define their own criteria for marking devices non-compliant.
They can combine dozens of device and user fields to create non-compliant matching criteria.
Compliance policy rules use the Advanced Search filter criteria to define non-compliant devices. Eachcompliance policy rule has a filter criteria and an associated compliance action object. Access compliance policies
by selecting Policies & Configs > Compliance Policies from the Admin Portal.
Core uses custom device and user attributes to set up compliance policy rule conditions. These settings, listed
under Devices & Users > Devices > Advanced Search > User Fields > LDAP > User Account Control in
the Admin Portal, are:l

Account DisabledlLocked OutlPassword Expired

Compliance policies are enforced by Core during device check-in.
The work flow to set up and use compliance policies is:lAssigning compliance roleslManaging compliance policy ruleslManaging compliance policy groupslDevice search fields for compliance rules

Assigning compliance roles
The following describes how to assign compliance roles.
Procedure
1. Log into the Admin Portal.
2. Go to Admin > Admins.
3. Select a user then click Actions > Edit Roles.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 289

Managing compliance policy rules

4. Select an Admin Space.
5. Scroll down the window to the Compliance Policy Management section.

6. Select one or more of the roles:lView compliance policy: Allows the selected user to view rules, groups, lists, and configuration.

lModify compliance policy: Allows the selected user to create, edit, and delete rules and groups.

lApply and remove compliance policy labels: Allows the selected user to add or remove groups
from labels.

7. Scroll to the Settings and Services Management section.
8. Select View settings and services.
9. Click Save.

Managing compliance policy rules
Compliance policy rules are the building blocks in compliance policy groups used to manage device compliance.
Administrators create compliance policy groups, add compliance policy rules to the groups, apply the groups tolabels pushed to devices. Administrators can create a group with no rules or add compliance policy rules while

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 290

Managing compliance policy rules

creating the compliance policy group, if rules have already been created. They can also modify the group, including
the name, description, and selected rules. This section describes:lCreating compliance policy ruleslSubstitution variables for compliance policy ruleslViewing and modifying compliance policy ruleslDeleting compliance policy ruleslSearching for compliance policy rules

Creating compliance policy rules
A single rule can be in multiple compliance policy groups.
Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies.
3. Click Compliance Policy Rule tab and then click Add+.
4. Add a unique name in the Rule Name field.
5. Select the Status to Enabled or Disable.
6. Enter a description of the rule if desired.
7. Build a Condition using Advance Search to define non-compliance.
NOTE: It is recommended to have one Condition set to include when Mobile@Work lastchecked in within the last 30 days. See the TIP below.
8. In the Compliance Actions field, select from the drop-down to use on devices matching the condition.
9. (Optional) In the Message field, enter text for alerts generated by violations of the policy rule.
When configuring the message accompanying the compliance action, custom attributes (see Adding
custom attributes to users and/or devices) and substitution variables can be inserted into the text. To dothis, copy the appropriate variable (see the Substitution variable table) located to the right of the Message
field and paste it into the text box. Before sending the message to the device, Core will replace thesubstitution variable to the actual value of the custom attribute for that device. For example, $FIRST_
NAME$ would insert the first name of the target user into the message.
10. If you don't want the search results to include retired devices, select the Exclude retired devices fromsearch results check box.
11. Click Save.
TIP: It is recommended to have a Compliance Policy Rule with one condition set to include when
Mobile@Work last checked in with Core. This is helpful if you need assurance that Mobile@Work is
running on devices (for example, for use in MobileIron Threat Defense).

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 291

Managing compliance policy rules

Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies.
3. Click Compliance Policy Rule tab and then click Add+.
4. Enter ClientLastCheckIn in the Rule Name field.
5. Enter Condition > All.
6. Go to Field and type in "Client Last Check-In" or select Common Fields > Client Last Check-In.
The regular expression is listed below; green check mark indicates regular expression is accepted.
7. Select within the last in the Value field; enter 30 days in the remaining two fields.
8. Keep the default setting of Exclude retired devices from search results.
9. In the Compliance Actions field, select Send Alert from the drop-down.
10. Click Save.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 292

Substitution variables for compliance policy rules

Substitution variables for compliance policy rules
TABLE 28. SUBSTITUTION VARIABLES FOR COMPLIANCE POLICY RULES
Category

Substitution variable

Compliancepolicy rulecustomized
message

The substitution variables are available for use in compliance policy rules for all devices. To
use in a compliance action message, copy/paste the variable into the Message field.
• $CN$• $CONFIG_UUID$• $DEVICE_CLIENT_ID$• $DEVICE_ID$• $DEVICE_IMEI$• $DEVICE_IMSI$• $DEVICE_MAC$• $DEVICE_PIVD_ACTIVATION_LINK$• $DEVICE_SN$• $DEVICE_UDID$• $DEVICE_UUID$• $DEVICE_UUID_NO_DASHES$• $DISPLAY_NAME$• $EMAIL$• $EMAIL_DOMAIN$• $EMAIL_LOCAL$• $FIRST_NAME$• $GOOGLE_AUTOGEN_PASSWORD$• $ICCID$• $LAST_NAME$• $MI_APPSTORE_URL$• $MODEL$• $NULL$• $OU$• $PASSWORD$• $PHONE_NUMBER$• $RANDOM_16$• $RANDOM_32$• $RANDOM_64$• $REALM$• $SAM_ACCOUNT_NAME$• $TIMESTAMP_MS$• $USERID$• $USER_CUSTOM1$• $USER_CUSTOM2$• $USER_CUSTOM3$• $USER_CUSTOM4$• $USER_DN$• $USER_LOCALE$• $USER_UPN$

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 293

Managing compliance policy groups

Viewing and modifying compliance policy rules
You can view or modify a compliance policy rule. Viewing a rule requires the View role and modifying a rule requires
the Modify role.
You can modify a rule without removing it from an assigned group. For instance, you can change its status from
Enabled to Disabled to troubleshoot it. When you modify a rule, the change is applied to all the groups that use therule.
To view or modify a compliance policy rule:
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Rule.
3. Select the name of the rule you want to modify and click Edit.
4. Modify details, as necessary, including disabling the rule.
5. Click Save.
Deleting compliance policy rules
To delete one or more compliance policy rules:
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Rule.
3. Select the name of one or more rules to delete.
4. Click Actions > Delete.
Searching for compliance policy rules
To search for compliance policy rules:
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Rule.
3. Enter a name in the search field.
4. Use one of the following filters:
l

All

l

EnabledlDisabled

5. Click Search.

Managing compliance policy groups
Compliance policy groups are applied to devices to manage device compliance. Administrators create compliancepolicy groups, add compliance policy rules to the groups, apply the group's rules to devices matching the label

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 294

Managing compliance policy groups

criteria.
Administrators can create a group with no rules or add compliance policy rules while creating the compliance policy
group, if rules have already been created. They can also modify the group, including the name, description, andselected rules. This section describes:lCreating compliance policy groupslModifying compliance policy groupslAdding compliance policy rules to a grouplApplying compliance policy groups to labelslRemoving compliance policy groups from labelslDeleting compliance policy groupslSearching for compliance policy groups

Creating compliance policy groups
You can create a group without adding rules, which can be added later. One rule can be member of multiple
groups.The following provides the steps to add one or more compliance policy rules to a compliance policy group.
Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies.
3. Click Compliance Policy Group tab.
4. Click Add+. The Add Compliance Policy Group page displays.
5. Enter a unique name in the Group Name field.
6. Select Enabled in the Status field.
7. Move one or more rules from Available Rules to the Selected Rules list.
8. Click Save.
Modifying compliance policy groups
The following provides the steps to modify compliance policy groups.
Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Select the name of the group you want to modify.
4. Modify details, as necessary, including the name, description, or to enable or disable the group.
5. Click Save in the Details section.
6. Click Edit in the Rules section.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 295

Managing compliance policy groups

7. Modify rules, as necessary, by adding or removing rules.
8. Click Save in the Rules section.
Adding compliance policy rules to a group
One rule can be a member of multiple groups. This procedure requires that you have already created one or morerule. See Creating compliance policy rules for details.
To apply a compliance policy rule to a compliance policy group:
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Double-click the name of the group to which you want to add one or more rules.
4. Go to the Rules section and click Edit.
5. Move one or more rules from the Available Rules list to the Selected Rules list.
6. Click Save in the Rules section.
Applying compliance policy groups to labels
Once a group (and its underlying rules) is assigned to devices, status of the devices are evaluated based on theconditions in the rules for compliance. Compliance Policy rules are evaluated against each device in the following
ways:
l

l

l

During device check-in
Periodically, during the compliance policy check interval. This is set at Policies & Configs >Compliance Actions > Preferences.
When a manual Check Compliance is initiated by the administrator. This can be set at Policies &Configs > Compliance Actions > Check Compliance or on the Devices page under Actions.

Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Select the name of the compliance policy group you want to apply to label.
4. Click Actions > Apply to Labels.
5. Select one or more of the labels.
6. Click Apply.
Removing compliance policy groups from labels
Once a group (and its underlying rules) is assigned to devices, status of the devices are evaluated based on theconditions in the rules for compliance. The following describes the steps to apply a compliance policy groups to one
or more labels.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 296

Device search fields for compliance rules

Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Select the name of the compliance policy group you want to remove from a label.
4. Click Actions > Remove from Labels.
5. De-select one or more of the labels.
6. Click Apply.
After the next device check in, these changes will apply.
Deleting compliance policy groups
The following provides the steps to delete one or more compliance policy groups.
Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Select the name of one or more groups to delete.
4. Click Actions > Delete.
Searching for compliance policy groups
The following provides the steps to search for compliance policy group.
Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Enter a name in the search field.
4. Use one of the following filters:
l

All

l

EnabledlDisabled

5. Click Search.

Device search fields for compliance rules
This section includes the compliance action objects the compliance policy rules use for device search fields. In
addition to the fields listed in the below table, any Custom Device Attributes or Custom User Attributes that wereadded in Settings > System Settings > Users & Devices > Custom Attributes will also be available forsearching.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 297

Device search fields for compliance rules

The following table lists the available objects, including:lCommon fieldslCustom fieldslAndroid devicesl

iOS deviceslWindows deviceslUser fields (including LDAP fields)

TABLE 29. DEVICE SEARCH FIELDS FOR COMPLIANCE RULES
Category

Compliance policy objects

CommonThe following search fields are available for use in compliance rules for all devices:cellular_technology, client_name, client_build_date, client_version, creation_date, current_
country_code, current_country_name, country_name, current_operator_name, carrier_short_
name, current_phone_number, current_phone_number, data_protection_enabled, data_protection_reasons, device_admin_enabled, device_encrypted, device_is_compromised, eas_
last_sync_time, ethernet_mac, home_country_code, home_country_name, home_operatory_
name, home_phone_number, imei, imsi, language, last_connected _at, locale, location_last_captured_at, manufacturer, mdm_managed, mdm_tos_accepted, mdm_tos_accepted_date,model, model_name, os_version, owner, pending_device_passcode, pending_device_passcode_expiration_time, platform_name, platform, registration_date, registration_imsi,
retired, roaming, security_state, status, uuid, wifi_mac_address

Android

The following search fields are available for use in compliance rules for all Android devices:admin_activated, attestation, afw_capable, brand, Client_version_code, device_roaming_flag,knox_version, manufacturer_os_version, mdm_enabled, multi-mdm, os_build_number, os_
update_status, registration_status, samsung_dm, secure_apps_encryption_enabled, secure_apps_encryption_mode, security_detail, security_patch, usb_debugging, dpm_encryption_
statusiOS

The following search fields are available for use in compliance rules for all iOS devices:BluetoothMAC, BuildVersion, CarrierSettingsVersion, Current MCC, Current MNC,
DataRoamingEnabled, data_protection, forceEncryptedBackup, iCloud Backup Is Enabled,
iOSBackgroundStatus, iPhone PRODUCT, iPhone VERSION,
IsDeviceLocatorServiceEnabled, IsDEPEnrolledDevice, IsDoNotDisturbInEffect,
IsMDMLostModeEnabled, IsMDMServiceEnrolledDevice, iTunesStoreAccountIsActive,
ProductName, PasscodePresent, PasscodeIsCompliantWithProfiles, PasscodeIsCompliant,Personal Hotspot Enabled, SerialNumber, Supervised, SIM MCC, SIM MNC, Subscriber
Carrier Network, Voice Roaming Enabled, osUpdateStatus,

Windows

The following search fields are available for use in compliance rules for all Windows devices:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 298

Device search fields for compliance rules

TABLE 29. DEVICE SEARCH FIELDS FOR COMPLIANCE RULES (CONT.)
Category

Compliance policy objects
dm_client_version, wp_firmware_version, wp_hardware_version, wp_os_edition, health_data_
issued, health_data_aik_present, health_data_dep_policy, health_data_bit_locker_status,
health_data_boot_manager_rev_list_version, health_data_code_integrity_rev_list_version,
health_data_secure_boot_enabled, health_data_boot_debugging_enabled, health_data_os_
kernel_debugging_enabled, health_data_code_integrity_enabled, health_data_test_signing_enabled, health_data_safe_mode, health_data_win_pe, health_data_elam_driver_loaded,health_data_vsm_enabled, health_data_pcr0, health_data_sbcp_hash,User

The following search fields are available for use in compliance rules user-related fields, including
LDAP:email_address, user_id, attr_dn, dn, name, locale, principal, upn, account-disabled, locked_out,
password_expired, custom1, custom2, custom3, custom4, <dynamically created custom userattribute field name #1>, <dynamically created custom user-attribute field name #2>,
<dynamically created custom user-attribute field name #3>, <dynamically created custom userattribute field name #4>, <dynamically created user-attribute field names>

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 299

13Managing Device Settings with Configurations
This section addresses the automation of major settings via configurations that can then be applied to a large
inventory of different devices.
lManagement of device settings with configurationslConfigurations pagelDefault configurationslEditing default iOS MDM settingslRestoring system web clips (iOS)l

Displaying configurations statusl

Adding new configurationslEditing configurationslDeleting configurationslExporting configurationslImporting configurationslApplying configurations to labelsl

Exporting the devices in the WatchListlImpact of changing LDAP server variables

Management of device settings with configurations
This feature is supported on macOS devices.
Configuring major settings across a large inventory of different devices can mean a major daily time investment for
IT personnel. You can automate this process by specifying and distributing configurations, previously called app
settings. A configuration is a group of settings to be applied to devices.
The following table summarizes the device settings managed by MobileIron Core. Configurations are found on the
Policies & Configs > Configurations page.

TABLE 30. DEVICE SETTINGS
Category

Configuration TypeInfrastructure•••

Exchange
Email
Wi-Fi

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 300

Configurations page

TABLE 30. DEVICE SETTINGS (CONT.)
Configuration Type

Category

•
•
•

VPN
Certificates
Certificate Enrollment

MobileIron AppConnect••

App Configuration
Container Policy

MobileIron Features••

Docs@Work
Web@Work

iOS and macOS

•
•
•
•
•
•

GeneralCalDAV
CardDAVWeb Clips
Configuration ProfileLDAPiOS Only

•
•
•
•
•
•
•
•
•
•

AirPlay (starting with iOS 7)
AirPrint (starting with iOS 7)
APN
Provisioning Profile
Restrictions
Subscribed Calendars
Web Content Filter (starting with iOS 7)
Managed App Config (starting with iOS 7)
Managed Domains
Single Sign-On Account (starting with iOS 7)

Configurations page
A configuration (previously called app settings) is a group of settings that are applied to devices. Go to the Policies& Configs > Configurations page to create and manage configurations. It displays the following information foreach configuration.

TABLE 31. CONFIGURATIONS PAGE OPTIONS
Field

Description

Name

Indicates a name for this group of settings.

Configuration Type

Indicates the kind of configuration.

Bundle/Package ID

If this configuration is links to a App Catalog entry, the Bundle/Package ID will
display here.

Description

Displays additional information about this group of settings.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 301

Default configurations

TABLE 31. CONFIGURATIONS PAGE OPTIONS (CONT.)
Field

Description# Phones

Indicates the number of phones to which this group of settings has been
applied. Click the link to display a list of the devices.

LabelsLists the labels to which this group of settings has been applied.

WatchList

Displays the number of devices for which this group of settings is queued.
Click the link to display a list of the devices.

Quarantined

Displays the number of devices that have had configurations removed due topolicy violations. Click the link to display a list of the devices. See Creating acompliance action for information on quarantining devices.

Required role: Administrator must have the View configuration role to access the Configurations page.

Default configurations
NOTE: The features described in this section are supported on macOS devices.
MobileIron Core provides the following default configurations. The names of these default configurations start with
“System - “.

TABLE 32. DEFAULT CONFIGURATIONS
Configuration NameType

Description

System - iOS Enrollment
CA Certificate

CERTIFICATE

System certificate to support the built-in CA server.

System - iOS EnrollmentSCEP

CERTIFICATEENROLLMENT

System settings for the built-in SCEP server. Note thatthe default URL contains HTTP. Do not change this to
HTTPS without configuring a third-party certificate. The
default is a self-signed certificate, which iOS does notsupport with HTTPS.

System - iOS Enterprise
AppStore

WEBCLIP

System settings for Apps@Work web clip.

System - iOS Enterprise
AppStore SCEPCERTIFICATEENROLLMENT

This SCEP setting is automatically created for the iOS
Enterprise App Store certificate.
NOTE: If the iOS label is removed from this default
configuration, MobileIron Core will re-apply
the iOS label following system or web server
reboot, and after upgrading from a previous
version to the current version of MobileIron
Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 302

Editing default iOS MDM settings

TABLE 32. DEFAULT CONFIGURATIONS (CONT.)
Configuration NameType

Description

System - iOS MDM

MDMDefault MDM profile for iOS MDM.

System - TLS Trust
Certificate Chain for Mobile
Management

CERTIFICATEThis certificate chain is used so that mobile devices willtrust requests from MobileIron Core.

System - Multi-User SecureSign-InWEBCLIP

System settings for Secure Sign-In web clip, whichenables access to multi-user function for iOS devices.
See “Multi-User Support” for more information.

Editing default iOS MDM settings
iOS MDM settings are editable, though, in most cases, you should not change access rights here.
Besides the initial iOS / macOS device registrations, the MDM profile is pushed to the device duringll

Mobile@Work re-enroll option
Changing of the MDM access rights. Choosing less access rights results in the MDM profile being updated
automatically; more access rights require a user prompt which is done via Mobile@Work. If the device
does not have Mobile@Work, the MDM profile does not get updated until the device is retired and reregistered.

NOTE: A re-push of the MDM profile will result in any applications with the Send installation request or
send convert unmanaged to managed app request (iOS 9 and later) on device registration orsign-in option selected. A repush of the MDM profile is considered a re-registration for the app
install process. For more information, see the MobileIron Apps@Work Guide.
To edit the default iOS MDM settings:
1. Go to Policies & Configs > Configurations.
2. Select the System - iOS MDM configuration.
3. Click Edit to open the Modify Profile MDM Setting dialog box.
4. If changing an access right is necessary, select an access right in the Available list and click theappropriate arrow to move the access right to the Selected list. The following table summarizes theseaccess rights.
Access Right

Notes

Allow inspection of installed configuration
profiles.

Enables inventory of configuration profiles.

Allow installation and removal of

Enables overall configuration tasks.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 303

Editing default iOS MDM settings

Access Right

Notes

configuration profiles.
Allow device lock and passcode removal.

Enables remote lock and unlock capabilities.

Allow device erase.

Enables remote wipe.

Allow query of Device Information.

Enables inventory of standard device items, such asdevice capacity, serial number.

Allow query of Network Information.

Enables inventory of standard network items, such as
phone/SIM numbers, MAC addresses.

Allow inspection of installed provisioning
profiles.

Enables a device user to run select in-house apps.

Allow installation and removal ofprovisioning profiles.

Enables installation of select in-house apps.

Allow inspection of installed applications.

Enables app inventory.

Allow restriction-related queries.

Enables reports on the restrictions of eachconfiguration profile on the device. These correspondto the settings in the iOS Restrictions and Passcodepayloads.

Allow security-related queries.

Enables report on security items, such as whether apasscode is present.

Allow manipulation of settings.

Enables an administrator to turn on/off voice and dataroaming.

Allow app management.

Enables the managed apps capability introduced in
iOS 5 so that an administrator can push requests to
install apps, prevent iCloud backup, and remove theapps and all app data on demand.

5. If you want MobileIron Core to indicate that the MDM profile has been removed from iOS devices, selectCheck out when MDM profile is removed.
NOTE: Receipt of this alert is not guaranteed. Therefore, this setting does not ensure notification
upon removal of the profile.
6. If you want to automatically alert iOS users when a new iOS MDM configuration is available, select Send
an APNs message to iOS 5 and later devices...
7. Click Save.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 304

Restoring system web clips (iOS)Restoring system web clips (iOS)If you enable the Removable option for the Multi-User web clip or the Apps@Work web clip, and the device user
removes one of these web clips, use one of the following methods to restore the web clip:lRemove the MDM profile on the device and tap Update Configuration Profile in Mobile@Work.

l

Push the web clip from the Devices page by selecting the device and clicking Push Profiles.

Displaying configurations status
This feature is supported on macOS devices.
To see the status of configurations for each device:
1. Go to Device & Users > Devices
2. Select a device, and click the caret to open the device details
3. Click the Configurations tab.
The statuses you will see are:l

Pending: The process of applying the settings has been started.

l

Sent: The settings have been successfully sent to the device.

l

l

l

Applied: MobileIron Core has confirmed that the verifiable settings appear to have been applied to thedevice.
Partially Applied: One or more settings may have been rejected by the device. This can mean that thefeature is not supported by the device.
Update Pending: The administrator has edited the setting in the Admin Portal. The process of applying
the updated setting has begun.

Adding new configurations
This feature is supported on macOS devices.
To add new configurations:
1. Go to Policies & Configs > Configurations.
2. Click Add New.
3. Select the type of configuration you want to create.
4. Complete the displayed form for the configuration.
5. Click Save.
6. To push the configuration to devices, apply it to the appropriate labels. Select Actions > Apply to Label.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 305

Editing configurations

Editing configurations
This feature is supported on macOS devices.
To edit configurations:
1. In the Configurations screen, select the configuration you want to edit.
2. Click Edit.
3. Make your changes.
4. Click Save.
A pop-up displays.
5. Click Yes to continue.
The configuration will be re-pushed to matching devices even you made no changes. However, if the onlychange made is to the description, the configuration will not be re-pushed to the devices.

Deleting configurations
This feature is supported on macOS devices.
To delete configurations:
1. In the Configurations screen, select the settings you want to delete.
2. Click Delete.

Exporting configurations
Export and importing setting configurations helps reduce errors when you have multiple instances of MobileIron.
You can export a configuration .json file for an existing setting, modify it, then import it to another configuration.
This feature is supported on macOS devices.
To export a configuration:
1. Select Policies & Configs > Configurations.
All available configurations are listed in the table.
2. Select a single configuration to export.
You can sort, as necessary, to find the configuration you want to export.
3. Click Export to create an export configuration .json file.
No application-related information is captured when exporting a configuration.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 306

Importing configurations

4. Locate the .json file, open, modify, and save it, as necessary.
NOTE: Review this file before reusing it as values are not verified before importing them.

Importing configurations
This feature is supported on macOS devices.
To import a configuration:
1. Log into MobileIron Core.
2. Select Policies & Configs > Configurations.
3. Click Import to locate a saved exported configuration .json file.
4. Enter the name of the file or click Browse to locate it.
5. Read the warning message and click in the I Agree check box.
6. Click Import to add the new configuration to the configuration table.
If you import a configuration that already exists, you can override the file or cancel the import.

Applying configurations to labels
Use labels to apply configurations to devices. Refer to the “Using labels to establish groups” section in the Getting
Started with MobileIron Core for more information.
This feature is supported on macOS devices.
To apply a configuration to a label:
1. Select Policies & Configs > Configurations to display the configurations table with all available
settings configurations.
2. Select the check box next to a configuration you want to apply to a label.
Search for a configuration by entering the configuration name or description in the search box.
3. Click Actions > Apply To Label.
Select the label.
4. You can search by label name or description to help find the label.
5. Click Apply.

Exporting the devices in the WatchList
The number in the WatchList field indicates the number of devices for which the configuration is still in queue.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 307

Impact of changing LDAP server variables

This feature is supported on macOS devices.
To export the WatchList:
1. In the MobileIron Core Admin Portal, go to Policies & Configs > Configurations.
2. Click the number in the WatchList field for the configuration for which you want to export the WatchList.
The Pending Devices window appears. The window displays a list of devices for which the configuration isqueued.
3. Click Export to export the list of devices.
4. The list is downloaded as .CSV file.

Impact of changing LDAP server variables
A change to a LDAP server variable (such as $EMAIL$, $FIRST_NAME$, $LAST_NAME$, $DISPLAY_NAME$,$USER_UPN$, $USER_CUSTOM1, $USER_CUSTOM2, $USER_CUSTOM3$, or $USER_CUSTOM4$) now
causes a setting that uses the variable to be re-pushed to the device. The impacted settings are:l

Exchange settinglEmail settingl

Wi-Fi settingl

VPN settingl

CalDAV settingl

CardDAV settinglSubscribed calendar settinglAppConnect app configurationlDocs@Work settingThis feature is supported on macOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 308

14
Configuring EmailThis section addresses email account configuration, enabling S/MIME encryption and synchronizing account data.
l

Exchange settingslConfiguring POP and IMAP email settings (for iOS and macOS)l

Enabling per-message S/MIME for iOSlEnabling S/MIME encryption and signing on iOS deviceslSynchronizing Google account datalSynchronizing Google calendar and contacts without ActiveSync

Exchange settings
To specify the settings for the ActiveSync server that devices use, go to Policies & Configs > Configurations,then click Add New > Exchange. The ActiveSync server can be a Microsoft Exchange server, an IBM® Lotus®
Notes Traveler server, Microsoft Office 365, or another server.
For macOS 10.10 Yosemite:
Contacts, Email, Notes, Reminders, and Calendar are synchronized. ActiveSync is not supported.
For iOS:l

If an Exchange profile already exists on the device, then attempts to distribute new ActiveSync settings
using MobileIron will fail.

For iOS and macOS:l

iOS/macOS can take advantage of the optional Save User Password feature under Settings >Preferences to facilitate Exchange configuration.

Note that AppConnect-enabled Email+ for iOS and Email+ for Android do not use an Exchange setting. Instead,
you configure the email clients using an AppConnect app configuration.
The following table describes the Exchange settings you can specify.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 309

Exchange settings

TABLE 33. EXCHANGE SETTINGS
SectionField Name

Description

GeneralName

Enter brief text that identifies this group of Exchange
settings.

Description

Enter additional text that clarifies the purpose of thisgroup of Exchange settings.

Server AddressEnter the address of the ActiveSync email server.
If you are using Standalone Sentry, do the following:
•
•

•

•

Enter the Standalone Sentry’s address.
If you are using Lotus Domino server 8.5.3.1
Upgrade Pack 1 for your ActiveSync server, set
the server address to <Standalone Sentry’s fully
qualified domain name>/traveler.
If you are using a Lotus Domino server earlier than
8.5.3.1 Upgrade Pack 1, set the address to<Standalone Sentry fully qualified domainname>/servlet/traveler.
If you are using load balancers, contact MobileIron
Professional Services.

When using Integrated Sentry, set the server address
to Microsoft Exchange Server’s address.
NOTE: When using Sentry, you can do
preliminary verification of your Exchange
configuration choices for the ActiveSync
User Name, ActiveSync User Email, andActiveSync Password fields. To do so, first
set the server address to the ActiveSync
server. After you have verified that users
can access their email using thisExchange configuration, change theserver address to the appropriate Sentry
address.
For more information about configuring Sentry, see the
MobileIron Sentry Guide.
Use SSL

Select to use secure connections.

Use alternate device
handling

Replaces the Use Standalone Sentry option. Use
this option only under the direction of MobileIron
Support.

DomainSpecify the domain configured for the server.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 310

Exchange settings

TABLE 33. EXCHANGE SETTINGS (CONT.)
SectionField Name

Description

Google Apps Password

This check box only appears if you have configured a
Google account with MobileIron Core.
When linking to Google Apps, select this option to use
the Google Apps password to log in to the Google
account you have configured to work with MobileIron
Core. This password allows device users to accesstheir Email, Contacts, and Calendar data on their
managed devices.
When selected, Core grays out the ActiveSync User
Name and ActiveSync User Password.
This check box only appears if you have configured a
Google account with MobileIron Core, as described inSynchronizing Google account data.

ActiveSync User Name

Specify the variable for the user name to be used withthis Exchange configuration. You can specify any or
all of the following variables $EMAIL$, $USERID$,$PASSWORD$. You can also specify custom
formats, such as $USERID$_US. Custom attribute
variable substitutions are supported.
Typically, you use $USERID$ if your ActiveSync
server is a Microsoft Exchange Server, and you use$EMAIL$ if your ActiveSync server is an IBM Lotus
Notes Traveler server. You cannot use $NULL$ for
this field.

ActiveSync User EmailSpecify the variable for the email address to be usedwith this Exchange configuration. You can specify any
or all of the following variables $USERID$,$EMAIL$,$SAM_ACCOUNT_NAME$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, CUSTOM_USER_
Attributename$, or $NULL$. You can also specify
custom formats, such as $USERID$_US. Custom
attribute variable substitutions are supported.
Typically, you use $EMAIL$ in this field; you cannot
use $NULL$.

ActiveSync User
Password

Specify the variable for the password to be used withthis Exchange configuration. You can specify any or
all of the following variables: $USERID$, $EMAIL$,$PASSWORD$, $USER_CUSTOM1$, $USER_

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 311

Exchange settings

TABLE 33. EXCHANGE SETTINGS (CONT.)
SectionField Name

Description
CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_DEVICE_Attributename$,
CUSTOM_USER_Attributename$, or $NULL$. You
can also specify custom formats, such as$USERID$_US. Custom attribute variable
substitutions are supported.
Enter additional variables or text in the text box
adjacent to the Password field. Entries in this text box
are kept hidden and will not be visible to any
MobileIron Core administrator.
NOTE: All variables and text up to the last valid
variable will be visible. Anything after thelast valid variable will not be visible. The
valid variable may appear in either of thepassword fields. Valid variables arevariables in the drop-down list.

Identity Certificate

Select the Certificate Enrollment entry you created forsupporting Exchange ActiveSync, if you are
implementing certificate-based authentication.
NOTE: When setting up email for devices withmulti-user sign-in, the exchange profile
must always use a user-based certificate.
The user-based certificate will ensure
secure access to email for all users. Usinga device-based certificate can result in
one user sending or receiving emails foranother user. When configuring the userbased certificate, select the Proxyenabled and Store certificate keys on
MobileIron Core options. This allows theuser certificate and private key to bedelivered each time they log in on theshared device.

Password is also required

Specify whether to prompt device users for apassword when certificate authentication is
implemented. The password prompt is turned off bydefault. Once you specify an Identify Certificate, thisoption is enabled. Select the option if you want toretain the password prompt.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 312

Exchange settings

TABLE 33. EXCHANGE SETTINGS (CONT.)
SectionField Name

Description

Items to Synchronize

This feature is not supported for iOS macOS.

(Android, Windows)
Items to Synchronize (iOS)

Select to specify individual syncing of Outlook items:
Email, Calendar, Contacts, Notes, and Reminders. All
check boxes are selected by default. If Allow User
Override is selected for a specific item, the deviceuser will be able to change the service status on thedevice.
NOTE: At least one of the Outlook items settingsmust be enabled. If you disabled syncing
for one of the Outlook items and allowed
the device user to override that same
item, the device user will still be able toenable the Outlook item. For example, if
you disabled Calendar, but had Allow
User Override selected, the device user
will be able to enable calendar on the
iOS device.

S/MIME

Past Days of Email to
Sync

Specify the maximum amount of email to synchronize
each time by selecting an option from the drop-down
list.

Move/Forward Messages
to Other Email Accounts

Starting with iOS 5: This feature specifies whether toblock device users from moving or forwarding email
from the managed email account.

Enable for Android andiOS 9.3.3 (or earlier)

Select to enable S/MIME signing and encryption on
devices running Android or iOS 9.3.3 or earlier.
You must select this option for the fields in the
S/MIME Signing and S/MIME Encryption sections
to apply to devices running iOS 9.3.3 or earlier.

S/MIME Signing(Optional) S/MIME signing applies to iOS devices up to iOS 9.3.3.
S/MIME Signing: Enable

Disabled by default.Select the check box to enable
S/MIME signing. Applicable to iOS 10.3 through themost recently released version as supported by
MobileIron.

S/MIME Signing identity

Select a certificate enrollment setting as a signing

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 313

Exchange settings

TABLE 33. EXCHANGE SETTINGS (CONT.)
SectionField Name

Description
identity. If you do not make a selection, then thedevice user will be prompted to select from thecertificates that are already installed on the device. If
the device has no certificate, then S/MIME signing will
not be functional on the device. Applicable to iOS 9.0
through the most recently released version as
supported by MobileIron.
Related topics
Certificate Enrollment settings.

Signing Identity: User
Overrideable

Applicable to iOS 12.0 through the most recently
released version as supported by MobileIron
Select to allow the user to select the signing identity
on the device.

S/MIME Signing: User
Overrideable

iOS 12 through the most recently released version as
supported by MobileIron
Select to allow the user to enable and disable S/MIME
signing in device settings.

S/MIME
Encryption

S/MIME encryption applies only to iOS devices.

Encryption by Default

Disabled by default.Select to enable S/MIME
encryption.

Encryption Identity

Select a certificate enrollment setting as an encryption
identity. If you do not make a selection, then thedevice user will be prompted to select from thecertificates that are already installed on the device. If
the device has no certificate, then S/MIME encryption
will not be functional on the device.
Related topics
Certificate Enrollment settings.

Encryption Identity: User
Overrideable

iOS 12.0 through the most recently released version
as supported by MobileIron
Select to allow the user to set the S/MIME encryption
identity and enable encryption.

Encryption by Default:
User Overrideable

iOS 12.0 through the most recently released version
as supported by MobileIron

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 314

Exchange settings

TABLE 33. EXCHANGE SETTINGS (CONT.)
SectionField Name

Description
Select to allow the user to enable or disable S/MIME
encryption by default in the device settings.

Per-Message Encryption
SwitchThis feature is not supported for Mac OS devices.Permessage S/MIME for iOS allows device users toenable or disable S/MIME encryption for each email
they send.
NOTE: S/MIME encryption is incompatible with
MobileIron Sentry attachment
encryption.

ActiveSync

Not for iOSmacOS.
Sync during
Peak Time

Select the preferred synchronization approach for peaktimes.

Off-peak Time

Select the preferred synchronization approach for offpeak times.

Use above settings whenroamingSpecify whether to apply synchronization preferences
while roaming.

Send/receive when send

Specify whether queued messages should be sent andreceived whenever the user sends a message.

Peak Time
Peak Days

Specify which days should be considered peak days.

Start Time

Specify the beginning of the peak period for all peakdays.

End Time

Specify the end of the peak period for all peak days.

iOS 5 and Later
Settings

These features are not supported for Mac OS devices.

Email access to ThirdParty apps

Specifies whether third-party apps can use theaccount for email access.

Recent Address syncing(iOS 6 and later)

Specifies whether recently used email addresses canbe synchronized.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 315

iOS and macOS Exchange profiles and password caching

TABLE 33. EXCHANGE SETTINGS (CONT.)
SectionField Name

Description

Use OAuth for
Authentication: Enable

iOS 12.0 through the most recently released version
as supported by MobileIron
Select the check box to enable OAuth for
Authentication. When selected, Core will not send thepassword and OAuth will be used.
For devices pre-iOS 12.0, the OAuth selection will beignored by the devices, so you should fill in the
ActiveSync User Password field.

Communication Service
Rules (iOS 10 and later)

Select a default audio service or app to be associatedwith the device user's accounts on the Exchange,
CardDAV, LDAP, and Google servers. All calls
initiated on the iOS device to contacts from contact
lists stored on the server will use the selected audio
service by default. This feature is supported on
devices running iOS 10 through the most recently
released version as supported by MobileIron.
To enable communication service rules:llAndroid

Select Choose a default app to be used
when calling contacts from this account. A
drop-down list of apps displays.
Click the drop-down list to select the default
audio app or service.

These features are not supported for iOS devices.
These features are not supported for Mac OS devices.
Windows 10 Desktop

This feature is not supported for iOS devices.
This feature is not supported for Mac OS devices.

iOS and macOS Exchange profiles and password caching
To facilitate iOS and macOS deployments, MobileIron offers the option of caching a user’s email password. This
option is turned off by default. Cached passwords are encrypted, stored on the appliance, and used only forauthentication. Note that the email password must match the LDAP password in order for this feature to be of use.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 316

Configuring POP and IMAP email settings (for iOS and macOS)

Configuring POP and IMAP email settings (for iOS andmacOS)
Select Policies & Configs > Configurations > Add New > Email to set up POP or IMAP email. The following
table describes the email settings you can specify:

TABLE 34. POP AND IMAP EMAIL SETTINGS (IOS AND MACOS)
SectionField Name

Description

Name

Enter brief text that identifies this group of email
settings.

Description

Enter additional text that clarifies the purpose of thisgroup of email settings.

Account Type

Select POP or IMAP to indicate the type of email
account you are configuring. The Internet Service
Provider (ISP) can give you information on which type ofaccount is available.

User EmailSpecify the email address to use. The default value is$EMAIL$. Use this field to specify an alternate format.
For example, your email standard might be $EMAIL$_
US for users in the United States. Custom attribute
variable substitutions are supported.
See Supported variables.

Incoming Mail Server
Settings
Path Prefix

Specify the IMAP path prefix for the email client. A
prefix is generally required when all IMAP folders arelisted under the Inbox. ISPs that require prefixes usuallyprovide information on the specific prefix to configure.

Server Address

Specify the address for the server handling incoming
mail. The Internet service provider (ISP) can give you
this address.

Server Port

Specify the port number for the server handling incoming
mail. The Internet service provider (ISP) can give you
this information.

Require SSL

Specify whether secure sockets layer (SSL) is requiredfor incoming email transport. This is determined by theway in which the user mailboxes are set up. YourInternet service provider (ISP) can give you thisinformation.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 317

Configuring POP and IMAP email settings (for iOS and macOS)

TABLE 34. POP AND IMAP EMAIL SETTINGS (IOS AND MACOS) (CONT.)
SectionField Name

Description

User Name

Specify the email address to use. The default value is$EMAIL$. Use this field to specify an alternate format.
For example, your standard might be $USERID$.
Custom attribute variable substitutions are supported.
Why: Some enterprises have a strong preference
concerning which identifier is exposed.
See Supported variables

Use Password
Authentication

Specify whether to authenticate the password for email
access.

Password

Specify the password to use. The default value is$PASSWORD$. Use this field to specify a custom
format, such as $PASSWORD$_$USERID$. Custom
attribute variable substitutions are supported.
See Supported variables.

Outgoing (SMTP) Mail
Server Settings
Server Address

Specify the address for the SMTP server handlingoutgoing mail.

Server Port

Specify the port number for the SMTP server handlingoutgoing mail.

Require SSL

Specify whether to use secure sockets layer (SSL)
outgoing email transport.

Require Authentication

Specify whether to use secure sockets layer (SSL) for
outgoing email transport.

Use Same User Name
and Password for
Sending EmailSpecify whether to use the same user name andpassword used for incoming email. If you select thisoption, then the Server User Name option is disabled.

Server User Name

Specify the user name to use. The default value is$EMAIL$. Use this field to specify an alternate format.
For example, your standard might be $USERID$.
Why: Some enterprises have a strong preference
concerning which identifier is exposed.
See Supported variables

Use Password
Authentication

Specify whether to authenticate the password for email
access.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 318

Configuring POP and IMAP email settings (for iOS and macOS)

TABLE 34. POP AND IMAP EMAIL SETTINGS (IOS AND MACOS) (CONT.)
SectionField Name

Description

Password

Specify the password to use. The default value is$PASSWORD$. Use this field to specify a custom
format, such as $PASSWORD$_$USERID$.
See Supported variables

Advanced Settings

Not for iOS, macOS
Automatic
Send/Receive

Specify how new email should be sent and retrieved.
You can set an automatic time interval or select Manual
to configure no automatic email exchange.

Download Messages

Specify the number of messages to download to thedevice during send/receive.

Message Format

Indicate whether messages should be formatted in plain
text or HTML.

Message Download
Limit

Specify a size limit for a single message to be
downloaded.

Download Attachment

Specify a size limit for an attachment to be downloaded,or specify that attachments are not be downloaded.

Block move/forward
messages to otheremail accounts

Enables the iOS 5 feature that prevents users frommoving email messages to other email accounts or
forwarding email from accounts other than theoriginating account.

Block email access to
3rd party apps

Prevents third-party apps from using the account foremail access.

Allow Recent Addresssyncing (iOS 6 andlater)

Selected by default, indicates recent address syncing. If
this check box is cleared, this email account is excluded
from address recent syncing.

Allow Mail Drop (iOSDe-selected by default, indicates allowance of Mail
Drop. If this check box is selected, Mail Drop is allowed
for this email account. Mail Drop limitations by Apple areapplied.

iOS 5 or later Settings

9.2 and later)

In Email settings on the users' device, the user canselect the Send large attachments with Mail Drop
option. This allows the user to upload attachments up to
5 GB and send a link or preview to email recipients.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 319

Configuring POP and IMAP email settings (for iOS and macOS)

TABLE 34. POP AND IMAP EMAIL SETTINGS (IOS AND MACOS) (CONT.)
SectionField Name

Description

S/MIME Setting

S/MIME settings apply only to iOS devices.

S/MIME
Enable for iOS 9.3.3 (orearlier)

Select to enable S/MIME signing and encryption on
devices running iOS 9.3.3 or earlier.
You must select this option for the fields in the S/MIME
Signing and S/MIME Encryption sections to apply todevices running iOS 9.3.3 or earlier.

S/MIME Signing

S/MIME signing applies only to iOS devices.
S/MIME Signing:
EnableDisabled by default. Select the check box to enable
S/MIME signing.

S/MIME Signing
identity

Select a certificate enrollment setting as a signing
identity. If you do not make a selection, then the deviceuser will be prompted to select from the certificates thatare already installed on the device. If the device has no
certificate, then S/MIME signing will not be functional on
the device.
Related topics
Certificate Enrollment settings.

Signing Identity: User
Overrideable

iOS 12.0 through the most recently released version as
supported by MobileIron
Select to allow the user to select the signing identity.

S/MIME Signing: User
Overrideable

iOS 12 through the most recently released version as
supported by MobileIron
Select to allow the user to enable and disable S/MIME
signing in device settings.

S/MIME
Encryption

S/MIME signing applies only to iOS devices.

Encryption by Default

Disabled by default.Select to enable S/MIME
encryption.

Encryption Identity

Select a certificate enrollment setting as an encryption
identity. If you do not make a selection, then the deviceuser will be prompted to select from the certificates thatare already installed on the device. If the device has no
certificate, then S/MIME encryption will not be

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 320

Supported variables

TABLE 34. POP AND IMAP EMAIL SETTINGS (IOS AND MACOS) (CONT.)
SectionField Name

Descriptionfunctional on the device.
Related topics
Certificate Enrollment settings.

Encryption Identity:
User Overrideable

iOS 12.0 through the most recently released version as
supported by MobileIron
Select to allow the user to set the S/MIME encryption
identity and enable encryption.

Per-Message
Encryption Switch

Per-message S/MIME for iOS allows device users toenable or disable S/MIME encryption for each email
they send.
NOTE: S/MIME encryption is incompatible with
MobileIron Sentry attachment encryption.

Supported variables
You can use the following variables in fields that support variables.
ll

For user name fields: $USERID$, $EMAIL$,$SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_DEVICE_
Attributename$, CUSTOM_USER_Attributename$, or $NULL$
For password fields: $USERID$, $EMAIL$, $PASSWORD$, $GOOGLE_AUTOGEN_PASSWORD$,$USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, CUSTOM_USER_Attributename$, or $NULL$.

Custom attribute variable substitutions are supported.

Enabling per-message S/MIME for iOS
Per-message S/MIME for iOS allows iOS device users to decide whether they wish to enable or disable S/MIME
encryption for individual emails. Allowing users to forgo encryption for emails that do not require such security
precautions could save company resources such as bandwidth.
WARNING: S/MIME encryption is incompatible with MobileIron Sentry attachment encryption. It is
recommended that you enable either S/MIME encryption or MobileIron Sentry attachment
encryption, but not both. If you would like to enable attachment security along with S/MIME
for email, you can use the Docs@Work attachment control feature, in which all
attachments can only be opened with a predefined set of device apps.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 321

Uploading a trusted root certificate to MobileIron Core

Organizations with varying security needs may wish to configure two Microsoft Exchange servers to handle default
and optional use of S/MIME. An example might be an organization with one set of email users defined on one
Exchange server that rarely need to encrypt their emails with S/MIME, and another set of email users defined onanother Exchange server who use S/MIME encryption for most of their email.
In this scenario, Exchange profile 1 might be configured to enable S/MIME encryption on all email by default, andpoint to one particular Exchange server. Exchange profile 2 might be configured to enable S/MIME per-message
encryption and point to a second Exchange server.
Note The Following:lllRecipients of all emails sent with S/MIME encryption must have a certificate.
A user sending an encrypted email must have the recipient’s certificate so that its public key can be used
to encrypt the message. This means that both the sender and recipient must be in the same organization,or if they are in different organizations, the sender and recipient must arrange to obtain their respective
certificates prior to sending the first encrypted email.
Both the sender and recipient must maintain historical archives of expired private keys, such that pastemails encrypted by any expired certificates are still readable.

Main steps
The main steps for enabling per-message S/MIME encryption for iOS devices are as follows:
1. Upload a trusted root certificate to MobileIron Core from an in-house or public certificate authority(Uploading a trusted root certificate to MobileIron Core).
2. Create a user-provided certificate enrollment setting (Creating a user-provided certificate enrollment
setting for S/MIME certificates).
3. Upload the user-provided P12 certificates with the MobileIron Core user portal or the Web Services API(Uploading user signing and encryption certificates with the User Portal and Uploading user certificateswith the Web Services API).
4. Create an Email or Exchange setting that references the user-provided certificate enrollment setting you
created (Creating an Email setting for per message S/MIME encryption or Creating an Exchange setting
for per message S/MIME encryption).
5. Push your settings to the relevant devices (Pushing per-message S/MIME changes to devices).
NOTE: iOS devices will not use SSL with an untrusted certificate.
For information about using per-message S/MIME encryption on an iOS device, see the following Apple article:
http://support.apple.com/en-us/HT4979

Uploading a trusted root certificate to MobileIron Core
Upload a trusted root certificate to MobileIron Core, and then push the root certificate to iOS devices. The root
certificate verifies the signature of the certificate authority presented with an email sender’s transmission.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 322

Creating a user-provided certificate enrollment setting for S/MIME certificates

1. In the Admin Portal, go to Policies & Configs > Configurations.
2. Select Add New > Certificates.
3. In the New Certificate Setting dialog box, fill in the following fields for the certificate setting:lName: Enter a name for the certificate setting.

lDescription: Enter a meaningful description for the certificate setting.

lFile Name: Browse for the certificate file.

4. Click Save.

Creating a user-provided certificate enrollment setting for S/MIME certificates
Create a user-provided certificate enrollment setting that specifies the use of S/MIME certificates, and push theuser-provided certificate enrollment setting to the relevant devices.
NOTE: If users are uploading both a signing certificate and an encryption certificate you must create
two separate user-provided certificate enrollment settings.
1. In the Admin Portal, go to Policies & Configs > Configurations.
2. Click Add New > Certificate Enrollment > User-Provided. The New User-Provided Certificate
Enrollment Setting dialog box opens.
3. Fill in or select the following fields:lName: Enter brief text that identifies this group.

lDescription: Enter additional text that clarifies the purpose of the setting.

lDisplay Name: Enter a name describing the purpose of a user-provided certificate. For example, enter"S/MIME Encryption". On the user portal, when the user uploads a certificate, the user selects a
display name (called “Configuration” on the user portal). The user’s selection associates the uploaded
certificate with a user-provided certificate enrollment setting. The user can upload the same
certificate, or different certificates, for each display name.

lRequire Password: This is selected by default and is required for the certificate enrollment option.

lDelete Private Keys After Days: Select an option between None - 15 days.

4. Click Save.
5. The Configurations page refreshes with the new certificate enrollment.
6. (Optional) If users are uploading both a signing certificate and an encryption certificate, repeat these steps
to create a second user-provided certificate enrollment setting.
Related topics
Configuring a user-provided certificate enrollment setting

Uploading user signing and encryption certificates with the User Portal
Allowing users to control their own S/MIME encryption per message requires users to upload their personal PKCS
12 files containing their certificates and private keys. Users can upload their certificates through the user portal.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 323

Uploading user certificates with the Web Services API

Alternatively, the certificates can be uploaded using the Web Services API, as described in Uploading user
certificates with the Web Services API.
To upload an S/MIME certificate through the user portal:
1. Go to https://<Core_Server_FQDN>/user.

2. Click on the device user’s name in the top right corner.
3. Click on Settings in the drop down menu.
The page including User-Provided CertificateManagement appears.
4. Click Upload New Certificate.
The Upload User-Provided Certificate page appears.
5. In the Configuration field, select the configuration for which you want the certificate to be used.
6. Click Browse to navigate to the location of the certificate and select the certificate.
7. Enter the Password associated with the certificate.
8. Click Upload Certificate to upload the certificate.
The User-Provided CertificateManagement page appears.
Device users can view, replace, or delete the S/MIME certificate.

Uploading user certificates with the Web Services API
Instead of having users upload their certificates to the MobileIron Core user portal, you can upload the user
certificates using a Web Services API. For more information about using the API, see the MobileIron V2 API
Guide.
NOTE: If you used the now unavailable V1 API to upload user certificates to MobileIron Core, the API
associated the user certificate with a certificate type: All, WIFI, VPN, SMIMESIGNING,SMIMEENCRYPTION, EMAIL or EXCHANGE. MobileIron Core still supports using those certificates
and their associated type. However, you should migrate to uploading certificates that areassociated with a user-provided certificate enrollment setting by using the V2 API .

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 324

Creating an Email setting for per message S/MIME encryption

Creating an Email setting for per message S/MIME encryption
Create an email setting so that device users can access their email with the ability to toggle S/MIME encryption permessage.
If your email is managed by an Exchange Server, or you are using ActiveSync, you can create an Exchange setting
instead, as described in Exchange settings.
1. In the Admin Portal go to Policies & Configs > Configurations.
2. Click Add New > Email. The New Email Setting dialog box opens.
3. Enter the information requested, as described in the table of settings in Configuring POP and IMAP email
settings (for iOS and macOS).

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 325

Creating an Email setting for per message S/MIME encryption

4. Configure the following to enable per-message S/MIME encryption:
SectionField Name

Description

Enable for iOS 9.3.3 (or earlier)

Select to enable S/MIME signing andencryption on Android devices anddevices running iOS 9.3.3 or earlier.

S/MIME Settings
S/MIMEYou must select this option for the fields
in the S/MIME Signing and
S/MIME Encryption sections to apply
to devices running iOS 9.3.3 or earlier.
S/MIME
Encryption
Encryption by Default

Disabled by default.Select to enable
S/MIME encryption.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 326

Creating an Exchange setting for per message S/MIME encryption

SectionField Name

Description

Encryption Identity

Select a certificate enrollment setting as
an encryption identity. If you do notmake a selection, then the device user
will be prompted to select from thecertificates that are already installed on
the device. If the device has no
certificate, then S/MIME encryption will
not be functional on the device.
Related topics
Certificate Enrollment settings.

Encryption Identity: User
Overrideable

iOS 12.0 through the most recently
released version as supported by
MobileIron
Select to allow the user to set the
S/MIME encryption identity and enableencryption.

Per-Message Encryption Switch

Per-message S/MIME for iOS allows
device users to enable or disable
S/MIME encryption for each email they
send.
NOTE: S/MIME encryption isincompatible with
MobileIron Sentry
attachment encryption.

5. Click Save.

Creating an Exchange setting for per message S/MIME encryption
If your organization uses Microsoft Exchange Server or ActiveSync to manage email, create an Exchange setting
to enable devices to access email.
NOTE: If an Exchange profile already exists on managed devices, then attempts to distribute new
ActiveSync settings using MobileIron will fail.
1. In the Admin Portal go to Policies & Configs > Configurations.
2. Click Add New > Exchange. The New Exchange Setting dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 327

Creating an Exchange setting for per message S/MIME encryption

3. Enter the following ActiveSync information.
SectionField Name

Description

ActiveSync User NameEnter a variable such as $USERID$. Thisfeature supports custom device and user
attributes variable names.

ActiveSync User EmailEnter a variable such as $USERID$. Thisfeature supports custom device and user
attributes variable names.

4. Configure the following to enable per-message S/MIME encryption:
SectionField Name

Description

Enable for Android and iOS 9.3.3(or earlier)

Select to enable S/MIME signing andencryption on Android devices anddevices running iOS 9.3.3 or earlier.

S/MIME Settings
S/MIMEYou must select this option for the fields
in the S/MIME Signing and
S/MIME Encryption sections to apply
to devices running iOS 9.3.3 or earlier.
S/MIME
Encryption
Encryption by Default

Disabled by default.Select to enable
S/MIME encryption.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 328

Creating an Exchange setting for per message S/MIME encryption

SectionField Name

Description

Encryption Identity

Select a certificate enrollment setting as
an encryption identity. If you do notmake a selection, then the device user
will be prompted to select from thecertificates that are already installed on
the device. If the device has no
certificate, then S/MIME encryption will
not be functional on the device.
Related topics
Certificate Enrollment settings.

Encryption Identity: User
Overrideable

iOS 12.0 through the most recently
released version as supported by
MobileIron
Select to allow the user to set the
S/MIME encryption identity and enableencryption.

Per-Message Encryption Switch

Per-message S/MIME for iOS allows
device users to enable or disable
S/MIME encryption for each email they
send.
NOTE: S/MIME encryption isincompatible with
MobileIron Sentry
attachment encryption.

5. Configure the following for iOS settings:
SectionField Name

Description

iOS 5 or later Settings

Email access to Third-Party apps:
Block

Select to prevent third-party apps
from using the account for email
access.

Allow Recent Address syncing (iOS 6
and later)

Selected by default, indicatesrecent address syncing. If thischeck box is cleared, this email
account is excluded from address
recent syncing.

Use OAuth for Authentication: Enable

For iOS 12.0 and later.
If selected, do not require a

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 329

Pushing per-message S/MIME changes to devices

SectionField Name

Description
password.

Communication Service Rules(iOS 10 and later)

Select to choose a default app to be
used when calling contacts fromthis account.

6. Continue configuring the Exchange settings as needed.
For more information about configuring an Exchange setting, see Exchange settings.
7. Click Save.

Pushing per-message S/MIME changes to devices
To push changes to devices:
1. In the Admin Portal go to Policies & Configs > Configurations.
2. From the list of settings, select the Certificate and Email or Exchange settings you created in previous
sections, then click Actions > Apply to Label.
The Apply to Label dialog box opens.
NOTE: Do not apply the user-provided certificate enrollment setting to any labels.
3. Select the labels to which you want to apply the Certificate setting, Email setting or Exchange setting.
4. Click Apply.
The settings will be pushed to the devices you specified per the Sync Interval defined in your sync policy,
or at the next forced device check-in.
5. Instruct users to enable S/MIME on their devices as follows:a. Go to Settings > Mail, Contacts, Calendars.
b. Select the email account associated with your client certificate.
c. Tap the Account button with your email address.
d. On the Account window, tap S/MIME.
e. Enable signing by tapping Sign and selecting your certificate.
f. Enable encryption by tapping Encrypt, and then select your certificate.
6. Email users the following link for more information on signing and encrypting email on an iOS device:
http://support.apple.com/en-us/HT4979

Enabling S/MIME encryption and signing on iOS devices
Note The Following:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 330

Configuring S/MIME encryption and signing for iOS devices

l

l

l

Recipients of all emails sent with S/MIME signing and encryption must have a certificate.
A user sending an encrypted or signed email must have the recipient’s certificate so that its public key canbe used to encrypt the message. This means that both the sender and recipient must be in the sameorganization, or if they are in different organizations, the sender and recipient must arrange to obtain theirrespective certificates prior to sending the first encrypted or signed email.
Both the sender and recipient must maintain historical archives of expired private keys, such that pastemails encrypted by any expired certificates are still readable.

Main steps
The main steps for enabling S/MIME encryption and signing for iOS devices are as follows:
1. Upload a trusted root certificate to MobileIron Core from an in-house or public certificate authority(Uploading a trusted root certificate to MobileIron Core).
2. Create a user-provided certificate enrollment setting (Creating a user-provided certificate enrollment
setting for S/MIME certificates).
3. Upload the user-provided P12 certificates with the MobileIron Core user portal or the Web Services API(Uploading user signing and encryption certificates with the User Portal and Uploading user certificateswith the Web Services API).
4. Create an Email or Exchange setting that references the user-provided certificate enrollment setting you
created (Configuring S/MIME encryption and signing for iOS devices).
5. Push your settings to the relevant devices (Pushing per-message S/MIME changes to devices).
NOTE: iOS devices will not use SSL with an untrusted certificate.

Configuring S/MIME encryption and signing for iOS devices
You can configure S/MIME encryption and/or signing settings for your ActiveSync server. The S/MIME settings
you configure allow managed iOS devices to use S/MIME encryption and signing features, depending on how you
have configured them.
For example, you can enable S/MIME encryption only, without signing, or you can enable both S/MIME encryption
and signing, while also allowing device users to decide whether they want to use these features. You can also
specify separate certificates for signing and encryption. If you do not specify a certificate, then the device user will
be prompted to select from the certificates that are already installed on the device.
NOTE: If an Exchange profile already exists on managed devices, then attempts to distribute new
ActiveSync settings using MobileIron will fail.
Before you begin
You need to complete the following tasks before configuring S/MIME for iOS devices:
1. Uploading a trusted root certificate to MobileIron Core
2. Creating a user-provided certificate enrollment setting for S/MIME certificates

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 331

Configuring S/MIME encryption and signing for iOS devices

3. Uploading user signing and encryption certificates with the User Portal
orEnabling per-message S/MIME for iOS
Procedure
1. In the Admin Portal, go to Policies & Configs > Configurations.
a. If using an Exchange setting:b. Select the Exchange setting you want to modify, and click Edit.
Alternatively, create a new Exchange setting by selecting Add New > Exchange.
2. Continue configuring the Exchange settings as needed. For more information, see Exchange settings.
a. If using an Email setting:b. Select the Email setting you want to modify, and click Edit.
Alternatively, create a new Email setting by selecting Add New > Email.
3. Enter the information required to configure your mail server, as described in Configuring POP and IMAP
email settings (for iOS and macOS).
4. Configure your S/MIME Settings using the table below.
SectionField Name

Description

S/MIME

Enable for iOS 9.3.3 (or earlier)

Select to enable S/MIME signing andencryption on devices running iOS 9.3.3
or earlier.
You must select this option for the fields
in the S/MIME Signing and
S/MIME Encryption sections to apply
to devices running iOS 9.3.3 or earlier.

S/MIME
Encryption

Encryption by Default

Disabled by default.Select to enable
S/MIME encryption.

Encryption Identity

Select a certificate enrollment setting as
an encryption identity. If you do notmake a selection, then the device user
will be prompted to select from thecertificates that are already installed on
the device. If the device has no
certificate, then S/MIME encryption will
not be functional on the device.
Related topics
Certificate Enrollment settings.

Encryption Identity: User

iOS 12.0 through the most recently

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 332

Synchronizing Google account data

SectionField Name

Description

Overrideable

released version as supported by
MobileIron
Select to allow the user to set the
S/MIME encryption identity and enableencryption.

Per-Message Encryption Switch

Per-message S/MIME for iOS allows
device users to enable or disable
S/MIME encryption for each email they
send.
NOTE: S/MIME encryption isincompatible with
MobileIron Sentry
attachment encryption.

5. Click Save.
6. Push your settings to devices, as described in Pushing per-message S/MIME changes to devices.

Synchronizing Google account data
You can synchronize email, contacts, calendar, and tasks with mail apps on devices managed by MobileIron Core.
To enable synchronization, you need to authorize apps to use Google APIs for communication between servers
without accessing user information. This requires a service account that makes API calls on behalf of an app, as
well as credentials that authenticate the identity of the app.
You create these credentials in the Google Developers Console, and then upload the credentials both to the Google
Admin Console and MobileIron Core. You can then configure an Exchange setting to synchronize Google email
data (including email, contacts, calendar, and tasks) with managed devices. You can alternatively choose tosynchronize only some email data, such as calendar and contacts only, or email alone.
The Exchange setting also allows you to control the Google Apps password through MobileIron Core.
Main steps
Synchronizing Google Apps data involves the following main steps:lUsing OAuth to enable access to Google APIsl

Uploading OAuth credentials to the Google Admin ConsolelLinking Google Apps credentials with MobileIron Corel

Setting up your Exchange setting for access to Google Apps datal

Renewing the Google Apps password for a given set of users (optional)

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 333

Using OAuth to enable access to Google APIs

Before you begin
You need a Google administrator account.
Review the following Google documentation:lhttps://developers.google.com/admin-sdk/?hl=en_USlhttps://support.google.com/googleapi/answer/6158857?hl=enlhttps://support.google.com/googleapi/answer/6158849?hl=en#serviceaccounts

Using OAuth to enable access to Google APIs
You must login to the Google Developers Console to enable access to Google APIs from clients using OAuth.
For detailed information, see the Google documentation here:lhttps://developers.google.com/identity/protocols/OAuth2lhttps://developers.google.com/identity/protocols/OAuth2ServiceAccountFollowing are the main steps of this procedure.
Main steps
1. Login to https://console.developers.google.com
2. In the Google Developers Console, create a new project.
3. Enable the Admin SDK and/or APIs.
4. Create credentials for the OAuth 2.0 client.
5. Create a consent form.
6. Enter the relevant information, as shown in the following table.
Item

Description

Application type

Select web application.

Name

Enter the name of the iOS app.

Authorized JavaScript origins

Enter JavaScript origins here or redirect URIs below (or both).
Cannot contain a wildcard (http://*.example.com) or a path
(http://example.com/subdir).

Authorized redirect URIs

Must have a protocol. Cannot contain URL fragments or relative
paths. Cannot be a public IP address.

7. Download the credentials in the form of a JSON file for the web client.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 334

Uploading OAuth credentials to the Google Admin Console

Uploading OAuth credentials to the Google Admin Console
You must now upload to the Google Admin Console the JSON file you created in Using OAuth to enable access toGoogle APIs. The JSON files contains the credentials you created for client access.
For detailed information, see the Google documentation here:••

https://developers.google.com/identity/protocols/OAuth2
https://developers.google.com/identity/protocols/OAuth2ServiceAccountFollowing are the main steps of this procedure.
Main steps
1. Go to https://admin.google.com and login with your administrator ID.
2. Enable API access.
3. Enter the client name and API scope.
4. Authorize the JSON file so that clients may access it.

Linking Google Apps credentials with MobileIron Core
You must upload the JSON credentials file you downloaded from the Google Developers console to link your
Google credentials with MobileIron Core. For more information, see Using OAuth to enable access to Google APIs.
NOTE: If the Google password has expired, iOS will not necessarily be aware of the expiration, andsynchronization could fail. Manually regenerate the Google password from the Google
Developers Console.
Procedure
1. In the Admin Portal, go to Services > Google.
2. In the Google Admin Username field, enter your Google administrator email address.
3. Next to the JSON File field, click Browse.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 335

Linking Google Apps credentials with MobileIron Core

4. Select the JSON file you downloaded from the Google Developers Console.
5. Click Save.
The results are displayed on the lower left.

6. Go to Settings > Preferences.
7. Scroll down to the Google Apps API section.
8. Click Password Settings.
9. Configure password settings as follows:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 336

Setting up your Exchange setting for access to Google Apps datalPassword length must be: Enter the minimum password length.

lRequire a password change every: Check the box and enter the number of days after which device
users must change their password.
NOTE: Password expiration and password length values should match whatever isconfigured in Google. For example, if you configured a 90 day expiration period in
Google with a password length of 8 to 90, then you would configure the same
expiration and password length values in MobileIron Core.

10. Click Save.
11. Optionally, view the Google Apps account status by clicking View Account.

Setting up your Exchange setting for access to Google Apps data
Create an Exchange setting to connect MobileIron Core to Google servers, such that device users will be able toaccess their email, calendar, and contacts. Apply the Exchange setting to the relevant labels, such that Core
pushes the new setting to the correct devices. The Exchange setting must include the Google Apps Password flag,
which tells Core to generate a Google Apps password and send it to Google servers.
When sending an event to a device, MobileIron Core checks whether the Google Apps Password flag is toggled on
or off. If a Google Apps password is required, but the password has not yet been generated and sent to Google,
then Core sends the password to Google first before sending the Exchange setting to the device.
If MobileIron Core cannot find a user on Google, Core logs an error, and does not push the Exchange setting again.
Under some circumstances, you may need to renew the Google Apps password. For more information, see
Renewing the Google Apps password for a given set of users.
Note The Following:ll

If you intend to distribute an AppConnect email app to devices, such as MobileIron Email+ for iOS, youmust add the key email_password with a value of $GOOGLE_AUTOGEN_PASSWORD$ to the
AppConnect app configuration for the email app. For more information, see “Configuring an AppConnect
app configuration” in the MobileIron Core AppConnect and AppTunnel Guide for MobileIron Core.
Set the Exchange Username field to $EMAIL$ when using $GOOGLE_AUTOGEN_PASSWORD$ in the
Password field and when using Android Enterprise managed configurations or AppConnect KVPs.

Procedure
1. In the Admin Portal go to Policies & Configs > Configurations.
2. Click Add New > Exchange.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 337

Setting up your Exchange setting for access to Google Apps data

3. In the Exchange Setting dialog box, enter the following:
Item

Description

GeneralName

Enter brief text that identifies this group of Exchange settings.

Description

Enter additional text that clarifies the purpose of this group of Exchange
settings.

Server AddressEnter the address of the mail server, such as m.google.com.
If you are using Standalone Sentry, do the following:•••Enter the address of Standalone Sentry.
Go to Services > Sentry and edit your Standalone Sentry. In the
ActiveSync Server field, enter m.google.com.
If you are using load balancers, contact MobileIron Professional
Services.

For more information about configuring Sentry, see the MobileIron
Sentry Guide.
Use SSL

Select to use secure connections.
NOTE: You must use SSL to link to Google Apps.

Google Apps Password

When linking to Google Apps, select this option to use the Google Apps
password to log in to the Google account you have configured to workwith MobileIron Core. This password allows device users to accesstheir mail, contacts, and calendar data on their managed devices.
When selected, Core grays out the ActiveSync User Name andActiveSync User Password.
This check box only appears if you have configured a Google accountwith MobileIron Core, as described in Synchronizing Google accountdata.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 338

Renewing the Google Apps password for a given set of users

Item

Description

ActiveSync User EmailSpecify the variable for the email address to be used with this Exchange
configuration. You can specify any or all of the following variables$EMAIL$, $USERID$, $PASSWORD$. You can also specify custom
formats, such as $USERID$_US. Custom attribute variable
substitutions are supported.
Typically, you use $EMAIL$ in this field.

Items to Synchronize

Select the items you want to synchronize with Google Apps: Contacts,
Calendar, Email, Tasks.

Email access to ThirdParty apps

Disable this option, so that third-party apps can use the account foremail access.

4. Click Save.
5. Check the box next to the Exchange setting you created, and select Actions > Apply To Label.
6. Select the labels to which you want to apply the Exchange setting and click Apply.
NOTE: For information on calling contacts using your Google email account, see Google
Account .

Renewing the Google Apps password for a given set of users
If there is a communication error when sending a Google Apps password to Google, MobileIron Corere-queues theevent. Core tracks the number of attempts to send updated passwords to Google. If it reaches the preset maximum
number of attempts to contact Google servers, Core stops trying and the password is set to failure state. At thispoint, you must manually renew the Google Apps password.
You can renew the Google password for an individual user or a set of users on the Users page in the MobileIron
Core Admin Portal. After you generate it, Core pushes the new password to Google when the device checks in.
Procedure
1. Go to Devices & Users > Users.
2. Select the user or users whose Google password you want to renew.
3. Select Actions > Renew Google Apps Password.
The Admin Portal shows a dialog that lists the users whose Google Apps password you want to renew.
4. Click Renew Google Apps Password.
The Admin Portal sends the request to renew the Google Apps password for the selected users.
5. Click Close.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 339

Synchronizing Google calendar and contacts without ActiveSync

Synchronizing Google calendar and contacts without
ActiveSync
MobileIron Core allows you to configure managed iOS devices to synchronize with Google calendar and contact
data directly, rather than through ActiveSync. Synchronizing Google calendar and contact data with iOS devices
using a CalDAV or CardDAV configuration allows data to synchronize more quickly with devices and without an
ActiveSync configuration.
Create a CalDAV or CardDAV configuration so that users will be able to access their Google calendar and contact
data.
Procedure
1. Go to Policies & Configs > Configurations.
2. Click Add New.
3. Select Apple > iOS and macOS > CardDAV or CalDAV.
4. Use the following guidelines to fill in the form:
Item

Description

Name

Enter brief text that identifies this group of iOS and macOS CalDAV or
CarDAV settings.

Description

Enter additional text that clarifies the purpose of this group of iOS andmacOS CalDAV or CarDAV settings.

HostNameEnter the host name of the calendar server.

Port

Enter the port for the calendar server.

Principal URL

Enter the URL for accessing calendar services.

Use SSL

Select to use SSL for data transfer.

Use Google Apps
Password

Select to use the Google Apps password.

5. Click Save.
6. Apply the new CalDAV or CardDAV setting to the relevant devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 340

15Managing Wi-Fi Settings
This section addresses the Wi-Fi settings.
NOTE: All Wi-Fi settings and features supported by iOS devices are also supported by tvOS devices.
l

Wi-Fi settingsl

Wi-Fi profiles and password cachingl

Wi-Fi authentication types

NOTE: The features described in this section are supported on macOS devices.

Wi-Fi settings
To configure wireless network access, in the Admin Console, go to Policies & Configs > Configurations. Click
Add New > Wi-Fi to create a new configuration.
Only the WPA Enterprise and EAP type of TTLS are supported for macOS devices.
For macOS only, select one of the following Channel options:lDevice channel - the configuration is effective for all users on a device. This is the typical option.

lUser channel - the configuration is effective only for the currently registered user on a device.

NOTE: Do not assign multiple Wi-Fi profiles to a device if the Network Name SSID (Service Set Identifier)differs only by case. For example, if one profile has an SSID value of "yourco" and another has an
SSID of "YourCo," those two must not be assigned to the same device. Doing so will cause checkin problems, and full device details will not be properly recorded.

Wi-Fi profiles and password caching
To make deployments easier, MobileIron offers the option of caching a user’s Wi-Fi password. This option is turned
off by default. Cached passwords are encrypted, stored on MobileIron Core, and used only for authentication. Notethat the password must match the LDAP password in order for this feature to be of use.

Wi-Fi authentication types
The fields that appear in the New Wi-Fi Setting dialog change based on values selected. The following tables
describe the fields required for each selection in the Authentication field:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 341

Open authentication

Open authentication
Use the following guidelines to set up Open authentication.

TABLE 35. WI-FI OPEN AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select Open.

Data Encryption

Not Applicable for iOS.

Network Key

Not Applicable for iOS.

Key Index

WEP encryption
If using multiple network keys, select a number indicating the memory positionof the correct encryption key.

Confirm Network Key

This feature is not supported on iOS devices.

User NameWEP Enterprise encryption
Specify the variable to use as the user name when establishing the Wi-Fi
connection. See Supported variables for Wi-Fi authentication

Password

WEP Enterprise encryption
Specify the variable to use and any necessary custom formatting for the Wi-Fi
password. The default variable selected is $PASSWORD$.
Enter additional variables or text in the text box adjacent to the Password field.
Entries in this text box are kept hidden and will not be visible to any MobileIron
Core administrator.
Note The Following:• If you specify $PASSWORD$, also enable Save User Password under
Settings > System Settings > Users & Devices > Registration.
• All variables and text up to the last valid variable will be visible. Anything
after the last valid variable will not be visible. The valid variable may appear

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 342

Open authentication

TABLE 35. WI-FI OPEN AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Descriptionin either of the password fields.
See Supported variables for Wi-Fi authentication.

Apply to Certificates

WEP Enterprise encryption
Configure this field with the CA certificate needed to validate the Identity
Certificate presented by the Wi-Fi Access Point. It is not the CA certificate

needed to validate the Identity Certificate sent to the device in the Wi-Fi
config.
Trusted Certificate Names

WEP Enterprise encryption.
If you did not specify trusted certificates in the Apply to Certificates list, thenenter the names of the authentication servers to be trusted. You can specify aparticular server, such as server.mycompany.com or a partial name such as*.mycompany.com.

Allow Trust Exceptions

WEP Enterprise encryption.
Select this option to let users decide to trust a server when the chain of trust
can’t be established. To avoid these prompts, and to permit connections only totrusted services, turn off this option and upload all necessary certificates.

Use Per-connection
Password

WEP Enterprise encryption.

EAP Type

Select the authentication protocol used:• EAP-FAST• EAP-SIM• LEAP• PEAP• TLS• TTLS

Select this option to prompt the user to enter a password each time the device
connects to the Wi-Fi network.

You can make multiple selections.
If you select EAP-FAST, then you also need to specify the Protected Access
Credential (PAC).
If you select TLS, then you must specify an Identity Certificate.
If you select TTLS, then you must also specify the Inner Identity
Authentication Protocol. You may optionally specify an Outer Identity
Connects To

Select Internet or Work.

Apple Settings

These features are not supported on Mac OS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 343

Open authentication

TABLE 35. WI-FI OPEN AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Auto Join

Specifies whether devices should automatically join the corresponding Wi-Fi
network. If this option is not selected, device users must tap the network nameon the device to join the network.

Disable Captive Network
Detection

Select to disable Apple's Captive Network Assistant, which automaticallydetects captive networks. When this option is selected, device users must
manually open a web browser to trigger the portal login for the captive network.
This feature is supported on devices running iOS 10 and macOS 10 through themost recently released versions as supported by MobileIron.

Disable MAC address

Select to disable MAC address randomization for that Wi-Fi network while

randomization

associated with the network. It also disables the Private Address. Device users
will see a "Privacy Warning" message on their Wi-Fi settings indicating that the
network has reduced privacy protections.
Note The Following:• The device user will still have the ability to set the device to report a random
address for new connections instead of the device's actual Wi-Fi MAC
address.
• MDM will always get the actual MAC address. This property only affects the
MAC address that the device reports to the server.
Applicable to iOS 14.0 through the latest version as supported by MobileIron.

Proxy TypeSpecifies whether a proxy is configured, and which type. Available types are
Manual and Auto.

Proxy PAC URL

Optional. Specifies the URL for the proxy auto-configuration (PAC) file.

Proxy Server

Specifies the proxy server’s IP address.

Proxy User Name

For manual proxies, specifies the optional user name for server access.

Proxy Password

For manual proxies, specifies the optional password for server access.

PriorityEnter a number between 1 and 100 to set the priority for the Wi-Fi setting, or
leave the field blank.
If multiple Wi-Fi settings are applied, the device selects the Wi-Fi setting withthe higher priority. Higher numbers signify higher priority.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 344

Shared authentication

TABLE 35. WI-FI OPEN AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

Cisco QoS fast lane

Supported on devices running iOS 10 through the most recently released version
as supported by MobileIron.

Restrict QoS marking

Select to restrict Cisco Quality of Service (QoS) "fast lane" prioritization toparticular whitelisted iOS apps. Disabled by default, such that any iOS app may
benefit from fast lane prioritization.

Disable L3 marking and only
allow L2 marking for traffic
sent to the Wi-Fi network

Select to mark traffic sent to the Wi-Fi network as L2 only.

Whitelist audio and video
calls for L2 and L3 marking

Select to allow all voice and video calls to be marked as L2 and L3 traffic.
NOTE: If you disable L3 marking and whitelist audio and video for L2 andL3 marking, then audio and video calls will be marked as L2 only.

Apps that will be whitelisted
for L2 and L3 marking for
traffic

Mark the check box to select specific apps you want to whitelist for L2 and L3
traffic marking.
• Click the Add (+) button to add a row to the table of apps. A new row isadded to the table. In the App Name column, click the drop-down list to
select an App Catalog app.
• Repeat for any other apps you want to whitelist for L2 and L3 traffic marking.

Windows Settings

These features are not supported on iOS devices.
These features are not supported on Mac OS devices.

Related topicslShared authenticationl

WPA Enterprise authenticationl

WPA2 / WPA3 Enterprise authenticationl

WPA Personal authenticationl

WPA2 / WPA3 Personal authenticationlSupported variables for Wi-Fi authentication

Shared authentication
Use the following guidelines to set up shared authentication:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 345

Shared authentication

TABLE 36. WI-FI SHARED AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select Shared.

Data Encryption

This feature is not supported on iOS devices.

Network Key

This feature is not supported on iOS devices.

Key Index

WEP encryption
If using multiple network keys, select a number indicating the memory positionof the correct encryption key.

Confirm Network Key

This feature is not supported on iOS devices.

User NameWEP Enterprise encryption
Specify the variable to use as the user name when establishing the Wi-Fi
connection. See Supported variables for Wi-Fi authentication.

Password

WEP Enterprise encryption
Specify the variable to use and any necessary custom formatting for the Wi-Fi
password. The default variable selected is $PASSWORD$.
Enter additional variables or text in the text box adjacent to the Password field.
Entries in this text box are kept hidden and will not be visible to any MobileIron
Core administrator.
Note The Following:• If you specify $PASSWORD$, also enable Save User Password under
Settings > System Settings > Users & Devices > Registration.
• All variables and text up to the last valid variable will be visible. Anything
after the last valid variable will not be visible. The valid variable may appear
in either of the password fields.
See Supported variables for Wi-Fi authentication.

Apply to Certificates

WEP Enterprise encryption
Configure this field with the CA certificate needed to validate the Identity

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 346

Shared authentication

TABLE 36. WI-FI SHARED AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description
Certificate presented by the Wi-Fi Access Point. It is not the CA certificate
needed to validate the Identity Certificate sent to the device in the Wi-Fi config.

Trusted Certificate Names

WEP Enterprise encryption.
If you did not specify trusted certificates in the Apply to Certificates list, thenenter the names of the authentication servers to be trusted. You can specify aparticular server, such as server.mycompany.com or a partial name such as*.mycompany.com.

Allow Trust Exceptions

WEP Enterprise encryption.
Select this option to let users decide to trust a server when the chain of trust
can’t be established. To avoid these prompts, and to permit connections only totrusted services, turn off this option and upload all necessary certificates.

Use Per-connection
Password

WEP Enterprise encryption.

EAP Type

Select the authentication protocol used:• EAP-FAST• EAP-SIM• LEAP• PEAP• TLS• TTLS

Select this option to prompt the user to enter a password each time the device
connects to the Wi-Fi network.

You can make multiple selections.
If you select EAP-FAST, then you also need to specify the Protected Access
Credential (PAC).
If you select TLS, then you must specify an Identity Certificate.
If you select TTLS, then you must also specify the Inner Identity
Authentication Protocol. You may optionally specify an Outer Identity.
Connects To

Select Internet or Work.

Apple Settings
ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 347

Shared authentication

TABLE 36. WI-FI SHARED AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

Auto Join

Specifies whether devices should automatically join the corresponding Wi-Fi
network. If this option is not selected, device users must tap the network nameon the device to join the network.

Disable Captive Network
Detection

Select to disable Apple's Captive Network Assistant, which automaticallydetects captive networks. When this option is selected, device users must
manually open a web browser to trigger the portal login for the captive network.
This feature is supported on devices running iOS 10 and macOS 10 through themost recently released versions as supported by MobileIron.

Disable MAC address

Select to disable MAC address randomization for that Wi-Fi network while

randomization

associated with the network. Device users will see a "Privacy Warning"message on their Wi-Fi settings indicating that the network has reduced privacy
protections. Changing this option will disable the Private Address.
NOTE: The device user will still have the ability to set the device to reporta random address for new connections instead of the device's
actual Wi-Fi MAC address.
Applicable to iOS 14.0 through the latest version as supported by MobileIron.

Proxy TypeSpecifies whether a proxy is configured, and which type. Available types are
Manual and Auto.

Proxy PAC URLSpecifies the URL for the proxy auto-configuration (PAC) file.

Proxy Server

Specifies the proxy server’s IP address.

PriorityEnter a number between 1 and 100 to set the priority for the Wi-Fi setting, or
leave the field blank.
If multiple Wi-Fi settings are applied, the device selects the Wi-Fi setting withthe higher priority. Higher numbers signify higher priority.

Cisco QoS fast lane

Supported on devices running iOS 10 through the most recently released version
as supported by MobileIron.

Restrict QoS marking

Select to restrict Cisco Quality of Service (QoS) "fast lane" prioritization toparticular whitelisted iOS apps. Disabled by default, such that any iOS app may
benefit from fast lane prioritization.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 348

WPA Enterprise authentication

TABLE 36. WI-FI SHARED AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

Disable L3 marking and only
allow L2 marking for traffic
sent to the Wi-Fi network

Select to mark traffic sent to the Wi-Fi network as L2 only.

Whitelist audio and video
calls for L2 and L3 marking

Select to allow all voice and video calls to be marked as L2 and L3 traffic.
NOTE: If you disable L3 marking and whitelist audio and video for L2 andL3 marking, then audio and video calls will be marked as L2 only.

Apps that will be whitelisted
for L2 and L3 marking for
traffic

Mark the check box to select specific apps you want to whitelist for L2 and L3
traffic marking.
• Click the Add (+) button to add a row to the table of apps. A new row isadded to the table. In the App Name column, click the drop-down list to
select an App Catalog app.
• Repeat for any other apps you want to whitelist for L2 and L3 traffic marking.

Related topicslOpen authenticationl

WPA Enterprise authenticationl

WPA2 / WPA3 Enterprise authenticationl

WPA Personal authenticationl

WPA2 / WPA3 Personal authenticationlSupported variables for Wi-Fi authentication

WPA Enterprise authentication
Use the following guidelines to set up WPA Enterprise authentication:

TABLE 37. WI-FI WPA ENTERPRISE AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select WPA Enterprise.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 349

WPA Enterprise authentication

TABLE 37. WI-FI WPA ENTERPRISE AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

Data Encryption

This feature is not supported on iOS devices. This feature is not supported on
Mac macOS devices.

User Name

Specify the variable to use as the user name when establishing the Wi-Fi
connection. See Supported variables for Wi-Fi authentication

Password

Specify the variable to use and any necessary custom formatting for the Wi-Fi
password. The default variable selected is $PASSWORD$.
Enter additional variables or text in the text box adjacent to the Password field.
Entries in this text box are kept hidden and will not be visible to any MobileIron
Core administrator.
Note The Following:• If you specify $PASSWORD$, also enable Save User Password under
Settings > System Settings > Users & Devices > Registration.
• All variables and text up to the last valid variable will be visible. Anything
after the last valid variable will not be visible. The valid variable may appear
in either of the password fields.
See Supported variables for Wi-Fi authentication

Apply to Certificates

Configure this field with the CA certificate needed to validate the Identity
Certificate presented by the Wi-Fi Access Point. It is not the CA certificate
needed to validate the Identity Certificate sent to the device in the Wi-Fi
configuration.

Trusted Certificate Names

If you did not specify trusted certificates in the Apply to Certificates list, thenenter the names of the authentication servers to be trusted. You can specify aparticular server, such as server.mycompany.com or a partial name such as*.mycompany.com.

Allow Trust Exceptions

Select this option to let users decide to trust a server when the chain of trust
can’t be established. To avoid these prompts, and to permit connections only totrusted services, turn off this option and upload all necessary certificates.

Use Per-connection
Password

Select this option to prompt the user to enter a password each time the device
connects to the Wi-Fi network.

EAP Type

Select the authentication protocol used:• EAP-FAST• EAP-SIM• LEAP• PEAP• TLS• TTLS

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 350

WPA Enterprise authentication

TABLE 37. WI-FI WPA ENTERPRISE AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description
You can make multiple selections.
If you select EAP-FAST, then you also need to specify the Protected Access
Credential (PAC).
If you select TLS, then you must specify an Identity Certificate.
If you select TTLS, then you must also specify the Inner Identity
Authentication Protocol. You may optionally specify an Outer Identity.

Connects To

Select Internet or Work.

Apple Settings
ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Auto Join

Specifies whether devices should automatically join the corresponding Wi-Fi
network. If this option is not selected, device users must tap the network nameon the device to join the network.

Disable Captive Network
Detection

Select to disable Apple's Captive Network Assistant, which automaticallydetects captive networks. When this option is selected, device users must
manually open a web browser to trigger the portal login for the captive network.
This feature is supported on devices running iOS 10 and macOS 10 through themost recently released versions as supported by MobileIron.

Disable MAC address

Select to disable MAC address randomization for that Wi-Fi network while

randomization

associated with the network. Device users will see a "Privacy Warning"message on their Wi-Fi settings indicating that the network has reduced privacy
protections. Changing this option will disable the Private Address.
NOTE: The device user will still have the ability to set the device to reporta random address for new connections instead of the device's
actual Wi-Fi MAC address.
Applicable to iOS 14.0 through the latest version as supported by MobileIron.

Proxy TypeSpecifies whether a proxy is configured, and which type. Available types are
Manual and Auto.

Proxy PAC URLSpecifies the URL for the proxy auto-configuration (PAC) file.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 351

WPA2 / WPA3 Enterprise authentication

TABLE 37. WI-FI WPA ENTERPRISE AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

Proxy Server

Specifies the proxy server’s IP address.

PriorityEnter a number between 1 and 100 to set the priority for the Wi-Fi setting, or
leave the field blank.
If multiple Wi-Fi settings are applied, the device selects the Wi-Fi setting withthe higher priority. Higher numbers signify higher priority.

Cisco QoS fast lane

Supported on devices running iOS 10 through the most recently released version
as supported by MobileIron.

Restrict QoS marking

Select to restrict Cisco Quality of Service (QoS) "fast lane" prioritization toparticular whitelisted iOS apps. Disabled by default, such that any iOS app may
benefit from fast lane prioritization.

Disable L3 marking and only
allow L2 marking for traffic
sent to the Wi-Fi network

Select to mark traffic sent to the Wi-Fi network as L2 only.

Whitelist audio and video
calls for L2 and L3 marking

Select to allow all voice and video calls to be marked as L2 and L3 traffic.
NOTE: If you disable L3 marking and whitelist audio and video for L2 andL3 marking, then audio and video calls will be marked as L2 only.

Apps that will be whitelisted
for L2 and L3 marking for
traffic

Mark the check box to select specific apps you want to whitelist for L2 and L3
traffic marking.
• Click the Add (+) button to add a row to the table of apps. A new row isadded to the table. In the App Name column, click the drop-down list to
select an App Catalog app.
• Repeat for any other apps you want to whitelist for L2 and L3 traffic marking.

Related topicslOpen authenticationlShared authenticationl

WPA2 / WPA3 Enterprise authenticationl

WPA Personal authenticationl

WPA2 / WPA3 Personal authenticationlSupported variables for Wi-Fi authentication

WPA2 / WPA3 Enterprise authentication
Use the following guidelines to configure WPA2 or WPA3 Enterprise authentication.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 352

WPA2 / WPA3 Enterprise authentication

Except for Apple TV, WPA2 Enterprise is applicable to iOS 8.0 through the latest version as supported by
MobileIron.
WPA3 Enterprise is applicable to iOS 13.0 through the latest version as supported by MobileIron.

TABLE 38. WI-FI WPA2 / WPA3 ENTERPRISE AUTHENTICATION FIELD DESCRIPTION
Item

Description

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select one:
• WPA2 Enterprise• WPA2 Enterprise (iOS 8 or later except Apple TV)• WPA3 Enterprise (iOS 13 or later)

Data Encryption

This feature is not supported on iOS devices.

User Name

Specify the variable to use as the user name when establishing the Wi-Fi
connection. See WPA2 / WPA3 Enterprise authentication.

Password

Specify the variable to use and any necessary custom formatting for the Wi-Fi
password. The default variable selected is $PASSWORD$.
Enter additional variables or text in the text box adjacent to the Password field.
Entries in this text box are kept hidden and will not be visible to any MobileIron
Core administrator.
Note The Following:• If you specify $PASSWORD$, also enable Save User Password under
Settings > System Settings > Users & Devices > Registration.
• All variables and text up to the last valid variable will be visible. Anything
after the last valid variable will not be visible. The valid variable may appear
in either of the password fields. Valid variables are variables in the dropdown list.

Apply to Certificates

Configure this field with the CA certificate needed to validate the Identity
Certificate presented by the Wi-Fi Access Point. It is not the CA certificate
needed to validate the Identity Certificate sent to the device in the Wi-Fi
configuration.

Trusted Certificate Names

If you did not specify trusted certificates in the Apply to Certificates list, thenenter the names of the authentication servers to be trusted. You can specify aparticular server, such as server.mycompany.com or a partial name such as*.mycompany.com.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 353

WPA2 / WPA3 Enterprise authentication

TABLE 38. WI-FI WPA2 / WPA3 ENTERPRISE AUTHENTICATION FIELD DESCRIPTION (CONT.)
Item

Description

Allow Trust Exceptions

Select this option to let users decide to trust a server when the chain of trust
can’t be established. To avoid these prompts, and to permit connections only totrusted services, turn off this option and upload all necessary certificates.

Use Per-connection
Password

Select this option to prompt the user to enter a password each time the device
connects to the Wi-Fi network.

EAP Type

Select the authentication protocol used:l

EAP-FASTl

EAP-SIM

l

LEAP

l

PEAP

l

TLS

l

TTLS

You can make multiple selections.
If you select EAP-FAST, then you also need to specify the Protected Access
Credential (PAC).
If you select TLS, then you must specify an Identity Certificate.
If you select TTLS, then you must also specify the Inner Identity
Authentication Protocol. You may optionally specify an Outer Identity.
Connects To

Select Internet or Work.

Apple Settings
ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Auto Join

Specifies whether devices should automatically join the corresponding Wi-Fi
network. If this option is not selected, device users must tap the network nameon the device to join the network.

Disable Captive Network

Select to disable Apple's Captive Network Assistant, which automatically

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 354

WPA2 / WPA3 Enterprise authentication

TABLE 38. WI-FI WPA2 / WPA3 ENTERPRISE AUTHENTICATION FIELD DESCRIPTION (CONT.)
Item

Description

Detection

detects captive networks. When this option is selected, device users must
manually open a web browser to trigger the portal login for the captive network.
This feature is supported on devices running iOS 10 and macOS 10 through themost recently released versions as supported by MobileIron.

Disable MAC address

Select to disable MAC address randomization for that Wi-Fi network while

randomization

associated with the network. Device users will see a "Privacy Warning"message on their Wi-Fi settings indicating that the network has reduced privacy
protections. Changing this option will disable the Private Address.
NOTE: The device user will still have the ability to set the device to reporta random address for new connections instead of the device's
actual Wi-Fi MAC address.
Applicable to iOS 14.0 through the latest version as supported by MobileIron.

Proxy TypeSpecifies whether a proxy is configured, and which type. Available types are
Manual and Auto.

Proxy PAC URLSpecifies the URL for the proxy auto-configuration (PAC) file.

Proxy Server

Specifies the proxy server’s IP address.

PriorityEnter a number between 1 and 100 to set the priority for the Wi-Fi setting, or
leave the field blank.
If multiple Wi-Fi settings are applied, the device selects the Wi-Fi setting withthe higher priority. Higher numbers signify higher priority.

Cisco QoS fast lane

Supported on devices running iOS 10 through the most recently released version
as supported by MobileIron.

Restrict QoS marking

Select to restrict Cisco Quality of Service (QoS) "fast lane" prioritization toparticular whitelisted iOS apps. Disabled by default, such that any iOS app may
benefit from fast lane prioritization.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 355

WPA Personal authentication

TABLE 38. WI-FI WPA2 / WPA3 ENTERPRISE AUTHENTICATION FIELD DESCRIPTION (CONT.)
Item

Description

Disable L3 marking and only
allow L2 marking for traffic
sent to the Wi-Fi network

Select to mark traffic sent to the Wi-Fi network as L2 only.

Whitelist audio and video
calls for L2 and L3 marking

Select to allow all voice and video calls to be marked as L2 and L3 traffic.
NOTE: If you disable L3 marking and whitelist audio and video for L2 andL3 marking, then audio and video calls will be marked as L2 only.

Apps that will be whitelisted
for L2 and L3 marking for
traffic

Mark the check box to select specific apps you want to whitelist for L2 and L3
traffic marking.
• Click the Add (+) button to add a row to the table of apps. A new row isadded to the table. In the App Name column, click the drop-down list to
select an App Catalog app.
• Repeat for any other apps you want to whitelist for L2 and L3 traffic marking.

Related topicslOpen authenticationlShared authenticationl

WPA Enterprise authenticationl

WPA Personal authenticationl

WPA2 / WPA3 Personal authenticationlSupported variables for Wi-Fi authentication

WPA Personal authentication
Use the following guidelines to configure WPA Personal authentication.

TABLE 39. WI-FI WPA PERSONAL AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 356

WPA Personal authentication

TABLE 39. WI-FI WPA PERSONAL AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

Authentication

Select WPA Personal.

Data Encryption

This feature is not supported for iOS devices.

Network Key

This feature is not supported for iOS devices.

Confirm Network Key

This feature is not supported for iOS devices.

EAP Type

Not applicable.

Connects To

Select Internet or Work.

Apple Settings
ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Auto Join

Specifies whether devices should automatically join the corresponding Wi-Fi
network. If this option is not selected, device users must tap the network nameon the device to join the network.

Disable Captive Network
Detection

Select to disable Apple's Captive Network Assistant, which automaticallydetects captive networks. When this option is selected, device users must
manually open a web browser to trigger the portal login for the captive network.
This feature is supported on devices running iOS 10 and macOS 10 through themost recently released versions as supported by MobileIron.

Disable MAC address

Select to disable MAC address randomization for that Wi-Fi network while

randomization

associated with the network. Device users will see a "Privacy Warning"message on their Wi-Fi settings indicating that the network has reduced privacy
protections. Changing this option will disable the Private Address.
NOTE: The device user will still have the ability to set the device to reporta random address for new connections instead of the device's
actual Wi-Fi MAC address.
Applicable to iOS 14.0 through the latest version as supported by MobileIron.

Proxy TypeSpecifies whether a proxy is configured, and which type. Available types are
Manual and Auto.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 357

WPA2 Personal authentication

TABLE 39. WI-FI WPA PERSONAL AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

Proxy PAC URLSpecifies the URL for the proxy auto-configuration (PAC) file.

Proxy Server

Specifies the proxy server’s IP address.

PriorityEnter a number between 1 and 100 to set the priority for the Wi-Fi setting, or
leave the field blank.
If multiple Wi-Fi settings are applied, the device selects the Wi-Fi setting withthe higher priority. Higher numbers signify higher priority.

Cisco QoS fast lane

Supported on devices running iOS 10 through the most recently released version
as supported by MobileIron.

Restrict QoS marking

Select to restrict Cisco Quality of Service (QoS) "fast lane" prioritization toparticular whitelisted iOS apps. Disabled by default, such that any iOS app may
benefit from fast lane prioritization.

Disable L3 marking and only
allow L2 marking for traffic
sent to the Wi-Fi network

Select to mark traffic sent to the Wi-Fi network as L2 only.

Whitelist audio and video
calls for L2 and L3 marking

Select to allow all voice and video calls to be marked as L2 and L3 traffic.
NOTE: If you disable L3 marking and whitelist audio and video for L2 andL3 marking, then audio and video calls will be marked as L2 only.

Apps that will be whitelisted
for L2 and L3 marking for
traffic

Mark the check box to select specific apps you want to whitelist for L2 and L3
traffic marking.
• Click the Add (+) button to add a row to the table of apps. A new row isadded to the table. In the App Name column, click the drop-down list to
select an App Catalog app.
• Repeat for any other apps you want to whitelist for L2 and L3 traffic marking.

WPA2 Personal authentication
Use the following guidelines to configure WPA2 Personal authentication.

TABLE 40. WI-FI WPA2 PERSONAL AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 358

WPA2 Personal authentication

TABLE 40. WI-FI WPA2 PERSONAL AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select WPA2 Personal.

Data Encryption

This feature is not supported for iOS devices.

Network Key

This feature is not supported for iOS devices.

Confirm Network Key

This feature is not supported for iOS devices.

EAP Type

Not applicable.

Connects To

Select Internet or Work.

iOS Settings
Auto Join

Specifies whether devices should automatically join the corresponding Wi-Fi
network. If this option is not selected, device users must tap the network nameon the device to join the network.

Disable Captive Network
Detection

Select to disable Apple's Captive Network Assistant, which automaticallydetects captive networks. When this option is selected, device users must
manually open a web browser to trigger the portal login for the captive network.
This feature is supported on devices running iOS 10 and macOS 10 through themost recently released versions as supported by MobileIron.

Disable MAC address

Select to disable MAC address randomization for that Wi-Fi network while

randomization

associated with the network. Device users will see a "Privacy Warning"message on their Wi-Fi settings indicating that the network has reduced privacy
protections. Changing this option will disable the Private Address.
NOTE: The device user will still have the ability to set the device to reporta random address for new connections instead of the device's
actual Wi-Fi MAC address.
Applicable to iOS 14.0 through the latest version as supported by MobileIron.

Proxy TypeSpecifies whether a proxy is configured, and which type. Available types are
Manual and Auto.

Proxy PAC URLSpecifies the URL for the proxy auto-configuration (PAC) file.

Proxy Server

Specifies the proxy server’s IP address.

PriorityEnter a number between 1 and 100 to set the priority for the Wi-Fi setting, orMobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 359

WPA2 / WPA3 Personal authentication

TABLE 40. WI-FI WPA2 PERSONAL AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description
leave the field blank.
If multiple Wi-Fi settings are applied, the device selects the Wi-Fi setting withthe higher priority. Higher numbers signify higher priority.

Cisco QoS fast lane

Supported on devices running iOS 10 through the most recently released version
as supported by MobileIron.

Restrict QoS marking

Select to restrict Cisco Quality of Service (QoS) "fast lane" prioritization toparticular whitelisted iOS apps. Disabled by default, such that any iOS app may
benefit from fast lane prioritization.

Disable L3 marking and only
allow L2 marking for traffic
sent to the Wi-Fi network

Select to mark traffic sent to the Wi-Fi network as L2 only.

Whitelist audio and video
calls for L2 and L3 marking

Select to allow all voice and video calls to be marked as L2 and L3 traffic.
NOTE: If you disable L3 marking and whitelist audio and video for L2 andL3 marking, then audio and video calls will be marked as L2 only.

Apps that will be whitelisted
for L2 and L3 marking for
traffic

Mark the check box to select specific apps you want to whitelist for L2 and L3
traffic marking.
• Click the Add (+) button to add a row to the table of apps. A new row isadded to the table. In the App Name column, click the drop-down list to
select an App Catalog app.
• Repeat for any other apps you want to whitelist for L2 and L3 traffic marking.

Related topicslOpen authenticationlShared authenticationl

WPA Enterprise authenticationl

WPA2 / WPA3 Enterprise authenticationl

WPA2 / WPA3 Personal authenticationlSupported variables for Wi-Fi authentication

WPA2 / WPA3 Personal authentication
Use the following guidelines to configure WPA2 or WPA3 Personal authentication.
WPA3 Personal is applicable to iOS 13.0 through the latest version as supported by MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 360

WPA2 / WPA3 Personal authentication

TABLE 41. WI-FI WPA2 / WPA3 PERSONAL AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select one:
• WPA2 Personal• WPA3 Personal (iOS 13 or later)

Data Encryption

This feature is not supported for iOS devices.

Network Key

This feature is not supported for iOS devices.

Confirm Network Key

This feature is not supported for iOS devices.

EAP Type

Not applicable.

Connects To

Select Internet or Work.

Apple Settings
ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Auto Join

Specifies whether devices should automatically join the corresponding Wi-Fi
network. If this option is not selected, device users must tap the network nameon the device to join the network.

Disable Captive Network
Detection

Select to disable Apple's Captive Network Assistant, which automaticallydetects captive networks. When this option is selected, device users must
manually open a web browser to trigger the portal login for the captive network.
This feature is supported on devices running iOS 10 and macOS 10 through themost recently released versions as supported by MobileIron.

Disable MAC address

Select to disable MAC address randomization for that Wi-Fi network while

randomization

associated with the network. Device users will see a "Privacy Warning"

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 361

WPA2 / WPA3 Personal authentication

TABLE 41. WI-FI WPA2 / WPA3 PERSONAL AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description
message on their Wi-Fi settings indicating that the network has reduced privacy
protections. Changing this option will disable the Private Address.
NOTE: The device user will still have the ability to set the device to reporta random address for new connections instead of the device's
actual Wi-Fi MAC address.
Applicable to iOS 14.0 through the latest version as supported by MobileIron.

Proxy TypeSpecifies whether a proxy is configured, and which type. Available types are
Manual and Auto.

Proxy PAC URLSpecifies the URL for the proxy auto-configuration (PAC) file.

Proxy Server

Specifies the proxy server’s IP address.

PriorityEnter a number between 1 and 100 to set the priority for the Wi-Fi setting, or
leave the field blank.
If multiple Wi-Fi settings are applied, the device selects the Wi-Fi setting withthe higher priority. Higher numbers signify higher priority.

Cisco QoS fast lane

Supported on devices running iOS 10 through the most recently released version
as supported by MobileIron.

Restrict QoS marking

Select to restrict Cisco Quality of Service (QoS) "fast lane" prioritization toparticular whitelisted iOS apps. Disabled by default, such that any iOS app may
benefit from fast lane prioritization.

Disable L3 marking and only
allow L2 marking for traffic
sent to the Wi-Fi network

Select to mark traffic sent to the Wi-Fi network as L2 only.

Whitelist audio and video
calls for L2 and L3 marking

Select to allow all voice and video calls to be marked as L2 and L3 traffic.
NOTE: If you disable L3 marking and whitelist audio and video for L2 andL3 marking, then audio and video calls will be marked as L2 only.

Apps that will be whitelisted
for L2 and L3 marking for
traffic

Mark the check box to select specific apps you want to whitelist for L2 and L3
traffic marking.
• Click the Add (+) button to add a row to the table of apps. A new row isadded to the table. In the App Name column, click the drop-down list to
select an App Catalog app.
• Repeat for any other apps you want to whitelist for L2 and L3 traffic marking.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 362

Supported variables for Wi-Fi authentication

Related topicslOpen authenticationlShared authenticationl

WPA Enterprise authenticationl

WPA2 / WPA3 Enterprise authenticationl

WPA Personal authenticationlSupported variables for Wi-Fi authentication

Supported variables for Wi-Fi authentication
You can use the following variables in fields that support variables.
l$PASSWORD$ (only supported in the password field)l$EMAIL$l$USERID$l$DEVICE_MAC$l$NULL$l$USER_CUSTOM1$... $USER_CUSTOM4$ (custom fields defined for LDAP)

Custom attribute variable substitutions are supported.
Related topicslOpen authenticationlShared authenticationl

WPA Personal authenticationl

WPA2 / WPA3 Personal authenticationl

WPA Enterprise authenticationl

WPA2 / WPA3 Enterprise authentication

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 363

16Managing VPN Settings
This section addresses the VPN settings. If you do not see information for the relevant VPN setting, check the
MobileIron Core Device Management Guide of the relevant OS.
l

VPN settings overviewlConfiguring new VPN settingsl

Check Point Capsulel

Cisco AnyConnect (iOS only)l

Cisco Legacy AnyConnectl

F5 SSLl

IKEv2 (iOS Only)l

IKEv2 (Windows)l

IPSec (Blue Coat)l

IPSec (Cisco)lJuniper SSL

l

L2TP

l

MobileIron Tunnel (iOS and macOS)l

MobileIron Tunnel (Android)lMobileIron Tunnel (Samsung Knox Workspace)l

MobileIron Tunnel (Windows)l

NetMotion Mobility VPN (iOS)l

OpenVPN

l

Palo Alto Networks GlobalProtect

l

PPTP

l

Pulse Secure SSLlSamsung Knox IPsecl

SonicWall Mobile ConnectlCustom SSL

NOTE: For macOS devices, use any VPN settings marked as supported on macOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 364

VPN settings overview

VPN settings overview
VPN is a technology that creates a secure network connection over a public network. A mobile device uses a VPN
client to securely access protected corporate networks.
To use VPN:l

On the device, the user installs a VPN client app.

lDefine a VPN setting in MobileIron Core.

l

Apply labels to the VPN setting so that the VPN setting is sent to the appropriate devices.

l

Depending on the type of VPN, additional set up steps may be required to complete the VPN configuration.

Mobile@Work uses the VPN client and the VPN setting to enable access to corporate networks.

Configuring new VPN settings
In the Admin Portal, go to Policies & Configs > Configurations and click Add New > VPN to configure VPN
access.
For macOS only, select one of the following Channel options:lDevice channel - the configuration is effective for all users on a device. This is the typical option.

lUser channel - the configuration is effective only for the currently registered user on a device.

The following sections describe the fields required for each selection in the Connect Type field. For MobileIron
Tunnel support for Android, select MobileIron Tunnel (Android) in the Connection Type field.
For macOS devices, distribute the VPN configurations to either the Device Channel (effective for all users on a
device) or the User Channel (effective only for the currently registered user on a device). Regardless of the user
logged into the device, the configuration is effective for all users at the device level.

Check Point Capsule
This VPN connection type is supported on iOS, macOS, and Windows devices only. It is not supported on Android
devices
Use the following guidelines to configure the Check Point Capsule VPN connection type:l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 365

Proxy - None (default)lCustom Data

Proxy - None (default)
Use the following guidelines to configure a Check Point Capsule VPN without a proxy.

TABLE 42. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Check Point Capsule.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 366

Proxy - Manual

TABLE 42. PROXY - NONE SETTINGS (CONT.)
Item

Description

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Send All Traffic

Select to send all traffic from the Windows device through the VPN gateway.
When Send All Traffic is checked, all traffic is sent through the VPN gateway
with the exception of traffic from the resources you enter in this table.
When Send All Traffic is unchecked, only traffic from the resources you enterin this table is sent through the VPN gateway.

Continue to Custom Data.

Proxy - Manual
If you select Manual, you must specify the proxy server, port number. and proxy domain information.

TABLE 43. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Check Point Capsule.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. For an Automatic proxy, see Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 367

Proxy - Manual

TABLE 43. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
Type - Select Static or Variable for the type of authentication to be used for theproxy server.

Type

Select Manual proxy to see this option. Select Static or Variable.

Proxy Server User Name

If the authentication type is Static, enter the user name for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 368

Proxy - Automatic

TABLE 43. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Send All Traffic

Select to send all traffic from the Windows device through the VPN gateway.
When Send All Traffic is checked, all traffic is sent through the VPN gateway
with the exception of traffic from the resources you enter in this table.
When Send All Traffic is unchecked, only traffic from the resources you enterin this table is sent through the VPN gateway.

Continue to Custom Data.

Proxy - Automatic
If you selected an Automatic proxy, you must specify the proxy server URL and proxy domain(s).

TABLE 44. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Check Point Capsule.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. For a manual proxy, see Proxy - Manual

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 369

Proxy - Automatic

TABLE 44. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$

Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Send All Traffic

Select to send all traffic from the Windows device through the VPN gateway.
When Send All Traffic is checked, all traffic is sent through the VPN gateway
with the exception of traffic from the resources you enter in this table.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 370

Custom Data

TABLE 44. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
When Send All Traffic is unchecked, only traffic from the resources you enterin this table is sent through the VPN gateway.

Continue to Custom Data.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

Cisco AnyConnect (iOS only)This VPN connection type is supported on iOS devices only. It is not supported on Android, macOS, and Windows
devices.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:l

On Demand Rulesl

Domainsl

Custom Data

Proxy - None (default)
Use the following guidelines to configure a Cisco AnyConnect VPN without a proxy.

TABLE 45. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

Connection Type

Select Cisco AnyConnect (iOS Only).

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 371

Proxy - None (default)

TABLE 45. PROXY - NONE SETTINGS (CONT.)
Item

Description

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:llPassword - see next row for information.
Certificate - If you select Certificate, select the identity certificate to
be used as the account credential.
If you select Certificate, and extended authentication (EAP) is not
used, this certificate will be sent out for IKE client authentication. If
extended authentication is used, this certificate can be used for EAPTLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Group Name

Specify the name of the group to use.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 372

Proxy - None (default)

TABLE 45. PROXY - NONE SETTINGS (CONT.)
Item

Description
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
For instructions, see On Demand Rules.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable Per-App VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Continue to Domains.
Continue to Custom Data.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 373

Proxy - Manual

Proxy - Manual
If you select Manual, you must specify the proxy server, port number. and proxy domain information.

TABLE 46. PROXY - MANUAL SETTINGS
Item

Description

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.
Type - Select Static or Variable for the type of authentication to be used for theproxy server.

Proxy Server User Name

If the authentication type is Static, enter the user name for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:lPassword - see next row for information.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 374

Proxy - Manual

TABLE 46. PROXY - MANUAL SETTINGS (CONT.)
Item

DescriptionlCertificate - If you select Certificate, select the identity certificate to
be used as the account credential.
If you select Certificate, and extended authentication (EAP) is not
used, this certificate will be sent out for IKE client authentication. If
extended authentication is used, this certificate can be used for EAPTLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Group Name

Specify the name of the group to use.

VPN on Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 375

Proxy - Automatic

TABLE 46. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
For instructions, see On Demand Rules.

Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Continue to Domains.
Continue to Custom Data.

Proxy - Automatic
If you selected an Automatic proxy, you must specify the proxy server URL and proxy domain(s).

TABLE 47. PROXY - AUTOMATIC SETTINGS
Item

Description

Proxy ServerEnter the name for the proxy server.

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 376

Proxy - Automatic

TABLE 47. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description

Username

If you selected Username/Password as the EAP authentication type, enter avalue for the username. Required.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$

Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
User Authentication

Select the user authentication to use:llPassword - see next row for information.
Certificate - If you select Certificate, select the identity certificate to
be used as the account credential.
If you select Certificate, and extended authentication (EAP) is not
used, this certificate will be sent out for IKE client authentication. If
extended authentication is used, this certificate can be used for EAPTLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Group Name

Specify the name of the group to use.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domain-

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 377

Proxy - Automatic

TABLE 47. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
based rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
For instructions, see On Demand Rules.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Continue to Domains.
Continue to Custom Data.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 378

On Demand Rules

On Demand Rules
Applicable to: iOS 7 and later
Whenever a network change is detected, the VPN On Demand service compares the newly connected network
against the match network criteria specified in each set of rules (in order) to determine whether VPN On Demandshould be allowed or not on the newly-joined network.
Rule sets are checked sequentially, beginning with the first. A rule set matches the current network only if all of thespecified policies in that rule set match.
If a rule set matches the current network, a server probe is sent if a URL is specified in the profile. VPN then acts
according to the policy defined in the dictionary (for example, Allow, Ignore, Evaluate Connection, Connect, or
Disconnect).
Define sets of evaluation rules for each action that can be taken by VPN On Demand: Allow, Connect,
Disconnect, Evaluate Connection, and Ignore. You can define more than one set of rules for each type of actionthat can be taken. For each set of evaluation rules, the number of rules defined for that set is indicated in the No. ofRules column.

Procedure
1. Click Add+ to add a new set of On Demand evaluation rules.
A rule creation dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 379

On Demand Rules

2. From the On Demand Action drop-down list, select the action you want to be taken when the rules you
create below are matched.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
3. Matching Rules - For each rule you create, enter one of the following types:• DNS domain: This rule matches if any of the domain names in the specified list matches any domain
in the device’s search domains list. A wildcard '*' prefix is supported. For example, *.example.com
matches against either mydomain.example.com or yourdomain.example.com.
• DNS Server Address: This rule matches if any of the network’s specified DNS servers match any
entry in the list. Matching with a single wildcard is supported. For example, 17.* matches any DNS
server in the class A 17 subnet.
• SSID: A list of SSIDs to match against the current network. If the network is not a Wi-Fi network, or if
the SSID does not appear in this list, the match fails. Omit this rule and the corresponding list to matchagainst any SSID.
• Interface Type: If specified, this rule matches only if the primary network interface hardware matches
the specified interface type. Choose Ethernet, Wifi, or Cellular.
• URL String Probe: A URL to probe. If this URL is successfully fetched without redirection (returning
a 200 HTTP status code), this rule matches.
4. Enter a value for each rule type and an optional description.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 380

Default Rules

5. After adding your rules, click OK.
Default Rules

Define a default rule that simply specifies a default VPN On Demand action in case none of the On Demand rules
match, or if no On Demand rules have been defined.
Procedure
1. From the On Demand Action drop-down list, select the action you want to be taken by default, if none of
the rules match or none are defined.
2. Click Add+ to add a default rule.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
If you select Evaluate Connection, a domain actions table displays:

3. Click Add+ to add a domain action.
The Action Parameters dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 381

Domains

4. From the Domain Action drop-down list, select one of the following actions to be taken for the domains
listed in the table:• Connect if needed: The specified domains should trigger a VPN connection attempt if domain nameresolution fails, such as when the DNS server indicates that it cannot resolve the domain, respondswith a redirection to a different server, or fails to respond (timeout).
• Never connect: The specified domains should never trigger a VPN connection attempt.
5. Click Add+ to include any of the following evaluation types:• Domain: The domains for which this evaluation applies.
• Required DNS Server: IP addresses of DNS servers to be used for resolving the specified domains.
These servers need not be part of the device’s current network configuration. If these DNS servers are
not reachable, a VPN connection is established in response. These DNS servers should be either
internal DNS servers or trusted external DNS servers. You can only configure required DNS server
evaluation types for the Connect if needed domain action.
• Required URL Probe: An HTTP or HTTPS (preferred) URL to probe, using a GET request. If no
HTTP response code is received from the server, a VPN connection is established in response. You
can only configure required URL probe evaluation types for the Connect if needed domain action.
6. Add a value and optional description for each entry.
7. Click OK to save your domain action parameters.

Domains
Safari Domains

Applicable to: Safari Domains (iOS 7 and later; macOS 10.11 and later)
NOTE: You must update your VPN software to a version that supports Per-app VPN.
If the server ends with one of these domain names, a VPN connection is started automatically.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 382

Calendar DomainslAdd+ - Click to add a domain.

l

Safari Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Calendar Domains

Applicable to: Calendar Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Calendar Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Contact Domains

Applicable to: Contact Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

lContact Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Mail Domains

Applicable to: Mail Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Associated Domains

Applicable to: Associated Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are associated with the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Excluded Domains

Applicable to: Excluded Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are excluded from the per-app VPN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 383

Custom Datal

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

Cisco Legacy AnyConnect
This VPN connection type is supported on iOS devices (up to version 12.0), macOS, Android, and Windows
devices.
Use the following guidelines to configure Cisco Legacy AnyConnect VPN.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:l

On Demand Rulesl

Domainsl

Custom Data (does not apply to Android devices)

Proxy - None (default)
Use the following guidelines to configure a Cisco Legacy AnyConnect VPN without a proxy.

TABLE 48. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 384

Proxy - None (default)

TABLE 48. PROXY - NONE SETTINGS (CONT.)
Item

Description

Connection Type

Select Cisco Legacy AnyConnect.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Group Name

Specify the name of the group to use.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 385

Proxy - None (default)

TABLE 48. PROXY - NONE SETTINGS (CONT.)
Item

Description

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
For instructions, see On Demand Rules.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for iOS devices.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 386

Proxy - Manual

TABLE 48. PROXY - NONE SETTINGS (CONT.)
Item

Description
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Domains.
Continue to Custom Data.

Proxy - Manual
If you select Manual, you must specify the proxy server, port number, and proxy domain information.

TABLE 49. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a
device. This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Cisco Legacy AnyConnect.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.
Type - Select Static or Variable for the type of authentication to be used forthe proxy server.

Proxy Server User Name

If the authentication type is Static, enter the user name for the proxy server.
If the authentication type is Variable, the default variable selected is

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 387

Proxy - Manual

TABLE 49. PROXY - MANUAL SETTINGS (CONT.)
Item

Description$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 388

Proxy - Manual

TABLE 49. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Group Name

Specify the name of the group to use.

VPN on Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
For instructions, see On Demand Rules.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for iOS devices.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 389

Proxy - Automatic

TABLE 49. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Domains.
Continue to Custom Data.

Proxy - Automatic
If you selected an Automatic proxy, you must specify the proxy server URL and proxy domain(s).

TABLE 50. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Cisco Legacy AnyConnect.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 390

Proxy - Automatic

TABLE 50. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Group Name

Specify the name of the group to use.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 391

Proxy - Automatic

TABLE 50. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
For instructions, see On Demand Rules.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for iOS devices.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 392

On Demand Rules

Continue to Domains.
Continue to Custom Data.

On Demand Rules
Applicable to: iOS 7 and later
Whenever a network change is detected, the VPN On Demand service compares the newly connected network
against the match network criteria specified in each set of rules (in order) to determine whether VPN On Demandshould be allowed or not on the newly-joined network.
Rule sets are checked sequentially, beginning with the first. A rule set matches the current network only if all of thespecified policies in that rule set match.
If a rule set matches the current network, a server probe is sent if a URL is specified in the profile. VPN then acts
according to the policy defined in the dictionary (for example, Allow, Ignore, Evaluate Connection, Connect, or
Disconnect).
Define sets of evaluation rules for each action that can be taken by VPN On Demand: Allow, Connect,
Disconnect, Evaluate Connection, and Ignore. You can define more than one set of rules for each type of actionthat can be taken. For each set of evaluation rules, the number of rules defined for that set is indicated in the No. ofRules column.

Procedure
1. Click Add+ to add a new set of On Demand evaluation rules.
A rule creation dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 393

On Demand Rules

2. From the On Demand Action drop-down list, select the action you want to be taken when the rules you
create below are matched.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
3. Matching Rules - For each rule you create, enter one of the following types:• DNS domain: This rule matches if any of the domain names in the specified list matches any domain
in the device’s search domains list. A wildcard '*' prefix is supported. For example, *.example.com
matches against either mydomain.example.com or yourdomain.example.com.
• DNS Server Address: This rule matches if any of the network’s specified DNS servers match any
entry in the list. Matching with a single wildcard is supported. For example, 17.* matches any DNS
server in the class A 17 subnet.
• SSID: A list of SSIDs to match against the current network. If the network is not a Wi-Fi network, or if
the SSID does not appear in this list, the match fails. Omit this rule and the corresponding list to matchagainst any SSID.
• Interface Type: If specified, this rule matches only if the primary network interface hardware matches
the specified interface type. Choose Ethernet, Wifi, or Cellular.
• URL String Probe: A URL to probe. If this URL is successfully fetched without redirection (returning
a 200 HTTP status code), this rule matches.
4. Enter a value for each rule type and an optional description.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 394

Default Rules

5. After adding your rules, click OK.
Default Rules

Define a default rule that simply specifies a default VPN On Demand action in case none of the On Demand rules
match, or if no On Demand rules have been defined.
Procedure
1. From the On Demand Action drop-down list, select the action you want to be taken by default, if none of
the rules match or none are defined.
2. Click Add+ to add a default rule.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
If you select Evaluate Connection, a domain actions table displays:

3. Click Add+ to add a domain action.
The Action Parameters dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 395

Domains

4. From the Domain Action drop-down list, select one of the following actions to be taken for the domains
listed in the table:• Connect if needed: The specified domains should trigger a VPN connection attempt if domain nameresolution fails, such as when the DNS server indicates that it cannot resolve the domain, respondswith a redirection to a different server, or fails to respond (timeout).
• Never connect: The specified domains should never trigger a VPN connection attempt.
5. Click Add+ to include any of the following evaluation types:• Domain: The domains for which this evaluation applies.
• Required DNS Server: IP addresses of DNS servers to be used for resolving the specified domains.
These servers need not be part of the device’s current network configuration. If these DNS servers are
not reachable, a VPN connection is established in response. These DNS servers should be either
internal DNS servers or trusted external DNS servers. You can only configure required DNS server
evaluation types for the Connect if needed domain action.
• Required URL Probe: An HTTP or HTTPS (preferred) URL to probe, using a GET request. If no
HTTP response code is received from the server, a VPN connection is established in response. You
can only configure required URL probe evaluation types for the Connect if needed domain action.
6. Add a value and optional description for each entry.
7. Click OK to save your domain action parameters.

Domains
Safari Domains

Applicable to: Safari Domains (iOS 7 and later; macOS 10.11 and later)
NOTE: You must update your VPN software to a version that supports Per-app VPN.
If the server ends with one of these domain names, a VPN connection is started automatically.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 396

Calendar DomainslAdd+ - Click to add a domain.

l

Safari Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Calendar Domains

Applicable to: Calendar Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Calendar Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Contact Domains

Applicable to: Contact Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

lContact Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Mail Domains

Applicable to: Mail Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Associated Domains

Applicable to: Associated Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are associated with the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Excluded Domains

Applicable to: Excluded Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are excluded from the per-app VPN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 397

Custom Datal

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Custom Data
Custom Data does not apply to Android devices.
ll

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

F5 SSL
This VPN connection type is supported on iOS, macOS, Windows devices. F5 SSL supports Android devices thathave Samsung Knox enabled and on Android devices without Samsung Knox.
Use the following guidelines to configure the F5 SSL VPN connection type:l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:l

On Demand Rulesl

Domainsl

Custom Data

Proxy - None (default)
Use the following guidelines to configure a F5 SSL VPN without a proxy.

TABLE 51. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 398

Proxy - None (default)

TABLE 51. PROXY - NONE SETTINGS (CONT.)
Item

Description
registered user on a device.

Connection Type

Select F5 SSL.

Samsung Knox

This setting is only supported on Android devices.

Deploy inside Knox
Workspace

This setting is only supported on Android devices.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 399

Proxy - None (default)

TABLE 51. PROXY - NONE SETTINGS (CONT.)
Item

Description

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
For instructions, see On Demand Rules.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 400

Proxy - Manual

TABLE 51. PROXY - NONE SETTINGS (CONT.)
Item

Description
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Domains.
Continue to Custom Data.

Proxy - Manual
If you select Manual, you must specify the proxy server, port number. and proxy domain information.

TABLE 52. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select F5 SSL.

Samsung Knox

This setting is only supported on Android devices.

Deploy inside Knox
Workspace

This setting is only supported on Android devices.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. For an Automatic proxy, see Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.
Type - Select Static or Variable for the type of authentication to be used for theproxy server.

Proxy Server User Name

If the authentication type is Static, enter the user name for the proxy server.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 401

Proxy - Manual

TABLE 52. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 402

Proxy - Automatic

TABLE 52. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.
For instructions, see On Demand Rules.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Domains.
Continue to Custom Data.

Proxy - Automatic
If you selected an Automatic proxy, you must specify the proxy server URL and proxy domain(s).

TABLE 53. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 403

Proxy - Automatic

TABLE 53. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

DescriptionllDevice channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select F5 SSL.

Samsung Knox

This setting is only supported on Android devices.

Deploy inside Knox
Workspace

This setting is only supported on Android devices.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. For a manual proxy, see Proxy - Manual

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$

Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 404

Proxy - Automatic

TABLE 53. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 405

On Demand Rules

TABLE 53. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.
For instructions, see On Demand Rules.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Domains.
Continue to Custom Data.

On Demand Rules
Applicable to: iOS 7 and later
Whenever a network change is detected, the VPN On Demand service compares the newly connected network
against the match network criteria specified in each set of rules (in order) to determine whether VPN On Demandshould be allowed or not on the newly-joined network.
Rule sets are checked sequentially, beginning with the first. A rule set matches the current network only if all of thespecified policies in that rule set match.
If a rule set matches the current network, a server probe is sent if a URL is specified in the profile. VPN then acts
according to the policy defined in the dictionary (for example, Allow, Ignore, Evaluate Connection, Connect, or
Disconnect).
Define sets of evaluation rules for each action that can be taken by VPN On Demand: Allow, Connect,
Disconnect, Evaluate Connection, and Ignore. You can define more than one set of rules for each type of actionthat can be taken. For each set of evaluation rules, the number of rules defined for that set is indicated in the No. ofRules column.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 406

On Demand Rules

Procedure
1. Click Add+ to add a new set of On Demand evaluation rules.
A rule creation dialog box opens.

2. From the On Demand Action drop-down list, select the action you want to be taken when the rules you
create below are matched.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
3. Matching Rules - For each rule you create, enter one of the following types:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 407

Default Rules

•

•

•

•
•

DNS domain: This rule matches if any of the domain names in the specified list matches any domain
in the device’s search domains list. A wildcard '*' prefix is supported. For example, *.example.com
matches against either mydomain.example.com or yourdomain.example.com.
DNS Server Address: This rule matches if any of the network’s specified DNS servers match any
entry in the list. Matching with a single wildcard is supported. For example, 17.* matches any DNS
server in the class A 17 subnet.
SSID: A list of SSIDs to match against the current network. If the network is not a Wi-Fi network, or if
the SSID does not appear in this list, the match fails. Omit this rule and the corresponding list to matchagainst any SSID.
Interface Type: If specified, this rule matches only if the primary network interface hardware matches
the specified interface type. Choose Ethernet, Wifi, or Cellular.
URL String Probe: A URL to probe. If this URL is successfully fetched without redirection (returning
a 200 HTTP status code), this rule matches.

4. Enter a value for each rule type and an optional description.
5. After adding your rules, click OK.
Default Rules

Define a default rule that simply specifies a default VPN On Demand action in case none of the On Demand rules
match, or if no On Demand rules have been defined.
Procedure
1. From the On Demand Action drop-down list, select the action you want to be taken by default, if none of
the rules match or none are defined.
2. Click Add+ to add a default rule.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
If you select Evaluate Connection, a domain actions table displays:

3. Click Add+ to add a domain action.
The Action Parameters dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 408

Domains

4. From the Domain Action drop-down list, select one of the following actions to be taken for the domains
listed in the table:• Connect if needed: The specified domains should trigger a VPN connection attempt if domain nameresolution fails, such as when the DNS server indicates that it cannot resolve the domain, respondswith a redirection to a different server, or fails to respond (timeout).
• Never connect: The specified domains should never trigger a VPN connection attempt.
5. Click Add+ to include any of the following evaluation types:• Domain: The domains for which this evaluation applies.
• Required DNS Server: IP addresses of DNS servers to be used for resolving the specified domains.
These servers need not be part of the device’s current network configuration. If these DNS servers are
not reachable, a VPN connection is established in response. These DNS servers should be either
internal DNS servers or trusted external DNS servers. You can only configure required DNS server
evaluation types for the Connect if needed domain action.
• Required URL Probe: An HTTP or HTTPS (preferred) URL to probe, using a GET request. If no
HTTP response code is received from the server, a VPN connection is established in response. You
can only configure required URL probe evaluation types for the Connect if needed domain action.
6. Add a value and optional description for each entry.
7. Click OK to save your domain action parameters.

Domains
Safari Domains

Applicable to: Safari Domains (iOS 7 and later; macOS 10.11 and later)
NOTE: You must update your VPN software to a version that supports Per-app VPN.
If the server ends with one of these domain names, a VPN connection is started automatically.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 409

Calendar DomainslAdd+ - Click to add a domain.

l

Safari Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Calendar Domains

Applicable to: Calendar Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Calendar Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Contact Domains

Applicable to: Contact Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

lContact Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Mail Domains

Applicable to: Mail Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Associated Domains

Applicable to: Associated Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are associated with the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Excluded Domains

Applicable to: Excluded Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are excluded from the per-app VPN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 410

Custom Datal

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

IKEv2 (iOS Only)
This VPN connection type is supported on iOS devices. It is not supported on Android, macOS, and Windows
devices.
Internet Key Exchange version 2 (IKEv2) is the default VPN setting for iOS. The IKEv2 is used to create a security
association in the IPSec (Internet Protocol Security) suite. A security association (SA) establishes shared security
attributes between two network entities to support secure communication.
Use the following guidelines to configure the IKEv2 VPN connection type.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:l

On Demand Rulesl

Domains

NOTE: iOS VPN configurations using IKEv2 need to include a selected value from the following list ofcertificate types:• RSA• ECDSA256• ECDSA384• ECDSA512

TABLE 54. IKEV2 SETTINGS (IOS)
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 411

IKEv2 (iOS Only)

TABLE 54. IKEV2 SETTINGS (IOS) (CONT.)
Item

Description

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a
device. This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select IKEv2 (iOS Only).

Always-on VPN (supervised
only)

Select to enable the VPN connection to remain on at all times. More settings
display, including Celluar settings and Service Exceptions.
This setting applies only to supervised devices.

Allow user to disable
automatic connection

Select to allow device users to disconnect automatically triggeredconnections.
This setting applies only to supervised devices.

Use same tunnel
configuration for Cellular and
Wi-Fi

Select to configure one VPN tunnel for both cellular and wi-fi data.
This setting applies only to supervised devices.

Cellular / Wi-Fi (Cellular and Wi-Fi configurations appear separately when you select Always-on VPN.)
ServerEnter the IP address, hostname, or URL for the VPN server.

Local Identifier

Required. Enter the local identifier of the IKEv2 client in one of the following
formats:• FQDN• UserFQDN• Address• ASN1DN

Remote Identifier

Required. Enter the remote identifier in one of the following formats:• FQDN• UserFQDN• Address• ASN1DN

Dead Peer Detection Rate

Optional. Defaults to Medium. Select one of the following:• None (Disable)• Low (keepalive sent every 30 minutes)• Medium (keepalive sent every 10 minutes)• High (keepalive sent every 1 minute)

Use IPv4/IPv6 Internal
Subnet Attributes

Optional. If selected, negotiations should use IKEv2 Configuration Attribute
INTERNAL_IP4_SUBNET and INTERNAL_IP6_SUBNET. Disabled bydefault.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 412

IKEv2 (iOS Only)

TABLE 54. IKEV2 SETTINGS (IOS) (CONT.)
Item

Description
Available in iOS 9.0 through the most recently released version of iOS as
supported by MobileIron.

Disable Mobility andMultihoming

Select to disable mobility and multihoming (MOBIKE).

Disable redirects

Optional. If selected, disables IKEv2 redirect. If not selected, the IKEv2
connection would be redirected if a redirect request is received from theserver. By default, not selected.

Available in iOS 9.0 through the most recently released version of iOS as
supported by MobileIron.

Available in iOS 9.0 through the most recently released version of iOS as
supported by MobileIron.
Enable NAT keepalive

Optional. Select to enable Network Address Translation (NAT) Keepalive
offload for Always On VPN IKEv2 connections. Keepalive packets are used tomaintain NAT mappings for IKEv2 connections. These packets are sent at
regular intervals when the device is awake. If selected, Keepalive packets
would be sent by the chip even while the device is asleep. The default interval
for the Keepalive packets for Always On VPN is 20 seconds over WiFi and110 seconds over Cellular interface.
Available in iOS 9.0 through the most recently released version of iOS as
supported by MobileIron.

NATKeepAliveInterval

Optional. Controls the interval over which Keepalive packets are sent by thedevice. The minimum value is 20 seconds. If no key is specified, the default is
20 seconds.
Available in iOS 9.0 through the most recently released version of iOS as
supported by MobileIron.

EnablePFS

Optional. Select to enable Perfect Forward Secrecy for IKEv2 connections. By
default, not selected.
Available in iOS 9.0 through the most recently released version of iOS as
supported by MobileIron.

Authentication
Machine Authentication

Select None, Shared Secret /Group Name, or Certificate. If selecting
None, be sure to enable EAP.

Shared Secret

If you select Shared Secret / Group Name, enter shared secret to be used
for IKE authentication.

Identity Certificate

If you select Certificate, select the identity certificate to be used as theaccount credential.
If you select Certificate, and extended authentication (EAP) is not used, thisMobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 413

IKEv2 (iOS Only)

TABLE 54. IKEV2 SETTINGS (IOS) (CONT.)
Item

Description
certificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Server Certificate Issuer
Common Name

Optional. The Common Name of the server certificate issuer. If set, this field
will cause IKE to send a certificate request based on this certificate issuer tothe server.

Server Certificate Common
Name

Optional. The Common Name of the server certificate. This name is used tovalidate the certificate sent by the IKE server. If not set, the Remote Identifier
will be used to validate the certificate.

Enable EAP

Select to enable extended authentication. If Machine Authentication is set toNone, you must select an EAP authentication method.

IKE SA Params (A Security Association establishes shared security attributes between two network entities
to support secure communication.)
Encryption algorithm

Optional. Select one of the following:• DES• 3DES• AES-128• AES-256 (Default)• AES-128-GCM• AES-256-GCM

Integrity algorithm

Optional. Select one of the following:• SHA1-96• SHA1-160• SHA2-256 (Default)• SHA2-384• SHA2-512

Diffie-Hellman Group

Optional. Select one of the following: 1, 2 (Default), 5, 14, 15, 16, 17, 18, 19,
20, 21.
NOTE: If you upgrade from a version of MobileIron Core that allowed
the value 0 for this field, edit the VPN configuration to use a
different Diffie-Hellman Group value. Core will send theconfiguration to devices only after you save the change.

Lifetime In Minutes

Optional security association lifetime (re-key interval) in minutes. Valid values
are 10 through 1440. Defaults to 1440 minutes.

Child SA Params (A Child SA is any SA that was negotiated via the IKE SA.)
Encryption algorithm

Optional. Select one of the following:• DES• 3DES

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 414

IKEv2 (iOS Only)

TABLE 54. IKEV2 SETTINGS (IOS) (CONT.)
Item

Description••••

AES-128
AES-256 (Default)
AES-128-GCM
AES-256-GCM

Integrity algorithm

Optional. Select one of the following:• SHA1-96• SHA1-160• SHA2-256 (Default)• SHA2-384• SHA2-512

Diffie-Hellman Group

Optional. Select one of the following: 1, 2 (Default), 5, 14, 15, 16, 17, 18, 19,
20, 21.
NOTE: If you upgrade from a version of MobileIron Core that allowed
the value 0 for this field, edit the VPN configuration to use a
different Diffie-Hellman Group value. Core will send theconfiguration to devices only after you save the change.

Lifetime In Minutes

Optional security association lifetime (rekey interval) in minutes. Valid values
are 10 through 1440. Defaults to 1440 minutes.

Wi-Fi see Cellular / Wi-Fi
Service Exceptions (Configure exceptions to VPN tunnel. This section is only displayed if the Always-on
VPN (supervised only) option is selected at the top of the window.)
Voice Mail

Select one of the following options for voicemail:• Allow traffic via tunnel• Allow traffic outside tunnel• Drop traffic

Air Print

Select one of the following options for Air Print:• Allow traffic via tunnel• Allow traffic outside tunnel• Drop traffic

Allow traffic from captive
web sheet outside the VPN
tunnelSelect to allow traffic from captive web sheets outside the VPN tunnel.

Allow traffic from all captive
networking apps outside the
VPN tunnel

Select to allow traffic from all captive networking apps outside the VPN tunnel.

Captive Networking App
Bundle IdentifiersSpecify the apps whose traffic you want to allow outside the VPN tunnel.
Captive networking apps may require additional entitlements to operate in a

When selecting this item, skip to the proxy server section.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 415

Proxy - None (default)

TABLE 54. IKEV2 SETTINGS (IOS) (CONT.)
Item

Description
captive environment.
Click Add+ to add the bundle ID of a relevant app to the list of apps allowed
outside the VPN tunnel.
NOTE: This section is only displayed if the Allow traffic from all captive
networking apps outside the VPN tunnel option is not selected.

Continue to Proxy - Manual , or Proxy - Automatic.

Proxy - None (default)
Use the following guidelines to configure an IPKEv2 (iOS Only) VPN proxy setting type.

TABLE 55. PROXY - NONE (DEFAULT) SETTINGS
Item

Description

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 416

Proxy - Manual

TABLE 55. PROXY - NONE (DEFAULT) SETTINGS (CONT.)
Item

Description
For instructions, see On Demand Rules.

Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Continue to On Demand Rules.
Continue to Domains.

Proxy - Manual
If you select Manual for proxy, you must specify the proxy server, port number and proxy domain information.

TABLE 56. PROXY - MANUAL SETTINGS
Item

Description

Proxy

Select Manual. To configure a or Automatic proxy, go to Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.
Type - Select Static or Variable for the type of authentication to be used for theproxy server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 417

Proxy - Manual

TABLE 56. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
For instructions, see On Demand Rules.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 418

Proxy - Automatic

TABLE 56. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Continue to On Demand Rules.
Continue to Domains.

Proxy - Automatic
If you selected an Automatic proxy, you must specify the proxy server URL and proxy domain(s).

TABLE 57. PROXY - AUTOMATIC SETTINGS
Item

Description

Proxy

Select Automatic proxy. To configure a Manual proxy, go to Proxy - Manual.

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 419

On Demand Rules

TABLE 57. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description•

evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
For instructions, see On Demand Rules.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Continue to On Demand Rules.
Continue to Domains.

On Demand Rules
Applicable to: iOS 7 and later
Whenever a network change is detected, the VPN On Demand service compares the newly connected network
against the match network criteria specified in each set of rules (in order) to determine whether VPN On Demandshould be allowed or not on the newly-joined network.
MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 420

On Demand Rules

Rule sets are checked sequentially, beginning with the first. A rule set matches the current network only if all of thespecified policies in that rule set match.
If a rule set matches the current network, a server probe is sent if a URL is specified in the profile. VPN then acts
according to the policy defined in the dictionary (for example, Allow, Ignore, Evaluate Connection, Connect, or
Disconnect).
Define sets of evaluation rules for each action that can be taken by VPN On Demand: Allow, Connect,
Disconnect, Evaluate Connection, and Ignore. You can define more than one set of rules for each type of actionthat can be taken. For each set of evaluation rules, the number of rules defined for that set is indicated in the No. ofRules column.

Procedure
1. Click Add+ to add a new set of On Demand evaluation rules.
A rule creation dialog box opens.

2. From the On Demand Action drop-down list, select the action you want to be taken when the rules you
create below are matched.
The following actions are available:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 421

Default Rules

•
•
•
•
•

Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
Connect: Unconditionally initiate a VPN connection on the next network attempt.
Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
Evaluate Connection: Evaluate the action parameters for each connection attempt.
Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.

3. Matching Rules - For each rule you create, enter one of the following types:• DNS domain: This rule matches if any of the domain names in the specified list matches any domain
in the device’s search domains list. A wildcard '*' prefix is supported. For example, *.example.com
matches against either mydomain.example.com or yourdomain.example.com.
• DNS Server Address: This rule matches if any of the network’s specified DNS servers match any
entry in the list. Matching with a single wildcard is supported. For example, 17.* matches any DNS
server in the class A 17 subnet.
• SSID: A list of SSIDs to match against the current network. If the network is not a Wi-Fi network, or if
the SSID does not appear in this list, the match fails. Omit this rule and the corresponding list to matchagainst any SSID.
• Interface Type: If specified, this rule matches only if the primary network interface hardware matches
the specified interface type. Choose Ethernet, Wifi, or Cellular.
• URL String Probe: A URL to probe. If this URL is successfully fetched without redirection (returning
a 200 HTTP status code), this rule matches.
4. Enter a value for each rule type and an optional description.
5. After adding your rules, click OK.
Default Rules

Define a default rule that simply specifies a default VPN On Demand action in case none of the On Demand rules
match, or if no On Demand rules have been defined.
Procedure
1. From the On Demand Action drop-down list, select the action you want to be taken by default, if none of
the rules match or none are defined.
2. Click Add+ to add a default rule.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
If you select Evaluate Connection, a domain actions table displays:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 422

Default Rules

3. Click Add+ to add a domain action.
The Action Parameters dialog box opens.

4. From the Domain Action drop-down list, select one of the following actions to be taken for the domains
listed in the table:• Connect if needed: The specified domains should trigger a VPN connection attempt if domain nameresolution fails, such as when the DNS server indicates that it cannot resolve the domain, respondswith a redirection to a different server, or fails to respond (timeout).
• Never connect: The specified domains should never trigger a VPN connection attempt.
5. Click Add+ to include any of the following evaluation types:• Domain: The domains for which this evaluation applies.
• Required DNS Server: IP addresses of DNS servers to be used for resolving the specified domains.
These servers need not be part of the device’s current network configuration. If these DNS servers are
not reachable, a VPN connection is established in response. These DNS servers should be either
internal DNS servers or trusted external DNS servers. You can only configure required DNS server
evaluation types for the Connect if needed domain action.
• Required URL Probe: An HTTP or HTTPS (preferred) URL to probe, using a GET request. If no
HTTP response code is received from the server, a VPN connection is established in response. You
can only configure required URL probe evaluation types for the Connect if needed domain action.
6. Add a value and optional description for each entry.
7. Click OK to save your domain action parameters.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 423

Domains

Domains
Safari Domains

Applicable to: Safari Domains (iOS 7 and later; macOS 10.11 and later)
NOTE: You must update your VPN software to a version that supports Per-app VPN.
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Safari Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Calendar Domains

Applicable to: Calendar Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Calendar Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Contact Domains

Applicable to: Contact Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

lContact Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Mail Domains

Applicable to: Mail Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Associated Domains

Applicable to: Associated Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are associated with the per-app VPN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 424

Excluded DomainslAdd+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Excluded Domains

Applicable to: Excluded Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are excluded from the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

IKEv2 (Windows)
This VPN connection type is supported on Windows devices. It is not supported on Android, iOS, and macOS
devices.

IPSec (Blue Coat)This VPN connection type is supported on iOS devices. It is not supported on Android, macOS, and Windows
devices.
This connection type is used with MobileIron Core integration with the Blue Coat Mobile Device Security (MDS)
service. This connection type is results in an always-on VPN on the device.
Use the following guidelines to configure an IPSec (Blue Coat) VPN.

TABLE 58. IPSEC (BLUE COAT) SETTINGS
Item

Description

Name

Enter brief text that identifies this VPN setting.

Description

Enter additional text that clarifies the purpose of this VPN setting.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select IPsec (Blue Coat).

Identity Certificate

Select a Blue Coat certificate enrollment setting from the drop-down list.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 425

IPSec (Cisco)

IPSec (Cisco)This VPN connection type is supported on iOS and macOS devices. It is not supported on Android and Windows
devices.
Use the following guidelines to configure IPSec (Cisco) VPN.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:l

Domains

Proxy - None (default)
Use the following guidelines to configure a IPSec (Cisco) VPN without a proxy.

TABLE 59. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select IPSec (Cisco).

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 426

Proxy - None (default)

TABLE 59. PROXY - NONE SETTINGS (CONT.)
Item

Description•$USERID$_$EMAIL$

Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
User Authentication

Select the authentication method to use: Shared Secret / Group Name or
Certificate.

Group Name

Shared Secret / Group Name authentication.
Specify the name of the group to use. If Hybrid Authentication is used, thestring must end with “[hybrid]”.

Shared Secret

Shared Secret / Group Name authentication.
The shared secret passcode. This is not the user’s password; the sharedsecret must be specified to initiate a connection.

Confirm Shared Secret

Shared Secret / Group Name authentication.
Re-enter the shared secret to confirm.

Use Hybrid Authentication

Shared Secret / Group Name authentication.
Select to specify hybrid authentication, i.e., server provides a certificate andthe client provides a pre-shared key.

Prompt for Password

Shared Secret / Group Name authentication.
Specify whether the user should be prompted for a password when connecting.

XAuth Enabled

Specifies that IPsec XAuth authentication is enabled. Select this option if yourVPN requires two-factor authentication, resulting in a prompt for the password.
This option is enabled by default.

Password

Specify the password to use. The default value is $PASSWORD$. Use thisfield to specify a custom format, such as $PASSWORD$_$USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN On Demand

Select to enable VPN On Demand.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 427

Proxy - None (default)

TABLE 59. PROXY - NONE SETTINGS (CONT.)
Item

Description
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 428

Proxy - Manual

Continue to Domains.

Proxy - Manual
If you select Manual, you must specify the proxy server, port number. and proxy domain information.

TABLE 60. PROXY - MANUAL SETTINGS
Item

Description

Proxy

Select Manual. To configure a or Automatic proxy, go to Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.
Type - Select Static or Variable for the type of authentication to be used for theproxy server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$

Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 429

Proxy - Manual

TABLE 60. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

User Authentication

Select the authentication method to use: Shared Secret / Group Name or
Certificate.

Group Name

Shared Secret / Group Name authentication.
Specify the name of the group to use. If Hybrid Authentication is used, thestring must end with “[hybrid]”.

Shared Secret

Shared Secret / Group Name authentication.
The shared secret passcode. This is not the user’s password; the sharedsecret must be specified to initiate a connection.

Confirm Shared Secret

Shared Secret / Group Name authentication.
Re-enter the shared secret to confirm.

Use Hybrid Authentication

Shared Secret / Group Name authentication.
Select to specify hybrid authentication, i.e., server provides a certificate andthe client provides a pre-shared key.

Prompt for Password

Shared Secret / Group Name authentication.
Specify whether the user should be prompted for a password when connecting.

XAuth Enabled

Specifies that IPsec XAuth authentication is enabled. Select this option if yourVPN requires two-factor authentication, resulting in a prompt for the password.
This option is enabled by default.

Password

Specify the password to use. The default value is $PASSWORD$. Use thisfield to specify a custom format, such as $PASSWORD$_$USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN On Demand

Select to enable VPN On Demand.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 430

Proxy - Automatic

TABLE 60. PROXY - MANUAL SETTINGS (CONT.)
Item

Description•

evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue with Domains.

Proxy - Automatic
If you selected an Automatic proxy, you must specify the proxy server URL and proxy domain(s).

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 431

Proxy - Automatic

TABLE 61. PROXY - AUTOMATIC SETTINGS
Item

Description

Proxy

Select Automatic. To configure a Manual proxy, go to Proxy - Manual

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$

Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
User Authentication

Select the authentication method to use: Shared Secret / Group Name or
Certificate.

Group Name

Shared Secret / Group Name authentication.
Specify the name of the group to use. If Hybrid Authentication is used, thestring must end with “[hybrid]”.

Shared Secret

Shared Secret / Group Name authentication.
The shared secret passcode. This is not the user’s password; the sharedsecret must be specified to initiate a connection.

Confirm Shared Secret

Shared Secret / Group Name authentication.
Re-enter the shared secret to confirm.

Use Hybrid Authentication

Shared Secret / Group Name authentication.
Select to specify hybrid authentication, i.e., server provides a certificate andthe client provides a pre-shared key.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 432

Proxy - Automatic

TABLE 61. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description

Prompt for Password

Shared Secret / Group Name authentication.
Specify whether the user should be prompted for a password when connecting.

XAuth Enabled

Specifies that IPsec XAuth authentication is enabled. Select this option if yourVPN requires two-factor authentication, resulting in a prompt for the password.
This option is enabled by default.

Password

Specify the password to use. The default value is $PASSWORD$. Use thisfield to specify a custom format, such as $PASSWORD$_$USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN On Demand

Select to enable VPN On Demand.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
Per-App VPN

Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 433

Domains

TABLE 61. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue with Domains.

Domains
Safari Domains

Applicable to: Safari Domains (iOS 7 and later; macOS 10.11 and later)
NOTE: You must update your VPN software to a version that supports Per-app VPN.
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Safari Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Calendar Domains

Applicable to: Calendar Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Calendar Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 434

Contact DomainslDescription - Enter a description for the domain.

Contact Domains

Applicable to: Contact Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

lContact Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Mail Domains

Applicable to: Mail Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Associated Domains

Applicable to: Associated Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are associated with the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Excluded Domains

Applicable to: Excluded Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are excluded from the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Juniper SSL
This VPN connection type is supported on iOS, macOS, Android and Windows devices.
NOTE: MobileIron recommends that you use Pulse Secure SSL instead of Juniper SSL.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 435

Proxy - None (default)

Use the following guidelines to configure Juniper SSL VPN.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:l

On Demand Rulesl

Domainsl

Custom Data

Proxy - None (default)
Use the following guidelines to configure a Juniper SSL VPN without a proxy.

TABLE 62. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Juniper SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 436

Proxy - None (default)

TABLE 62. PROXY - NONE SETTINGS (CONT.)
Item

Description••$USERID$:$EMAIL$$USERID$_$EMAIL$

Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.
User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Role

Specify the Juniper user role to use as a restriction.

Realm

Specify the Juniper realm to use as a restriction.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 437

Proxy - Manual

TABLE 62. PROXY - NONE SETTINGS (CONT.)
Item

Description
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.

Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Domains.
Continue to Custom Data.

Proxy - Manual
Use the following guidelines to configure a Juniper SSL VPN with a manual proxy.

TABLE 63. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 438

Proxy - Manual

TABLE 63. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Juniper SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an Automatic proxy, go to Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 439

Proxy - Manual

TABLE 63. PROXY - MANUAL SETTINGS (CONT.)
Item

Description$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Role

Specify the Juniper user role to use as a restriction.

Realm

Specify the Juniper realm to use as a restriction.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 440

Proxy - Automatic

TABLE 63. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.

Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Domains.
Continue to Custom Data.

Proxy - Automatic
Use the following guidelines to configure a Juniper SSL VPN with an automatic proxy.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 441

Proxy - Automatic

TABLE 64. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Juniper SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a manual proxy, go to Proxy - Manual .

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 442

Proxy - Automatic

TABLE 64. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Role

Specify the Juniper user role to use as a restriction.

Realm

Specify the Juniper realm to use as a restriction.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 443

On Demand Rules

TABLE 64. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description•

Per-app VPN

For each matching rule you can create up to 50 Type and Value pairs.

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Domains.
Continue to Custom Data.

On Demand Rules
Applicable to: iOS 7 and later
Whenever a network change is detected, the VPN On Demand service compares the newly connected network
against the match network criteria specified in each set of rules (in order) to determine whether VPN On Demandshould be allowed or not on the newly-joined network.
Rule sets are checked sequentially, beginning with the first. A rule set matches the current network only if all of thespecified policies in that rule set match.
If a rule set matches the current network, a server probe is sent if a URL is specified in the profile. VPN then acts
according to the policy defined in the dictionary (for example, Allow, Ignore, Evaluate Connection, Connect, or
Disconnect).
Define sets of evaluation rules for each action that can be taken by VPN On Demand: Allow, Connect,
Disconnect, Evaluate Connection, and Ignore. You can define more than one set of rules for each type of actionthat can be taken. For each set of evaluation rules, the number of rules defined for that set is indicated in the No. ofRules column.
MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 444

On Demand Rules

Procedure
1. Click Add+ to add a new set of On Demand evaluation rules.
A rule creation dialog box opens.

2. From the On Demand Action drop-down list, select the action you want to be taken when the rules you
create below are matched.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
3. Matching Rules - For each rule you create, enter one of the following types:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 445

Default Rules

•

•

•

•
•

DNS domain: This rule matches if any of the domain names in the specified list matches any domain
in the device’s search domains list. A wildcard '*' prefix is supported. For example, *.example.com
matches against either mydomain.example.com or yourdomain.example.com.
DNS Server Address: This rule matches if any of the network’s specified DNS servers match any
entry in the list. Matching with a single wildcard is supported. For example, 17.* matches any DNS
server in the class A 17 subnet.
SSID: A list of SSIDs to match against the current network. If the network is not a Wi-Fi network, or if
the SSID does not appear in this list, the match fails. Omit this rule and the corresponding list to matchagainst any SSID.
Interface Type: If specified, this rule matches only if the primary network interface hardware matches
the specified interface type. Choose Ethernet, Wifi, or Cellular.
URL String Probe: A URL to probe. If this URL is successfully fetched without redirection (returning
a 200 HTTP status code), this rule matches.

4. Enter a value for each rule type and an optional description.
5. After adding your rules, click OK.
Default Rules

Define a default rule that simply specifies a default VPN On Demand action in case none of the On Demand rules
match, or if no On Demand rules have been defined.
Procedure
1. From the On Demand Action drop-down list, select the action you want to be taken by default, if none of
the rules match or none are defined.
2. Click Add+ to add a default rule.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
If you select Evaluate Connection, a domain actions table displays:

3. Click Add+ to add a domain action.
The Action Parameters dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 446

Domains

4. From the Domain Action drop-down list, select one of the following actions to be taken for the domains
listed in the table:• Connect if needed: The specified domains should trigger a VPN connection attempt if domain nameresolution fails, such as when the DNS server indicates that it cannot resolve the domain, respondswith a redirection to a different server, or fails to respond (timeout).
• Never connect: The specified domains should never trigger a VPN connection attempt.
5. Click Add+ to include any of the following evaluation types:• Domain: The domains for which this evaluation applies.
• Required DNS Server: IP addresses of DNS servers to be used for resolving the specified domains.
These servers need not be part of the device’s current network configuration. If these DNS servers are
not reachable, a VPN connection is established in response. These DNS servers should be either
internal DNS servers or trusted external DNS servers. You can only configure required DNS server
evaluation types for the Connect if needed domain action.
• Required URL Probe: An HTTP or HTTPS (preferred) URL to probe, using a GET request. If no
HTTP response code is received from the server, a VPN connection is established in response. You
can only configure required URL probe evaluation types for the Connect if needed domain action.
6. Add a value and optional description for each entry.
7. Click OK to save your domain action parameters.

Domains
Safari Domains

Applicable to: Safari Domains (iOS 7 and later; macOS 10.11 and later)
NOTE: You must update your VPN software to a version that supports Per-app VPN.
If the server ends with one of these domain names, a VPN connection is started automatically.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 447

Calendar DomainslAdd+ - Click to add a domain.

l

Safari Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Calendar Domains

Applicable to: Calendar Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Calendar Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Contact Domains

Applicable to: Contact Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

lContact Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Mail Domains

Applicable to: Mail Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Associated Domains

Applicable to: Associated Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are associated with the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Excluded Domains

Applicable to: Excluded Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are excluded from the per-app VPN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 448

Custom Datal

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

L2TP
This VPN connection type is supported on iOS, macOS, and Windows devices. It is not supported on Android
devices.
This section covers how to configure L2TP VPN.
l

Proxy - None (default)lProxy - Manuall

Proxy - Automatic

Proxy - None (default)
Use the following guidelines to configure a L2TP VPN without a proxy.

TABLE 65. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select L2TP.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 449

Proxy - Manual

TABLE 65. PROXY - NONE SETTINGS (CONT.)
Item

Description

Shared Secret

The shared secret passcode. This is not the user’s password; the sharedsecret must be specified to initiate a connection.

Confirm Shared Secret

Re-enter the shared secret to confirm.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the authentication method to use: Password or RSA SecureID.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Proxy - Manual
Use the following guidelines to configure a L2TP VPN with a manual proxy.

TABLE 66. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 450

Proxy - Manual

TABLE 66. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select L2TP.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an automatic proxy, go to Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Shared Secret

The shared secret passcode. This is not the user’s password; the sharedsecret must be specified to initiate a connection.

Confirm Shared Secret

Re-enter the shared secret to confirm.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 451

Proxy - Automatic

TABLE 66. PROXY - MANUAL SETTINGS (CONT.)
Item

Description$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the authentication method to use:Password or RSA SecureID.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Proxy - Automatic
Use the following guidelines to configure a L2TP VPN with an automatic proxy.

TABLE 67. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:llConnection Type

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Select L2TP.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 452

Proxy - Automatic

TABLE 67. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a Manual proxy, go to Proxy - Manual.

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Shared Secret

The shared secret passcode. This is not the user’s password; the sharedsecret must be specified to initiate a connection.

Confirm Shared Secret

Re-enter the shared secret to confirm.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the authentication method to use:Password or RSA SecureID.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 453

MobileIron Tunnel (iOS and macOS)

TABLE 67. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

MobileIron Tunnel (iOS and macOS)
This VPN connection type is supported on iOS and macOS devices only. It is not supported on Windows orAndroid devices.
Use this setting to configure Tunnel VPN for iOS and macOS. For information on how to set up and configure
Tunnel VPN for MobileIron Tunnel for iOS and macOS, see the following:l

MobileIron Tunnel for iOS Guideon the MobileIron Tunnel for iOS Documentation Home Page.

l

MobileIron Tunnel for macOS Guide on the MobileIron Tunnel for macOS Documentation Home Page.

MobileIron Tunnel (Android)
This VPN connection type is supported on Android devices only. It is not supported on iOS, macOS and Windows
devices.

MobileIron Tunnel (Samsung Knox Workspace)
This VPN connection type is supported on Android devices only. It is not supported on iOS, macOS and Windows
devices.

MobileIron Tunnel (Windows)
This VPN connection type is supported on Windows devices only. It is not supported on iOS, macOS and Android
devices.

NetMotion Mobility VPN (iOS)This VPN connection type is supported on iOS devices. It is not supported on macOS, Android and Windows
devices.
Use the following guidelines to configure a NetMotion Mobility VPN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 454

Proxy - None (default)lProxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:l

Domainsl

Custom Data

Proxy - None (default)
Use the following guidelines to configure a NetMotion Mobility VPN connection without a proxy.

TABLE 68. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select NetMotion Mobility VPN (iOS).

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 455

Proxy - Manual

TABLE 68. PROXY - NONE SETTINGS (CONT.)
Item

Description

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN on DemandThis setting applies to iOS and macOS devices only.
Select to enable this VPN connection to be available on demand.

Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
Per-app VPN is supported on iOS devices version 9.0 through the most recently
released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected VPN
configurations in the Per-App VPN section, then VPN prioritization
will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Continue to Domains.
Continue to Custom Data.

Proxy - Manual
Use the following guidelines to configure a NetMotion Mobility VPN connection with a manual proxy.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 456

Proxy - Manual

TABLE 69. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select NetMotion Mobility VPN (iOS).

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an Automatic proxy, go to Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes canbe used to match multiple domains. For example, .com would include all .com
domains, and example.com would include all domains ending in example.com,
such as pages.example.com and mysite.example.com . Wildcards are notsupported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 457

Proxy - Manual

TABLE 69. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN on DemandThis setting applies to iOS and macOS devices only.
Select to enable this VPN connection to be available on demand.

Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
Per-app VPN is supported on iOS devices version 9.0 through the most recently
released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected VPN
configurations in the Per-App VPN section, then VPN prioritization
will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Continue to Domains.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 458

Proxy - AutomaticContinue to Custom Data.

Proxy - Automatic
Use the following guidelines to configure a NetMotion Mobility VPN connection with an automatic proxy.

TABLE 70. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select NetMotion Mobility VPN (iOS).

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a Manual proxy, go to Proxy - Manual.

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes canbe used to match multiple domains. For example, .com would include all .com
domains, and example.com would include all domains ending in example.com,
such as pages.example.com and mysite.example.com . Wildcards are notsupported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 459

Proxy - Automatic

TABLE 70. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN on DemandThis setting applies to iOS and macOS devices only.
Select to enable this VPN connection to be available on demand.

Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
Per-app VPN is supported on iOS devices version 9.0 through the most recently
released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected VPN
configurations in the Per-App VPN section, then VPN prioritization
will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Continue to Domains.
Continue to Custom Data.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 460

Domains

Domains
Safari Domains

Applicable to: Safari Domains (iOS 7 and later; macOS 10.11 and later)
NOTE: You must update your VPN software to a version that supports Per-app VPN.
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Safari Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Calendar Domains

Applicable to: Calendar Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Calendar Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Contact Domains

Applicable to: Contact Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

lContact Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Mail Domains

Applicable to: Mail Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Associated Domains

Applicable to: Associated Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are associated with the per-app VPN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 461

Excluded DomainslAdd+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Excluded Domains

Applicable to: Excluded Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are excluded from the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

OpenVPN
This VPN connection type is supported on Android devices. It is not supported on iOS, macOS, and Windows
devices.

Palo Alto Networks GlobalProtect
This VPN connection type is supported on iOS, macOS, and Android devices. It is not supported on Windows
devices.
Use the following guidelines to configure the Palo Alto Networks GlobalProtect VPN connection type.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:l

On Demand Rulesl

Domainsl

Custom Data

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 462

Proxy - None (default)

Proxy - None (default)
Use the following guidelines to configure a Palo Alto Networks GlobalProtect VPN without a proxy.

TABLE 71. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Palo Alto Networks GlobalProtect.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 463

Proxy - None (default)

TABLE 71. PROXY - NONE SETTINGS (CONT.)
Item

Description
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
• For instructions, see On Demand Rules.
Per-App VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this setting.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 464

Proxy - Manual

TABLE 71. PROXY - NONE SETTINGS (CONT.)
Item

Description
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Domains.
Continue to Custom Data.

Proxy - Manual
If you select Manual, you must specify the proxy server, port number. and proxy domain information.

TABLE 72. PROXY - MANUAL SETTINGS
Item

Description

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.
Type - Select Static or Variable for the type of authentication to be used for theproxy server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 465

Proxy - Manual

TABLE 72. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
Include at least one of the following variables:$USERID$, $EMAIL$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$

Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 466

Proxy - Automatic

TABLE 72. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
• For instructions, see On Demand Rules.

Per-App VPN
Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this setting.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
iOS apps.
Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue with Domains.
Continue with Custom Data.

Proxy - Automatic
If you selected an Automatic proxy, you must specify the proxy server URL and proxy domain(s).

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 467

Proxy - Automatic

TABLE 73. PROXY - AUTOMATIC SETTINGS
Item

Description

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$

Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
User Authentication

Select the user authentication to use:llPassword - see next row for information.
Certificate - If you select Certificate, select the identity certificate to
be used as the account credential.
If you select Certificate, and extended authentication (EAP) is not
used, this certificate will be sent out for IKE client authentication. If
extended authentication is used, this certificate can be used for EAPTLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN On Demand

Select to enable VPN On Demand.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 468

Proxy - Automatic

TABLE 73. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
• For instructions, see On Demand Rules.
Per-App VPN.
Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
Select Yes to create a per-app VPN setting. An additional license may berequired for this setting.
The Provider Type field displays.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 469

On Demand Rules

TABLE 73. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
iOS apps.

Provider Type.If Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue with Domains.
Continue with Custom Data.

On Demand Rules
Applicable to: iOS 7 and later
Whenever a network change is detected, the VPN On Demand service compares the newly connected network
against the match network criteria specified in each set of rules (in order) to determine whether VPN On Demandshould be allowed or not on the newly-joined network.
Rule sets are checked sequentially, beginning with the first. A rule set matches the current network only if all of thespecified policies in that rule set match.
If a rule set matches the current network, a server probe is sent if a URL is specified in the profile. VPN then acts
according to the policy defined in the dictionary (for example, Allow, Ignore, Evaluate Connection, Connect, or
Disconnect).
Define sets of evaluation rules for each action that can be taken by VPN On Demand: Allow, Connect,
Disconnect, Evaluate Connection, and Ignore. You can define more than one set of rules for each type of actionthat can be taken. For each set of evaluation rules, the number of rules defined for that set is indicated in the No. ofRules column.

Procedure
1. Click Add+ to add a new set of On Demand evaluation rules.
A rule creation dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 470

On Demand Rules

2. From the On Demand Action drop-down list, select the action you want to be taken when the rules you
create below are matched.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
3. Matching Rules - For each rule you create, enter one of the following types:• DNS domain: This rule matches if any of the domain names in the specified list matches any domain
in the device’s search domains list. A wildcard '*' prefix is supported. For example, *.example.com
matches against either mydomain.example.com or yourdomain.example.com.
• DNS Server Address: This rule matches if any of the network’s specified DNS servers match any
entry in the list. Matching with a single wildcard is supported. For example, 17.* matches any DNS
server in the class A 17 subnet.
• SSID: A list of SSIDs to match against the current network. If the network is not a Wi-Fi network, or if
the SSID does not appear in this list, the match fails. Omit this rule and the corresponding list to matchagainst any SSID.
• Interface Type: If specified, this rule matches only if the primary network interface hardware matches
the specified interface type. Choose Ethernet, Wifi, or Cellular.
• URL String Probe: A URL to probe. If this URL is successfully fetched without redirection (returning
a 200 HTTP status code), this rule matches.
4. Enter a value for each rule type and an optional description.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 471

Default Rules

5. After adding your rules, click OK.
Default Rules

Define a default rule that simply specifies a default VPN On Demand action in case none of the On Demand rules
match, or if no On Demand rules have been defined.
Procedure
1. From the On Demand Action drop-down list, select the action you want to be taken by default, if none of
the rules match or none are defined.
2. Click Add+ to add a default rule.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
If you select Evaluate Connection, a domain actions table displays:

3. Click Add+ to add a domain action.
The Action Parameters dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 472

Domains

4. From the Domain Action drop-down list, select one of the following actions to be taken for the domains
listed in the table:• Connect if needed: The specified domains should trigger a VPN connection attempt if domain nameresolution fails, such as when the DNS server indicates that it cannot resolve the domain, respondswith a redirection to a different server, or fails to respond (timeout).
• Never connect: The specified domains should never trigger a VPN connection attempt.
5. Click Add+ to include any of the following evaluation types:• Domain: The domains for which this evaluation applies.
• Required DNS Server: IP addresses of DNS servers to be used for resolving the specified domains.
These servers need not be part of the device’s current network configuration. If these DNS servers are
not reachable, a VPN connection is established in response. These DNS servers should be either
internal DNS servers or trusted external DNS servers. You can only configure required DNS server
evaluation types for the Connect if needed domain action.
• Required URL Probe: An HTTP or HTTPS (preferred) URL to probe, using a GET request. If no
HTTP response code is received from the server, a VPN connection is established in response. You
can only configure required URL probe evaluation types for the Connect if needed domain action.
6. Add a value and optional description for each entry.
7. Click OK to save your domain action parameters.

Domains
Safari Domains

Applicable to: Safari Domains (iOS 7 and later; macOS 10.11 and later)
NOTE: You must update your VPN software to a version that supports Per-app VPN.
If the server ends with one of these domain names, a VPN connection is started automatically.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 473

Calendar DomainslAdd+ - Click to add a domain.

l

Safari Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Calendar Domains

Applicable to: Calendar Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Calendar Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Contact Domains

Applicable to: Contact Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

lContact Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Mail Domains

Applicable to: Mail Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Associated Domains

Applicable to: Associated Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are associated with the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Excluded Domains

Applicable to: Excluded Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are excluded from the per-app VPN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 474

Custom Datal

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

PPTP
This VPN connection type is supported on iOS, macOS, Android, and Windows devices.
Use the following guidelines to configure the PPTP VPN connection type.
NOTE: iOS 10 and macOS Sierra iOS 10 and macOS Sierra through the latest version of MobileIron do notsupport the PPTP VPN connection type.
l

Proxy - None (default)lProxy - Manuall

Proxy - Automatic

Proxy - None (default)
Use the following guidelines to configure a PPTP VPN without a proxy.

TABLE 74. PROXY - NONE (DEFAULT) SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select PPTP.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 475

Proxy - Manual

TABLE 74. PROXY - NONE (DEFAULT) SETTINGS (CONT.)
Item

Description
Proxy - Manual or Proxy - Automatic

Encryption Level

Select None, Automatic or Maximum (128 bit).

DomainSpecify the network domain.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

User Name

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the authentication method to use: Password or RSA SecureID.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Proxy - Manual
Use the following guidelines to configure a PPTP VPN with a manual proxy.

TABLE 75. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 476

Proxy - Manual

TABLE 75. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select PPTP.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an automatic proxy, go to Proxy - Automatic

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Encryption Level

Select None, Automatic or Maximum (128 bit).

DomainSpecify the network domain.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 477

Proxy - Automatic

TABLE 75. PROXY - MANUAL SETTINGS (CONT.)
Item

Description$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the authentication method to use: Password or RSA SecureID.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Proxy - Automatic
Use the following guidelines to configure a PPTP VPN with an automatic proxy.

TABLE 76. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:llConnection Type

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Select PPTP.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 478

Proxy - Automatic

TABLE 76. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a manual proxy, go to Proxy - Manual.

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Encryption Level

Select None, Automatic or Maximum (128 bit).

DomainSpecify the network domain.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the authentication method to use: Password or RSA SecureID.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 479

Pulse Secure SSL

TABLE 76. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Pulse Secure SSLThis VPN connection type is supported on iOS, macOS, Android, and Windows devices.
NOTE: MobileIron recommends using the Pulse Secure SSL connection type instead of Juniper SSL.
Use the following guidelines to configure Pulse Secure SSL VPN.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:l

On Demand Rulesl

Domainsl

Custom Data

Proxy - None (default)
Use the following guidelines to configure a Pulse Secure SSL VPN without a proxy.

TABLE 77. PROXY - NONE (DEFAULT) SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Pulse Secure SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox

This setting applies to Android devices only.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 480

Proxy - None (default)

TABLE 77. PROXY - NONE (DEFAULT) SETTINGS (CONT.)
Item

Description

Workspace
ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

UsernameEnter a value for the username (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Use this field to specify a custom format, such as $PASSWORD$_$USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Role

Specify the Pulse user role to use as a restriction.

Realm

Specify the Pulse realm to use as a restriction.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 481

Proxy - None (default)

TABLE 77. PROXY - NONE (DEFAULT) SETTINGS (CONT.)
Item

Description
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
For instructions, see On Demand Rules.
Per-app VPN

Select Yes to create a per-app VPN setting.
The On Demand Rules section displays.
Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
An additional license may be required for this feature.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 482

Proxy - Manual

TABLE 77. PROXY - NONE (DEFAULT) SETTINGS (CONT.)
Item

Description

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue with Domains.
Continue with Custom Data.

Proxy - Manual
Use the following guidelines to configure a Pulse Secure SSL VPN with a manual proxy.

TABLE 78. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Pulse Secure SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an automatic proxy, go to Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 483

Proxy - Manual

TABLE 78. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

UsernameEnter a value for the username (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Use this field to specify a custom format, such as $PASSWORD$_$USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 484

Proxy - Manual

TABLE 78. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

Role

Specify the Pulse user role to use as a restriction.

Realm

Specify the Pulse realm to use as a restriction.

VPN On Demand

Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
For instructions, see On Demand Rules.
Per-app VPN

Select Yes to create a per-app VPN setting.
The On Demand Rules section displays.
Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
An additional license may be required for this feature.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 485

Proxy - Automatic

TABLE 78. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue with Domains.
Continue with Custom Data.

Proxy - Automatic
Use the following guidelines to configure a Pulse Secure SSL VPN with an automatic proxy.

TABLE 79. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Pulse Secure SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a manual proxy, go to Proxy - Manual

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 486

Proxy - Automatic

TABLE 79. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

UsernameEnter a value for the username (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Use this field to specify a custom format, such as $PASSWORD$_$USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Role

Specify the Pulse user role to use as a restriction.

Realm

Specify the Pulse realm to use as a restriction.

VPN On Demand

Select to enable VPN On Demand.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 487

Proxy - Automatic

TABLE 79. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles
the connection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection
evaluation array, VPN On Demand compares the requested domain
against the domains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network
interface changes, for example when the device switches to a different Wi-Fi
network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matchingrule is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
For instructions, see On Demand Rules.
Per-app VPN

Select Yes to create a per-app VPN setting.
Per-app VPN is supported on iOS devices version 9.0 through the mostrecently released version of iOS as supported by MobileIron.
An additional license may be required for this feature.
You cannot delete a per-app VPN setting that is being used by an app.
Remove the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected
VPN configurations in the Per-App VPN section, then VPNprioritization will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 488

On Demand Rules

TABLE 79. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packettunnel).
Select app-proxy (default) or packet-tunnel.

Continue with Domains.
Continue with Custom Data.

On Demand Rules
Applicable to: iOS 7 and later
Whenever a network change is detected, the VPN On Demand service compares the newly connected network
against the match network criteria specified in each set of rules (in order) to determine whether VPN On Demandshould be allowed or not on the newly-joined network.
Rule sets are checked sequentially, beginning with the first. A rule set matches the current network only if all of thespecified policies in that rule set match.
If a rule set matches the current network, a server probe is sent if a URL is specified in the profile. VPN then acts
according to the policy defined in the dictionary (for example, Allow, Ignore, Evaluate Connection, Connect, or
Disconnect).
Define sets of evaluation rules for each action that can be taken by VPN On Demand: Allow, Connect,
Disconnect, Evaluate Connection, and Ignore. You can define more than one set of rules for each type of actionthat can be taken. For each set of evaluation rules, the number of rules defined for that set is indicated in the No. ofRules column.

Procedure
1. Click Add+ to add a new set of On Demand evaluation rules.
A rule creation dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 489

On Demand Rules

2. From the On Demand Action drop-down list, select the action you want to be taken when the rules you
create below are matched.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
3. Matching Rules - For each rule you create, enter one of the following types:• DNS domain: This rule matches if any of the domain names in the specified list matches any domain
in the device’s search domains list. A wildcard '*' prefix is supported. For example, *.example.com
matches against either mydomain.example.com or yourdomain.example.com.
• DNS Server Address: This rule matches if any of the network’s specified DNS servers match any
entry in the list. Matching with a single wildcard is supported. For example, 17.* matches any DNS
server in the class A 17 subnet.
• SSID: A list of SSIDs to match against the current network. If the network is not a Wi-Fi network, or if
the SSID does not appear in this list, the match fails. Omit this rule and the corresponding list to matchagainst any SSID.
• Interface Type: If specified, this rule matches only if the primary network interface hardware matches
the specified interface type. Choose Ethernet, Wifi, or Cellular.
• URL String Probe: A URL to probe. If this URL is successfully fetched without redirection (returning
a 200 HTTP status code), this rule matches.
4. Enter a value for each rule type and an optional description.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 490

Default Rules

5. After adding your rules, click OK.
Default Rules

Define a default rule that simply specifies a default VPN On Demand action in case none of the On Demand rules
match, or if no On Demand rules have been defined.
Procedure
1. From the On Demand Action drop-down list, select the action you want to be taken by default, if none of
the rules match or none are defined.
2. Click Add+ to add a default rule.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
If you select Evaluate Connection, a domain actions table displays:

3. Click Add+ to add a domain action.
The Action Parameters dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 491

Domains

4. From the Domain Action drop-down list, select one of the following actions to be taken for the domains
listed in the table:• Connect if needed: The specified domains should trigger a VPN connection attempt if domain nameresolution fails, such as when the DNS server indicates that it cannot resolve the domain, respondswith a redirection to a different server, or fails to respond (timeout).
• Never connect: The specified domains should never trigger a VPN connection attempt.
5. Click Add+ to include any of the following evaluation types:• Domain: The domains for which this evaluation applies.
• Required DNS Server: IP addresses of DNS servers to be used for resolving the specified domains.
These servers need not be part of the device’s current network configuration. If these DNS servers are
not reachable, a VPN connection is established in response. These DNS servers should be either
internal DNS servers or trusted external DNS servers. You can only configure required DNS server
evaluation types for the Connect if needed domain action.
• Required URL Probe: An HTTP or HTTPS (preferred) URL to probe, using a GET request. If no
HTTP response code is received from the server, a VPN connection is established in response. You
can only configure required URL probe evaluation types for the Connect if needed domain action.
6. Add a value and optional description for each entry.
7. Click OK to save your domain action parameters.

Domains
Safari Domains

Applicable to: Safari Domains (iOS 7 and later; macOS 10.11 and later)
NOTE: You must update your VPN software to a version that supports Per-app VPN.
If the server ends with one of these domain names, a VPN connection is started automatically.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 492

Calendar DomainslAdd+ - Click to add a domain.

l

Safari Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Calendar Domains

Applicable to: Calendar Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Calendar Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Contact Domains

Applicable to: Contact Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

lContact Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Mail Domains

Applicable to: Mail Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Associated Domains

Applicable to: Associated Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are associated with the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Excluded Domains

Applicable to: Excluded Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are excluded from the per-app VPN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 493

Custom Datal

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

Samsung Knox IPsec
This VPN connection type is supported on Android devices. It is not supported on iOS, macOS, and Windows
devices.

SonicWall Mobile Connect
This VPN connection type is supported on iOS, macOS, and Windows devices. It is not supported on Android
devices.
Use the following guidelines to configure a SonicWall Mobile Connect VPN.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:l

On Demand Rulesl

Domainsl

Custom Data

Proxy - None (default)
Use the following guidelines to configure a SonicWall Mobile VPN connection without a proxy.

TABLE 80. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 494

Proxy - None (default)

TABLE 80. PROXY - NONE SETTINGS (CONT.)
Item

DescriptionllDevice channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select SonicWall Mobile Connect.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Continue to Domains.
Continue to Custom Data.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 495

Proxy - Manual

Proxy - Manual
Use the following guidelines to configure a SonicWall Mobile VPN connection with a manual proxy.

TABLE 81. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select SonicWall Mobile Connect.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an Automatic proxy, go to Proxy - Automatic

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)This field is applicable to iOS only.
The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes canbe used to match multiple domains. For example, .com would include all .com
domains, and example.com would include all domains ending in example.com,
such as pages.example.com and mysite.example.com . Wildcards are notsupported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 496

Proxy - Manual

TABLE 81. PROXY - MANUAL SETTINGS (CONT.)
Item

Description$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Login Group or Domain

The LDAP group or domain associated with users.

VPN on DemandThis setting applies to iOS and macOS devices only.
Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles theconnection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection evaluationarray, VPN On Demand compares the requested domain against thedomains listed in the Domains array.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 497

Proxy - Automatic

TABLE 81. PROXY - MANUAL SETTINGS (CONT.)
Item

Description•

If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network interfacechanges, for example when the device switches to a different Wi-Fi network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matching rule
is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
Per-app VPN is supported on iOS devices version 9.0 through the most recently
released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected VPN
configurations in the Per-App VPN section, then VPN prioritization
will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packet-tunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Domains.
Continue to Custom Data.

Proxy - Automatic
Use the following guidelines to configure a SonicWall Mobile VPN connection with an automatic proxy.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 498

Proxy - Automatic

TABLE 82. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select SonicWall Mobile Connect.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a manual proxy, go to Proxy - Manual

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)This field is applicable to iOS only.
The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes canbe used to match multiple domains. For example, .com would include all .com
domains, and example.com would include all domains ending in example.com,
such as pages.example.com and mysite.example.com . Wildcards are notsupported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 499

Proxy - Automatic

TABLE 82. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description•

Password

Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Login Group or Domain

The LDAP group or domain associated with users.

VPN on DemandThis setting applies to iOS and macOS devices only.
Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles theconnection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection evaluationarray, VPN On Demand compares the requested domain against thedomains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network interfacechanges, for example when the device switches to a different Wi-Fi network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matching rule
is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 500

On Demand Rules

TABLE 82. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
The Provider Type field displays.
Per-app VPN is supported on iOS devices version 9.0 through the most recently
released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected VPN
configurations in the Per-App VPN section, then VPN prioritization
will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packet-tunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Domains.
Continue to Custom Data.

On Demand Rules
Applicable to: iOS 7 and later
Whenever a network change is detected, the VPN On Demand service compares the newly connected network
against the match network criteria specified in each set of rules (in order) to determine whether VPN On Demandshould be allowed or not on the newly-joined network.
Rule sets are checked sequentially, beginning with the first. A rule set matches the current network only if all of thespecified policies in that rule set match.
If a rule set matches the current network, a server probe is sent if a URL is specified in the profile. VPN then acts
according to the policy defined in the dictionary (for example, Allow, Ignore, Evaluate Connection, Connect, or
Disconnect).
Define sets of evaluation rules for each action that can be taken by VPN On Demand: Allow, Connect,
Disconnect, Evaluate Connection, and Ignore. You can define more than one set of rules for each type of actionthat can be taken. For each set of evaluation rules, the number of rules defined for that set is indicated in the No. ofRules column.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 501

On Demand Rules

Procedure
1. Click Add+ to add a new set of On Demand evaluation rules.
A rule creation dialog box opens.

2. From the On Demand Action drop-down list, select the action you want to be taken when the rules you
create below are matched.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
3. Matching Rules - For each rule you create, enter one of the following types:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 502

Default Rules

•

•

•

•
•

DNS domain: This rule matches if any of the domain names in the specified list matches any domain
in the device’s search domains list. A wildcard '*' prefix is supported. For example, *.example.com
matches against either mydomain.example.com or yourdomain.example.com.
DNS Server Address: This rule matches if any of the network’s specified DNS servers match any
entry in the list. Matching with a single wildcard is supported. For example, 17.* matches any DNS
server in the class A 17 subnet.
SSID: A list of SSIDs to match against the current network. If the network is not a Wi-Fi network, or if
the SSID does not appear in this list, the match fails. Omit this rule and the corresponding list to matchagainst any SSID.
Interface Type: If specified, this rule matches only if the primary network interface hardware matches
the specified interface type. Choose Ethernet, Wifi, or Cellular.
URL String Probe: A URL to probe. If this URL is successfully fetched without redirection (returning
a 200 HTTP status code), this rule matches.

4. Enter a value for each rule type and an optional description.
5. After adding your rules, click OK.
Default Rules

Define a default rule that simply specifies a default VPN On Demand action in case none of the On Demand rules
match, or if no On Demand rules have been defined.
Procedure
1. From the On Demand Action drop-down list, select the action you want to be taken by default, if none of
the rules match or none are defined.
2. Click Add+ to add a default rule.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
If you select Evaluate Connection, a domain actions table displays:

3. Click Add+ to add a domain action.
The Action Parameters dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 503

Domains

4. From the Domain Action drop-down list, select one of the following actions to be taken for the domains
listed in the table:• Connect if needed: The specified domains should trigger a VPN connection attempt if domain nameresolution fails, such as when the DNS server indicates that it cannot resolve the domain, respondswith a redirection to a different server, or fails to respond (timeout).
• Never connect: The specified domains should never trigger a VPN connection attempt.
5. Click Add+ to include any of the following evaluation types:• Domain: The domains for which this evaluation applies.
• Required DNS Server: IP addresses of DNS servers to be used for resolving the specified domains.
These servers need not be part of the device’s current network configuration. If these DNS servers are
not reachable, a VPN connection is established in response. These DNS servers should be either
internal DNS servers or trusted external DNS servers. You can only configure required DNS server
evaluation types for the Connect if needed domain action.
• Required URL Probe: An HTTP or HTTPS (preferred) URL to probe, using a GET request. If no
HTTP response code is received from the server, a VPN connection is established in response. You
can only configure required URL probe evaluation types for the Connect if needed domain action.
6. Add a value and optional description for each entry.
7. Click OK to save your domain action parameters.

Domains
Safari Domains

Applicable to: Safari Domains (iOS 7 and later; macOS 10.11 and later)
NOTE: You must update your VPN software to a version that supports Per-app VPN.
If the server ends with one of these domain names, a VPN connection is started automatically.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 504

Calendar DomainslAdd+ - Click to add a domain.

l

Safari Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Calendar Domains

Applicable to: Calendar Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Calendar Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Contact Domains

Applicable to: Contact Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

lContact Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Mail Domains

Applicable to: Mail Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Associated Domains

Applicable to: Associated Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are associated with the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Excluded Domains

Applicable to: Excluded Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are excluded from the per-app VPN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 505

Custom Datal

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

Custom SSL
This VPN connection type is supported on iOS devices. It is not supported on macOS, Android, and Windows
devices.
The Custom SSL connection type is for SSL VPN solutions that have a third-party app in the App Store. Use thefollowing guidelines to configure a Custom SSL VPN.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:l

On Demand Rulesl

Domainsl

Custom Data

iOS VPN profiles and password caching
To facilitate iOS deployments, MobileIron offers the option of caching a user’s VPN password. This option is turned
off by default. Cached passwords are encrypted, stored on the appliance, and used only for authentication. Notethat the password must match the LDAP password in order for this feature to be of use.

Proxy - None (default)
Use the following guidelines to configure a Custom SSL VPN connection without a proxy.

TABLE 83. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 506

Proxy - None (default)

TABLE 83. PROXY - NONE SETTINGS (CONT.)
Item

Description

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Custom SSL (iOS and macOS only).

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Identifier

App Store identifier for the VPN app being configured. The app creator should
provide this information.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 507

Proxy - None (default)

TABLE 83. PROXY - NONE SETTINGS (CONT.)
Item

Description

VPN on DemandThis setting applies to iOS and macOS devices only.
Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles theconnection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection evaluationarray, VPN On Demand compares the requested domain against thedomains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network interfacechanges, for example when the device switches to a different Wi-Fi network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matching rule
is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
Per-app VPN is supported on iOS devices version 9.0 through the most recently
released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected VPN
configurations in the Per-App VPN section, then VPN prioritization
will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 508

Proxy - Manual

Continue to Domains.
Continue to Custom Data.

Proxy - Manual
Use the following guidelines to configure a Custom SSL VPN connection with a manual proxy.

TABLE 84. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Custom SSL (iOS and macOS only).

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an Automatic proxy, go to Proxy - Automatic.

Proxy Server URL

Automatic Proxy
Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes canbe used to match multiple domains. For example, .com would include all .com

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 509

Proxy - Manual

TABLE 84. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
domains, and example.com would include all domains ending in example.com,
such as pages.example.com and mysite.example.com . Wildcards are notsupported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Identifier

App Store identifier for the VPN app being configured. The app creator should
provide this information.

VPN on DemandThis setting applies to iOS and macOS devices only.
Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 510

Proxy - Automatic

TABLE 84. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles theconnection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection evaluationarray, VPN On Demand compares the requested domain against thedomains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network interfacechanges, for example when the device switches to a different Wi-Fi network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matching rule
is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
Per-app VPN is supported on iOS devices version 9.0 through the most recently
released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected VPN
configurations in the Per-App VPN section, then VPN prioritization
will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Continue to Domains.
Continue to Custom Data.

Proxy - Automatic
Use the following guidelines to configure a Custom SSL VPN connection with an automatic proxy.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 511

Proxy - Automatic

TABLE 85. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Custom SSL (iOS and macOS only).

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a Manual proxy, go to Proxy - Manual.

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)

The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes canbe used to match multiple domains. For example, .com would include all .com
domains, and example.com would include all domains ending in example.com,
such as pages.example.com and mysite.example.com . Wildcards are notsupported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be used

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 512

Proxy - Automatic

TABLE 85. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
as the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Identifier

App Store identifier for the VPN app being configured. The app creator should
provide this information.

VPN on DemandThis setting applies to iOS and macOS devices only.
Select to enable VPN On Demand.
The On Demand Rules field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles theconnection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection evaluationarray, VPN On Demand compares the requested domain against thedomains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network interfacechanges, for example when the device switches to a different Wi-Fi network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matching rule
is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 513

On Demand Rules

TABLE 85. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
Per-app VPN is supported on iOS devices version 9.0 through the most recently
released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected VPN
configurations in the Per-App VPN section, then VPN prioritization
will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Continue to Domains.
Continue to Custom Data.

On Demand Rules
Applicable to: iOS 7 and later
Whenever a network change is detected, the VPN On Demand service compares the newly connected network
against the match network criteria specified in each set of rules (in order) to determine whether VPN On Demandshould be allowed or not on the newly-joined network.
Rule sets are checked sequentially, beginning with the first. A rule set matches the current network only if all of thespecified policies in that rule set match.
If a rule set matches the current network, a server probe is sent if a URL is specified in the profile. VPN then acts
according to the policy defined in the dictionary (for example, Allow, Ignore, Evaluate Connection, Connect, or
Disconnect).
Define sets of evaluation rules for each action that can be taken by VPN On Demand: Allow, Connect,
Disconnect, Evaluate Connection, and Ignore. You can define more than one set of rules for each type of actionthat can be taken. For each set of evaluation rules, the number of rules defined for that set is indicated in the No. ofRules column.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 514

On Demand Rules

Procedure
1. Click Add+ to add a new set of On Demand evaluation rules.
A rule creation dialog box opens.

2. From the On Demand Action drop-down list, select the action you want to be taken when the rules you
create below are matched.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
3. Matching Rules - For each rule you create, enter one of the following types:• DNS domain: This rule matches if any of the domain names in the specified list matches any domain
in the device’s search domains list. A wildcard '*' prefix is supported. For example, *.example.com
matches against either mydomain.example.com or yourdomain.example.com.
• DNS Server Address: This rule matches if any of the network’s specified DNS servers match any
entry in the list. Matching with a single wildcard is supported. For example, 17.* matches any DNS
server in the class A 17 subnet.
• SSID: A list of SSIDs to match against the current network. If the network is not a Wi-Fi network, or if
the SSID does not appear in this list, the match fails. Omit this rule and the corresponding list to matchagainst any SSID.
• Interface Type: If specified, this rule matches only if the primary network interface hardware matches
the specified interface type. Choose Ethernet, Wifi, or Cellular.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 515

Default Rules•

URL String Probe: A URL to probe. If this URL is successfully fetched without redirection (returning
a 200 HTTP status code), this rule matches.

4. Enter a value for each rule type and an optional description.
5. After adding your rules, click OK.
Default Rules

Define a default rule that simply specifies a default VPN On Demand action in case none of the On Demand rules
match, or if no On Demand rules have been defined.
Procedure
1. From the On Demand Action drop-down list, select the action you want to be taken by default, if none of
the rules match or none are defined.
2. Click Add+ to add a default rule.
The following actions are available:• Allow: (Deprecated by iOS.) Allow VPN On Demand to connect if triggered.
• Connect: Unconditionally initiate a VPN connection on the next network attempt.
• Disconnect: Tear down the VPN connection and do not reconnect on demand as long as this
dictionary matches.
• Evaluate Connection: Evaluate the action parameters for each connection attempt.
• Ignore: Leave any existing VPN connection up, but do not reconnect on demand as long as this
dictionary matches.
If you select Evaluate Connection, a domain actions table displays:

3. Click Add+ to add a domain action.
The Action Parameters dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 516

Domains

4. From the Domain Action drop-down list, select one of the following actions to be taken for the domains
listed in the table:• Connect if needed: The specified domains should trigger a VPN connection attempt if domain nameresolution fails, such as when the DNS server indicates that it cannot resolve the domain, respondswith a redirection to a different server, or fails to respond (timeout).
• Never connect: The specified domains should never trigger a VPN connection attempt.
5. Click Add+ to include any of the following evaluation types:• Domain: The domains for which this evaluation applies.
• Required DNS Server: IP addresses of DNS servers to be used for resolving the specified domains.
These servers need not be part of the device’s current network configuration. If these DNS servers are
not reachable, a VPN connection is established in response. These DNS servers should be either
internal DNS servers or trusted external DNS servers. You can only configure required DNS server
evaluation types for the Connect if needed domain action.
• Required URL Probe: An HTTP or HTTPS (preferred) URL to probe, using a GET request. If no
HTTP response code is received from the server, a VPN connection is established in response. You
can only configure required URL probe evaluation types for the Connect if needed domain action.
6. Add a value and optional description for each entry.
7. Click OK to save your domain action parameters.

Domains
Safari Domains

Applicable to: Safari Domains (iOS 7 and later; macOS 10.11 and later)
NOTE: You must update your VPN software to a version that supports Per-app VPN.
If the server ends with one of these domain names, a VPN connection is started automatically.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 517

Calendar DomainslAdd+ - Click to add a domain.

l

Safari Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Calendar Domains

Applicable to: Calendar Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Calendar Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Contact Domains

Applicable to: Contact Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

lContact Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Mail Domains

Applicable to: Mail Domains (iOS 13 and later; macOS 10.15 and later)
If the server ends with one of these domain names, a VPN connection is started automatically.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Associated Domains

Applicable to: Associated Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are associated with the per-app VPN.
l

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Excluded Domains

Applicable to: Excluded Domains (iOS 14.3 and later; macOS 11.0 and later)
Connections to servers within one of these domains are excluded from the per-app VPN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 518

Custom Datal

Add+ - Click to add a domain.

l

Mail Domain - Enter a domain name. Only alphanumeric characters and periods (.) are supported.

lDescription - Enter a description for the domain.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 519

17Managing Certificates and Configuring
Certificate Authorities
This section addresses components related to managing certificates and certificate authorities.
MobileIron Core supports the use of certificates and certificate-related features for tvOS devices in every instance
where iOS devices are supported. Certificates can be used for macOS devices, except in the case of certificatesfor AppConnect.
Certificates overview
Managing certificates issued by certificate enrollment configurations
Supported certificate scenarios
MobileIron Core as a certificate authority
Configuring MobileIron Core as an independent root CA (Self-Signed)
Configuring MobileIron Core as an intermediate CA
Mutual authentication between devices and MobileIron Core
Certificates settings
Certificate Enrollment settings
Configuring Blue Coat Mobile Device Security service integration
Configuring a client-provided certificate enrollment setting
Configuring an Entrust CA
Configuring a GlobalSign CA
Configuring MobileIron Core as the CA
Configuring OpenTrust CA
Configuring a single file identity certificate enrollment setting
Configuring SCEP
Configuring Symantec Managed PKI
Configuring Symantec Web Services Managed PKI
Configuring a user-provided certificate enrollment setting
Certificate Transparency Payload

Certificates overview
MobileIron is capable of distributing and managing certificates.
Certificates are mainly used for the following purposes:lEstablishing secure communicationslEncrypting payloads

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 520

Types of certificateslAuthenticating users and devices

Certificates establish user identity while eliminating the need for users to enter user names and passwords on theirmobile devices. Certificates streamline authentication to key enterprise resources, such as email, Wi-Fi, and VPN.
Some applications require the use of certificates for authentication.
The following diagram compares a certificate to a passport:

FIGURE 15. COMPARING CERTIFICATES TO A PASSPORTThe certificate includes information that identifies the following information:lthe issuing certificate authoritylacceptable uses for the certificatelinformation that enables the certificate to be validated.

The MobileIron solution provides the flexibility to use MobileIron Core as a local certificate authority, anintermediate certificate authority, or as a proxy for a trusted certificate authority.

Types of certificates
MobileIron uses the following types of certificates:

TABLE 86. CERTIFICATE TYPES
Certificate type

Description

Portal HTTPSThe identify certificate and its certificate chain, including the private key, that
identifies MobileIron Core, allowing a client (such as a browser or app) to trust
MobileIron Core. Typically, this certificate is the same certificate as the Client TLS
and iOS Enrollment certificates.
Core sends this certificate to the client as part of the TLS handshake over port 443 or

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 521

Types of certificates

TABLE 86. CERTIFICATE TYPES (CONT.)
Certificate type

Description
8443 when the client initiates a request to Core.
NOTE: This certificate must be a publicly trusted certificate from a wellknown Certificate Authority if you are using mutual authentication.
Related topics“Certificates you configure on the System Manager” in the MobileIron Core System
Manager Guide

Client TLS

The identify certificate and its certificate chain, including the private key, that
identifies MobileIron Core, allowing Mobile@Work for iOS and Android to trust
MobileIron Core. Typically, this certificate is the same certificate as the Portal
HTTPS and iOS Enrollment certificates.
Core sends this certificate to Mobile@Work for iOS or Android as part of the TLS
handshake over port 9997 when Mobile@Work initiates a request to Core.
Related topics“Certificates you configure on the System Manager” in the MobileIron Core System
Manager Guide

MobileIron Core
server SSL

Can be either self-signed or third-party certificates. By default, Core generates selfsigned certificates. You can use trusted certificates from third-party certificate
providers such as Verisign, Thawte, or Go Daddy. Kerberos and Entrust certificatesare also supported.

Sentry server SSL

Identifies the Sentry to the client and secures communication, over port 443,
between devices and the Sentry.

TLS trust certificate
chain for mobile
management

Allows iOS mobile devices to trust requests from MobileIron Core. Validates profile
authenticity for iOS. Enables the MDM feature set for iOS devices. Uses port 2195
to communicate with Apple APNS.

(formerly known as
the iOS MDM
certificate)
iOS Enrollment

The identify certificate and its certificate chain, including the private key, that
identifies MobileIron Core.
Core uses this identity certificate to sign the Apple MDM configurations that it sends
to iOS and macOS devices. Typically, this certificate is the same certificate as the
Client TLS and Portal HTTPS certificates.
Related topicsl

IKEv2 (iOS Only)

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 522

Managing certificates issued by certificate enrollment configurations

TABLE 86. CERTIFICATE TYPES (CONT.)
Certificate type

Descriptionl“Certificates you configure on the System Manager” in the MobileIron Core
System Manager Guide.

Client identity

Verifies the identity of users and devices and can be distributed through Certificate
Enrollment.

The following diagram illustrates where each certificate type is used in the MobileIron architecture:

FIGURE 16. CERTIFICATE TYPES IN THE MOBILEIRON ARCHITECTURE

Managing certificates issued by certificate enrollment
configurations
MobileIron Core runs a process each day at 3:45 am that manages all certificates issued using certificate
enrollment configurations.
Certificates have a limited lifetime that is defined when certificates are issued. When the certificate lifetime iswithin the expiry window (60 days, by default), MobileIron Core does not automatically renew the certificates. Onlya forced manual renewal/creation is possible.
Re-issued certificates are sent to the managed device configuration and the expiring certificates become inactive.
The inactive certificates are purged from the system once the certificates are expired or confirmed to be revoked.

Supported certificate scenarios
MobileIron supports the following certificate scenarios:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 523

MobileIron Core as a certificate authorityl

MobileIron Core as a certificate authoritylUsing MobileIron Core as a certificate proxyl

Using MobileIron Core as a certificate enrollment reverse proxy

MobileIron Core as a certificate authority
You can configure MobileIron Core as a local certificate authority (CA) for the following scenarios:llCore as an Independent Root CA (self-signed)—Configure Core as an independent root certificate
authority if you are using a self-signed certificate. Use this option if your company does not have its own
certificate authority and you are using Core as the certificate authority.
Core as an Intermediate CA—Use this option when your company already has its own certificate authority.
Using Core as an Intermediate CA gives your mobile device users the advantage of being able toauthenticate to servers within your company intranet.

Using MobileIron Core as a certificate proxy
MobileIron Core can act as a proxy to a 3rd party CA by using APIs exposed by the 3rd party CA or the SCEP
protocol to obtain certificates required by a Certificate Enrollment. This enables you to configure certificate-based
authentication for devices.
Using Core as a certificate proxy has the following benefits:
l

l

l

l

Certificate verifies Exchange ActiveSync, Wi-Fi and/or VPN connections, eliminating the need forpasswords that are complex to manage
MobileIron can manage certificates by checking status against a CA's CRL, deactivating revokedcertificates and requesting replacement when certificates are about to expire
MobileIron can detect and address certificate renewal and ensure that devices cannot reconnect toenterprise resources if they are out of compliance with company policies.
Simplified enrollment with the following:o

MS Certificate Enrollmento

Entrusto

Local CAo

Symantec Managed PKIoUser provided certificatesoOpen TrustoSymantec Web Services Managed PKI

The following applications are supported.
lActiveSync is supported with Email+ and the iOS native mail client.

l

VPN is supported on and on iOS with IPSec, Cisco AnyConnect, and JunOS Pulse.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 524

Using MobileIron Core as a certificate enrollment reverse proxyl

Wi-Fi.

The following certificates are supported for iOS devices:l

Microsoft NDES Certificate Enrollmentl

Entrustl

Local CAl

Symantec Managed PKIlUser provided certificateslOpen TrustlSymantec Web Services Managed PKIlClient-Provided certificateslClient-provided certificates using the native SCEP client on iOS

For information about how to create certificate enrollment settings in MobileIron Core, see Certificate Enrollment
settings.

Using MobileIron Core as a certificate enrollment reverse proxy
Identity certificates with Microsoft Certificate Enrollment are supported. A root or intermediate certificate from atrusted certificate authority (CA) is required, and you must set up MobileIron Core to act as a SCEP reverse proxy.
Windows devices originate the certificate request. When the Windows device requests a certificate, the MobileIron
Core acts as a Certificate Enrollment reverse proxy and communicates with the Certificate Enrollment server todeliver the certificate to the device.

MobileIron Core as a certificate authority
You can configure MobileIron Core as a local certificate authority for the following scenarios:lMobileIron Core as an Independent Root CA (self-signed)—Configure MobileIron Core as anindependent root certificate authority if you are using a self-signed certificate. Use this option if yourcompany does not have its own certificate authority and you are using MobileIron Core as the certificate
authority.
See Configuring MobileIron Core as an independent root CA (Self-Signed).

l

MobileIron Core as an Intermediate CA—Use this option when your company already has its own
certificate authority. Using MobileIron Core as an Intermediate CA gives your mobile device users theadvantage of being able to authenticate to servers within your company intranet.
See Configuring MobileIron Core as an intermediate CA.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 525

Configuring MobileIron Core as an independent root CA (Self-Signed)

Configuring MobileIron Core as an independent root CA (SelfSigned)
Configuring MobileIron Core as an independent root CA requires configuring your infrastructure to trust Core as anindependent root CA.
To configure MobileIron Core as an independent root CA, you must follow these basic steps:
1. Generate a self-signed certificate
See Generating a self-signed certificate.
2. Create a local CA certificate enrollment setting for the self-signed certificate
See Creating a local certificate enrollment setting.

Generating a self-signed certificate
To generate the self-signed certificate:
1. Log into the Admin Portal.
2. Go to Services > Local CA.
3. Select Add > Generate Self-Signed Cert.

4. Enter the following information.
l

l

l

l

Local CA Name: Enter a recognizable name to identify the self-signed certificate. This name willappear in the list of local certificate authorities in Services > Local CA.
Key Type: Specify the key type. The options are RSA (default) or Elliptical Curve.
Key Length: Specify the key length. The values are 2048, 3072 (the default), and 4096. The longer the
key length, the more secure the certificate.
CSR Signature Algorithm: The values are SHA1, SHA256, SHA384 (default), and SHA512.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 526

Generating a self-signed certificateo

Key Lifetime (in days): Enter number of days. The key will expire after the entered number ofdays.
The default is 10,950 days. MobileIron recommends 5 years or longer; 61 days is the minimum.

oIssuer Name: Requires an X.509 name. For example, CN=www.yourcompany.com,
DC=yourcompany, DC=com.
The Issuer Name field uses an X.509 distinguished name. You can use one or more X.509 codes,
separated by commas. The following table describes the valid codes for the Issuer Name field:
Code

Name

Type

Max
Size

ExampleC

Country/Region

ASCII

2

C=US

DC

Domain Component

ASCII

255

DC=company, DC=com

S

State or Province

Unicode128

S=California

L

Locality

Unicode128

L=Mountain View

O

Organization

Unicode64

O=Company Name, Inc.

OU

Organizational Unit

Unicode64

OU=Support

CN

Common NameUnicode64

CN=www.company.com

If you have a registered DNS name that you use to send SMTP mail, a best practice is to use thedomain component convention and the DNS name for the certificate name.
5. Click Generate.

6. Configure the Client Certificate Template.
Values depend on the purpose for the certificate and the requirements of your environment.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 527

Creating a local certificate enrollment settinglHash Algorithm: The larger the hash number, the more secure. The options are SHA256, SHA384(default), SHA512—part of the SHA2 secure hash algorithm family required for U.S. government
applications. The number signifies the output bits.

l

Minimum Key Size Allowed: The longer the key length is, the more secure the certificate.

l

Key Lifetime (days): 365 days or longer is recommended; 61 days is the minimum.

l

Key Lifetime limited by CA: Select to use the key lifetime specified for the self-signed CA.
MobileIron recommends enabling this option. Enabling this option ensures that client certificate
validity periods do not exceed the life time of the issuing CA certificate.

llEnhanced Key Usage: When a certificate is presented to an application, the application can require
the presence of an Enhanced Key Usage OID specific to that application. Leave these deselected if
you do not have any applications that require additional OIDs.
Custom OIDs: If you are using this certificate for SSL authentication, enter the OID in this field.

7. Click Save.
The newly created self-signed certificate will be listed in Services > Local CA.

Creating a local certificate enrollment setting
After you have generated the self-signed certificate, you need to create a local CA certificate enrollment setting forthe self-signed certificate. Creating a local CA certificate enrollment setting enables proxy functionality so that
MobileIron Core generates the certificates and caches the generated keys.
1. Log into the Admin Portal.
2. Go to Policies & Configs > Configurations.
3. Click Add New > Certificate Enrollment > Local.
For more information on configuring the settings, see Certificate Enrollment settings.

Configuring MobileIron Core as an intermediate CA
When you configure Core as an intermediate certificate authority, the managed device users can authenticate toservers within your company intranet; not just the MobileIron system.
After you get the certificate from your certificate vendor, you can add the certificates to MobileIron Core to create
the intermediate certificate authority (CA).
Procedure
1. In the MobileIron Core Admin Portal go to Services > Local CA.
2. Click on Add > Intermediate Enterprise CA.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 528

Mutual authentication between devices and MobileIron Core

3. Click Browse and navigate to the combined file.
4. Click Open.
5. Enter a recognizable name in the Local CA Name field.
6. Click Upload Certificate.
Your local certificate authority is now available to use. The local CA will be listed in Services > Local CA.

Mutual authentication between devices and MobileIron Core
MobileIron Core supports mutual authentication, which means that not only must the device trust MobileIron Core,
but MobileIron Core must trust the device. Therefore, with mutual authentication, a registered device can continue
to communicate with Core only if the device provides the right certificate to Core. Mutually authenticatedcommunication between the device and MobileIron Core enhances security.
NOTE: A device authenticating to Core with a certificate is also known as certificate-based
authentication to Core.
l

Scenarios that can use mutual authenticationlCore port usage with devices, with and without mutual authenticationl

The mutual authentication setting on MobileIron Corel

When devices use mutual authenticationlMutual authentication identity certificate for MobileIron Corel

Mutual authentication client identity certificatelSupported custom attributes for mutual authentication certificateslNew endpoint for mutual certification authenticationlHandling client identity certificate expiration for Android deviceslHandling client identity certificate expiration for iOS deviceslMutual authentication and Apps@Workl

Enabling mutual authentication for Apple and Android devices

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 529

Scenarios that can use mutual authenticationlEnabling TLS inspecting proxy support when using mutual authenticationlEnabling mutual authentication for Apple and Android deviceslEnabling mutual authentication for Apple and Android devices

Scenarios that can use mutual authentication
The device can present a client identity certificate to MobileIron Core in the following cases:

TABLE 87. MUTUAL AUTHENTICATION USAGE BY PLATFORM
Platform

Mutual Authentication usage

iOS

•
•
•
•

Mobile@Work for iOS device check-in
AppConnect for iOS check-in
iOS MDM device check-in
Apps@Work for iOS communication

macOS

•
•

Mobile@Work for macOS device check-in
macOS MDM device check-in

Android••

Mobile@Work for Android device check-in, which includes AppConnect checkinApps@Work for Android communication•

Device check-in

Windows 10

NOTE: Mutual authentication is not possible at the time Mobile@Work registers with Core, because thedevice receives its identity certificate during the registration process.

Core port usage with devices, with and without mutual authentication
The following table summarizes MobileIron Core port usage for registration and further communication with
devices. The port usage for some cases is different depending on whether mutual authentication is enabled.

TABLE 88. CORE PORT USAGE WITH DEVICES WITH AND WITHOUT MUTUAL AUTHENTICATION
Without mutual authentication

With mutual authentication

Mobile@Work for iOS

9997

443

Mobile@Work for Android

9997

443

Mobile@Work for macOSNot applicable.

443

Mobile@Work for macOS always
uses mutual authentication withCore.
iOS and macOS MDM agent
provisioning and agent

443

443

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 530

The mutual authentication setting on MobileIron CoreTABLE 88. CORE PORT USAGE WITH DEVICES WITH AND WITHOUT MUTUAL AUTHENTICATION (CONT.)
Without mutual authentication

With mutual authentication

Not applicable.

443

check-inWindows 10

Windows 10 always uses mutual
authentication with Core.
NOTE: Port 9997 is configurable in the System Manager in Settings > Port Settings > Sync TLS Port.
However, changing the port is rare.

The mutual authentication setting on MobileIron Core
The setting on MobileIron Core to enable mutual authentication is in the Admin Portal in Settings > System
Settings > Security > Certificate Authentication. Whether the setting is automatically selected on new
installations and upgrades is described by the following table.

TABLE 89. SETTING FOR MUTUAL AUTHENTICATION ON NEW INSTALLS AND UPGRADES
Setting to enable mutual authentication
New installations

Not selected. Mutual authentication is not enabled.

Upgrade from a previous version of Core in which
mutual authentication was not enabled.

Not selected. Mutual authentication is not enabled.

Or
Upgrade from a version of Core prior to Core 9.7.0.0
in which the Android mutual authentication setting
was not enabled.
Upgrade from a previous version of Core in which
mutual authentication was enabled.

Selected. Mutual authentication is enabled.

Or
Upgrade from a version of Core prior to Core 9.7.0.0
in which the Android mutual authentication setting
was enabled.
IMPORTANT: Once mutual authentication is enabled on Core, it cannot be disabled.
The mutual authentication setting impacts mutual authentication usage only on:l

Mobile@Work for Androidl

Apps@Work for Android

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 531

When devices use mutual authenticationlHowever, to enable mutual authentication for Apps@Work for Android:o

You must also select Certificate Authentication for Apps@Work at Apps > Apps@Work Settings> App Storefront Authentication.

o

The device must be using Mobile@Work 10.2.0.0 for Android through the most recently released
version as supported by MobileIron.

l

Mobile@Work 9.8 for iOS through the most recently released version as supported by MobileIronl

iOS MDMlmacOS MDM

The mutual authentication setting has no impact on mutual authentication usage on:lVersions of Mobile@Work for iOS prior to Mobile@Work 9.8
These versions of Mobile@Work for iOS never use mutual authentication.

lApps@Work for iOS
Apps@Work for iOS uses mutual authentication if you select Certificate Authentication for
Apps@Work at Apps > Apps@Work Settings > App Storefront Authentication.

l

Mobile@Work for macOS
Mobile@Work for macOS always uses mutual authentication.

lWindows 10 devices
Windows 10 devices always uses mutual authentication.

When devices use mutual authentication
Whether devices use mutual authentication depends on:l

The device platformlWhether mutual authentication was enabled before upgradelWhether mutual authentication is enabled after upgradelWhether mutual authentication is enabled after a new installationl

For Mobile@Work for iOS, the version of Mobile@Work

The following table summarizes when devices use mutual authentication and the port they use in communication
with MobileIron Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 532

When devices use mutual authentication

TABLE 90. CORE MUTUAL AUTHENTICATION (MA) SETTING IMPACT TO DEVICE COMMUNICATIONNew Core
installation

New Core installation inwhich you enable MA
setting after installation.

orCore upgrade in which:
MA setting WAS enabled
before upgradeorCore upgradein which:
MA setting was
NOT enabled
before upgrade
Mutualauthentication
settingCore upgrade in which:
MA setting was NOT
enabled before upgrade but
you enable it after the
upgrade.

Not enabled

EnabledEnabledAndroid:

Port: 9997

Port: 443

Mobile@Work

MA: not used

Devices that register after
enabling MA:• Port: 443• MA: used

Device client(all Mobile@Workversions that Core
supports)

MA: used

Devices that were alreadyregistered:• Port: 9997
• MA: not used.

iOS:

Port: 9997

Devices that register after
enabling MA:• Port: 443• MA: used

Devices that register after
enabling MA:• Port: 443• MA: used

Mobile@Work 9.8
through the mostrecently released
version as
supported by
MobileIron

MA: not used

Devices that were alreadyregistered:• Port: 9997
• MA: not used.

Devices that were alreadyregistered:• Port: 9997
• MA: not used.

iOS:

Port: 9997

Port: 9997

Port: 9997

Mobile@Workversions prior to
9.8

MA: not used

MA: not used

MA: not usediOS:

Port: 443

Port: 443

Port: 443

iOS MDM check-in

MA: not used

MA: used

MA: used.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 533

Mutual authentication identity certificate for MobileIron CoreTABLE 90. CORE MUTUAL AUTHENTICATION (MA) SETTING IMPACT TO DEVICE COMMUNICATION (CONT.)New Core
installation

New Core installation inwhich you enable MA
setting after installation.

orCore upgrade in which:
MA setting WAS enabled
before upgradeorCore upgradein which:
MA setting was
NOT enabled
before upgradeCore upgrade in which:
MA setting was NOT
enabled before upgrade but
you enable it after the
upgrade.

macOS:

Port: 443

Port: 443

Port: 443

Mobile@Work

MA: used

MA: used

MA: usedmacOS

Port: 443

Port: 443

Port: 443

macOS MDM
agent check-in

MA: not used

MA: used

MA: used

Windows 10

Port: 443

Port: 443

Port: 443

MA: used

MA: used

MA: used

NOTE: On new MobileIron Core installations (not upgrades), if you enable mutual authentication
before any devices register, you can disable port 9997 (in the System Manager in Settings > Port
Settings > Sync TLS Port) because it is not used. If devices were registered before enabling mutual
authentication, disabling the port causes those devices to not be able to check-in.

Mutual authentication identity certificate for MobileIron Core
You provide an identity certificate for MobileIron Core to use in mutual authentication in the Portal HTTPS
certificate. You configure this certificate on the System Manager at Security > Certificate Mgmt. The certificate
is the identify certificate and its certificate chain, including the private key, that identifies MobileIron Core, allowing
the devices to trust MobileIron Core. This certificate must be a publicly trusted certificate from a well-known
Certificate Authority when using mutual authentication.

Mutual authentication client identity certificate
You enable mutual authentication for iOS and Android devices in the Admin Portal in Settings > System Settings> Security > Certificate Authentication. The certificate enrollment setting specifies how the identity certificatethat the device will present to Core is generated.
By default, the certificate enrollment setting for mutual authentication is generated with Core as a local Certificate
Authority (CA). Most customers use the default selection. However, if necessary due to your security
requirements, you can instead specify a SCEP certificate enrollment setting that you create.
IMPORTANT:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 534

Supported custom attributes for mutual authentication certificates

l

l

l

If you use a SCEP certificate enrollment setting for mutual authentication, you cannot use it for any otherpurpose. For example, you cannot use it in VPN or wi-fi configurations.
If you use a SCEP certificate enrollment setting that uses an intermediate CA, make sure that all theintermediate CA certificates and the root CA certificate are included in MobileIron Core's trusted root
certificates. See "Managing trusted certificates" in the Getting Started with MobileIron CoreSee:oHandling client identity certificate expiration for Android devicesoHandling client identity certificate expiration for iOS devices

Supported custom attributes for mutual authentication certificates
From Core release 10.8.0.0 through the latest release supported by MobileIron, Core supports only the following listof custom attributes in the Subject field for mutual authentication enrollment certificates:l$RANDOM_16$l$RANDOM_32$l$RANDOM_64$l$CONFIG_UUID$l$TIMESTAMP_MS$

If, after upgrading to release 10.8.0.0 through the latest version as supported by MobileIron, the existing selectedmutual authentication certificate includes unsupported attributes, Core will replace them with the value$RANDOM_32$ for new device registrations and for existing device certificate renewals.
The Admin portal > Settings > System Settings > Client Mutual Certificate Authentication > Certificate
Enrollment setting drop-down menu displays only the Simple Certificate Enrollment Protocol (SCEP)
configurations with the five supported custom attributes in the Subject field. Configurations with other custom
attributes do not display.

New endpoint for mutual certification authentication
Once mutual authentication is enabled on Core by the administrator, new mutual authentication devices endpoints
are available for use by iOS and Android clients. The existing (old) OAuth endpoint is not protected by 2FA or
mutual certificate authentication and is vulnerable to password spraying and DOS attacks. There is an option for
the administrator to disable the original OAuth endpoint and utilize the new endpoint.
This feature is applicable on Mobile@Work for Android version 11.1.0.0 and Mobile@Work for iOS version
12.11.10 through the latest versions as supported by MobileIron.
Below is an example scenario of the old OAuth versus the new endpoint:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 535

New endpoint for mutual certification authentication

TABLE 91. OLD OAUTH VS NEW ENDPOINT
New endpoint

Old OAuth

Not configured

Enabled (old OAuth endpoint works)

EnabledEnabled (new endpoint works)

EnabledDisabled (new endpoint works)

Disabled

Disabled (Error)

Note The Following:
You can have mutual certificate authentication on Mobile@Work clients (both iOS and Android) and on thewatchOS app, however, it will mean less security. MobileIron does not recommend putting mutual certificate
authentication on the watchOS app.
To implement this setup, two endpoints are required:
1. A current OAuth endpoint that can be used by watchOS app, an old or updated Mobile@Work for iOS, OR
an old or updated Mobile@Work for Android and cURL script.
2. A new endpoint that will always require mutual certificate authentication.
Before you beginlAdministrators should have enabled mutual certificate authentication and have migrated all the devices.
Check-ins will occur on port 443 and not sync the TLS port 9997.

lClients need to be upgraded to the version that supports the new endpoint.

Procedure
1. Go to Settings > System Settings.
2. In the left navigational pane, click Security > Certificate Authentication.
The Client Mutual Certification Authentication page displays in the right pane.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 536

Handling client identity certificate expiration for Android devices

3. Use the below guidelines to complete this form.

TABLE 92. CLIENT MUTUAL CERTIFICATION AUTHENTICATION
Item

Description

Enable client mutual certificate

Selecting the check box is a pre-requisite to enabling the
new endpoint.

authentication on Android client, iOSclient, iOS and macOS MDM and
AppConnect communications
Certificate Enrollment Setting

Select System-Mutual Auth CE from the drop-down.

Enable new OAuth Endpoint with Mutual

Select this to enable the new endpoint. If this field is greyed

certificate Authenticationout, it means you did not meet the pre-requisite
requirements of enabling mutual certificate authenticationand migrating all client devices. See Before you begin.

Disable legacy OAuth Endpoint

This should only be done after the client devices have been
updated to Mobile@Work for Android version X and
Mobile@Work for iOS version X.
a. When selecting the Disable legacy OAuth Endpointbox, a confirmation displays. Click Disable.
b. A second confirmation dialog box displays, click
Disable.
Once disabled, the WatchOS app will no longer work. Thissetting can be reversed by de-selecting it.
NOTE: Before disabling the legacy OAuth endpoint,
make sure that all devices are migrated to
the new endpoint.

4. Click Save.

Handling client identity certificate expiration for Android devices
Mobile@Work 10.1 for Android handles the expiration of the client identity certificate used for mutual authentication
between Mobile@Work for Android and MobileIron Core. In the Admin Portal, on the sync policy for the device,specify a renewal window for the certificate. The renewal window is a number of days prior to the certificate
expiration. When Mobile@Work determines the renewal window has begun, it requests a new certificate fromCore.
If Mobile@Work is out of contact with Core during the renewal window, but is in contact again within 30 days after
the expiration, Mobile@Work requests a new certificate from Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 537

Handling client identity certificate expiration for iOS devices

If Mobile@Work is not in contact with Core either during the renewal window or within 30 days after the expiration,
the device will be retired and will need to re-register with Core.
Mobile@Work versions prior to 10.1 do not support certificate expiration. When the certificate expires, the deviceuser must re-register Mobile@Work.
Procedure
1. In the Admin Portal, go tos Policies & Configs > Policies.
2. Select the appropriate sync policy.
3. For Mutual Certificate Authentication Renewal Window, enter the number of days prior to the
expiration date that you want to allow devices to renew their identity certificate. Enter a value between 1
and 60.
NOTE: A blank value defaults to 60 days.
4. Click Save.
5. Click OK.

Handling client identity certificate expiration for iOS devices
Mobile@Work 11.1.0 for iOS handles the expiration of the client identity certificate used for mutual authentication
between Mobile@Work for iOS and MobileIron Core version 10.3.0.0 through the most recently released version as
supported by MobileIron. In the Admin Portal, on the sync policy for the device, specify a renewal window for thecertificate. The renewal window is a number of days prior to the certificate expiration. When Mobile@Work
determines the renewal window has begun, it requests a new certificate from Core.
If Mobile@Work is out of contact with Core during the renewal window, but is in contact again within 30 days after
the expiration, Mobile@Work requests a new certificate from Core.
If Mobile@Work is not in contact with Core either during the renewal window or within 30 days after the expiration,
the device will be retired and will need to re-register with Core.
Mobile@Work versions prior to 11.1.0 do not support certificate expiration. When the certificate expires, the deviceuser must re-register Mobile@Work.
Procedure
1. In the Admin Portal, go to Policies & Configs > Policies.
2. Select the appropriate sync policy.
3. For Mutual Certificate Authentication Renewal Window, enter the number of days prior to the
expiration date that you want to allow devices to renew their identity certificate. Enter a value between 1
and 60.
NOTE: A blank value defaults to 60 days.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 538

Mutual authentication and Apps@Work

4. Click Save.
5. Click OK.

Mutual authentication and Apps@Work
Both Apps@Work for Android and Apps@Work for iOS can use mutual authentication.
Apps@Work for iOS uses mutual authentication if you select Certificate Authentication at Apps > Apps@Work
Settings > App Storefront Authentication. It does not depend on the mutual authentication setting at Settings >System Settings > Security > Certificate Authentication.
However, Apps@Work for Android uses mutual authentication only if you do both of the following:ll

Select Certificate Authentication at Apps > Apps@Work Settings > App Storefront Authentication.
Enable the mutual authentication setting at Settings > System Settings > Security > Certificate
Authentication.

Related topicsl"Setting up Apps@Work for iOS and macOS" in the MobileIron Apps@Work Guidel"Apps@Work in Mobile@Work for Android in the MobileIron Apps@Work Guide

Enabling mutual authentication for Apple and Android devices
The MobileIron Core mutual authentication setting enables mutual authentication for:l

Mobile@Work for Androidl

Apps@Work for Androido

You must also select Certificate Authentication for Apps@Work at Apps > Apps@Work Settings> App Storefront Authentication.

o

The device must be using Mobile@Work 10.2.0.0 for Android through the most recently released
version as supported by MobileIron.

l

Mobile@Work 9.8 for iOS through the most recently released version as supported by MobileIronl

iOS MDMlmacOS MDM

Note The Following:ll

The setting is automatically enabled in the cases described in The mutual authentication setting on
MobileIron Core.
After you enable mutual authentication, you cannot disable it.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 539

Enabling TLS inspecting proxy support when using mutual authentication

Before you begin
1. As discussed in in Mutual authentication client identity certificate, create a SCEP certificate enrollment
setting if you do not want to use the default local certificate enrollment setting for mutual authentication.
The SCEP setting must select the Decentralized option. For details, see Certificate Enrollment settings.
NOTE: When you enable mutual authentication, change the certificate enrollment selection
for mutual authentication before any more devices register. Any devices alreadyregistered and using mutual authentication will not be able to check-in with Core. Those
devices will need to re-register with Core. Note that devices already registered but notusing mutual authentication can continue to check-in.
2. If you are using iOS devices with the Apps@Work web clip using certificate authentication, change theApps@Work Port field in the System Manager in Settings > Port Settings. MobileIron recommends port
7443. However, you can use any port except the port that the Admin Portal uses, which is either 443 or
8443, which you specify in the MIFS Admin Port field in the System Manager in Settings > Port
Settings.
Procedure
1. In the Admin Portal, go to Settings > System Settings > Security > Certificate Authentication.
2. Select Enable client mutual certification on Android client, iOS client and Apple MDM
communication.
3. In the Certificate Enrollment Configuration field, most customers use the default selection. Otherwise,
select a SCEP certificate enrollment setting.
4. Click Save.
Related topicsl“Setting up Apps@Work for iOS and macOS” in the MobileIron Apps@Work Guidel"Port settings" in the MobileIron Core System Manager Guidel“Apps@Work for Android authentication to MobileIron Core” in the MobileIron Apps@Work Guide

Enabling TLS inspecting proxy support when using mutual authentication
Contact MobileIron Professional Services or a MobileIron certified partner to set up this deployment.
MobileIron Core can support a TLS inspecting proxy to handle HTTPS requests from your devices to MobileIron
Core when using mutual authentication. For example, you can use a TLS offload proxy such as an Apache or F5
server. This proxy is also known as a Trusted Front End. It intercepts and decrypts HTTPS network traffic andwhen it determines that the final destination is MobileIron Core, it re-encrypts and forwards the traffic to Core. The
devices that register to Core (using port 443) must send HTTPS requests to the TFE rather than to MobileIron
Core. Also, the TFE must be provisioned with digital certificates that establish an identity chain of trust with alegitimate server verified by a trusted third-party certificate authority.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 540

Migrating Mobile@Work for Android to use mutual authentication

Related topics"Advanced: Trusted Front End" in the MobileIron Core System Manager Guide.

Migrating Mobile@Work for Android to use mutual authentication
For devices that register after enabling mutual authentication, Mobile@Work uses port 443 for device check-ins.
However, devices that were already registered continue to use port 9997. You can migrate Mobile@Work forAndroid from using port 9997 without mutual authentication to using port 443 with mutual authentication. The
device users do not need to re-register with MobileIron Core.
Before you begin
Instruct Android device users to upgrade to Mobile@Work 10.1 for Android through the most recently released
version as supported by MobileIron. Prior Mobile@Work releases do not support migration.
Procedure
1. In the Admin Portal, go to Policies & Configs > Policies.
2. Select the sync policy for the devices that you want to migrate. Select Edit.
3. In the Modify Sync Policy dialog box, select Migrate Mobile@Work Client.
4. Click Save.
5. Click OK.
On the next device check-in, MobileIron Core will send the mutual authentication client identity certificate to thedevice. In all subsequent device check-ins, the device will use mutual authentication on port 443.
On that first device check-in, the device's client migration status changes to Pending. After Core has sent themutual authentication client identity certificate to the device, the client migration status changes to Success.
You can search on this value in the Client Migration Status field in Advanced Search on Devices & Users> Devices.
Related topics
When devices use mutual authentication

Certificates settings
Use a certificate setting to upload a trusted public key root certificate or certificate chain. If it is a certificate chain,it can include the root certificate or only intermediate certificates.
IMPORTANT: You cannot upload an identity certificate -- a certificate that contains a private key -- intoa certificate setting. To upload an identity certificate to Core, use the certificate
enrollment setting called single file identity.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 541

Adding a certificate setting

You configure MobileIron Core to deliver the uploaded certificate or certificate chain to devices so that the devices
can trust, for example, specific web services, email servers, or network components like VPN and Wi-Fi.
Two ways are available to deliver the certificate to a device:ll

You reference the certificate setting from another Core setting, and apply the appropriate labels to thereferencing setting. Only the following settings can reference a certificate setting:o

An AppConnect app configuration, Web@Work setting, or Docs@Work setting can reference a
certificate setting as the value of a key-value pair.

o

A Wi-Fi setting can reference a certificate setting in its Apply to Certificates field (used with specificauthentication and data encryption values on the Wi-Fi setting).

You want to deliver a trusted public key certificate directly to a set of devices, without referencing thecertificate setting from another setting. In this case, label the certificate setting. This case is less common.

Note The Following:llWhen upgrading from a MobileIron Core prior to Core 9.5.0.0, each certificate setting that contained an
identity certificate is automatically converted to a single file identity certificate enrollment setting. Any
settings that referenced the certificate setting refer to the new single file identity certificate enrollment
setting.
You cannot import a certificate setting from a MobileIron Core prior to Core 9.4.0.0 if the certificate setting
contained an identity certificate. You must manually create a single file identity certificate enrollment
setting.

Adding a certificate setting
Procedure
1. Log in to the Admin Portal.
2. Go to Policies & Configs > Configurations
3. Click Add New > Certificates.
4. Fill in the entries:lName: Enter brief text that identifies certificate setting.

lDescription: Enter additional text that clarifies the purpose of this certificate setting.

lFile Name: Click Browse to select the X.509 certificate file (.cer, .crt, .pem, or .der) to upload to
MobileIron Core. The certificate must be encoded as binary DER or ASCII PEM.

5. Click Save.
Label the certificate setting if you want to deliver the certificate directly to a set of devices, regardless whether it isreferenced from another setting. If you are referencing the certificate setting from another setting, label the othersetting.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 542

Certificate Enrollment settings

Certificate Enrollment settings
Certificate enrollment settings are used as follows:
l

l

l

l

As part of a larger process of setting up a certificate enrollment server to support authentication for VPN on
demand, Wi-Fi, Exchange ActiveSync, AppTunnel and so on.
To provide devices identity certificates that you uploaded to Core for the case when you want to provide
the same identity certificate to many users’ devices.
To provide user-provided certificates to devices when end users use the MobileIron Core user portal to
upload their identity certificates to Core.
To specify that AppConnect apps on devices use derived credentials.

The available options are:llBlue Coat: Select Blue Coat to create a Blue Coat certificate enrollment setting for integrating with theBlue Coat Mobile Device Security service.
Client-Provided: Select Client-Provided if you want AppConnect apps to use derived credentials forauthentication, digital signing, or encryption.

lEntrust: Select Entrust if you are using the Entrust Datacard certificate enrollment solution.

lGlobalSign: Select GlobalSign if you are using GlobalSign as the CA for certificate enrollment.

lLocal: Select Local if you are using MobileIron Core as the CA.

l

OpenTrust: Select OpenTrust if you are using the OpenTrust integration. See Configuring OpenTrust CA.

llSingle File Identity: Select Single File Identity to upload an identity certificate for distribution todevices.
SCEP: Select SCEP for standard certificate-based authentication using a separate CA.
NOTE: SCEP Configurations created before upgrading to Core 7.0.0.0 or later should be
replaced with a new SCEP Configuration. Failure to do so might result in cert renewal
failure from Core 9.4.0.0.

l

l

l

Symantec Managed PKI: Select Symantec Managed PKI if you are using Symantec’s Certificate
Enrollment solution. See Configuring Symantec Managed PKI for more information.
Symantec Web Services Managed PKI: Select Symantec Web Services Managed PKI if you areusing the Symantec Web Services Managed PKI solution. See Configuring Symantec Web Services
Managed PKI for more information.
User-Provided: Select User-Provided if device users will upload their personal certificates. The user
portal includes a certificate upload section for this purpose. A web services API is also available for you to
upload user-provided certificates.

If Certificate Enrollment integration is not an option
If Certificate Enrollment integration is not an option for your organization, consider configuring MobileIron Core as
an intermediate or root CA. See Certificate Enrollment settings for more information.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 543

Supported variables for certificate enrollment

Supported variables for certificate enrollment
The following variables are supported for the required and optional fields when configuring integration withsupported Certificate Authorities (CA’s):l$EMAIL$l$USERID$l$FIRST_NAME$l$LAST_NAME$l$DISPLAY_NAME$l$USER_DN$l$USER_UPN$l$USER_LOCALE$l$DEVICE_UUID$l$DEVICE_UUID_NO_DASHES$l$DEVICE_UDID$l$DEVICE_IMSI$l$DEVICE_IMEI$l$DEVICE_SN$l$DEVICE_ID$l$DEVICE_MAC$l$DEVICE_CLIENT_ID$l$USER_CUSTOM1$l$USER_CUSTOM2$l$USER_CUSTOM3$l$USER_CUSTOM4$l$REALM$l$TIMESTAMP_MS$l$RANDOM_16$l$RANDOM_32$l$RANDOM_64$l$CONFIG_UUID$** This substitution variable works only for the values under the Subject Alternative Names section for thefollowing configurations: Entrust, Local, SCEP, Symantec Managed KPI. It is used for Sentry certificate-basedtunneling (CBT).

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 544

Certificate generation time

Certificate generation time
Certificate enrollment settings can be referenced from other settings on Core that require an identity certificate.
Some settings that can reference certificate enrollment settings are Exchange settings, Email settings, Wi-Fi
settings, VPN settings, AppConnect app configuration settings, Docs@Work settings, and Web@Work settings.
Most certificate enrollment settings cause an identity certificate to be generated. The identity certificate is
generated at one of these times:l

Early generationlOn-demand generation

NOTE: Some certificate enrollment settings do not cause an identity certificate to be generated.
Specifically, for user-provided certificate enrollment settings and single file identity certificate
enrollment settings, the certificate is available on Core. For client-provided certificate
enrollment settings, the certificate is available in Mobile@Work.

Early generation
Early generation occurs when you apply a label to a setting that references the certificate enrollment setting. Core
generates identity certificates at this time for:l

AppConnect app configurationslDocs@Work settingsl

Web@Work settings

For each device that has the same label as the setting, Core does the following:ll

For devices running Mobile@Work 9.1 for iOS or earlier, Core generates an identity certificate for thedevice for each setting that references the certificate enrollment setting.
For devices running Mobile@Work 9.5 for iOS, Core generates exactly one identity certificate for thedevice regardless how many settings reference the certificate enrollment setting

NOTE: After Core generates an identity certificate, if Core does not send the certificate to a device
within 14 days, Core deletes the certificate from its file system. The certificate will be generated
on-demand.

On-demand generation
On-demand generation occurs when MobileIron Core sends a setting that references the certificate enrollment
setting to the device. On-demand generation occurs for all settings (that reference a certificate enrollment setting)that are not listed in the early generation list above. A setting, including the certificate, is delivered to a device when
the device checks in with MobileIron Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 545

Certificate delivery time for AppConnect-related certificates

Certificate delivery time for AppConnect-related certificates
This feature is not supported on macOS devices.
When an AppConnect-related setting (AppConnect app configuration, Web@Work setting, or Docs@Work
setting) specifies a certificate enrollment setting, the time that MobileIron Core delivers the identity certificate to
the device depends on the Mobile@Work version on the device.
NOTE: Certificate delivery from Core to the device is not applicable in these cases:- The certificate enrollment setting specifies decentralized mode.
- The certificate enrollment setting type is client-provided.

Certificate delivery for Mobile@Work 9.1 for iOS and earlier versions‫‫‬
Core delivers the identity certificate to the device when the AppConnect-related setting is delivered to the device.
An AppConnect-related setting is delivered to the device when Mobile@Work does an app check-in with Core andeither:l

The AppConnect app launched for the first time.

l

The AppConnect-related setting changed.

NOTE: These versions of Mobile@Work do not store the certificates.

Certificate delivery for Mobile@Work 9.5 for iOS
Core delivers an identity certificate to Mobile@Work on the device when the first AppConnect app that uses thecertificate launches. Mobile@Work stores the identity certificate. Subsequent AppConnect apps which use thesame certificate receive the certificate from Mobile@Work without any involvement from Core.
When an AppConnect app launches, control switches to Mobile@Work so that Mobile@Work can check in with
Core to receive the AppConnect-related configurations and identity certificates for the app. The time it takes toswitch control back to the app is longer when the app needs many identity certificates and it is the first AppConnect
app that needs those certificates.
Note The Following:lll

Mobile@Work stores the certificates securely on the device, encrypting them the same way it encrypts
AppConnect-related data such as AppConnect app configurations. Mobile@Work displays general
information about each stored certificate, such as its expiration date.
When a device user upgrades Mobile@Work from version 9.1 or earlier, existing AppConnect apps that
already have their certificates continue to use those certificates. Such apps receive replacement
certificates from Mobile@Work only when their AppConnect-related setting changes on Core.
The delivery strategy has no impact on AppConnect apps themselves. The apps do not need to be rebuilt
or rewrapped.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 546

Performance impact

Related topicsl“Data encryption for secure apps” in The AppConnect and AppTunnel Guide.

l“App check-in and Mobile@Work” in The AppConnect and AppTunnel Guide.

l“Viewing certificates stored in Mobile@Work” in The AppConnect and AppTunnel Guide.

Performance impact
When a device uses Mobile@Work 9.5 for iOS, the generation and delivery strategy of certificates to a device
improves performance on Core and on the device.
The Core performance improvements are:lll

When multiple AppConnect apps’ AppConnect-related settings use the same certificate enrollment
setting, Core generates and delivers the certificate to the device only once.
With prior versions of Mobile@Work, Core generates and delivers a separate certificate for each
AppConnect app.
When you modify an AppConnect-related setting field that does not involve the certificate:oCore does not regenerate the certificate.

oWith prior versions of Mobile@Work, Core regenerated the certificate unless you had selected Storekeys on Core on the certificate enrollment setting.

oCore does not re-deliver the certificate to the device.

oWith prior versions of Mobile@Work, Core redelivered the certificate.

These improvements are especially significant when Core has many registered devices, each with many
AppConnect apps.
The device user experiences improved launch time when launching an AppConnect app other than the first
AppConnect app. The improvement is because:ll

The app does not have to wait for Core to deliver the certificate.
The app does not have to wait for Core to generate the certificate when non-certificate fields havechanged.

Related topics
Certificate generation time

Configuring Blue Coat Mobile Device Security service
integration
MobileIron Core supports integration with the Blue Coat Mobile Device Security (MDS) service. This integration
allows you to manage your iOS devices’ traffic to the Internet, by directing all the traffic to the Blue Coat MDS

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 547

Overview of how to set up Core integration with the Blue Coat MDS service

service first. The service can then, for example, stop access to specific web sites based on corporate security
rules that you set up on a Blue Coat site. The Blue Coat MDS service also provides traffic analytics. This
integration is supported only with iOS devices.

Overview of how to set up Core integration with the Blue Coat MDS service
To set up MobileIron Core to integrate with Blue Coat MDS, do the following high-level steps:
1. Work with Blue Coat to set up MobileIron as your Unified Endpoint Management (UEM) vendor on the Blue
Coat MDS service.
2. Get a Blue Coat customer ID from Blue Coat.
3. Get the certificate that MobileIron Core uses to authenticate to the Blue Coat MDS service so that Corecan interact with the service. An example of such an interaction is when Core informs the MDS service
about what iOS devices are registered.
4. Set up a Blue Coat certificate enrollment setting.
5. This setting contains the information necessary for Core to request the Blue Coat MDS service for an
identity certificate for a device. This certificate authenticates the device to the Blue Coat MDS service
when the device’s traffic is directed to the MDS service.
6. For details, see Configuring the Blue Coat certificate enrollment setting.
7. Set up a IPsec (Blue Coat) VPN setting on Core.
8. This always-on VPN is how all device traffic is always directed first to the Blue Coat MDS service.
9. For details, see Configuring the IPsec (Blue Coat) VPN setting.

Limitations when integrating with the Blue Coat MDS service
Because all device traffic is directed to the Blue Coat MDS service using an always-on VPN:l

You cannot use any other VPNs on the device.

l

You cannot use MobileIron Tunnel (AppTunnel with TCP tunneling) on the device because it uses a VPN.

NOTE: Using AppTunnel with HTTP/S tunneling with AppConnect apps on the device is compatible withusing the Blue Coat MDS service.

Configuring the Blue Coat certificate enrollment setting
Before you begin:l

Set up MobileIron as your Unified Endpoint Management (UEM) vendor on the Blue Coat MDS service.

l

Get your Blue Coat customer ID.

l

Get the certificate and certificate password that MobileIron uses to authenticate to the Blue Coat MDS
service.

To specify the Blue Coat certificate enrollment settings:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 548

Configuring the Blue Coat certificate enrollment setting

1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment > Blue
Coat.
2. In the New Blue Coat Certificate Enrollment Setting dialog box, use the following guidelines to specify thesettings.
Item

Description

Name

Enter brief text that identifies this certificate enrollment setting.

Description

Enter additional text that clarifies the purpose of this certificate
enrollment setting.

Store keys on Core

Specifies whether MobileIron Core stores the private key sent to eachdevice. When storing keys is enabled, private keys are encrypted andstored on the local Core.
If you select this option after devices have been provisioned, certificateswill be re-provisioned for all impacted devices.

Blue Coat Customer
ID / MDM Identifier
API URL

Specifies your Blue Coat customer ID. The customer ID is also known toBlue Coat as the MDM Identifier.
Specifies the URL that MobileIron Core uses to interact with the Blue
Coat MDS service. This field is set to:https://mobility.threatpulse.com:9443
Typically, you do not change this field unless you are working with Blue
Coat in a special test environment.

Certificate 1

Upload the certificate that MobileIron uses to authenticate to the Blue
Coat MDS service. This certificate is available from MobileIron.

Password 1 (Optional)

Enter the password for the certificate. This password is available from
MobileIron.
Note: Although you can click Add Certificate to add additional
certificates and their corresponding passwords, no reason currently
exists to do so.

Device Name

Optionally enter a MobileIron Core substitution variable that identifies thedevice. This device name is used by the Blue Coat MDS service.
The device name allows you to differentiate multiple devices belonging to
one use on Blue Coat MDS reports.

User IDEnter the email address for the user. Blue Coat requires that the User ID
is the user’s email address.
Typically, you use the MobileIron Core substitution variable $EMAIL$.

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. The Issue Test Certificate dialog box opens.
Note: Although this step is optional, it is recommended. A real certificate is not generated.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 549

Configuring the IPsec (Blue Coat) VPN setting

4. Enter a user’s email address that Blue Coat can validate.
5. Click OK.
6. Click Save.
Note: If values that you enter in fields result in errors, you cannot save the configuration. If values that you
enter result in warnings, you can save the configuration after confirming the warning messages. To see
configuration errors, go to Services > Overview.

Configuring the IPsec (Blue Coat) VPN setting
Before you begin: Configure the Blue Coat certificate enrollment setting.
To specify the IPsec (Blue Coat) VPN setting:
1. Go to Policies & Configs > Configurations and click Add New > VPN.
2. Use the following guidelines to specify the settings.
Item

Description

Name

Enter brief text that identifies this VPN setting.

Description

Enter additional text that clarifies the purpose of this VPN setting.

Connection Type

Select IPsec (Blue Coat).

Identity Certificate

Select a Blue Coat certificate enrollment setting from the drop-down list.

3. Click Save.
4. Select the VPN setting that you just created.
5. Select Actions > Apply To Label.
6. Select the appropriate labels.
7. Click Apply.

Revoking the certificate
You can revoke a Blue Coat certificate.
Revoking a certificate adds the certificate to the CRL (Certificate Revocation List). The certificate is also removed
from the Blue Coat service. When a device authenticates with MobileIron Core, the system first checks the CRL toverify that the certificate is not on the list. If the certificate is on the list, authentication fails.
To revoke a certificate:
1. Navigate to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Select Actions > Revoke.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 550

Configuring a client-provided certificate enrollment setting

Configuring a client-provided certificate enrollment settingThis section covers client-provided certificate enrollment settings.
Client-provided certificate enrollment settings are applicable only to iOS and Android devices.

Overview of client-provided certificate enrollment settings
Derived credentials are identity certificates derived from the certificates on a smart card. The derived credentials
are stored on the device in Mobile@Work on iOS devices, and in Secure Apps Manager on Android devices.
AppConnect apps on mobile devices can use derived credentials for these purposes:lauthentication to backend servers, such as email servers, web servers, or app serversldigital signinglencryptionldecryption of older emails for which the original encryption certificate has expired (iOS only)lauthenticating the user to Standalone Sentry when using AppTunnel with Kerberos authentication to thebackend server

You create a client-provided certificate enrollment setting when you want an AppConnect app to use derived
credentials for one of these purposes. You then refer to the client-provided certificate enrollment in the appropriate
setting.
NOTE: The certificate enrollment setting is called client-provided because Mobile@Work for iOS or
Secure Apps Manager for Android, known as client apps, provide the identity certificate to the
AppConnect app.
Only the following settings can refer to a client-provided certificate enrollment setting:l

AppConnect app configuration
It can refer to a client-provided certificate enrollment setting in:lo

the value in a key-value pair in its App-specific Configurations sectionothe identity certificate in its AppTunnel Rules section

Web@Work setting
It can refer to a client-provided certificate enrollment setting in:lo

the value in a key-value pair in its Custom Configurations sectionothe identity certificate in its AppTunnel Rules section

Docs@Work setting
It can refer to a client-provided certificate enrollment setting in:othe value in a key-value pair in its Custom Configurations sectionothe identity certificate in its AppTunnel Rules section

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 551

Specifying a client-provided certificate enrollment setting

Make sure the version of Mobile@Work for iOS or the Secure Apps Manager for Android on the device supports
client-provided certificate enrollment settings as shown in the following table:
Reference to theclient-provided
certificate
enrollment
setting

iOS:

iOS:

iOS:

Android:

Mobile@Workprior to 8.5

Mobile@Work
8.5 and 8.6

Mobile@Work 9.0
through the mostrecently released
version as
supported by
MobileIron

All versions ofSecure Apps
Manager supported
or compatible with
MobileIron Core

In key-value pairs

Not supported

Supported

Supported

Supported

In AppTunnel
rules

Not supported

Not supported

Supported

Not supported

Related topicslMobileIron Core Derived Credentials Guidel

MobileIron PIV-D Manager App for iOS Release Notesl

MobileIron PIV-D Entrust App for Android Release Notes

Specifying a client-provided certificate enrollment setting
To specify a client-provided certificate enrollment setting:
1. Go to Policies & Configs > Configurations.
2. Select Add New > Certificate Enrollment > Client-Provided.
3. In the New Client-Provided Certificate Enrollment Setting dialog box, use the following guidelines tospecify your settings.
Item

Description

Name

Enter brief text that identifies this certificate enrollment
setting.

Description

Enter additional text that clarifies the purpose of thiscertificate enrollment setting.

Select purpose

Select one of the following, depending on the intended
use of the client-provided identity certificate:• Authentication• Decryption• Encryption• Signing

ProviderSelect the derived credential provider.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 552

Configuring an Entrust CA

4. Click Save.

Configuring an Entrust CA
MobileIron Core supports integration with the Entrust Administration Services (EAS). This integration allows
MobileIron Core to work with Entrust to obtain certificates directly from the CA. This type of interaction is called
centralized mode. Alternatively, Core can work with Entrust to enable mobile devices with native SCEP clients toobtain certificates from the Entrust CA. This interaction is called decentralized mode.
Entrust Prerequisites
The information in this section assumes the following:l

You have the URL for your Entrust server (received from Entrust).

l

You have the Admin ID and password.

Entrust decentralized mode
Entrust decentralized mode allows iOS devices to communicate directly with Entrust by embedding the SCEP
challenge string in the MDM configuration. Managed devices generate PKI key pairs and CSRs, obtaining
certificates directly from Entrust CA without going through MobileIron Core as a proxy. In this way, using
decentralized mode improves security in that the private key never leaves the device.
When implementing decentralized mode, confirm the managed device:lhas a native SCEP clientlcan work with the encryption algorithm and key lengths supported by Entrustlaccepts the CSR signature algorithm used by Entrust, if the selected algorithm is overridden

The mobile device will notify the device user when the Entrust certificate has been installed successfully.
Additionally, the device reports the retrieved certificate to MobileIron Core as part of the standard device certificate
inventory report. You can view the certificate data by going to Devices & Users > Devices, clicking the carat (^)
symbol next to the device, and clicking the Logs tab. You can also view the certificate by going to Logs >Certificate Management, and clicking the View link under the Content column next to the relevant device.
Note The Following:llCurrently, iOS only supports the RSA key type with key lengths of 1024 and 2048.
If you configure multiple app settings (such as email, VPN, and Wi-Fi) to consume the same decentralized
Entrust certificate enrollment setting, and apply a label to the app settings all at once, then Entrust fails toreturn the certificate to the devices with that label. Instead, configure each certificate enrollment consumer
to reference different Entrust certificate enrollment settings, which themselves reference different
certificate profiles.

Procedure

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 553

Configuring an Entrust CA

1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment > Entrust.
2. Use the following guidelines to specify the settings.
lName: Enter brief text that identifies this group of settings.

lDescription: Enter additional text that clarifies the purpose of this group.

l

API URL: Enter the URL for your Entrust server (received from Entrust).

l

Admin ID: The credentials to log into the Entrust server.

lAdmin Password: Enter the Admin Password.

lGroup: The Entrust group associated with users. Custom attribute variable substitutions aresupported.
NOTE: If the profile you selected contains an iggroup variable, then the you must configure
the same value here as welll

Key Usage: Use these options to filter out the certificates returned by Entrust, which may return
multiple certificates with different uses depending on the selected profile.
NOTE: When multiple certificates are returned by a DigitalID profile, the first one thatmatches the selected key usage flags is used. If none of the returned certificatesmatch the selected key usage flags, an error is raised. Use the Issue Test Certificate
feature to ensure the expected certificate is selected.

lProfile: Use these options to filter out the certificates returned by Entrust, which may return multiple
certificates with different uses depending on the selected profile.
Select a profile template from Entrust. Once you select this profile, more options (required and optionalvariables) are available to you based on the profile you select. Entrust refers to profiles as DigitalIDs.
If using decentralized mode, select a profile that supports decentralized mode.

lProfile Description: Pre-populated based on the profile you select.

lApplication Description: Pre-populated based on the profile you select.

lCentralized: Select to allow MobileIron Core to retrieve certificates on behalf of devices.
Decentralized: Select to let managed devices retrieve their own certificates.

lThis feature is supported on iOS devices only.
Store keys on Core: Specifies whether MobileIron Core stores the private key sent to each device.
When storing keys is enabled, private keys are encrypted and stored on the local Core.
o

If you select this option after devices have been provisioned, certificates will be re-provisioned for
all impacted devices.

olThis option is disabled when selecting Decentralized mode.

User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.
This option is disabled when selecting Decentralized mode.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 554

Revoking the certificatelDevice Certificate: Specifies that the certificate is bound to the given device.

l

Entrust SCEP CA:o

URL: Enter the URL of the Entrust SCEP CA.

o

Key Type: Select RSA.

o

Key Length: Select 1024 or 2048.

l

Subject Alternative Names table: Select a type and value. At run-time, these variables are resolved
into user values. (See Certificate Enrollment settings for more information.) Custom attribute variable
substitutions are supported.

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values thatyou enter result in warnings, you can save the configuration after confirming the warning
messages. To see configuration errors, go to Services > Overview.

Revoking the certificate
You can revoke an Entrust API Version 9 certificate.
Revoking a certificate adds the certificate to the CRL (Certificate Revocation List). The certificate is also removed
from the Entrust manager. When a device authenticates with MobileIron Core, the system first checks the CRL toverify that the certificate is not on the list. If the certificate is on the list, authentication fails.
To revoke a certificate:
1. Navigate to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Select Actions > Revoke.

Configuring a GlobalSign CA
MobileIron Core supports integration with GlobalSign as a certificate authority (CA) for certificate enrollment. This
integration enables GlobalSign to perform the proxy tasks that would normally be performed by Core, allowing thedevice to obtain certificates from the GlobalSign CA.

GlobalSign Prerequisites
The information in this section assumes that you have set up the following information with GlobalSign:l

A user name and password for MobileIron Core to use to access the GlobalSign serverlGlobalSign profiles

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 555

GlobalSign PrerequisitesllWhether you want the generated certificates to have the enhanced key usage extension Encrypting File
System (EFS)
Whether you want the generated certificates to be the GlobalSign type “personal” or “department”

To specify GlobalSign settings:
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment >GlobalSign.
2. Use the following guidelines to specify the settings.
lName: Enter brief text that identifies this certificate enrollment setting.

lDescription: Enter additional text that clarifies the purpose of this certificate enrollment setting.

lStore keys on Core: Specifies whether MobileIron Core stores the private key sent to each device.
When storing keys is enabled, private keys are encrypted and stored on the local Core.
If you select this option after devices have been provisioned, certificates will be re-provisioned for all
impacted devices.

l

User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.

l

Device Certificate: Specifies that the certificate is bound to the given device.

l

URL: Enter the URL for the GlobalSign server. This field defaults to:https://system.globalsign.com/cr/ws/GasOrderService
Typically, you only change this if you are working with a GlobalSign test environment.

l

l

l

User Name: The user name for MobileIron Core to use to access the GlobalSign server. Custom
device and user attributes variable names are supported.
Password: Enter the password then re-enter to confirm. Custom device and user attributes variablenames are supported.
Profile: Click Refresh to populate the drop-down list of profiles from GlobalSign. Then, select a
profile.
NOTE: You must enter a valid User Name and Password before clicking Refresh.

lProfile Description: Pre-populated based on the profile you select.

lApplication Description: Pre-populated based on the profile you select.

l

Product Code: Select either EPKIPSPersonal or EPKIPSDept, depending on whether you want thegenerated certificates to be the GlobalSign type “personal” or “department”.

lCertificate Expiration: Specify when the generated certificate will expire.

l

EFS option: Select this setting if you want the generated certificate to have the enhanced key usage
extension Encrypting File System (EFS).
Selecting this setting has no impact if the selected profile has disabled EFS.

lCommon Name: Specify the Common Name to use in the generated certificate.

l

Organization Unit: Specify the Organization Unit to use in the generated certificate.

l

E-Mail: Specify the email address to use in the generated certificate.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 556

Revoking the certificatelSubject Alternative Names Value: Enter a type and value. At run-time, these variables are resolved
into user values. Add multiple SAN entries with corresponding values. Click Add+, select the SAN
type (NT Principal Name) from the drop-down list, then select one of the available values. (SeeSupported variables for certificate enrollment for more information.)

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values thatyou enter result in warnings, you can save the configuration after confirming the warning
messages. To see configuration errors, go to Services > Overview.

Revoking the certificate
You can revoke a GlobalSign certificate.
Revoking a certificate adds the certificate to the CRL (Certificate Revocation List). The certificate is also removed
from the GlobalSign server. When a device authenticates with MobileIron Core, the system first checks the CRL toverify that the certificate is not on the list. If the certificate is on the list, authentication fails.
To revoke a certificate:
1. Navigate to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Select Actions > Revoke.

Configuring MobileIron Core as the CA
This section describes how to configure MobileIron Core as the CA.
To specify local settings:
1. Go to Policies & Configs > Configurations.
2. Click Add New > Certificate Enrollment > Local.
3. Use the following guidelines to specify the settings.
lName: Enter brief text that identifies this group of settings. Example: Local Certificate Settings for WiFil

Description: Enter additional text that clarifies the purpose of this group of settings.

lStore keys on Core: Specifies whether MobileIron Core stores the private key sent to each device.
When storing key is enabled, private keys are encrypted and stored on the local Core.
If you select this option after devices have been provisioned, certificates will be re-provisioned for all
impacted devices.
Select this option for certificates used for email on devices with multi-user sign-in.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 557

Revoking the certificatel

User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.
Select this option for certificates used for email on devices with multi-user sign-in.

lDevice Certificate: Specifies that the certificate is bound to the given device.

l

Local CAs: Select the name of the self-signed certificate you generated.

l

Key Type: Specifies the key exchange algorithm used (typically RSA or elliptic curve).

lSubject: Enter an X.509 name represented as an array of OIDs and values.
See Supported variables for certificate enrollment for more information.

l

Subject Common Name Type: Select the CN type specified in the certificate template. If you enter
the $USER_DN$ variable in the Subject field, select None from the drop-down list.

l

Key Usage: Specify acceptable use of the key (signing and/or encryption).

l

Key Length: Select a Key Length.
The values are 1024, 1536, 2048 (the default), 3072, and 4096.

l

CSR Signature Algorithm: Select the signature algorithm.
The values are SHA1, SHA256, SHA384 (default), and SHA512.

l

Subject Alternative Names table: Enter a type and value. At run-time these variables are resolved
into user values.
See Supported variables for certificate enrollment for more information.

4. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
5. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values thatyou enter result in warnings, you can save the configuration after confirming the warning
messages. To see configuration errors, go to Services > Overview.

Revoking the certificate
You can revoke a local certificate.
Revoking a certificate adds the certificate to the CRL (Certificate Revocation List). When a device authenticateswith MobileIron Core, the system first checks the CRL to verify that the certificate is not on the list. If the certificate
is on the list, authentication fails.
To revoke a certificate:
1. Navigate to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Click Actions > Revoke.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 558

Configuring OpenTrust CA

Configuring OpenTrust CA
MobileIron Core supports integration with the OpenTrust Mobile Provisioning Server (MPS). This integration
enables OpenTrust to perform the proxy tasks that would normally be performed by Core. The following describes
the configuration in Core.
Note The Following: Compatibility notesllThis integration does not support the pushing Certificate Authorities Bundles to devices, which is offeredby OpenTrust.
MobileIron Core supports one certificate per OpenTrust configuration. OpenTrust supports creating profiles
having multiple credentials (called application in the OpenTrust context).

Before you begin
The information in this section assumes the following:ll

You have the URL for your OpenTrust cloud instance.
You have the client-side JSON connector identity certificate MobileIron Core will use to authenticate to the
MPS.

l

You have implemented a centralized OpenTrust cloud.

l

You have created a Mobile Management Profile on MPS containing a single centralized credential.

Procedure
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment >OpenTrust.
2. Use the following guidelines to specify the settings:
NOTE: Although optional fields are not required by OpenTrust, they are still used if present.
Therefore, you must still specify the appropriate variable for each optional field. For
example, the phone number might be an optional field because the tablets in yourorganization do not have phone numbers. However MPS might still use this information torequest a certificate from the PKI server if it is present.
lName: Enter brief text that identifies this group of settings.

lDescription: Enter additional text that clarifies the purpose of this group.

l

l

l

Store keys on Core: Specifies whether MobileIron Core stores the private key sent to each device.
When storing key is enabled, private keys are encrypted and stored on the local Core.
If you select this option after devices have been provisioned, certificates will be re-provisioned for all
impacted devices
User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.

l

Device Certificate: Specifies that the certificate is bound to the given device.

l

API URL: Enter the URL for the OpenTrust server.

lCertificate 1: This is the name of the uploaded certificate.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 559

Revoking the certificatelPassword 1 (Optional): This password is optional.

l

Add Certificate: Click this link to add one or more certificates, as necessary.

l

l

l

Profile: This is the MPS Mobile Profile to use for the integration. If you do not see an expected profile,then it most likely contains multiple credentials, a configuration that MobileIron Core does not currently
support.
Profile Description: This is pre-populated based on the profile you select.
Application Description: This is populated automatically with the corresponding OpenTrust content
associated with the selected profile.

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values thatyou enter result in warnings, you can save the configuration after confirming the warning
messages. To see configuration errors, go to Services > Overview.

Revoking the certificate
You can revoke a OpenTrust certificate.
Revoking a certificate adds the certificate to the CRL (Certificate Revocation List). The certificate is also removed
from the OpenTrust manager. When a device authenticates with MobileIron Core, the system first checks the CRL
to verify that the certificate is not on the list. If the certificate is on the list, authentication fails.
Procedure
1. Navigate to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Click Actions > Revoke.

Configuring a single file identity certificate enrollment setting
Use a single file identity certificate enrollment setting to upload an identity certificate to MobileIron Core for
distribution to devices. A typical use case for a single file identity certificate is using the certificate to authenticate
devices to a network server, such as:llStandalone Sentry
When device authentication on Standalone Sentry is configured as Group Certificate, you typically
distribute the same identity certificate to multiple devices.
a Wi-Fi network component
When you configure a Wi-Fi setting to use TLS or TTLS for its EAP type, you can distribute the same
identity certificate to multiple devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 560

Configuring a single file identity certificate enrollment settingla VPN network component
When you configure a VPN setting, depending on the type of VPN setting, you can use certificate-based
authentication. For the authentication, you can distribute the same identity certificate to multiple devices.

You can upload either:lll

An identity certificate.
The certificate is a PKCS 12 certificate which contains exactly one private key. It is a .p12 or .pfx file. The
file can optionally include the certificate chain. The certificate chain can include only intermediate
certificates, or intermediate certificates through the root certificate. The root certificate is not necessary if it
is from a well known certificate authority.
You also provide the password for the identity certificate’s private key.
Multiple files, which include among them:othe private key and its password.

othe public certificate.

othe supporting certificates in the certificate chain. The root certificate is not necessary if it is from awell known certificate authority.

Examples of combinations you can upload are:oa .p12 or .pfx file containing a an identity certificate and its private key and password, plus additional.pem files containing the intermediate certificates.

oa .pem file containing the private key and password, a .pem file containing the public certificate, plus
additional .pen files containing the intermediate certificates.

Procedure
1. Log in to the Admin Portal.
2. Go to Policies & Configs > Configurations
3. Click Add New > Certificate Enrollment > Single File Identity.
4. Fill in the entries:lName: Enter brief text that identifies certificate enrollment setting.

lDescription: Enter additional text that clarifies the purpose of this certificate enrollment setting.

lCertificate 1: Click Browse to select the .p12 or .pfx file of the identity certificate, if you are uploading
only one file.

l

If you are uploading multiple files, select the file (.p12, .pfx, or .pem) that contains the private key.

l

Password 1: Enter the password for the certificate’s private key.

5. If you are uploading multiple files, click Add Certificate to add another file.
6. Fill in the entries:llCertificate 2: Click Browse to select the .pem file to upload to MobileIron Core. The certificate mustbe formatted as binary DER or ASCII PEM.
Password 2: The Password field is applicable only for the file that contains the private key.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 561

Configuring SCEP

7. Optionally, click Add Certificate to add another file.
8. Click Save.
After you save the single file identity certificate enrollment setting, you can view or change the certificate by editing
the setting.

Configuring SCEPThis section describes how to specify settings that allow the device to obtain certificates from a certificate
authority (CA) using Simple Certificate Enrollment Protocol (SCEP).
To specify the SCEP settings:
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment > SCEP.
2. Use the following guidelines to specify the settings:lName: Enter brief text that identifies this group of settings.

lDescription: Enter additional text that clarifies the purpose of this group.

lCentralized: MobileIron Core retrieves certificates on behalf of devices. Core also manages thecertificate lifetime and triggers renewals. See “SCEP proxy functions”.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.

lDecentralized: Devices retrieve their own certificates.
Use this feature if using the SCEP setting for mutual authentication. It is not supported for any otheruse cases with AndroidiOS and macOS devices. See Enabling mutual authentication for Apple andAndroid devices.
This feature is not available for iOS or macOS devices.

lStore keys on Core:
Specifies whether MobileIron Core stores the private key sent to each device. When storing key isenabled, private keys are encrypted and stored on the local Core.
If you select this option after devices have been provisioned, certificates will be re-provisioned for all
impacted devices.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.

lProxy requests through Core:
This feature is not available for iOS devices.
This feature is not available for MAC devices.
When this option is enabled, Core acts as a reverse proxy between devices and the target certificate
authority. This option is only available when Decentralized is selected.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 562

Configuring SCEPl

User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.

lDevice Certificate: Specifies that the certificate is bound to the given device.

l

URL: Enter the URL for the SCEP server.

l

CA-Identifier: (Optional) Enter the name of the profile for SCEP servers that support named-profiles.

l

Subject: Enter an X.509 name represented as a comma-separated array of OIDs and values.
Typically, the subject is set to the user’s fully qualified domain name. For example,
C=US,DC=com,DC=MobileIron,OU=InfoTech or
CN=www.mobileiron.com.
You can also customize the Subject by appending a variable to the OID. For example,
CN=www.mobileiron.com-$DEVICE_CLIENT_ID$.
For ease of configuration you can also use the $USER_DN$ variable to populate the Subject with theuser’s FQDN.

l

Subject Common Name Type: Select the CN type specified in the certificate template. If you enter
the $USER_DN$ variable in the Subject field, select None from the drop-down list.

l

Key Usage: Specify acceptable use of the key by signing.

lEncryption: Specify acceptable use of the key by encryption.

l

Key Type: Specify the key type.

l

Key Length: The values are 1024, 1536, 2048 (the default), 3072, and 4096.

l

CSR Signature Algorithm: The values are SHA1, SHA256, SHA384 (default), and SHA512.

l

Finger Print: The finger print of the CA issuing the root certificate.

llChallenge Type: Select None, Microsoft SCEP, or Manual to specify the type of challenge touse. The Challenge Type will depend on what the NDES server is configured to use.
Challenge URL: For a Microsoft SCEP challenge type, enter the URL of the trustpoint defined foryour Microsoft CA.

lUser Name: Enter the user name for the Microsoft SCEP CA.

l

Password: Enter the password for the Microsoft SCEP CA.

lSubject Alternative Names Type: Select NT Principal Name, RFC 822 Name, or None, based on
the attributes of the certificate template. You can enter four alternative name types.
NOTE: If this SCEP setting is for authenticating the device to the Standalone Sentry using an
identity certificate: select NT Principal Name and select Distinguished Name for asecond Subject Alternative NamelSubject Alternative Names Value: Select the Subject Alternate Name Value from the drop-down listof supported variables. You can also enter custom variables in addition to and instead of the supported
variables.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 563

X.509 Codes

NOTE: If this SCEP setting is for authenticating the device to the Standalone Sentry using an
identity certificate: enter $USER_UPN$ for the value corresponding to NT Principal
Name and enter $USER_DN$ for the value corresponding to Distinguished Name.
3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
You cannot make changes to the saved SCEP settings. When you open a saved SCEP setting, the Save
button is disabled.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values
that you enter result in warnings, you can save the configuration after confirming thewarning messages. To see configuration errors, go to Services > Overview.

X.509 Codes
The Subject field uses an X.509 distinguished name. You can use one or more X.509 codes, separated bycommas. This table describes the valid X.509 codes:

TABLE 93. X.509 CODES
Code

Name

Type

Max Size

ExampleC

Country/Region

ASCII

2

C=US

DC

Domain Component

ASCII

255

DC=company, DC=com

S

State or Province

Unicode128

S=California

L

Locality

Unicode128

L=Mountain View

O

Organization

Unicode64

O=Company Name, Inc.

OU

Organizational Unit

Unicode64

OU=Support

CN

Common NameUnicode64

CN=www.company.com

NOTE: If the SCEP entry is not valid, then you will be prompted to correct it; partial and invalid entries
cannot be saved.

SCEP proxy functions
Choosing to enable SCEP proxy functions has the following benefits:lA single certificate verifies Exchange ActiveSync, Wi-Fi, and VPN configurationsl

There is no need to expose a SCEP listener to the Internet.

l

MobileIron can detect and address revoked and expired certificates.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 564

Configuring Symantec Managed PKI

Configuring Symantec Managed PKI
Symantec Managed PKI support enables you to configure certificate-based authentication. Symantec Managed
PKI is a source for certificates that you can reference in a variety of configurations, such as for Exchange, VPN,
and AppConnect.

PrerequisiteslA valid Symantec Verisign Managed PKI account is required.

l(Optional) Get finger print from issuing CA for root certificate.

l

One or more client certificate and password from CA.

Procedure
To specify the Symantec Managed PKI settings:
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment > Symantec
Managed PKI.
2. Use the following guidelines to specify the settings:lName: Enter brief text that identifies this group of settings.

lDescription: Enter additional text that clarifies the purpose of this group.

lCentralized: MobileIron Core retrieves certificates on behalf of devices. Core also manages thecertificate lifetime and triggers renewals. See “Using a proxy”.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.

lDecentralized: Devices retrieve their own certificates.

oThis feature is not available for iOS devices.

oThis feature is not available for MAC devices.

lStore keys on Core: Specifies whether MobileIron Core stores the private key sent to each device.
When storing key is enabled, private keys are encrypted and stored on the local Core.
If you select this option after devices have been provisioned, certificates will be re-provisioned for all
impacted devices.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.

lProxy requests through Core:oThis feature is not available for iOS devices.

oThis feature is not available for MAC devices.

o

When this option is enabled, Core acts as a reverse proxy between devices and the target certificate
authority. This option is only available when Decentralized is selected.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 565

Using a proxyl

User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.

l

URL Mode: Specifies the mode and the corresponding URL supplied by Symantec.

l

CA-Identifier: Required information supplied by Symantec.

l

Subject: See Supported variables for certificate enrollment for more information.

l

Subject Common Name Type: Select the CN type specified in the certificate template. If you enter
the $USER_DN$ variable in the Subject field, select None from the drop-down list.

l

Key Usage: Use these options to indicate which key usage to request from the CA.

l

Key Type: This is the Key Exchange algorithm: RSA or Elliptic Curve.

l

Key Size: The values are 1024, 1536, 2048 (the default), 3072, and 4096.

l

CSR Signature Algorithm: The values are SHA1, SHA256, SHA384 (the default), and SHA512.

l

Finger Print: The finger print of Symantec Managed PKI.

l

Certificate 1: Upload for the client authentication with the server.

lPassword 1: This password is optional.Best used when certificate and password are in separate files.

l

Subject Alternative Names table: Enter a type and value. At run-time these variables are resolved
into user values. (See Supported variables for certificate enrollment for more information.)
NOTE: The Required Fields and Optional Fields for the certificate are displayed based on
how the MDM (Web Service Client) profile was set up in the Symantec PKI manager.

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values
that you enter result in warnings, you can save the configuration after confirming thewarning messages. To see configuration errors, go to Services > Overview.

Using a proxy
Choosing to enable proxy functions has the following benefits:lA single certificate verifies Exchange ActiveSync, Wi-Fi, and VPN configurationsl

There is no need to expose a SCEP listener to the Internet.

l

MobileIron can detect and address revoked and expired certificates.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 566

Configuring Symantec Web Services Managed PKI

Configuring Symantec Web Services Managed PKI
Integration with Symantec Web Services Managed PKI version 8.x enables you to configure certificate-based
authentication. The following describes how to configure Symantec Web Managed PKI in MobileIron Core.
Before you beginl

Set up your account for Symantec Web Services Managed PKI with Symantec.

lCreate an MDM (Web Service Client) profile in the Symantec PKI manager that you will use for the
MobileIron integration.
SeatID
Be sure to include the Symantec SeatID as a required certificate profile field. In a Symantec Web Services
Managed PKI environment, Symantec uses the SeatID to track the number of seats for billing purposes.
To correctly track the number of seats, the SeatID value in the MobileIron Core SCEP settings must map
to the value you created for the SeatID in the Symantec PKI Manager. For example, if the user's email
address is used as the SeatID in Symantec PKI Manager, the Core SCEP settings should map the Coreemail address attribute to the Symantec SeatID.
Core associates each issued Symantec certificate to a SeatID in the Symantec PKI Manager. If the
SeatID does not exist, a new Symantec user account and SeatID is automatically created for the user at
the time the certificate is requested.

lGather the following items:oThe server address for the Symantec Web Services Managed PKI.
On MobileIron Core the default is set to pki-ws.symauth.com.

o

The Registration Authority (RA) certificate MobileIron Core will use to authenticate to the Symantec
CA.

Procedure
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment > Symantec
Web Managed PKI.
2. Use the following guidelines to specify the settings:
NOTE: The Required Fields and Optional Fields for the certificate are displayed based on how
the MDM (Web Service Client) profile was set up in the Symantec PKI manager.
lName: Enter brief text that identifies this group of settings.

lDescription: Enter additional text that clarifies the purpose of this group.

lStore keys on Core: Specifies whether MobileIron Core stores the private key sent to each device. If
you are using a Symantec profile that is set up to store keys on the Symantec server, you typically do
not select this option.
NOTE: If you select this option after devices have been provisioned, certificates will be reprovisioned for all impacted devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 567

Revoking the certificatel

User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.
The certificate is revoked when the user is removed from Core.

l

Device Certificate: Specifies that the certificate is bound to the given device. Make sure theSymantec certificates are unique for each device.
The certificate is revoked when the device is retired from Core.

a. API URL: Enter the server address for the Symantec Web Services Managed PKI (received from
Symantec).
The default is set to pki-ws.symauth.com.
NOTE: Do not add https:// before the server name, and do not add path information after
the server name.
Only the hostname of the Symantec CA server should be provided.
l

l

l

l

Certificate 1: Navigate and select the RA certificate you received from Symantec. This is usuallya.p12 file. Enter the password for the certificate when prompted.
Password 1: (Optional if certificate and password are stored in the same file.) Enter the password forthe certificate.
Add Certificate: Click this link to add one or more certificates, as necessary.
Profile: This is the profile to be used for the integration. If you do not see an expected profile, then it
most likely contains multiple credentials, a configuration that MobileIron Core does not currently
support.

lProfile Description: This is pre-populated based on the profile you select.

lApplication Description: This is populated automatically based on the selected profile.

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values
that you enter result in warnings, you can save the configuration after confirming thewarning messages. To see configuration errors, go to Services > Overview.

Revoking the certificate
You can revoke a Symantec Web Services Managed PKI certificate.
Revoking a certificate adds the certificate to the CRL (Certificate Revocation List). The certificate is also removed
from the Symantec Web Services Managed PKI manager. When a device authenticates with MobileIron Core, thesystem first checks the CRL to verify that the certificate is not on the list. If the certificate is on the list,
authentication fails.
To revoke a certificate:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 568

Configuring a user-provided certificate enrollment setting

1. Navigate to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Click Actions > Revoke.

Configuring a user-provided certificate enrollment setting
One user-provided certificate enrollment setting for each purpose
Configure a user-provided certificate enrollment setting for every purpose for which users can upload a certificate(PKCS 12 file) in the user portal. For example, consider a case in which users have three different purposes forproviding certificates: S/MIME signing, S/MIME encryption, and authenticating to a backend server. In this case,
you create three user-provided certificate enrollment settings.
You provide a display name for each user-provided certificate enrollment setting. The display name you choose isimportant because the device user sees it in two places:
l

l

l

l

in the user portal when deciding what certificate to upload
In the user portal, the display name is called “configuration”. The user’s selection associates the uploaded
certificate with a user-provided certificate enrollment setting. The user can upload the same certificate, ordifferent certificates, for each display name.
in Mobile@Work for iOS, when Mobile@Work for iOS prompts the user for the private key password.
Mobile@Work prompts for the password if a password was not required when the user uploaded thecertificate to the user portal. Mobile@Work uses the display name to inform the user about which
certificate to provide the password for. For details, see The private key password.

Note The Following:
l

l

l

l

The PKCS 12 file must contain the certificate and one private key. MobileIron Core does not support
PKCS 12 files with more than one private key.
A web services MobileIron V2 API is also available for uploading user-provided certificates to Core andassociating the certificates with a user-provided certificate enrollment setting.
See the MobileIron V2 API Guide.
The V1 API that uploaded user certificates to MobileIron Core is no longer available. If you used the V1 API
to upload user certificates, Core will continue to use the certificates until either:o

the user uploads a replacement in the user portaloyou use the V2 API to upload a replacement
Note that the V1 API associated the user certificate with a certificate type: All, WIFI, VPN,SMIMESIGNING, SMIMEENCRYPTION, EMAIL or EXCHANGE. Although Core still supports using
these certificates and their associated type, the user portal does not display these certificates in theuser portal.

Core stores the certificate and private key

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 569

Configuring a user-provided certificate enrollment setting

When the user uploads a user-provided certificate in the user portal, the user uploads a PKCS 12 file. Core storesthe file, which includes the certificate and its private key. Core does not remove the PKCS 12 file after delivering itto the user’s device. Therefore, if the user registers another device, the PKCS 12 file is available to deliver to theadditional device.
The private key password
In each user-provided certificate enrollment setting, you specify whether the user is required to provide a password
for the certificate’s private key. When a password is required, users must provide a password when using the user
portal to upload a certificate associated with this certificate enrollment setting.
Important: Always require a password unless both of the following are true:ll

The devices that will use the user-provided certificate are iOS devices running Mobile@Work 9.0 for iOS
through the most recently released version as supported by MobileIron.
The apps that will use the certificate are AppConnect apps.

When you do not require a private key password when the user uploads a certificate, Mobile@Work for iOS and an
AppConnect for iOS app that uses the certificate behave as follows:
1. When the AppConnect app launches, control switches to Mobile@Work for iOS.
2. Mobile@Work prompts the device user for the private key password.
3. The device user enters the password.
NOTE: If the device user exits Mobile@Work without providing the password, when the
AppConnect app next launches, Mobile@Work unauthorizes the app, with the reason
that the app is missing credentials.
4. Control returns to the AppConnect app.
Whether you require a password depends on your security requirements. If a password is required, Core stores the
password along with the PKCS 12 file containing the certificate and private key. However, if your security
environment requires limiting the password’s storage to the device that uses the certificate, then do not require a
password.
When the private key of a user-provided certificate is deleted
The private key of a PKCS 12 file, and password if provided, can be deleted from the Core file system. Whether
you want the private key and password deleted from Core depends on your security requirements.
The following mechanisms are available to delete the private key and password:lA user can delete the private key and password using the user portal.

l

A web services API can delete the private key and password.

l

You can specify in the Admin Portal that Core deletes private keys and passwords older than somenumber of days.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 570

Certificate Transparency Payload

IMPORTANT: When the private key and associated password is deleted, Core retains the publiccertificate and maintains an entry in its certificate table so it can track where thecertificate is used, when it expires and display information about it in the UI. Without theprivate key and associated password, Core is unable to use the identity certificate withany new certificate enrollments, AppConnect configuration and devices. Once theprivate key and associated password is deleted, the user-provided certificate must be
uploaded again before it can be used.
Because the certificate without the private key is still available on Core, you can view information about thecertificate, such as its expiration date. This information can help you manage devices still using the certificate.
Related topicslViewing, replacing, and deleting certificates in the user portallMobileIron V2 API Guide

Specifying the settings for a user-provided certificate enrollment setting
To specify the settings for a user-provided certificate enrollment setting:
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment > UserProvided.
2. Use the following guidelines to specify the settings:lName: Enter brief text that identifies this setting.

lDescription: Enter additional text that clarifies the purpose of this setting.

llDisplay Name: Enter the name that will appear on the user portal where device users upload theircertificates. This name also appears in Mobile@Work if Mobile@Work prompts the device user for acertificate’s private key password.
Require Password: This option requires the user to provide a password for the certificate’s private
key when uploading a certificate associated with this certificate enrollment setting.

lImportant: Always require a password except as described in The private key password.

lDelete Private Keys After Days: Select the number of days after a user-provided certificate is
uploaded to MobileIron Core after which Core deletes the private key and, if provided, its password,from Core.
The default is None, which means Core does not delete the private key and its password.
The default is None, which means Core does not delete the private key and its password.

3. Click Save.

Certificate Transparency Payload
In late 2018, Apple introduced a new Certificate Transparency policy. All certificates issued after October 15, 2018
must meet Apple's requirements to be trusted by Apple products. Aa Certificate Authority should issue a leaf
certificate that meets Apple's Certificate Transparency policy by submitting it to a Certificate Transparency log andMobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 571

Certificate Transparency Payload

including the Signed Certificate Timestamp (SCT) when the certificate is signed, or the SCT must be provided
during TLS handshake.
A Certificate Transparency payload specifies which domains or certificates to bypass Certificate Transparency
enforcement.
This feature is applicable to:l

iOS 12.1.1l

MacOS 10.14.2

ltvOS 12.1.1

Procedure
1. In the Admin portal, go to Policies & Configs > Configs.
2. Click Add New > Apple > iOS/macOS /tvOS > Certificate Transparency. The New Certificate
Transparency Setting dialog box opens.
Item

Description

Name

Enter a name for the certificate transparency
configuration.

Description

Enter a description of the certificate transparency
configuration.

Domains

Clicking the Add+ button adds another field in the
Domains section.
A leading period can be used to match subdomains, but
a domain matching rule must not match all domains
within a top level domain.
For example: .sampledomain.com and.sampledomain.co.uk are allowed while .com and.co.uk are not allowed.

Certificate Hash for Certificates

Clicking the Add+ button adds a drop-down field for you
to select.
ll

Hash Algorithm - string. Must be sha256. Required
field.
Hash - Created by applying the specified hashalgorithm to the DER-encoding of the certificate's
subjectPublicKeyInfo . See Creating thecertificate hash for certificates.

3. Click Save.
The new configuration displays in the Configurations page.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 572

Creating the certificate hash for certificates

Creating the certificate hash for certificates
To generate the data specified by the Hash key in the subjectPublicKeyInfo dictionary, use this
CLI command for a PEM encoded certificate:
openssl x509 -pubkey -in example_certificate.pem -inform pem | openssl pkey -pubin outform der | openssl dgst -sha256 -binary | base64

If your certificate is DER encoded, use this CLI command:
openssl x509 -pubkey -in example_certificate.der -inform der | openssl pkey -pubin outform der | openssl dgst -sha256 -binary | base64

If your certificate does not have a .pem or .der extension, use the CLI file command to identify its encoding
type.
$ file example_certificate.crt
example_certificate.crt: PEM certificate$ file example_certificate.cer
example_certificate.cer: data

For more information, see the Apple Configuration Profile Reference Guide.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 573

18
Configuring iOS and macOS settings andrestrictions
This section addresses settings and restrictions relating to iOS and macOS devices.
l

iOS and macOS settingslExtensible Single Sign-OnlExtensible Single Sign-On Kerberosl

iOS / tvOS settingslmacOS settingsl

iOS and macOS Core settings differences

iOS and macOS settings
The following settings are available:lGeneral settings (iOS and macOS)l

CalDAV settings (iOS and macOS)l

CardDAV settings (iOS and macOS)l

Web Clips settings (iOS and macOS)l

Configuration profile settings (iOS, tvOS, and macOS)l

LDAP settings (iOS and macOS)

General settings (iOS and macOS)
You can configure a general settings configuration that determines when configuration profiles can be removed
from iOS and macOS devices.
NOTE: General settings can be set once; if you want to use this screen to change these settings, thenthe user must manually delete the profile.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > iOS and macOS > General to specify the basic information for interactions
with the iOS and macOS configuration profiles.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 574

CalDAV settings (iOS and macOS)

3. Configure the general settings as described in Table 94. General iOS and macOS settings .
4. Click Save.

TABLE 94. GENERAL IOS AND MACOS SETTINGS
Item

Description

Name

Enter brief text that identifies this group of iOS and macOS general
settings.

Description

Enter additional text that clarifies the purpose of this group of iOS andmacOS general settings.

Identifier

Specify the profile identifier. It must uniquely identify this profile. Use theformatcom.companyname.identifier
where identifier describes the profile, as in com.mycompany.work.

Organization

Specify the issuing organization of the profile, as it will be shown to theuser.

Control when the profile
can be removed

Not for iOS with MDM: Specify when configuration profiles should be
removed:Always: always removable.
With Authentication: removable with authentication.
Never: never removable. Select this option to prevent users fromremoving the profile.

CalDAV settings (iOS and macOS)
CalDAV configurations allow you to specify parameters for connecting to CalDAV-compliant calendar servers.
CalDAV (or Calendaring Extensions to WebDAV), is a remote calendar access standard supported by iOS andmacOS.
NOTE: Users may be prompted for any settings you do not specify.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > iOS and macOS > CalDAV.
3. Specify parameters for connecting to CalDAV-compliant calendar servers, as described in Table 95.
CalDAV settings (iOS and macOS) .
4. Click Save.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 575

Supported Variables for CalDAV Settings

TABLE 95. CALDAV SETTINGS (IOS AND MACOS)
Item

Description

Name

Enter brief text that identifies this group of iOS and macOS CalDAV
settings.

Description

Enter additional text that clarifies the purpose of this group of iOS andmacOS general settings.

HostNameEnter the host name of the calendar server.

Port

Enter the port for the calendar server.

Principal URL

Enter the URL for accessing calendar services.

Use SSL

Select to use SSL for data transfer.

Use Google Apps
Password

Select to use the Google Apps password. For more information about
configuring the Google Apps password, see [].

User Name

Specify the user name to use. The default value is $USERID$. Use thisfield to specify an alternate format.
Why: Some enterprises have a strong preference concerning which
identifier is exposed.
See Supported Variables for CalDAV Settings.

Password

Specify the password to use. The default value is $PASSWORD$. Use
this field to specify a custom format, such as $PASSWORD$_US.
See Supported Variables for CalDAV Settings.

Supported Variables for CalDAV Settings
You can use the following variables in fields that support variables.
l$USERID$l$EMAIL$l$NULL$l$USER_CUSTOM1$... $USER_CUSTOM4$ (custom fields defined for LDAP)

CardDAV settings (iOS and macOS)
CardDAV configurations allow you to specify parameters for connecting to CardDAV-compliant address bookservers. CardDAV (or vCard Extensions to WebDAV), is a remote contact data access standard supported by iOS
and macOS.
NOTE: This configuration is supported on iOS and macOS v10.8. macOS v10.7 Lion is not supported.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 576

CardDAV settings (iOS and macOS)

Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > iOS and macOS > CardDAV to configure access to subscription address
books compatible with this protocol.
3. Configure your CardDav settings as described in Table 96. CardDAV settings (iOS and macOS) .
4. Click Save.

TABLE 96. CARDDAV SETTINGS (IOS AND MACOS)
Item

Description

Name

Enter brief text that identifies this group of iOS and macOS subscribed address
book settings.

Description

Enter additional text that clarifies the purpose of this group of iOS and macOS
subscribed address book settings.

HostNameEnter the hostname or IP address of the CardDAV account.

Port

Enter the port number of the CardDAV account.

Principal URL

Enter the Principal URL for the CardDAV account.

Use SSL

Select to use SSL for data transfer.

Use Google Apps Password

Select to use the Google Apps password. For more information about
configuring the Google Apps password, see [].

User Name

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format.
Why: Some enterprises have a strong preference concerning which identifier is
exposed.
See Supported variables for CardDAV Settings.

Password

Specify the password to use. The default value is $PASSWORD$. Use thisfield to specify a custom format, such as $PASSWORD$_$USERID$.
See Supported variables for CardDAV Settings.

Communication Service
Rules (iOS 10 and later)

Select a default audio service or app to be associated with the device user's
accounts on the Exchange, CardDAV, LDAP, and Google servers. All calls
initiated on the iOS device to contacts from contact lists stored on the server
will use the selected audio service by default. This feature is supported on
devices running iOS 10 through the most recently released version as
supported by MobileIron.
To enable communication service rules:• Select Choose a default app to be used when calling contacts fromthis account. A drop-down list of apps is displayed.
• Click the drop-down list to select the default audio app or service.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 577

Supported variables for CardDAV Settings

Supported variables for CardDAV Settings
You can use the following variables in fields that support variables.
l$USERID$l$EMAIL$l$NULL$l$USER_CUSTOM1$... $USER_CUSTOM4$ (custom fields defined for LDAP)Web Clips settings (iOS and macOS)
You can send web clips to the home screens of managed devices by creating a web clip setting.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > iOS and macOS > Web Clips to add web clips to the home screen of users’
devices.
3. Use Table 97. Web clips settings to make your configurations.

TABLE 97. WEB CLIPS SETTINGS
Item

Description

Web Clips Set NameEnter brief text that identifies this group of iOS and macOS web clips
settings.

Description

Enter additional text that clarifies the purpose of this group of iOS andmacOS web clips settings.

4. Under the Web Clips field, click Add New. The Add Web Clip dialog box opens.
5. Use the table below as a guide to completing your web clip entry.

TABLE 98. WEB CLIPS SETTINGS (IOS AND MACOS)
Item

Description

Name

Enter brief text to describe the web clip. This is the text that users willsee.

Address/URL

Enter the address or URL for the target of the web clip. Ensure the URL
you enter includes the prefix http:// or https://.

Removable

Clear the Removable check box to prevent users from removing the web
clip once it is pushed out to their phones.

Full Screen

By default, Full Screen is selected. When selected, the web clip isdisplayed as a full-screen application.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 578

Configuration profile settings (iOS, tvOS, and macOS)

TABLE 98. WEB CLIPS SETTINGS (IOS AND MACOS) (CONT.)
NOTE: Apple does not currently support the display of full screen
web clips in full screen mode on devices running iOS 8, iOS
8.1, and iOS 8.1.1.
Precomposed

By default, Precomposed is selected. When selected, iOS will not add
the bezel shading effect to the icon.

Icon

Select an icon to display for the web clip.

6. In the New Web Clips Setting dialog box, click Add New for additional web clips.
7. When finished, click Save.

Configuration profile settings (iOS, tvOS, and macOS)
Occasionally, you may want to upload an iOS, tvOS, or macOS configuration profile generated from outside ofCore and push it to devices.
For example, you can send devices an Apple Configurator payload by exporting the payload from Apple
Configurator and pushing it to devices as a .plist file. This is particularly useful for edge case scenarios, where thecommand you wish to execute on the device is not otherwise available.
NOTE: When pushing a configuration profile to iOS and macOS devices applied to a particular label,Core also pushes the profile to any Apple TV devices applied to that label.
NOTE: When using this option, it is required to only have the portion of the .plist that is inside the array ofthe "PayloadContent", essentially "<dict>...</dict>". Any substitution variables will not be
substituted. The file will not be validated and will be added to the payload without any
modifications.
Another use case is if you wish to deploy a signed .mobileconfig file, for example, Apple debug configurations via
MobileIron MDM. Because Core does not expect a signed file, it would not be able to parse it and inject a
substitution variable because it would change the signature of the signed file. To get around this, select the Send
File Verbatim - do not parse or use substitution variables check box. Files uploaded with this option selected
are sent as is to the device without parsing, validating, or signing of the file by MobileIron.
NOTE: Core server will not attempt to process the file by parsing for substitution variables, sign theconfiguration when delivering to a device, or make any additions or modifications to theconfiguration. File must be in a valid .mobileconfig format and should be signed.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > iOS and macOS > Configuration Profile.
3. In the Name field, enter a name for the configuration profile setting.
4. Click Choose File and navigate to the relevant .plist file.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 579

LDAP settings (iOS and macOS)

5. You can hide or display the contents of the file as follows:lSelect Allow Viewing of Content to make the file contents visible.

l

Deselect Allow Viewing of Content to hide the file contents.

6. Select User or Device channel.
7. If the file is a signed .mobileconfig file, select Send File Verbatim - do not parse or use substitution
variables check box.
8. Click Save.
9. Select the configuration profile you created and apply it to a relevant label or labels.

LDAP settings (iOS and macOS)
You can configure an LDAP profile for iOS and macOS devices.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > iOS and macOS > LDAP to configure an LDAP profile for iOS and macOS devices.
The New LDAP Setting dialog box opens.
3. Use the guidelines in the table below to complete this form.

TABLE 99. ADD NEW LDAP CONFIGURATION
Item

Description

Name

Descriptive name to use when referencing this configuration.

Account Description

Optional. Description of the LDAP account.

Account Username

Optional. Username for accessing the LDAP account.

Account Password

Optional. Password that corresponds to the Account Username value.
The password applies to encrypted accounts.

Confirm AccountPassword

Optional. Confirms the password entered in the Account Password
field.

Account Hostname

The hostname for the LDAP server.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 580

Extensible Single Sign-On

TABLE 99. ADD NEW LDAP CONFIGURATION (CONT.)
Item

Description

Use SSL

Whether to use SSL.

Search Settings

Should have at least one entry for the account. Each entry represents a
node in the LDAP tree from which to start searching. Click the + button
to add a new entry, then edit the entry.
An entry consists of the following values:
Description: Explains the purpose of the search setting.
Scope: Select Base, Subtree, or One Level to indicate the scope of thesearch. Base indicates just the node level, Subtree indicates the node
and all children, One Level indicates the node and one level of children.
Search Base: The conceptual path to the specified note (e.g.,
ou=people, o=mycorp).

Communication Service
Rules (iOS 10 and later)

Select a default audio service or app to be associated with the device
user's accounts on the Exchange, CardDAV, LDAP, and Google
servers. All calls initiated on the iOS device to contacts from contact
lists stored on the server will use the selected audio service by default.
This feature is supported on devices running iOS 10 through the mostrecently released version as supported by MobileIron.
To enable communication service rules:• Select Choose a default app to be used when calling contacts
from this account. A drop-down list of apps is displayed.
• Click the drop-down list to select the default audio app or service.

4. Click Save.

Extensible Single Sign-On
Extensible Single Sign-On is an Apple feature that allows you to configure single sign-on for users accessing
enterprise resources from iOS and macOS devices that are registered with MobileIron Core. The extension can beused by identity providers to deliver a seamless experience as users sign in to enterprise resources. App users on
the device need to authenticate once. The initial user authentication can be done using enterprise credentials or
through an identity provider (IdP) setup. User are not prompted for authentication for subsequent access.
This configuration does not require a MobileIron Tunnel or a MobileIron Sentry deployment.
IMPORTANT:l

An app, also referred to as an app extension, that performs the SSO is required.

l

If you are configuring an identity provider (IdP), the IdP must have an app extension.
o

The Extensible Single Sign-On configuration is supported with ADFS.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 581

Extensible Single Sign-Onl

The feature is supported with iOS 13.0 ad macOS 10.15 through the most recently released version as
supported by MobileIron.

You configure Extensible Single Sign-On on the MobileIron Core Admin Portal. Go to Policies & Configs >Configurations > Apple > iOS / macOS / tvOS > Extensible Single Sign-On. To distribute the configuration,
save and apply it to a label that contains the target devices.
The following table describes the fields and settings in the configuration.

TABLE 100. EXTENSIBLE SINGLE SIGN-ON FIELD DESCRIPTION
Item

Description

Name

Enter a name that identifies this configuration.

Description

Enter a description that clarifies the purpose of this configuration.

ChannelThe Channel options are applicable to macOS only.
Select one of the following:l

User: Select to apply to only specific users on the device.

l

Device: Select to apply to all users on the device.

NOTE: The User option is not supported on macOS 10.15 devices .
Extensible Single Sign-On
Choose SSO
Type

Select the initial sign on method.
lCredentials: Select this option if the initial authentication method uses your enterprisecredentials.

lRedirect: Select this option if the enterprise resource uses an identity provider toauthenticate users.

Host

If you select Credentials as the SSO Type, enter one or more host names or domain namesthat can be authenticated through the app extension.
Host or domain name matching is not case sensitive. The host and domain names must be
unique. Hosts that begin with a “.” are wildcard suffixes. Wildcard suffixes will match all subdomains. Otherwise, the host or domain name must be an exact match.

URL

If you select Redirect as the SSO Type, enter one or more URL prefixes of identity providers
where the app extension performs SSO.
The URLs must begin with http:// or https://. The scheme and host name matching is not casesensitive. Do not use query parameters and URL fragments. The URLs must be unique.

Extension
IdentifierEnter the bundle ID of the app extension that performs the single sign-on for the specified
URLs.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 582

Extensible Single Sign-On Kerberos

TABLE 100. EXTENSIBLE SINGLE SIGN-ON FIELD DESCRIPTION (CONT.)
Item

Description

Team
IdentifierEnter the team identifier of the app extension.

Realm

If you select Credentials as the SSO Type, enter the realm name.

The team identifier is required on macOS. However, it is ignored on iOS.

The realm name is case sensitive and must be an exact match.
Custom Data

Enter one or more custom data as key-value pairs.

Extensible Single Sign-On Kerberos
Extensible Single Sign-On is an Apple feature that allows you to configure single sign-on for users accessing
enterprise resources from iOS and macOS devices that are registered with MobileIron Core. App users on thedevice need to authenticate once. Users are not prompted for authentication for subsequent access.
Use this configuration to do single sign-on if your enterprise uses Kerberos authentication.
This configuration does not require a MobileIron Tunnel or a MobileIron Sentry deployment.
IMPORTANT:l

An app, also referred to as an app extension, that performs the SSO is required.

l

The feature is supported with iOS 13.0 ad macOS 10.15 through the most recently released version as
supported by MobileIron.

You configure Extensible Single Sign-On with Kerberos on the MobileIron Core Admin Portal. Go to Policies &Configs > Configurations > Apple > iOS / macOS / tvOS > Extensible Single Sign-On Kerberos. To
distribute the configuration, save and apply it to a label that contains the target devices.
The following table describes the fields and settings in the configuration.

TABLE 101. EXTENSIBLE SINGLE SIGN-ON KERBEROS FIELD DESCRIPTION
Item

Description

Name(Required) Enter a name that identifies this configuration.

Description

Enter a description that clarifies the purpose of this configuration.

ChannelThe Channel options are applicable to macOS only.
Select one of the following:l

User: Select to apply to only specific users on the device.

l

Device: Select to apply to all users on the device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 583

Extensible Single Sign-On Kerberos

TABLE 101. EXTENSIBLE SINGLE SIGN-ON KERBEROS FIELD DESCRIPTION (CONT.)
Item

Description
NOTE: The User option is not supported on macOS 10.15 devices .

Extensible Single Sign-On Kerberos
Principal Name

(Required) Enter the Kerberos Principal Name.

Realm(Required) Enter the Kerberos Realm.

Certificate(Required) Select the certificate to use to renew the Kerberos credential.

Host

Enter the Kerberos domain name that can be authenticated through the app extension.
Host or domain name matching is not case sensitive. The host and domain names must
be unique Hosts that begin with a “.” are wildcard suffixes. Wildcard suffixes will match all
sub-domains. Otherwise, the host or domain name must be an exact match.

Allow Automatic
Login

Allows passwords to be saved in the keychain. By default, the option is selected.

Delay User Setup

Applicable to macOS 11 through the latest version as supported by MobileIron.

If the option is deselected, passwords are not saved in the keychain.

Select the option so that users are not prompted to set up the app extension for Kerberos.
If the option is selected users are prompted to set up the app extension for Kerberos only if
the administrator enables app extension with the app-SSO tool or the user sees a
Kerberos challenge.
Require User
Presence

Select the option to require users to provide Touch ID, Face ID, or their passcode toaccess the keychain entry.

Monitor Credential
Cache

Applicable to macOS 11 through the latest version as supported by MobileIron.
By default, the option is selected.
Deselect the option to request credentials on the next matching Kerberos challenge or
network state change.
If the credentials expire, a new is created.

Cache NameEnter the Generic Security Service (GSS) name of the Kerberos cache to use.

Domain Realm Mapping
DomainClick +Add to add a domain and DNS suffixes.
For Domain, enter the name of realm.
For value, enter one or more DNS suffixes that map to the realm.

Default Realm

Enter the default realm if there is more than one Kerberos extension configuration.

Use Site Auto
Discovery

The option is selected by default.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 584

Extensible Single Sign-On Kerberos

TABLE 101. EXTENSIBLE SINGLE SIGN-ON KERBEROS FIELD DESCRIPTION (CONT.)
Item

Description
If selected, the Kerberos extension automatically uses LDAP and DNS to determine its
Active Directory (AD) site name.

Site CodeEnter the name of the Active Directory site that the Kerberos extension should use.

Replication Time

Applicable to macOS 11 through the latest version as supported by MobileIron.
Enter the time, in seconds, required to replicate changes int he Active Directory domain.
The Kerberos extension uses the configured replication time to check the password age.

Credential Bundle IDACL
Credential Bundle

Click Add+ to enter an app bundle ID allowed to access the Ticket Granting Ticket (TGT).

Include managed
Apps in Bundle
IdACL

Applicable to iOS 14 through the latest version as supported by MobileIron.
Select the check box to allow only managed apps to access and use the credential.
This option is used in addition to the Credential Bundle.

CustomUsername Label

Applicable to macOS 11 through the latest version as supported by MobileIron.

Help Text

Applicable to iOS 14 through the latest version as supported by MobileIron.

Enter the custom user name label used in the Kerberos extension instead of the"Username."Enter text to display at the bottom of the Kerberos log in window.
TIP: The text can be a disclaimer or help information.
Credential Use
Mode

Select one of the following options to specify how the Kerberos extension credential isused by other processes:
Always (default): The extension credential is always used if the service principal name
(SPN) matches the Kerberos Extension Hosts array. The credential is not used if thecalling app is not in the configured in Credential Bundle.
When Not Specified: The credential is only used when another credential has not been
specified by the caller and the SPN matches the Kerberos Extensions Hostsarray. The
credential will not be used if the calling app is not in in Credential Bundle.
Kerberos Default: The default Kerberos processes for selecting credentials is used which
normally uses the default Kerberos credential. This is the same as turning off thiscapability.

Require TLS for
LDAP

Select to require TLS for the LDAP.

Password Settings

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 585

iOS / tvOS settings

TABLE 101. EXTENSIBLE SINGLE SIGN-ON KERBEROS FIELD DESCRIPTION (CONT.)
Item

Description

The Password Settings options are applicable to macOS 10.15 through the latest version as supported by
MobileIron.
Allow Password
ChangeThe option is selected by default.

Password Change
URLEnter the URL to launch when they initiate a password change. The URL is launched inAllow Password
Complexity

If selected, passwords must meet Active Directory's definition of "complex."

Minimum
Password Length

Enter the minimum length, in characters, of passwords on the domain.

Password Expiry
Notification

Enter the number of days prior to password expiration when a notification of password

Deselect to disable password changes.

the user’s default web browser.

expiration is sent to the user.
The default value is 15 days.

Password Expiry
OverrideEnter the number of days that passwords can be used on this domain.
For most domains, this can be calculated automatically.

Password
Required Text

Enter the domain's password requirements.
Use only if pwReqComplexity or pwReqLength are not specified.

Password History
Count

Enter the number of prior password that cannot be re-used on this domain.

Password
Minimum Age

Enter the minimum age, in days, of the password before it can be changed on this domain.

Allow Syncing
Local Password

Select to enable password syncing.
NOTE: The setting is not applied if the user is logged in with a mobile account.

iOS / tvOS settings
The following settings are available. Note that they apply to tvOS devices only when specified.
AirPlay settings
AirPrint settings
App restrictions configuration setting
iOS and tvOS restrictions settings
Subscribed Calendars settings
APN settings
MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 586

AirPlay settings

Provisioning Profile settings
Web content filter settings
Managed App Config settings that use plists
Google AccountManaged domains settings
Network usage rules settings
Enterprise single sign-on account settings with Kerberos

AirPlay settings
This feature is only supported for iOS 7 through the most recently released version as supported by MobileIron.
AirPlay is an iOS feature that allows you to mirror the content displayed on your iOS device on to a destination
device, for example, an HDTV.
For iOS 7 through the most recently released version as supported by MobileIron, you can now configure your
MobileIron Core to control the AirPlay resources that supervised devices can access. You can configure thefollowing settings:llSpecify the passcode for the AirPlay destination device so that devices can connect seamlessly.
Specify a whitelist of destination devices to which you can mirror the content that is displayed on thescreen of your supervised device.

NOTE: This setting does not apply to tvOS devices.
Procedure
1. In the Admin Portal, go to Policies & Configs > Configurations.
2. Click Add New > Apple > iOS / tvOS > AirPlay. The New AirPlay Configuration dialog box opens.
3. Enter a name for the AirPlay Configuration.
4. Enter additional information that describes the AirPlay Configuration.
5. In the AirPlay Destination Devices section, click + to add a new destination device.
6. For each destination device, enter the following information:
Field

Description

Device NameEnter the name of the destination device.

Password

Enter the password for the destination device.

Description

Enter additional information that describes this destination device.

-

Click if you want to delete this device.

7. In the AirPlay Whitelist Devices section, click + to add a new destination device to the whitelist.
NOTE: Whitelists are only supported on supervised devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 587

AirPrint settings

8. For each destination device in the whitelist, enter the following information:
Field

Description

Device MAC AddressEnter the Bonjour Device ID.

Description

Enter additional information that describes this destination device.

-

Click if you want to delete this device.

9. Click Save.

AirPrint settings
This feature is only supported on iOS 7 through the most recently released version as supported by MobileIron.
AirPrint is an iOS feature that allows you to print to an AirPrint printer from your iOS device without the need to
install drivers or download software.
You can configure your MobileIron Core to control the printing resources that devices can access. You can specify
a whitelist of AirPrint printers that devices can access.
NOTE: This setting does not apply to tvOS devices.
Procedure
1. In the Admin Portal, go to Policies & Configs > Configurations.
2. From the Add New drop-down menu, go to Apple > iOS / tvOS > AirPrint. The New AirPrint
Configuration dialog box opens.
3. Enter a name for the AirPrint Configuration.
4. Enter additional information that describes the AirPrint Configuration.
5. In the AirPrint Destination Whitelist section, click + to add a new destination printer.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 588

App restrictions configuration setting

6. For each destination printer, enter the following information:
Field

Description

IP AddressEnter the IP address of the AirPrint printer.

PathEnter the Resource Path associated with the AirPrint printer. This
corresponds to the rp parameter of the _ipps.tcp Bonjour record. For
example:• printers/Canon_MG5300_series• printers/Xerox_Phaser_7600• ipp/print• Epson_IPP_Printer.
NOTE: The resource path is case sensitive.

Description

Enter additional information that describes this destination device.

-

Click if you want to delete this device.

7. Click Save.

App restrictions configuration settingThis feature applies only to iOS devices.
The app restrictions configuration setting allows you to whitelist or blacklist managed apps in the App Catalog on
MobileIron Core. Creating a whitelist restricts device users to viewing on their devices only apps explicitly listed in
the whitelist. Creating a blacklist restricts device users from viewing or launching blacklisted apps on their devices.
You can also blacklist apps from the Apple App Store.
You can create more than one whitelist or blacklist, but MobileIron Core will only send one app restriction setting todevices. There is no default app restrictions configuration. If you configure both a blacklist and a whitelist, thenCore removes all blacklisted apps from the whitelist, and sends only the whitelist to devices. If you apply one ormore app restriction configurations to a label, then MobileIron Core combines all app restriction configurations andsends it to the devices belonging to that label.
After you have created a blacklist, you cannot convert it to a whitelist.
NOTE: This feature applies only to supervised devices running iOS 9.3 through the most recently released
version as supported by MobileIron.
NOTE: This setting does not apply to tvOS devices.

Whitelisting managed iOS apps
Creating a whitelist of managed apps allows you to specify the apps you want to be visible to device users on theirdevices. You can whitelist apps from the App Catalog in MobileIron Core. Core hides from the device user any appthat is not whitelisted.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 589

Blacklisting iOS apps

NOTE: This feature applies only to supervised devices running iOS 9.3 through the most recently released
version as supported by MobileIron. You cannot whitelist a web clip. This is an Apple limitation.
Procedure
1. Select Policies & Configs > Configurations.
2. Click Add New.
3. Select Apple > iOS / tvOS > App Restrictions. The New App Restrictions Configurations dialog box
opens.
4. In the Name field, enter a name for the app restriction configuration. Optionally, enter a description for theapp restriction configuration in the Description field.
5. Under App Restrictions, select Create a Whitelist.
6. Click Add > App Catalog.
A new row is added to the table of apps.
7. In the table, click the cell in the App Name column, and begin typing the app name you want to blacklist.
A drop-down list of App Catalog apps appears.
8. From the drop-down list, select the App Catalog app you want to blacklist.
9. Repeat steps 6-8 for any additional apps you would like to whitelist.
10. Click Save.
11. Select the app restrictions configuration you created.
12. Select Actions > Apply to Label.
13. Select the labels to which you want to apply the provisioning profile, such as iOS.
14. Click Apply.

Blacklisting iOS apps
Creating a blacklist allows you to specify particular apps you want to prevent device users from viewing or running.
You can select apps to blacklist in the following ways:lll

From an Apple App Store: You can blacklist a public app from a particular Apple App Store by firstchoosing the Apple App Store and then searching for the app.
From the App Catalog: You can blacklist a particular managed app from the App Catalog on MobileIron
Core.
Manually: You can blacklist a particular app by manually entering its name or bundle ID.

This feature applies only to supervised devices running iOS 9.3 through the most recently released version as
supported by MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 590

iOS and tvOS restrictions settings

Procedure
1. Select Policies & Configs > Configurations.
2. Click Add New.
3. Select Apple > iOS / tvOS > App Restrictions. The New App Restrictions Configurations dialog box
opens.
4. In the Name field, enter a name for the app restriction configuration. Optionally, enter a description for theapp restriction configuration in the Description field.
5. Under App Restrictions, select Create a Blacklist.
6. To blacklist an app from the Apple App Store:lClick Add > iTunes Store to select the particular Apple App Store where the app can be found. A row
is added to the table of apps.

l

In the App Name column, search for the app in the App Store by entering the app name.

l

From the drop-down list that appears, select the relevant app.

7. To blacklist an app from the App Catalog on MobileIron Core:lllClick Add > App Catalog. A row is added to the table of apps.
In the table, click the cell in the App Name column, and begin typing the app name you want toblacklist.
From the drop-down list that appears, select the App Catalog app you want to blacklist.

8. To blacklist an app manually:lllClick Add > Enter Bundle ID. A row is added to the table of apps.
In the table, click the cell in the App Name column and enter the name of the app you want toblacklist.
Alternatively, click the cell in the Bundle ID column, and enter the bundle ID of the app you want toblacklist.

9. For any other apps you want to blacklist, repeat steps 6, 7 or 8.
10. Click Save.
11. Select the app restrictions configuration you created.
12. Select Actions > Apply to Label.
13. Select the labels to which you want to apply the provisioning profile, such as iOS.
14. Click Apply.

iOS and tvOS restrictions settings
Select Policies & Configs > Configurations > Add New > Apple > iOS / tvOS > Restrictions to specify
lockdown capabilities for iOS and tvOS devices.
There are restrictions available on all iOS/tvOS devices. Each restriction has a default value that is determined byApple. Without a restrictions configuration, the values in Core's Restrictions tab will be the default ones as definedby Apple. When Core sends a restriction configuration, the values will be set based on that configuration. The next

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 591

iOS and tvOS restrictions settings

Restrictions "report" will display in the Device Details page > Restrictions tab and will list the new values basedon the configurations sent and what was sent by the device.
The Restrictions report may not display each and every restriction that was sent.
NOTE: When iOS 13 devices upgrade to Core, restrictions are enabled by default. However, when tvOS
12.2 and 13.0 devices upgrade, the restrictions are not enabled by default.
If User Enrollment through Apple Business Manager was done, the Restrictions tab may not display the table andinstead display "No Data." This is because no data was returned listing which restrictions were set and what thevalues were.
If Notes for Audit Logs is enabled, after clicking Save, a text dialog box opens. Enter the reason for the change andthen click Confirm. For more information, see Best practices: label management.
NOTE: When there are two iOS restrictions of the same key and are pushed to the device withconflicting values, Core will send both restrictions to device. However, when two restriction
configuration are sent to device with different values, Apple states that the most restrictive
option takes precedence. There is no clear documentation from Apple about this behavior. Bestpractice is to have a single restriction setting with the desired value set instead of multiple
settings with same key, which results in having value conflicts.
The following table summarizes the settings.

TABLE 102. RESTRICTIONS SETTINGS (IOS)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

NameEnter brief text that identifies
this group of iOS restriction
settings.

N/A

N/A

Description

Enter additional text thatclarifies the purpose of thisgroup of iOS restriction
settings.

N/A

N/A

allowCamera

Yes

allowVideoConferencing

Yes

Device Functionality
Allow use ofcameraSelect to disable the camera
and remove its icon from theHome screen. Users will be
unable to take photographs.
Clearing this restriction also
disables the Allow FaceTime
restriction.

Allow FaceTime

When deselected, disables
video conferencing.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 592

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

Allowscreenshots andscreen recording

When deselected, users areunable to save screenshots orrecord video of the display.

allowScreenShot

Yes

When deselected, thisrestriction prevents theClassroom app from observing
remote screens. Available foriOS 9.0 through the mostrecently released version of
iOS as supported by
MobileIron.

Allow AirPlay
and View
Screen by
Classroom(supervised
devices only)

Select to enable remote screen
observation. Available for iOS
9.3 through the most recently
released version of iOS as
supported by MobileIron.

allowRemoteScreenObservation

Yes

Allow
Classroom toperform AirPlay
and View
Screen without
prompting (iOS10.3 and laterwith supervised
devices only)

Select to enable remote screen
observation without prompting.

forceClassroomUnpromptedScreenOb
servation

Yes

Allow AirDrop(supervised
devices only)

If deselected, AirDrop is
disabled.

allowAirDrop

Yes

Allow iMessage(supervised
devices only)

When deselected, disables theuse of the Messages app withsupervised devices.

allowChat

Yes

Allow AppleMusic (withsupervised
devices only)

If disabled, Music service isdisabled and Music app reverts
to classic mode. Available foriOS 9.3 through the mostrecently released version of
iOS as supported by
MobileIron.

allowMusicService

Yes

Available for iOS 10.3 throughthe most recently released
version of iOS as supported by
MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 593

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

Allow Radio(supervised
devices only)

If disabled, iTunes Radio isdisabled. Available for iOS 9.3
through the most recently
released version of iOS as
supported by MobileIron.

allowRadioService

Yes

Allow voice
dialing whiledevice is locked

When deselected, disables
voice dialing.

allowVoiceDialing

Yes

Allow Siri

When deselected, disables
Siri.

allowAssistantYes

Allow Siri whiledevice is locked

When deselected, the user isunable to use Siri when thedevice is locked. This
restriction is ignored if thedevice does not have apasscode set.

allowAssistantWhileLocked

Yes

Enable Siriprofanity filter(supervised
devices only)

When selected, forces the useof the profanity filter assistant.
Available for iOS 8.0 throughthe most recently released
version of iOS as supported by
MobileIron.

forceAssistantProfanityFilter

No

Show usergenerated
content in Siri(supervised
devices only)

If deselected, prevents Sirifrom querying user-generated
content from the web.

allowAssistantUserGeneratedContent

Yes

Allow Siri
Suggestions(supervised
devices only)

If deselected, prevents Sirifrom offering suggestions forapps, people, search results,
and more.

allowSpotlightInternetResults

Yes

Allow server-

If deselected, disables server-

allowSiriServerLogging

Yesside logging ofside Siri logging.

allowBookstore

Yes

Siri commands
later)

Applicable to iOS 12.2 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow Apple

Select to allow access to(iOS 12.2 andMobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 594

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

DescriptionBooks(supervised
devices only)

iBookstore.

Allow installingapps using
Apple
Configurator andiTunes(supervised
devices only)

When deselected, the App
Store is disabled and its icon isremoved from the Home
screen. Users are unable toinstall or update theirapplications.

Allow installingapps using App
Store(supervised
devices only)

When deselected, the App
Store is disabled and its icon isremoved from the Home
screen. However, users may
continue to use host apps
(iTunes, Configurator) to installor update their apps.

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

allowAppInstallationYes

allowUIAppInstallationYes

allowAutomaticAppDownloads

Yes

This setting does not affectinstallation of in-house apps.

Available for iOS 9.0 throughthe most recently released
version of iOS as supported by
MobileIron.
NOTE: This restriction isunavailable if Allow
installing apps using
Apple Configurator
and iTunes isdeselected.
Allow automatic
app downloads(supervised
devices only)

If deselected, prevents
automatic downloading of apps
purchased on other devices.
Does not affect updates toexisting apps.
If selected, apps purchased by
the device user will be
automatically downloaded.
NOTE: This restriction isunavailable if Allow

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 595

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

allowAppRemoval

Yes

allowSystemAppRemoval

Yes

allowAppClips

Yes

allowApplePersonalizedAdvertisingYes

allowNFC

Yes

installing apps using
Apple Configurator
and iTunes isdeselected.
Allow removing
apps(supervised
devices only)

If deselected, disables
removal of apps from iOS
devices.
Available for iOS 9.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow System
App Removal(iOS 11.0 andlater withsupervised
devices only)

When deselected, disables theremoval of system apps fromthe device.
Available for iOS 11.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow App Clips

When deselected, prevents a(iOS 14.0 and

device user from adding any

later withApp Clips and removes any

supervised

existing App Clips on thedevices only)

device.
Available for iOS 14.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow

When deselected, limits

Personalized

personalized advertising.

Advertising (iOS14.1 and later)

Allow NFC (iOSAvailable for iOS 14.1 throughthe most recently released
version of iOS as supported by
MobileIron.
When deselected, NFC is not

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 596

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

14.2 and later)allowed on the device. This is

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

forceOnDeviceOnlyDictationNo

not specific to device
registration.
Available for iOS 14.2 throughthe most recently released
version of iOS as supported by
MobileIron.
Force Dictation

When selected, uses theProcessing Only

native dictation program thaton Device (iOSsends information such as

14.3 and later)

voice input, contacts, andlocation to Apple (whennecessary) for processing yourrequests.
Available for iOS 14.3 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow In-App
Purchases

When deselected, prohibits inapp purchasing.

allowInAppPurchases

Yes

Require iTunes
Store password
for all purchases

When selected, forces device
users to enter their iTunes
password for each App Storetransaction.

forceITunesStorePasswordEntry

Yes

Allow iCloud
backupWhen deselected, disables
backing up the device toiCloud.

allowCloudBackup

Yes

Allow iCloud
documents &data

When deselected, disables
document and key-value
syncing to iCloud.

allowCloudDocumentSync

Yes

Allow iCloud
KeychainIf deselected, disables iCloud
Keychain synchronization.

allowCloudKeychainSync

Yes

Allow managed
apps to store
data in iCloudIf deselected, prevents
managed applications fromusing cloud sync.

allowManagedAppsCloudSync

Yes

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 597

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

Allow backup ofenterprise books

Select to allow device users toback up enterprise-managed
books to iCloud.

allowEnterpriseBookBackup

Yes

allowEnterpriseBookMetadataSync

Yes

Available for iOS 8.0 throughthe most recently released
version of iOS as supported by
MobileIron.
Allow notes andhighlights sync
for enterprise
books

Select to allow device users tosynchronize with iCloud theirnotes and highlights inenterprise-managed books.
Available for iOS 8.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow iCloudphoto sharing

If deselected, Shared Photo
Stream will be disabled.

allowSharedStream

Yes

Allow iCloudPhoto Library

If deselected, disables iCloudPhoto Library. Any photos not
fully downloaded from iCloudPhoto Library to the device will
be removed from local storage.

allowCloudPhotoLibrary

Yes

Available for iOS 9.0 throughthe most recently released
version of iOS as supported by
MobileIron.
Allow My Photo
Stream(disallowing cancause data loss)

When deselected, disables
Photo Stream.

allowPhotoStream

Yes

Allow automaticsync whileroaming

When deselected, disables
global background fetch
activity when an iOS phone isroaming. Background fetch
allows apps to update data inthe background in anticipationof users accessing the app

allowGlobalBackgroundFetchWhenRoaming

Yes

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 598

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

data.
Force encryptedbackupsWhen selected, encrypts all
backups. Automaticallyselected due to SCEP
requirements.

forceEncryptedBackup

Yes

Force limited ad
tracking

If selected, limits ad tracking.

forceLimitAdTracking

No

Allow Erase All
Content andSettings(supervised
devices only)

Deselect to disable the “Erase
All Content and Settings”
option in the Reset section of
iOS devices.

allowEraseContentAndSettings

Yes

Allow user toacceptuntrusted TLS
certificates

Select to allow the device user
to accept untrusted HTTPS
certificates. If this option is notselected, then the device willautomatically reject untrusted
HTTPS certificates without
prompting the device user.

allowUntrustedTLSPrompt

Yes

Allow automatic
updates tocertificate trust
settings

If deselected, over-the-air PKI
updates are disabled. Setting
this restriction to false does
not disable CRL and OCSP
checks.

allowOTAPKIUpdates

Yes

Allow trusting
new enterprise
app authors

If deselected, prevents trusting
enterprise apps from othercompanies.

allowEnterpriseAppTrust

Yes

Available for iOS 9.0 throughthe most recently released
version of iOS as supported by
MobileIron.
Allow installing
configuration
profiles(supervised
devices only)

If deselected, the user isprohibited from installing
configuration profiles andcertificates interactively.

allowUIConfigurationProfileInstallati
on

Yes

Allow adding

When selected, allows theallowVPNCreation

Yes

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 599

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

VPN configurations (iOS 11.0
and later withsuperviseed
devices only)

creation of VPN
configurations.

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

forceClassroomUnpromptedAppAndDeviceL
ock

Yes

forceClassroomAutomaticallyJoinClasses

Yes

forceClassroomRequestPermissionToLeav
eClassesYes

allowAccountModification

Yes

Available for iOS 11.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow
Classroom tolock to an app
and lock thedevice without
prompting (iOS11.0 and laterwith supervised
devices only)

If selected, allow the teacher
to lock apps or the device
without prompting the student.

Automaticallyjoin Classroomclasses without
prompting (iOS11.0 and laterwith supervised
devices only)

If selected, automatically give
permission to the teacher’srequests without prompting thestudent.

Available for iOS 11.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Available for iOS 11.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Require teacher
permission to
leaveClassroom
unmanagedclasses (iOS11.3 and laterwith supervised
devices only)

Requires teacher approval fora student to leave a Classroom
unmanaged classes from theirdevice.

Allow modifying
account settings(supervised
devices only)

Select to allow users to modify
accounts settings, such asadding or removing mailaccounts and modifying iCloudand iMessage settings, and soon.

Available for iOS 11.3 throughthe most recently released
version of iOS as supported by
MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 600

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

Allow modifying
Bluetoothsettings (iOS10.0 and later
supervised
devices only)

If deselected, prevents themodification of Bluetoothsettings. For supervised
devices only.

allowBluetoothModification

Yes

Allow modifying
cellular data app
settings(supervised
devices only)

If deselected, changes tocellular data usage for apps are
disabled.

allowAppCellularDataModification

Yes

Allow modifying
cellular plansettings (iOS11.0 and laterwith supervised
devices only)

If deselected, changes tocellular plan settings are
disabled.

allowCellularPlanModification

Yes

Allow modifying
device name(supervised
devices only)

If deselected, prevents devicename from being changed.

allowDeviceNameModification

Yes

Available in iOS 10.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Available for iOS 9.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow modifying
Find my Friends
settings(supervised
devices only)

If deselected, changes to the
Find My Friends app are
disabled.

allowFindMyFriendsModification

Yes

Allow modifying
notification
settings(supervised
devices only)

If disabled, notification
settings cannot be modified.
Available for iOS 9.3 throughthe most recently released
version of iOS as supported by
MobileIron.

allowNotificationsModification

Yes

Allow modifying
passcode

iOS 9.0 and later withsupervised devices only. If

allowPasscodeModification

Yes

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 601

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description(supervised
devices only)

deselected, prevents device
passcode from being added,
changed, or removed.

Allow modifying
Touch ID
fingerprints /Face ID faces(supervised
devices only)

If deselected, prevents device
users from changing their
TouchID or Face ID settings.

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

allowFingerprintModificationYes

allowEnablingRestrictions

Yes

allowWallpaperModificationYes

allowPersonalHotspotModification

Yes

This restriction is
automatically deselected if thepreceding restriction [Allow
modifying passcode (iOS
9.0 and later withsupervised devices only)] isdeselected.
Available for iOS 9.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow ScreenTime(supervised
devices only)

For iOS 9.0- 11.x - If
deselected, disables the"Enable Restrictions" option in
Settings > Restrictions on
iOS devices.
For iOS 12.0 through the mostrecently released version as
supported by MobileIron - If
this option is deselected, the"Enable Screen Screen Time"
option on iOS devices will bedisabled (Settings >Restrictions.)

Allow modifying
Wallpaper
supervised
devices only)

If deselected, prevents
wallpaper from being changed.
Available for iOS 9.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow modifying

Deselecting disables thedevice user's ability to modify

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 602

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Personal

the personal hotspot.

Hotspot settings

Available for iOS 12.2 throughthe most recently released
version of iOS as supported by
MobileIron.

(iOS 12.2 andlater withsupervised

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

allowUSBRestrictedModeYesdevices only)
Allow changing
USB restricted
in Settings(supervised
devices only)

Select to enable
USB restricted mode.
Available for iOS 12.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow pairingwith nonConfigurator
hosts(supervised
devices only)

Select to allow host pairing for
iTunes synchronization.
Disabling this option disables
all host pairing with the
exception of the supervision
host. If no supervision hostcertificate has been
configured, all pairing is
disabled. Host pairing lets theadministrator control which
devices an iOS device can pairwith.

allowHostPairing

Yes

Allow
documents frommanaged apps
to unmanaged
apps

Select to allow documents inmanaged apps and accounts
to be opened in unmanaged
apps and accounts. Disabling
this option prevents exchangeof documents from managed tounmanaged apps andaccounts. For example, you
might want to keep enterprise
documents from being opened
with personal apps.

allowOpenFromManagedToUnmanaged

Yes

NOTE: If you have enabled
the “Open only with
Docs@Work, andMobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 603

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description••

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

protect withencryption” option
for attachment
control, it isrecommended todisable thisrestriction. Enabling
this restriction, may
cause.secure attachments to notopen in Mobile@Work.
.secure and .attachctrl
attachments to not open in
the Docs@Work app foriOS.

A '?' icon will be visible on theattachment.
See also iOS 8: Managed
apps and Open In
Extension for how iOS app
extensions interact with thissetting.
Allow
documents fromunmanaged
apps tomanaged apps

Select to allow documents inunmanaged apps andaccounts to be opened inmanaged apps and accounts.
Disabling this option preventsexchange of documents fromunmanaged to managed apps
and accounts. For example,
you might want to keep users
from sending personal
documents using company
email.

allowOpenFromUnmanagedToManaged

Yes

Treat AirDrop as
unmanaged
destination

If selected, AirDrop will not be
displayed as a sharing
destination. This prevents
confidential data from being
shared through AirDrop.

forceAirDropUnmanaged

Yes

This restriction requires
deselecting the

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 604

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

allowActivityContinuationYes

allowOpenFromManagedToUnm
anaged restriction.

Available for iOS 9.0 throughthe most recently released
version of iOS as supported by
MobileIron.
Allow Handoff

Select to enable the Handoff
feature, which allows users toseamlessly continue working
where they left off using any
Apple device on which they are
logged in with their Apple ID.
Available for iOS 8.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow sending
diagnostic andusage data toAppleWhen deselected, thisprevents the device fromautomatically submitting
diagnostic reports to Apple.

allowDiagnosticSubmission

Yes

Allow modifying
diagnostics
settings(supervised
devices only)

When deselected, thediagnostic submission and app
analytics settings in the
Diagnostics & Usage pane in
Settings cannot be modified.

allowDiagnosticSubmissionModificationYes

allowFingerprintForUnlock

Yes

Available for iOS 9.3.2 throughthe most recently released
version of iOS as supported by
MobileIron.
Allow Touch ID /Face ID tounlock device

Selected (default) means a
PIN is required instead of
FaceID to unlock device. Deselected means the use of
FaceID is allowed in place of a
PIN.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 605

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

Force Apple
Watch Wrist
Detection

If selected, paired Apple
Watches are forced to use thewrist detection feature. Wrist
detection allows the WatchOS
to determine when the watch is
being worn, and enablesecurity features (such as apasscode) accordingly.

forceWatchWristDetection

No

allowPairedWatch

Yes

Available for iOS 8.2 throughthe most recently released
version of iOS as supported by
MobileIron.
Allow pairingwith Apple
Watch(supervised
devices only)

If deselected, the device user
will not be able to pair theirdevice with an Apple Watch.
Currently paired Apple
Watches are unpaired anderased.
Available for iOS 9.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Requirepasscode on
first AirPlay
pairing

If set to true, forces all devices
receiving AirPlay requests
from this device to use apairing password when pairing
for the first time.

forceAirPlayOutgoingRequestsPairingPa
sswordNo

Allow setting up
new nearby
devices (iOS11.0 and laterwith supervised
devices only)

If deselected, device users
cannot use their Apple devices
to set up and configure otherApple devices.

allowProximitySetupToNewDevice

Yes

allowAirPrint

Yes

Available for iOS 11.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow AirPrint(iOS 11.0 and

When deselected, disables Air
Print feature.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 606

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

later andsupervised
devices only)

Available for iOS 11.0 throughCorresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

allowAirPrintCredentialsStorage

Yes

forceAirPrintTrustedTLSRequirementNoallowAirPrintiBeaconDiscovery

YesallowPredictiveKeyboard

Yes

the most recently released
version of iOS as supported by
MobileIron.

Allow storage of
AirPrint
credentials in
Keychains (iOS11.0 and laterwith supervised
devices only)

Supervised only. Whendisabled, prohibits keychain
storage of username andpassword for Airprint.
Available for iOS 11.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Disallow
AirPrint todestinations
with untrusted
certificates (iOS11.0 and laterwith supervised
devices only)

When selected, requires
trusted certificates for TLS
printing communication.

Allow discoveryof AirPrint
printers using
iBeacons (iOS11.0 and laterand supervised
devices only)

When selected, disables
iBeacon discovery of AirPrint
printers, preventing spurious
AirPrint Bluetooth beaconsfrom phishing for network
traffic.

Available for iOS 11.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Available for iOS 11.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow predictive
keyboard(supervised
devices only)

If deselected, disables thepredictive keyboard.
Available for iOS 8.1.3 throughthe most recently released
version of iOS as supported by
MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 607

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

Allow keyboard
shortcuts (withsupervised
devices only)

If deselected, keyboard
shortcuts cannot be used.

allowKeyboardShortcuts

Yes

allowAutoCorrection

Yes

allowSpellCheckYes

allowDefinitionLookup

Yes

allowDictationYes

allowPassbookWhileLocked

Yes

Available for iOS 9.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow auto
correction(supervised
devices only)

If deselected, disables
keyboard auto-correction.
Available for iOS 8.1.3 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow spell
check(supervised
devices only)

If deselected, disables spell
check.
Available for iOS 8.1.3 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow Define(supervised
devices only)

If deselected, disables
definition look-up.
Available for iOS 8.1.3 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow dictation(iOS 10.3 andlater withsupervised
devices only)

When deselected, disables
dictation input method.
Disabled automatically whenusing Advanced Audio Coding(AAC) mode.
Available for iOS 10.3 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow Wallet

If deselected, Wallet

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 608

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

notifications inLock screen

notifications will not be shownon the lock screen.

Show Control
Center in LockscreenIf disabled, prevents Control
Center from appearing on the
Lock screen.

allowLockScreenControlCenter

Yes

Show
Notification
Center in LockscreenIf deselected, the Notifications
view in Notification Center on
the lock screen is disabled.

allowLockScreenNotificationsView

Yes

Show Today
view in LockscreenIf deselected, the Today viewin Notification Center on thelock screen is disabled.

allowLockScreenTodayView

Yes

Defer software
updates for __days (iOS 11.3,
tvOS 12.2 andlater withsupervised
devices only)Enter the number of days bywhich you want to defersoftware updates. The default
is 30 days, and the maximum
is 90 days.

enforcedSoftwareUpdateDelay

No

forceDelayedSoftwareUpdates

Available for iOS 11.3 andtvOS 12.2 through the mostrecently released version of
iOS/tvOS as supported by
MobileIron.

Force Password
on AirPlay
incoming
requests (tvOS
up to 10.1)

Select to force the usage of apassword for all AirPlay
incoming requests for device
pairing.

forceAirPlayIncomingRequestsPairingPa
sswordNoallowAirPlayIncomingRequests

Yes

Available for tvOS 11.3
through the most recently
released version of tvOS as
supported by MobileIron.

Allow incoming
AirPlay requests(tvOS 11.3 andlater)

Select to allow incoming
AirPlay requests.
Available for tvOS 11.3
through the most recently
released version of tvOS as
supported by MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 609

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

Allow pairingwith Remoteapp (tvOS 11.3
and later)

Select to allow pairing with aremote app.

allowPairingRemoteApp

Yes

forceAutomaticDateAndTime

No

allowPasswordAutoFill

Yes

allowPasswordProximityRequests

Yes

allowPasswordSharing

Yes

Available for tvOS 11.3
through the most recently
released version of tvOS as
supported by MobileIron.

Force automatic
date & time
setting (iOS12.0, tvOS 12.2
and later withsupervised
devices only)

When selected, the user
cannot turn it off. Note that thedevice's time zone will only be
updated when the device candetermine its location.
Available for iOS 12.0 andtvOS 11.3 through the mostrecently released version of
iOS/tvOS as supported by
MobileIron.

Allow AutoFill
Password(iOS 12.0 andlater withsupervised
devices only)

Select to allow password
autofill.
Available for iOS 12.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow nearby
devices torequestpasswords(iOS / tvOS
12.0, and laterwith supervised
devices only)

Select to allow nearby devices
to request device passwords.

Allow users toshare theirpasswords
using AirDrop
Passwords
feature(iOS 12.0 and

Select to allow users to share
their device passwords using
Airdrop Passwords feature.

Available for iOS 12.0 andtvOS 12.0 through the mostrecently released version of
iOS/tvOS as supported by
MobileIron.

Available for iOS 12.0 throughthe most recently released
version of iOS as supported by

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 610

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

later withsupervised
devices only)

MobileIron.

Allow managed
apps to write
contacts tounmanaged
contacts
account (iOS12.0 and later)

Select to allow managed apps
to write contacts tounmanaged contacts account.

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

allowManagedToWriteUnmanagedContacts

Yes

allowUnmanagedToReadManagedContacts

Yes

allowESIMModificationYes

allowContinuousPathKeyboard

Yes

allowDeviceSleep

Yes

Available for iOS 12.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow
unmanaged
apps to readfrom managed
contacts
account (iOS12.0 and later)

Select to allow unmanaged
apps to read from managed
contacts account.
Available for iOS 12.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow modifying
the eSimconfiguration(iOS 12.1 andlater withsupervised
devices only)

Select to allow modifying theeSim configuration, whichallows adding or removing acellular plan.
Available for iOS 12.1 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow

Select to allow continuous

continuous path

path keyboard on supervised

keyboard (iOSdevices.

13.0 and laterwith supervised
devices only)

Available for iOS 13.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow device
sleep (tvOS

Select to allow device to sleep.
Available for tvOS 13.0

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 611

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

13.0 and later

through the most recently

with supervised

released version of tvOS asdevices only)

supported by MobileIron.

Allow Find My

Select to allow Find My Device

Device (iOSin the Find My app for13.0 and later

supervised devices.

with supervised
devices only)

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

allowFindMyDevice

Yes

allowFindMyFriends

Yes

forceWiFiPowerOn

No

allowFilesUSBDriveAccessYes

allowFilesNetworkDriveAccess

Yes

Available for iOS 13.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow Find My

Select to allow Find My

Friends (iOSFriends for supervised

13.0 and later

devices.

with supervised
devices only)

Available for iOS 13.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Wi-Fi on or off

Select to force Wi-Fi power
on/off for supervised devices.

(iOS 13.0 and

Available for iOS 13.0 throughlater withthe most recently released

supervised

version of iOS as supported bydevices only)

MobileIron.

Allow USB drive
access in Files

Select to allow USB drive
access in Files app.

app (iOS 13.0

Available for iOS 13.0 throughand later withthe most recently released

supervised

version of iOS as supported bydevices only)

MobileIron.

Allow Network
drive access inFiles app (iOS13.0 and laterwith supervised

Select to allow network drive

Allow turning

access in the Files app.
Available for iOS 13.0 throughthe most recently released

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 612

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

devices only)

version of iOS as supported by

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

MobileIron.
Application Restrictions
Allow Use of
iTunes StoreWhen deselected, the iTunes
Music Store is disabled and its
icon is removed from theHome screen. Users cannot
preview, purchase, or
download content.

allowiTunes

Yes

Allow News
(supervised
devices only)

If deselected, prevents thedevice user from accessingNews.

allowNewsYes

allowPodcasts

Yes

Available for iOS 9.0 throughthe most recently released
version of iOS as supported by
MobileIron.
Allow Podcasts(supervised
devices only)

Select to display the default
Apple Podcast app. Deselectto hide the Apple Podcast app.
Available for iOS 8.0 throughthe most recently released
version of iOS as supported by
MobileIron.

Allow use of
Game Center(supervised
devices only)

When deselected, Game
Center is disabled and its icon
is removed from the Home
screen.

allowGameCenter

Yes

Allow
multiplayer
gamingWhen deselected, prohibits
multiplayer gaming. Disabled
when Allow use of Game
Center is deselected.

allowMultiplayerGaming

Yes

Allow adding
Game Center
friends

When deselected, prohibits
adding friends to Game
Center. Disabled when Allowuse of Game Center isdeselected.

allowAddingGameCenterFriends

Yes

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 613

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

Allow use of
Safari

Deselect to disable the Safari
web browser, remove its iconfrom the Home screen, andprevent users from opening
web clips.

allowSafari

Yes

When deselected, thefollowing restrictions are also
disabled: Enable autofill, Forcefraud warning, Enable
Javascript, Block pop-ups,
Accept cookies.
NOTE: Safari is required for
updating
configurations on
iOS devices that are
not managed withApple's MDM
protocol.
Enable autofill

Select to turn on the autofillfeature for fields displayed in
Safari.

safariAllowAutoFill

Yes

Force
authentication
before AutoFill(iOS 11.3 andlater withsupervised
devices only,
Face ID only)

Select to require Face ID
authentication before AutoFill

forceAuthenticationBeforeAutoFill

Yes

Force fraud
warning

Select to prompt Safari toattempt to prevent users fromvisiting websites identified as
being fraudulent orcompromised.

safariForceFraudWarning

No

EnableJavascript

Select to turn on Javascript
support for Safari.

safariAllowJavaScript

Yes

Block pop-ups

Select to block pop-ups for
Safari.

safariAllowPopups

No

Available for iOS 11.3 throughthe most recently released
version of iOS as supported by
MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 614

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

Accept cookies

Select an option from the dropdown list to control when
Safari browser accepts
cookies on devices. Options
include Never, From visited
sites, From Websites I Visit,
and Always.

safariAcceptCookies

AlwaysMedia Content Ratings
Ratings region

Select a region from the dropdown list to change the region
associated with the rating
selections for applications, TVshows, and movies.

N/A

UnitedStatesAllowed content
ratings: Movies

Select a rating limit for movies
stored on the device:

N/A

Allow All
MoviesN/A

Allow AllTV shows

N/A

Allow AllApps

Don’t Allow Movies
G
PG
PG-13
R
NC-17
Allow All Movies
Allowed content
ratings:

Select a rating limit for TV
shows stored on the device:

TV Shows

Don’t Allow TV Shows
TV-Y
TV-Y7
TV-G
TV-PG
TV-14
TV-MA
Allow All TV Shows

Allowed content
ratings:

Select a rating limit for
applications on the device:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 615

iOS and tvOS restrictions settings

TABLE 102. RESTRICTIONS SETTINGS (IOS) (CONT.)
Item

Description

Apps

Don’t Allow Apps

Corresponding Apple Configurator
Property Key in Restrictions Payload

Enabledby default

allowExplicitContent

Yes

allowBookstoreErotica

Yes

4+
9+
12+
17+
Allow All Apps
Allow playbackof explicit
music,
podcasts, &iTunes U media(iOS and tvOS
11.3 and later)

When de-selected, explicit
music or video content
purchased from the iTunes
Store is hidden. Explicit
content is marked as such bycontent providers, such asrecord labels, when soldthrough the iTunes Store.
Available for iOS 11.3 andtvOS 11.3 through the mostrecently released version of
iOS/tvOS as supported by
MobileIron.

Allow explicit
sexual content
in iBooks Store(iOS and tvOS
11.3 and later)

Select to allow users to
download iBookstore material
that has been tagged as
erotica.
Available for iOS 11.3 andtvOS 11.3 through the mostrecently released version of
iOS/tvOS as supported by
MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 616

Subscribed Calendars settings

TABLE 103. RESTRICTIONS SETTINGS (IOS)
Item

Description

Enabledby default

App whitelist forSingle App Mode

Specify a list of apps that can autonomously enter single app mode onsupervised devices running iOS 7-9.1. For example, you can specify
custom exam apps for students. As soon as the student launches the app,the app enters single app mode to ensure that the student cannot use otherresources while taking the exam. This feature applies to supervised iOS
devices only, and apps with the ability to autonomously enter singleapp mode.

N/A

Use the following guidelines to complete each entry:•••

Enter the app name defined in the app’s bundle.
Enter the bundle identifier for this app.
One way to find the bundle identifier is to add the app to the App Catalog
on MobileIron Core. After you add the app, edit the app entry to see theInventory Apps field, which lists the bundle ID for the app.
Enter an optional description for the app.

NOTE: This feature is different from single-app mode policy, whichenables an administrator to configure a specific app to run insingle-app mode on devices to the exclusion of any otherapps. For more information about setting a single-app mode
policy, see Single-app mode policies.

Subscribed Calendars settings
Select Policies & Configs > Configurations > Add New > Apple > iOS / tvOS > Subscribed Calendars to
configure read-only calendar subscriptions for the device’s Calendar application.
A list of public calendars you can subscribe to is available at www.apple.com/downloads/macosx/calendars/.
NOTE: This setting does not apply to tvOS devices.
The following table describes the settings for subscribed calendars.

TABLE 104. SUBSCRIBED CALENDARS SETTINGS (IOS)
Item

Description

Name

Enter brief text that identifies this group of iOS subscribed calendar settings.

Description

Enter additional text that clarifies the purpose of this group of iOS subscribedcalendar settings.

URL

Enter the URL for accessing the subscribed calendar.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 617

APN settings

TABLE 104. SUBSCRIBED CALENDARS SETTINGS (IOS) (CONT.)
Item

Description

Use SSL

Select to use SSL for data transfer.

User Name

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format. Custom attribute variable substitutions aresupported.
Why: Some enterprises have a strong preference concerning which identifier is
exposed. See Supported variables.

Password

Specify the password to use. The default value is $PASSWORD$. Use thisfield to specify a custom format, such as $PASSWORD$_$USERID$.
Custom attribute variable substitutions are supported. See Supported
variables.

iOS devices accept settings for up to four subscribed calendars. Therefore, any additional calendar settings
applied to an iOS device will be ignored.
Supported variables
You can use the following variables in fields that support variables.
l$USERID$l$EMAIL$l$NULL$l$USER_CUSTOM1$... $USER_CUSTOM4$ (custom fields defined for LDAP)

Custom attribute variable substitutions are supported.

APN settings
Select Policies & Configs > Configurations > Add New > Apple > iOS / tvOS > APN to define parameters
for access point interactions, which define how the device accesses the operator’s network.
IMPORTANT:llApple disabled APN settings in iOS 9.0, but re-enabled APN settings in iOS 9.0.1. Apple has replaced the
APN setting with a cellular policy. MobileIron strongly recommends creating a cellular policy for new
configurations. To create a cellular policy, see Cellular policies.
MobileIron Core supports the use of APN settings for iOS devices running iOS 7 through iOS 8.4, as well
as iOS 9.0.1 through iOS 9.0.2. APN settings cannot be used on iOS 9.0 devices, as Apple does notsupport APN settings on iOS 9.0.

APN settings do not apply to macOS devices.
NOTE: This setting does not apply to tvOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 618

Provisioning Profile settings

The following table describes the APN settings.

TABLE 105. APN SETTINGS (IOS)
Item

Description

Access Point Name

Identifier available from the operator.

Description

Enter additional text that clarifies the purpose of this group of iOS
APN settings.

User NameEnter a user name authorized for this access point.

Password

Enter the password corresponding to the user name entered.

Proxy ServerEnter the IP address or URL of the APN proxy.

Port

Enter the port number of the APN proxy.

Provisioning Profile settings
A provisioning profile is a file containing verification information for an app. Apps are not usable on iOS without acurrent provisioning profile. There are two types of provisioning profile: app-specific, and wildcard, which works formore than one app. Provisioning profiles are required for distributing in-house apps through the MobileIron Core
Admin Portal.
NOTE: This setting does not apply to tvOS devices.
Procedure
1. Go to Policies & Configs > Configurations.
2. Click Add New > Apple > iOS / tvOS > Provisioning Profile. The New Provisioning Profile Setting
dialog box opens.
3. In the space provided, enter a name and description for the provisioning profile, such as
MyInHouseApp1Prov and “Provisioning profile for in-house app 1”.
4. Click Choose File.
5. Browse for the provisioning profile and click Open.
6. Click Save.
7. Select the provisioning profile you created.
8. Select Actions > Apply to Label.
9. Select the labels to which you want to apply the provisioning profile, such as iOS.
10. Click Apply.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 619

Web content filter settings

Web content filter settings
Starting with iOS 7, supervised iOS devices support web content filtering. Web content filtering restricts the web
sites that any browser on a supervised device can access. This feature is useful, for example, in fleet-based lockdown environments, such as retail stores or schools.
MobileIron Core supports configuring web content filters on the Admin Portal. You can do one of the following:l

Block access to sites containing adult content.

lConfigure the device’s set of accessible sites.

NOTE: This setting does not apply to tvOS devices.

Configuring the web content filter
Procedure
1. In the Admin Portal, go to Policies and Configs > Configurations.
2. Click Add New > iOS / tvOS > Web Content Filter. The New Web Content Configuration dialog box
opens.
3. Use the following guidelines to create or edit a web content configuration:
TABLE 106. WEB CONTENT FILTER CONFIGURATION SETTINGS
Item

Description

Name

Enter brief text that identifies this web content configuration.

Description

Enter additional text that clarifies the purpose of this web content
configuration.

Allowed Websites••

Permitted URLs

Limit Adult Content
Select this option if you want to block access to web sites based on
iOS automatic filters. These filters attempt, with a high degree of
accuracy, to block websites with inappropriate content.
Specific Web Sites Only
Select this option if you want to manually list the accessible web
sites.

Available only if you selected Limit Adult Content.
These URLs are accessible even if the iOS automatic filters block them.
To add a permitted URL, click +.
To delete a permitted URL, click -.
You can add up to 50 permitted URLs.

URLEnter the permitted URL. The URL must begin with either:• http://MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 620

Configuring the web content filter

TABLE 106. WEB CONTENT FILTER CONFIGURATION SETTINGS (CONT.)
Item

Description•

https://

NOTE: If you want to permit both http:// and https:// for the same
site, include a row for each URL.
All URLs for which the initial characters match the given permitted URL
are accessible.
Example:http://www.someCompanySite.com
permits access to the following:
http://www.someCompanySite.com
http://www.someCompanySite.com/jobs
http://www.someCompanySite.com/products
Description

Enter additional text that clarifies the purpose of this permitted URL.

Blacklisted URLs

Available only if you selected Limit Adult Content.
These URLs are blocked even if the iOS automatic filters allow them.
To add a blacklisted URL, click +.
To delete a blacklisted URL, click -.
You can add up to 50 blacklisted URLs.

URLEnter the blacklisted URL. The URL must begin with either:• http://• https://
NOTE: If you want to block both http:// and https:// for the same
site, include a row for each URL.
All URLs for which the initial characters match the given blacklisted URL
are blocked.
Example:http://www.someCompanySite.com
blocks access to the following:
http://www.someCompanySite.com
http://www.someCompanySite.com/jobs
http://www.someCompanySite.com/products

Description

Enter additional text that clarifies the purpose of this blacklisted URL.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 621

Browser impact

TABLE 106. WEB CONTENT FILTER CONFIGURATION SETTINGS (CONT.)
Item

Description

Specific Websites

Available only if you selected Specific Web Sites Only.
These URLs are the only accessible sites. On Safari, they are added as
bookmarks. Any existing bookmarks on Safari are disabled.
To add an accessible URL, click +.
To delete an accessible URL, click -.

URLEnter the URL of a website you want to make accessible. The URL must
begin with either:• http://• https://
NOTE: If you want to make both http:// and https:// for the samesite accessible, include a row for each URL.
If you are using the Apps@Work or Secure Sign-in web clips, include an
entry for the URL of MobileIron Core. Otherwise, these web clips cannot
work.

Name

The title of the bookmark in Safari.

Bookmark

Optionally enter the folder into which the bookmark should be added in
Safari.
Example:/Sales/Products/
If absent, the bookmark is added to the default bookmarks directory.

Description

Optionally enter additional text that clarifies the purpose of this URL.

4. Click Save.
5. Select the web content configuration you just created.
6. Select Actions > Apply To Label.
7. Select the labels to which you want to apply this web content configuration.
8. Click Apply.

Browser impact
The web content filter feature impacts all browsers and web views on the device including:l

Safari
When using the option “Specific Web Sites Only”, only Safari displays the bookmarks that you specify.
Other browsers do not.

l

Web@Work

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 622

Removing a Web content configuration from a devicelApps@Worklthe Secure Sign-in web cliplother browsers and web views

Therefore, if you use the option “Specific Web Sites Only”, be sure to include the URL for your MobileIron Core sothat the Apps@Work and Secure Sign-in web clips work.

Removing a Web content configuration from a device
A web content configuration is removed from a device when:l

You remove the label associated with the device from the setting, and the device checks in.

l

You remove the web content configuration, and the device checks in.

l

You retire the device.

Multiple web content configurations on a device
If you apply multiple web content configurations to a device, web access works as follows:ll

The URL is accessible only if all of the web content configurations on the device allow it and none of the
web content configurations block it.
The URL is blocked if any of the web content configurations block it.

Managed App Config settings that use plists
An additional license is required for this feature.
Select Policies & Configs > Configurations > Add New > Apple > iOS / tvOS > Managed App Config toprovide app configuration to a managed app. In this setting, you provide a property list (plist) file as specified by theapp vendor or developer.
When a managed app gets its configuration from MobileIron Core, the device user does not have to manually enter
the configuration. This feature results in easier app deployment and fewer support calls for you, and a better user
experience for the device user.
Note The Following:lllThis setting does not apply to tvOS devices.
The AppConfig Community (AppConfig.org) describes another mechanism for managed app configuration.
Using the AppConfig Community mechanism on Core is described in in “Managed App Configuration
settings in the app in the App Catalog” in the MobileIron Apps@Work Guide.
By default, the managed app configuration settings in the app in the App Catalog (AppConfig Community
mechanism) override the Managed App Config setting that uses a plist. However, you can specify that theManaged App Config setting has precedence, as described in “Precedence of the iOS managed app

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 623

Managed App Config with plist overview

configuration in the App Catalog versus the Managed App Config setting” in theMobileIron Apps@Work
Guide.

Managed App Config with plist overview
Providing a managed app with an app configuration involves these high-level steps:
1. You get a plist file containing the app configuration from the app vendor or developer. The plist is a text filein XML format.
2. Edit the file as directed by the app’s managed app configuration documentation. For example,
documentation can instruct you to replace a default server value in the plist with a URL for one of yourenterprise servers.
3. You create a Managed App Config setting on MobileIron Core.
4. When you create the setting, you upload the plist file to Core.
5. You apply labels to the setting to indicate which devices the setting applies to.
6. MobileIron Core sends the setting to the device when the device checks in.
7. The managed app installed on the device accesses the configuration using iOS programming interfaces.
NOTE: You can apply a Managed App Config setting to a device before the app is installed on thedevice. When the app is installed, it accesses the configuration. Until then, the configuration has
no impact on the device.

Configuring the Managed App Config setting
Before you begin
Edit the provided plist with values specific to your enterprise, as directed by the app documentation. You can use
any text editor or plist editor. Put the edited plist file into a folder accessible from your Admin Portal.
Procedure
1. In the Admin Portal, go to Policies & Configs > Configurations.
2. Click Add New > Apple > iOS / tvOS > Managed App Config. The New Managed App Config Setting
dialog box opens.
3. Use the following guidelines to create or edit a Managed App Config setting:Item

Description

Name

Enter brief text that identifies this Managed App Config setting.

Description

Enter additional text that clarifies the purpose of this Managed App
Config setting.

BundleId

Enter the bundle ID of the managed app.

File

Click Choose File.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 624

Viewing the plist file

Item

Description
Select the plist file that contains the app configuration for the app.
NOTE: MobileIron Core does not validate the plist file’s type orcontents.

4. Click Save.
5. Select the Managed App Config setting you just created.
MobileIron Core assigns the setting the type MDM APP CONFIG.
6. Select Actions > Apply To Label.
7. Select the labels to which you want to apply this Managed App Config setting.
8. Click Apply.
Note The Following:lll

You cannot edit the Managed App Config setting, including uploading a different plist file. If changes arenecessary, delete the Managed App Config setting and create a new one. Be sure to re-apply labels.
You can apply only one Managed App Config setting for each app to each device, including when morethan one version of the app is installed on a device.
The configuration information is not encrypted on the device. The configuration should therefore not containany sensitive information, such as passwords or private keys.

Viewing the plist file
Procedure
1. On the Admin Portal, go to Policies & Configs > Configurations.
2. Select a Managed App Config setting.
3. Select View File Data in App Settings Detail pane.
A pop-up displays the file contents.
4. Close the pop-up when you are done viewing the file contents.

Removing a Managed App Config setting from a device
A Managed App Config setting is removed from a device when:l

You remove the label associated with the device from the setting, and the device checks in.

l

You remove the Managed App Config setting, and the device checks in.

l

You retire the device.

When the Managed App Config setting is removed, the managed app automatically removes its use of theconfiguration.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 625

Supported variables

Supported variables
The plist can use the MobileIron Core variables described in the following table:

TABLE 107. MOBILEIRON CORE VARIABLES FOR PLIST FILES
Variable

Description$DEVICE_MAC$

The Wi-Fi MAC (Media Access Control) address of the device.

$DEVICE_UDID$

The unique device identifier of the device.

$DISPLAY_NAME$

The display name of the device user.

$EMAIL$The email address of the device user.

$FIRST_NAME$

The first name of the device user.

$LAST_NAME$

The last name of the device user.

$USERID$

The user ID of the device user.

When MobileIron Core sends the configuration to a device, it substitutes the appropriate values for the variables.

Sample plist
A plist is a text file in XML format. The XML content vary for each app, and the contents have been validated by theapp developer. The following is a sample plist, included here only to illustrate the format you can expect:<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN""http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>Server</key><string>http://www.somecompanyserver.com</string><key>Some Dict</key><dict><key>A</key><string>$DISPLAY_NAME$</string><key>C</key><string>$DEVICE_UDID$</string></dict><key>Some Array</key><array><string>abc</string><string>val</string><string>$DEVICE_MAC$</string></array>

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 626

Google Account</dict></plist>Google Account
You can set up a Google email account for communication service rules for an audio service. All calls initiated on
iOS devices to the contacts on the Google contact list will be using the default audio service. Each Google payload
sets up a Google email address as well as any other Google services the device user enables after authentication.
Procedure
1. In the Admin Portal go to Policies & Configs > Configurations.
2. Click Add New > Apple > iOS and tvOS > Google Account.
3. In the New Google Account Configuration dialog box, enter the following:
Item

Description

Name

Enter brief text that identifies this email account.

Description

Enter additional text that clarifies the purpose of this Google account.

Google Account Name

When an email is sent from this Google account, the name entered here
displays who the email is from.
You can use substitution variables in this field. MobileIron recommends
using $DISPLAY_NAME$.

Email AddressEnter the Google email address of this account. Typically, you use the
MobileIron Core substitution variable $EMAIL$. For more information
on substitution variables, see Custom compliance policies.

Communication Service
Rules (iOS 10 and Later)

Select a default audio service or app to be associated with the device
user's accounts on the Google servers. All calls initiated on the iOS
device to contacts from contact lists stored on the server will use theselected audio service by default. This feature is supported on devices
running iOS 10 through the most recently released version as supported
by MobileIron.
To enable communication service rules:• Select Choose a default app to be used when calling contacts
from this account. A drop-down list of apps is displayed.
• Click the drop-down list to select the default audio app or service.

4. Click Save.
5. In the Configurations page, select the box next to the Google email account configuration you created, andselect Actions > Apply To Label.
6. In the Apply to Label dialog box, select the label(s) to which you want to apply the Google email accountand click Apply.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 627

Managed domains settingsOnce pushed to devices, the device user is invited to go to Settings > Passwords & Accounts to enter the
password to the Google email account.

Managed domains settings
Managed domains enable you to specify which domains are trusted for Mail and Safari on iOS and macOS devices.
Once the configuration is applied to the device:lll

Email from domains that are not specified in the configuration will be highlighted (untrusted) in the native
Mail app.
Documents downloaded from domains that are specified in the configuration will be considered managed
for the purposes of the Safari on the device. Use this configuration combined with restrictions to control thedata downloads allowed in Safari.
Device users will be unable to use the Safari autofill feature for passwords unless the URLs they accesshave been specifically configured as managed Safari password autofill domains.

Managed domains work together with the managed app options in the restrictions configuration. MobileIron Corerequires a special license for using these options.
NOTE: This setting does not apply to tvOS devices.

Configuring managed domains
Procedure
1. In the Admin Portal, select Policies & Configs.
2. Click Add New > Apple > iOS / tvOS > Restrictions. The New Restrictions Setting dialog box opens.
3. Create a restrictions configuration with at least the following settings not checked:lAllow documents from managed apps to unmanaged appslAllow documents from unmanaged apps to managed apps

4. Apply the configuration to an appropriate label to distribute it to target devices.
5. In the Admin Portal, select Policies & Configs > Configurations.
6. Click Add New > Apple > iOS / tvOS > Managed Domains. The Managed Domains Configuration
dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 628

Domain formats

7. Use the following guidelines to complete the form:
Item

Description

Name

Enter brief text to identify this configuration. Note that this text will
display in the iOS Settings app on the device.

Description

Enter optional text to clarify the purpose of this configuration.

Email Domains

Click Add+ to enter an email domain, such as mycompany.com.
Email domains may not include the wild card format “/* ”. Any email
address lacking a suffix specified in the list of managed email
domains will be highlighted as out-of-domain in the Mail app.
Note that the www prefix and trailing slashes are ignored.

Web Domains

Click Add+ to enter a web domain, as in mycompany.com. Note thatthe www prefix and trailing slashes are ignored. See Domain formats
for more information.

Managed Safari
Password Auto Fill
Domains (iOS 9.3+
Supervised Only)

Click Add+ to enable password auto-fill and auto-save for URLs
matching a specific Safari web domain. Supported on supervised
devices running iOS 9.3 through the most recently released version
as supported by MobileIron.
Notes:• The managed Safari password auto-filled domain feature isdisabled on multi-user devices.
• Safari will only save and auto-fill passwords on web pages thatare configured for auto-fill. Password auto-fill will not work on
domains where auto-fill is not configured, even if you add thedomain to the list.
• The www prefix and trailing slashes are ignored.
• If a managed Safari password auto-fill domain contains a port
number, Safari will only manage URLs that specify that port
number. Otherwise, the domain will be matched without regard to
the specified port number.
For example, the pattern *.example.com:8080 will match
http://site.example.com:8080/page.html , but not
http://site.example.com/page.html . The pattern*.example.com will match both URLs.
• Be sure to enable saving passwords on all iOS devices before
enabling this feature. On the iOS device, select Settings > Safari> Autofill > Names and Passwords > Enable.

8. Apply the configuration to an appropriate label to distribute it to target devices.

Domain formats
Use the following table as a guideline for entering both web domains and managed Safari password auto-filldomains:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 629

Managed domains example

TABLE 108. WEB DOMAIN AND MANAGED SAFARI PASSWORD AUTO-FILL DOMAIN FORMATS
Enter

To match

To exclude

company.com

company.com/*site.company.com/

site.company.com

site.company.com/*company.com/
site2.company.com/*.company.com

site.company.com/*company.com/

site2.company.com/*company.com/folder

company.com/folder/*company.com/*.company.com/folder

foo.company.com/folder

company.com

bar.company.com/folder

foo.company.com/

foo.apple.com/folder

company.com

foo.apple.com/folder2

company.com/sub

foo.apple.com/folder/folder

foo.company.com/

foo.company.com/folder

bar.company.com/folder*.cocompany.cocompany.co.uk

beats.cocompany.com

company.co/folder
NOTE: If you specify a port number, then only addresses that specify that port number will be matched.
Otherwise, port 80 will be assumed for http and port 443 will be assumed for https.

Managed domains example
Acme, Inc. wants to use managed domains to do the following:lprovide a cue to users who are about to email content outside of Acme, Inc.

lprevent users from emailing confidential documents downloaded from their website

They have created the following managed domain configuration and assigned it to a label that identifies all iOS 8
devices:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 630

Managed domains example

FIGURE 17. MANAGED DOMAINS CONFIGURATION EXAMPLE

They have also created a restrictions configuration and assigned it to the same label as the managed domains
configuration. The restrictions configuration has the managed apps options disabled, as shown in the following
figure.

FIGURE 18. RESTRICTIONS SETTING EXAMPLE

As a result of these two configurations, external addresses are highlighted in red when a user composes an email in
the native Mail app:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 631

Network usage rules settings

FIGURE 19. HIGHLIGHTED EXTERNAL ADDRESSES IN EMAIL

Also, users who use Safari to download documents from acme.com/confidential find that the usual Mail andMessage apps are not available for these documents because they are not managed apps.

FIGURE 20. UNMANAGED APPS ARE NOT AVAILABLE

Network usage rules settings
MobileIron Core allows you to control the cellular network usage for any given managed app on iOS 9 through themost recently released version as supported by MobileIron. With a network usage configuration, you can prohibit
specific managed apps from using cellular data when roaming, or from using cellular data at all. For example, you
can configure YouTube as a managed app to be used only when connected to Wi-Fi.
Note The Following:lll

If you create a cellular data rule with the wildcard value com.* , this rule will prohibit the use of other apps
when using a cellular data connection, as the com.* rule takes precedence over any other allowed apps
beginning with com.* (such as com.mobileiron.helpatwork ) . This is an Apple issue
Given an iPad managed by MobileIron Core with a network usage configuration prohibiting the use ofcellular data for a given managed app, if the iPad is removed from MobileIron Core management, the app
continues to prohibit the use of cellular data in that app until the device is factory reset. This is an Apple
issue.
This setting does not apply to tvOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 632

Configuring network usage for managed apps

Configuring network usage for managed apps
Network usage configurations allow you to control whether device users can access the managed apps you
specify while roaming or using the cellular data network. Network usage configurations can thus lower the cost ofcellular data usage for your organization.
Procedure
1. Go to Policies & Configs > Configurations.
2. Click Add New.
3. Go to Apple > iOS / tvOS > Network Usage Rules. The New Network Usage Rules Configuration
dialog box opens.
4. Use the following guidelines to fill in the form:
Item

Description

Name

Enter a name for the network usage rules configuration.

Description

Enter a brief description that explains the purpose of thisconfiguration.

Network Usage Rules
Disallow Roaming on Cellular
Data

Click Add to list the bundle IDs of apps for which you want toprohibit roaming on cellular data. Select the relevant app from thedrop-down list that appears.
Alternatively, enter a wildcard match for the URLs you want toprohibit roaming on cellular data. A wildcard must appear after aperiod, and can only be used once at the end of the search string.
For example: com.example.*
To delete a rule, click the X icon next to it.

Disallow Cellular Data

Click Add to list the bundle IDs of apps for which you want toprohibit the use of cellular data. Select the relevant app from thedrop-down list that appears.
Alternatively, enter a wildcard match for the URLs you want toprohibit the use of cellular data. A wildcard must appear after aperiod, and can only be used once at the end of the search string.
For example: com.example.*
To delete a rule, click the X icon next to it.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 633

Configuring network usage for managed apps

FIGURE 21. NETWORK USAGE RULES CONFIGURATION: DISALLOW ROAMING ON CELLULAR DATA

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 634

Configuring network usage for managed apps

FIGURE 22. NETWORK USAGE RULES CONFIGURATION: DISALLOW CELLULAR DATA

5. Click Save.
6. Select the network usage rule configuration you just created.
7. Go to Actions > Apply to label.
8. Select the labels you want to apply.
9. Click Apply.
What device users see
Device users will be able to run managed apps prohibited from accessing cellular networks when roaming or
prohibited from using cellular data. However, when attempting any action requiring the use of cellular data, they will
receive a timeout or similar error.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 635

Enterprise single sign-on account settings with Kerberos

FIGURE 23. TIMEOUT ERROR IF ROAMING OR CELLULAR DATA IS DISALLOWEDEnterprise single sign-on account settings with Kerberos
With enterprise single sign-on (SSO) with Kerberos, device users can log into your internal backend resources
without having to re-enter their enterprise credentials. Creating a single sign-on account configuration is part of alarger configuration to set up single sign-on using Kerberos. The single sign-on setup using Kerberos requires
MobileIron Standalone Sentry and MobileIron Tunnel.
NOTE: This setting does not apply to tvOS devices.

URLs and bundle IDs in enterprise single sign-on settings
When you configure enterprise SSO, you specify the URLs of the backend resources that the device user canaccess using SSO. The backend resource must support Kerberos based authentication.You can also specify
bundle IDs (app IDs). If you specify any bundle IDs, then only the specified apps use enterprise SSO whenaccessing the specified URLs. If you specify no bundle IDs, then all apps that support enterprise SSO use it whenaccessing the specified URLs.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 636

Identity certificates in enterprise single sign-on settings

Identity certificates in enterprise single sign-on settings
When you configure enterprise SSO, you can optionally specify an identity certificate. The app uses this certificate
to authenticate the device user to a backend resource when the Kerberos ticket has expired. Once authenticated,
the Kerberos ticket is silently renewed.
If you do not provide an identity certificate, the device user is prompted to enter a user ID and password when theKerberos ticket has expired. Therefore, providing an identity certificate results in a better device user experience.

Configuring a Single Sign-on Account Configuration
For a complete set of configuration tasks for setting up enterprise single sign-on using Kerberos, and for a
description of the fields in the single sign-on account configuration, see the MobileIron Tunnel for iOS Guide for
Administrators.

macOS settings
MobileIron Core allows you to define a number of macOS restrictions.
All restrictions are available to devices running macOS 10.12 through the most recently released version ofmacOS, as supported by MobileIron. Some restrictions are available on other versions of macOS. These areusually indicated by an information icon in the user interface.
lmacOS Kernel Extension settingslmacOS restrictionslmacOS Apple App Store restrictionslDisc settings for macOSlMedia Control setting for macOSmacOS Kernel Extension settings
Starting from macOS High Sierra 10.13.2, Apple introduced the concept of “User Approved” MDM Enrollment. This
optional enrollment type allows MDM management of certain security-sensitive settings. Using the macOS Kernel
Extension loading enables the device user to one of the following:lDevice user manually installs an MDM enrollment profile using System Preferencesl

All Device-enrolled Macs are considered user-approved enrollment.

The Kernel Extension Policy payload is designated by specifying com.apple.syspolicy.kernel-extension-policy as
the PayloadType. This payload controls restrictions and settings for User Approved Kernel Extension Loading on
macOS v10.13.2 and later. The profile containing the payload must be delivered via a User Approved MDM server,and it must be installed as a device profile.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 637

macOS restrictions

In addition to the settings common to all payloads, this payload defines the following keys.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > macOS Only > macOS Kernel Extensions. The New macOS Kernel
Extension Setting dialog box opens.
3. Select Add+ and configure the settings as described in the table below.
Item

Description

ExampleName

Enter the name of the kernel
extension policy. This will
display in the Configurations
page.

Test_kext

Description

Enter an optional description
for the policy.

Kernel Ext Policy Name

Allow User
Overrides

Select this check box to allow
device users to approve
additional kernel extensions
not explicitly allowed by thisconfiguration.

N/A

Allowed Team
IdentifiersEnter the name of team
identifiers that all validlysigned kernel extensions areallowed to load. The type usedshould be string.

PXPZ95SK77

Allowed Kernel
Extensions

Enter a dictionary that
represents a set of validlysigned kernel extensions thatwill always be allowed to loadon the user's device.

com.paloaltonetworks.kext.pangpd(for Application: Global Protect VPN)

This corresponds to Allowed Team Identifier
example PXPZ95SK77

4. Repeat step 3 for any additional team identifiers and kernel extensions.
5. Click Save. The kernel extension displays in the Configurations page.

macOS restrictions
The macOS restrictions setting can be configured for the user or device channel. For devices running macOS 10.12
through the most recently released version as supported by MobileIron, the default is user channel. If you want toapply the restrictions setting to macOS devices regardless of what user is logged in, select Device channel. If you
want the restrictions setting to apply to a specific user, select User channel.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 638

macOS restrictions settings

A macOS device should only have a single managed user. However, a macOS device may also have an admin
user. If you want the restrictions setting to apply to the whole device regardless of whatever user logs in, selectDevice channel.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > macOS Only > macOS Restrictions to specify lockdown capabilities formacOS.
3. Configure the settings as described in Table 109. macOS restrictions settings .
4. Click Save.
5. If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click
Confirm. For more information, see Best practices: label management.

macOS restrictions settings
The following table describes the macOS restrictions settings.

TABLE 109. MACOS RESTRICTIONS SETTINGS
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

Name

Enter a name forthe macOS
restriction setting.

N/A

N/A

Description

Enter adescription for themacOS restriction
setting.

N/A

N/A

Restrictions
channel

•

N/A

User

•

User: Selectto apply
restrictions tothe usersigned in to
the macOS
device.
Device:Select to
apply
restrictions to
the macOS
device,MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 639

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

allowCamera

Yes

allowCloudDocumentSync

Yes

allowCloudPhotoLibraryYesregardless of
the usercurrently
signed in.
Allow use ofcameraDeselect todisable thecamera andremove its iconfrom the Home
screen. Users will
be unable to takephotographs.
Available formacOS 10.11
through the mostrecently released
version of macOS
as supported by
MobileIron.

Allow document
and key-value
sync to iCloud

When deselected,
disablesdocument andkey-value syncing
to iCloud.
Available formacOS 10.11
through the mostrecently released
version of macOS
as supported by
MobileIron.

Allow iCloudPhoto Library

If deselected,
disables iCloudPhoto Library.
Any photos not
fully downloaded
from iCloud Photo
Library to the

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 640

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

allowDefinitionLookup

Yesdevice will be
removed fromlocal storage.
Allow definition
lookupIf deselected,
disables definition
look-up.
Available formacOS 10.11.2
through the mostrecently released
version of macOS
as supported by
MobileIron.

Allow Back to My
Mac iCloud
service

When deselected,
disables macOS
Back to My Mac
iCloud service.

allowCloudBTMM

Yes

Allow Find My
Mac iCloud
service

When deselected,
disables macOS
Find My Mac
iCloud service.

allowCloudFMM

Yes

Allow iCloud
Bookmark sync

When deselected,
disables macOS
iCloud Bookmarksync.

allowCloudBookmarks

Yes

Allow iCloud Mail
service

When deselected,
disables macOS
Mail iCloud
services.

allowCloudMail

Yes

Allow iCloudCalendar service

When deselected,
disables macOS
iCloud Calendar
services.

allowCloudCalendar

Yes

Allow iCloud
Reminderservice

When deselected,
disables iCloud
ReminderallowCloudReminders

Yes

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 641

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

services.
Allow iCloud
Address Book
service

When deselected,
disables macOS
iCloud Address
Book services.

allowCloudAddressBook

Yes

Allow iCloud
Notes service

When deselected,
disables macOS
iCloud Notes
services.

allowCloudNotes

Yes

Allow iCloud
Keychainsynchronization

When deselected,
disables Cloudkeychainsynchronization.

allowCloudKeychainSync

Yes

Allow Music
service

If disabled, Music
service isdisabled andMusic app reverts
to classic mode.

allowMusicService

Yes

Allow Spotlight
Internet search
results

If deselected,
Spotlight will not
return Internet
search results.

allowSpotlightInternetResultsYesallowFingerprintForUnlock

Yes(supervised only)

Available formacOS 10.11
through the mostrecently released
version of macOS
as supported by
MobileIron.
Allow Touch ID
to unlock adeviceIf selected, allows
Touch ID tounlock a device.
Available formacOS 10.12.4
through the mostrecently released

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 642

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

version of macOS
as supported by
MobileIron.
Allow macOS
auto unlock

If deselected,
disables macOS
auto unlock.

allowAutoUnlock

Yes

Allow iTunes File
Sharing

If deselected,
disables iTunes
application filesharing services.

allowiTunesFileSharing

Yes

allowContentCachingYes

allowCloudDesktopAndDocuments

Yes

Available formacOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.
Allow Content
Caching

Allow content
caching to reduce
bandwidth usage
and speed up
installation bystoring software
updates, apps,
and other content
on the device.
Available formacOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.

Allow iClouddesktop anddocuments
serviceIf deselected,
disables macOS
cloud desktop anddocument

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 643

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

allowAirPrint

Yes

forceAirPrintTrustedTLSRequirementNoallowAirPrintiBeaconDiscovery

Yes

services.
Defaults to true.
Available formacOS 10.12.4
through the mostrecently released
version of macOS
as supported by
MobileIron.
Allow Air Print

When deselected,
disables Air Print
feature.
Available formacOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.

Disallow AirPrint
to destinations
with untrusted
certificates

When selected,
requires trusted
certificates for
TLS printing
communication.
Available formacOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.

Allow discoveryof AirPrint
printers using
iBeacons

When selected,
disables iBeacon
discovery of
AirPrint printers,
preventing
spurious AirPrint
Bluetooth

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 644

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

beacons fromphishing for
network traffic.
Available formacOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.
Delay OS
Software Update
for __days

If selected,
delays user
visibility of OS
software updates.
Enter the numberof days by which
you want to delay
OS software
updates. The
default is 30 days,
and the maximum
is 90 days.

forceDelayedSoftwareUpdates

No

forceDelayedAppSoftwareUpdates

No

Available formacOS 10.13.4
through the mostrecently released
version of macOS
as supported by
MobileIron.
Delay App
Software Update
for __days

If selected,
delays user
visibility of nonOS Software
Updates.
Requires asupervised
device. Enter thenumber of days

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 645

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

If deselected,
prevents device
passcode frombeing added,
changed, or
removed.

allowPasscodeModification

Yes

Select to allow
password autofill.

allowPasswordAutoFill

Yes

allowPasswordProximityRequests

Yesby which you
want to delay app
software updates.
The default is 30
days, and the
maximum is 90
days.
Available formacOS 10.11
through the mostrecently released
version of macOS
as supported by
MobileIron.
Allow modifying
passcode(supervised
devices)

Allow password
AutoFill

Available formacOS 10.14
through the mostrecently released
version of macOS
as supported by
MobileIron.
Allow proximity
based password
sharing requests

Select to allow
nearby devices torequest device
passwords.
Available formacOS 10.14
through the mostrecently released
version of macOS

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 646

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

allowPasswordSharing

Yes

allowScreenShot

Yes

as supported by
MobileIron.
Allow password
sharing

Select to allow
users to share
their device
passwords using
Airdrop
Passwords
feature.
Available formacOS 10.14
through the mostrecently released
version of macOS
as supported by
MobileIron.

Allow
screenshots andscreen recording

When deselected,
users are unable
to save
screenshots orrecord video ofthe display.
When deselected,
this restriction
also prevents theClassroom appfrom observing
remote screens.
Available formacOS 10.14.4
through the mostrecently released
version of macOS
as supported by
MobileIron.

Allow remote
screenobservation

If this is deselected, remoteallowRemoteScreenObservation

Yes

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 647

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

screenobservation by
the Classroom
app is disabled.
Available formacOS 10.14.4
through the mostrecently released
version of macOS
as supported by
MobileIron.
Automaticallyjoin Classroomclasses without
prompting(supervised only)

When selected,
automaticallygives permission
to the teacher'srequests without
prompting thestudent. Available
for macOS
10.14.4 throughthe most recently
released versionof macOS as
supported by
MobileIron.

forceClassroomAutomaticallyJoinClasses

No

Require teacher
permission toleave Classroom
unmanagedclasses(supervised only)

When selected, astudent enrolled in
an unmanaged
course via
Classroom will
requestpermission fromthe teacher whenattempting toleave the course.
Available formacOS 10.14.4
through the mostrecently released
version of macOS

forceClassroomRequestPermissionToLeaveClassesNo

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 648

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

as supported by
MobileIron.
Allow Classroom
to lock an app
and lock thedevice without
prompting(supervised only)

When selected,
alls the teacher tolock apps or thedevice without
prompting thestudent. Available
for macOS
10.14.4 throughthe most recently
released versionof macOS as
supported by
MobileIron.

forceClassroomUnpromptedAppAndDeviceLock

No

Allow Classroom
to perform
AirPlay and View
Screen without
prompting(supervised only)

If selected, andforceClassroomUnpromptedScreenObservation

No

the Apple
Education >ScreenObservation
Modification
Control field isalso selected, astudent enrolled ina managed
course via theClassroom app
will automaticallygive permission tothat courseʼsteacherʼsrequests toobserve thestudentʼs screen
without prompting
the student.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 649

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

Available formacOS 10.14.4
through the mostrecently released
version of macOS
as supported by
MobileIron.
Allow Handoff

Select to enable
the Handoff
feature, whichallows users toseamlessly
continue working
where they left off
using any Appledevice on which
they are logged inwith their Apple
ID. Available formacOS 10.15
through the mostrecently released
version of macOS
as supported by
MobileIron.

allowActivityContinuation

Yes

Allow use of
Game Center

When deselected,
Game Center isdisabled and its
icon is removed
from the Home
screen. Available
for macOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.

allowGameCenterYes(supervised
devices only)

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 650

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

Allow adding
Game Center
friends(supervised
device)When deselected,
prohibits adding
friends to Game
Center. Disabled
when Allow useof Game Centeris deselected.
Available formacOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.

allowAddingGameCenterFriends

Yes

Allow multiplayer
gaming(supervised
device)When deselected,
prohibits
multiplayer
gaming. Disabled
when Allow useof Game Centeris deselected.
Available formacOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.

allowMultiplayerGaming

Yes

Allow AirDrop(supervised
device)If deselected,
AirDrop is
disabled.
Available formacOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.

allowAirDrop

Yes

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 651

macOS restrictions settings

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

Allow sending
diagnostic andusage data toAppleWhen deselected,
this prevents thedevice fromautomaticallysubmitting
diagnostic reports
to Apple.
Available formacOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.

allowDiagnosticSubmission

Yes

Allow dictation

When deselected,
disables dictation
input method.
Disabled
automaticallywhen using
Advanced Audio
Coding (AAC)
mode. Available
for macOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.

allowDictation

Yes

If deselected,
prevents
wallpaper frombeing changed.
Available formacOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.

allowWallpaperModification

Yes(supervised
device)Allow modifying
Wallpaper(supervised
device)MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 652

macOS Apple App Store restrictions

TABLE 109. MACOS RESTRICTIONS SETTINGS (CONT.)
Item

Description

Corresponding Apple Configurator Property Key in
the Restrictions Payload

Enabledby
Default

Allow Safari
AutoFill

Deselect todisable the Safari
web browser,
remove its iconfrom the Home
screen, andprevent users
from opening web
clips.

allowSafari

Yes(supervised
device)Available formacOS 10.13
through the mostrecently released
version of macOS
as supported by
MobileIron.

macOS Apple App Store restrictions
The macOS Apple App Store restrictions setting allows you to restrict user or device interactions with the AppleApp Store. For example, you can restrict app installations and updates to admin users only, or to MDM-installedapps in updates only.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > macOS Only > macOS App Store Restrictions to specify App Store
lockdown capabilities for macOS.
3. Configure the settings as described in Table 110. macOS App Store Restrictions options .
4. Click Save.
5. Select the setting you just created.
6. Go to Actions > Apply to label.
7. Select the labels you want to apply.
8. Click Apply.

macOS AppStore restriction options
The following table describes the macOS App Store restrictions.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 653

macOS AppStore restriction options

TABLE 110. MACOS APP STORE RESTRICTIONS OPTIONS
Item

Description

Corresponding Apple Configurator
Property Key in the Restrictions Payload

Name

Enter a name for themacOS App Store
Restrictions setting.

Description

Enter a description forthe setting.

N/A

N/A

Restrictions
ChannelSelect one of thefollowing:• User: Select toapply restrictions tothe user signed in to
the macOS device.
• Device: Select toapply restrictions to
the macOS device,
regardless of theuser currently signed
in.

N/A

User

com.apple.app.appstore

Selected by
Default

N/A

For devices running
macOS 10.12 throughthe most recently
released version as
supported by MobileIron,
the default is user
channel. If an you want
the restrictions setting toapply to macOS devices
regardless of what user
is logged in, selectDevice channel. If you
want the restrictions
setting to apply to a
specific user, selectUser channel.
Restrict app
installations toadmin users only

Select to restrict the
installation of apps toadmins only.

restrict-store-require-admin-toinstall

Yes

Available on macOS
devices running macOS
10.9 through the most

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 654

macOS AppStore restriction options

TABLE 110. MACOS APP STORE RESTRICTIONS OPTIONS (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in the Restrictions Payload

Selected by
Default

recently released
version as supported by
MobileIron.
Restrict app
installations tosoftware updates
only

Select to restrict
updates to apps alreadyinstalled to managed
macOS devices.

restrict-store-softwareupdate-onlyYes

restrict-store-disable-app-adoption

Yes

Available on macOS
devices running macOS
10.10 through the mostrecently released
version as supported by
MobileIron.
Disable app
adoption

Select to prevent users
from managing apps
through the Apple App
Store that were notoriginally purchased
through the Apple App
Store.
Available on macOS
devices running macOS
10.10 through the mostrecently released
version as supported by
MobileIron.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 655

Disc settings for macOSTABLE 110. MACOS APP STORE RESTRICTIONS OPTIONS (CONT.)
Item

Description

Corresponding Apple Configurator
Property Key in the Restrictions Payload

Disable software
updates
notifications

Select to prevent app
update notifications fromappearing on managed
macOS devices.

Selected by
Default

DisableSoftwareUpdateNotifications

Yes

restrict-store-mdm-installsoftwareupdate-only

Yes

Available on macOS
devices running macOS
10.10 through the mostrecently released
version as supported by
MobileIron.
Restrict app
installations to
MDM-installedapps and software
updates (macOS
10.11 and later)

Select to restrict app
installations and updates
to MDM-installed apps
only.
Available on macOS
devices running macOS
10.11 through the mostrecently released
version as supported by
MobileIron.

Disc settings for macOSYou can use the Finder and Disc Burning restriction settings to restrict the ability of managed macOS devices toburn data to disc. You must configure both settings to control the burning of data to disc on managed macOS
devices.

Configuring Finder disc burning settings for macOSThe Finder restriction for macOS devices allow you to disable disc burning capabilities using macOS Finder onmanaged macOS devices. Disabling disc burning through Finder using this restriction setting will also disable discburning regardless of the disc burning restriction setting described in Configuring the Disc Burning setting formacOS.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > macOS Only > Disc > Finder.
3. Enter a name for the Finder restriction setting.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 656

Configuring the Disc Burning setting for macOS

4. Select Disable Finder's Disc Burning Support to disable the disc burning capability on managed
macOS devices. If you want to enable support for burning to disc using Finder, leave this option
unchecked.
5. Click Save.
6. Select the setting you just created.
7. Go to Actions > Apply to label.
8. Select the labels you want to apply.
9. Click Apply.

Configuring the Disc Burning setting for macOSThe Disc Burning restriction allows you to control whether users can burn data to disc on managed macOS
devices. You can enable or disable disc burning, or allow the burning of data to disc only after users have gone
through an authentication process. You must also create a Finder restriction in addition to the Disc Burning
restriction to control disc burning on managed macOS devices.
Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > macOS Only > Disc > Disc Burning.
The New Disc Burning dialog box opens.
3. Configure the settings as described in Table 111. Disc Burning settings (macOS) .
4. Click Save.
5. Select the setting you just created.
6. Go to Actions > Apply to label.
7. Select the labels you want to apply.
8. Click Apply.

Disc burning settings (macOS)
The following table describes the settings for disc buning.

TABLE 111. DISC BURNING SETTINGS (MACOS)
Item

Description

Name

Enter a name for the disc burning setting.

Description

Enter a description for the disc burning setting (optional).

Burn Support

Select one of the following:• Off: Select to disable support for burning data to disc on a managed macOS
device. You must also disable disc burning in the Finder setting to disable discburning on managed macOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 657

Media Control setting for macOSTABLE 111. DISC BURNING SETTINGS (MACOS) (CONT.)
Item

Description••

On: Select to enable support for burning data to disc on a managed macOS
device. You must also enable disc burning in the Finder setting to enable discburning on managed macOS devices.
Authenticate: Select to require managed macOS device users to enter theirlogin information before burning data to disc.

Media Control setting for macOSThe Media Control setting allows you to permit or forbid users to mount, unmount, and eject on logout a variety of
media, such as DVDs, network disks, and external drives. This setting enables you to fine-tune your control overmedia use on macOS devices, for example, you can configure all blank DVDs to be rejected by the macOS media
drive, or require user authentication when connecting to a network drive.
The Supported media types are:
l

BD

l

Blank BDlBlank CDl

Blank DVD

l

CD

l

Disk Image

l

DVD

l

Hard Disk ExternallHard Disk InternallNetwork Disk

Procedure
1. Go to Policies & Configs > Configurations.
2. Select Add New > Apple > macOS Only > Media Control.
The New Media Control Setting dialog box opens.
3. Configure the settings as described in Table 112. Media Control Setting (macOS) .
4. Click Save.
5. Select the setting you just created.
6. Go to Actions > Apply to label.
7. Select the labels you want to apply.
8. Click Apply.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 658

Media Control setting for macOSTABLE 112. MEDIA CONTROL SETTING (MACOS)
Item

Description

Name

Enter a name for the Media Control setting.

Description

Enter a description for the Media Control setting.

Logout Eject

Logout Eject rules cause the selected medium to be ejected when themacOS user logs out.
1. Click Add to select a medium from the drop-down list andconfigure settings for that medium.
2. For the rule you are creating, select any of the following:lAuthenticate: Requires macOS device users toauthenticate before interacting with the medium.

l

Read only: Makes the medium read-only.

lDeny: Denies access to the medium.

lEject: Causes the medium to eject when macOS users
attempt to access it.

3. Repeat for any other media for which you would like to create
a rule.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 659

iOS and macOS Core settings differences

TABLE 112. MEDIA CONTROL SETTING (MACOS) (CONT.)
Item

Description

Mount Controls

Creating rules for Mount Controls allows you to govern the media thatcan be mounted on managed macOS devices.
1. Click Add to select a medium from the drop-down list andconfigure settings for that medium.
2. For the rule you are creating, select any of the following:lAuthenticate: Requires macOS device users toauthenticate before interacting with the medium.

l

Read only: Makes the medium read-only.

lDeny: Denies access to the medium.

lEject: Causes the medium to eject when macOS users
attempt to access it.

3. Repeat for any other media for which you would like to create
a rule.
Unmount Controls

Creating rules for Unmount Controls allows you to govern the media
that can be unmounted from managed macOS devices.
1. Click Add to select a medium from the drop-down list andconfigure settings for that medium.
2. For the rule you are creating, select any of the following:llAuthenticate: Requires macOS device users toauthenticate before interacting with the medium.
Deny: Denies access to the medium.

3. Repeat for any other media for which you would like to create
a rule.

iOS and macOS Core settings differences
The following table outlines important differences in feature support between macOS and iOS.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 660

Running shell scripts on macOS devices

TABLE 113. DIFFERENCES BETWEEN IOS AND MACOS
Feature

macOS

iOS

CalDAV

MDM authenticates the account before
pushing profiles. Therefore, if MobileIron
Core does not have valid credentials, itwill not push the profile.

MDM does not authenticate the accountbefore pushing profiles. The device user is
prompted to enter a password.

The Save user password field in
Settings > System Settings > Users& Devices > Registration must be
enabled.
CardDAVMDM does not authenticate the account.
If no credentials are available, thecontacts will not be synchronized and thedevice user will not be prompted for apassword.

MDM does not authenticate the accountbefore pushing profiles. The device user is
prompted to enter a password.

Exchange

Only Contacts are synchronized. SSL isrequired.

Email, contacts, tasks, and appointments
are synchronized.

web clip

Profiles will not be pushed if the size of
the web clip image is greater than 20K.

Profiles will be pushed, regardless of thesize of the web clip image.

Running shell scripts on macOS devices
This section addresses the components related to running shell scripts on macOS devices.
Shell scripts on macOS devices
Creating certificates for your shell scripts for macOS
Creating a shell script for macOS
Testing your shell script for macOS
Signing your shell script for macOS
Configuring a macOS script configuration on Core
Configuring a macOS script policy on Core
Viewing macOS script execution logs

Shell scripts on macOS devices
MobileIron Core allows you to create and sign your own macOS shell scripts, which you can then upload to Coreand run on managed macOS devices. You can write a script that configures any setting within macOS System
Preferences on macOS devices. Or, you may wish to run scripts that:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 661

Components required to run shell scripts on macOS deviceslforce device users to change their passwords monthlyllock the screen after 5 minutes of idle timelor configures a secured Wi-Fi network.

After uploading scripts to Core and configuring macOS script configuration and policy components, Core executes
your scripts on macOS devices using Mobile@Work for macOS. Mobile@Work for macOS polls Core periodicallyto check whether there are any scripts awaiting execution. If there are scripts in the queue, Mobile@Work formacOS downloads and runs the scripts on macOS devices according to settings you define on Core.
Mobile@Work runs the scripts as the device user or as root, depending on how you signed the script.
Mobile@Work then returns the script execution results to Core, which are shown in the audit logs.

Components required to run shell scripts on macOS devices
NOTE: Mobile@Work for macOS is not supported on Connected Cloud.
To run shell scripts on macOS devices, you need:ll

Mobile@Work for macOS on macOS devices
MobileIron Core 9.7.0.0, through the most recently released version of Core as supported by MobileIron,
configured with mutual authenticationlScript signing tool, provided by MobileIronl

macOS script configuration on CorelmacOS script policy on Core

Main steps of running shell scripts on macOS devices
Running shell scripts on macOS devices involves the following main steps:
1. Registering macOS devices with Core using Mobile@Work for macOS
2. Creating certificates for your shell scripts for macOS
3. Creating a shell script for macOS
4. Testing your shell script for macOS5. Signing your shell script for macOS6. Configuring a macOS script configuration on Core
7. Configuring a macOS script policy on Core
8. Viewing macOS script execution logs

Creating certificates for your shell scripts for macOS
This section includes the following main steps:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 662

Creating a certificate authority for your macOS scripts

1. Creating a certificate authority for your macOS scripts
2. Creating a script signing identity for your macOS scripts
3. Exporting the CA public key certificate for your macOS scripts

Creating a certificate authority for your macOS scripts
Create a certificate authority for signing your macOS scripts.You can optionally use the certificate authority you
create as your default.
Procedure
1. On a macOS device, run the Keychain Access utility.
2. From the Keychain Access menu, choose Certificate Assistant > Create a Certificate Authority.
3. Enter a name for the certificate authority, noting it for later use.
4. For the user certificate type, select Code Signing.
5. Enter your email address.
6. In Keychain Access, select My Certificates to view the certificate authority.
Related topics
Creating a certificate authority using Keychain Access

Creating a script signing identity for your macOS scripts
Create a signing identity certificate so that you can sign your scripts.
Before you begin
Creating a certificate authority for your macOS scripts
Procedure
1. On a macOS device, run the Keychain Access utility.
2. From the Keychain Access menu, choose Certificate Assistant > Create a Certificate.
3. Enter a name for the signing identity, noting it for later use.
4. For the identity type, select Leaf.
5. For the certificate type, select Code Signing.
6. Create the leaf.
7. Choose an issuer. Select the certificate authority you created.
8. Create the certificate.
9. In Keychain Access, select My Certificates to view the signing identity you created.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 663

Exporting the CA public key certificate for your macOS scripts

Related topics
Code Signing Tasks on the Apple Developer website

Exporting the CA public key certificate for your macOS scripts
You must now export the certificate authority you created and upload it to Core.
Before you begin
Creating a script signing identity for your macOS scripts
Procedure
1. On a macOS device, run the Keychain Access utility.
2. Select Certificates in the left pane.
3. Select the certificate of the certificate authority you created in Creating a certificate authority for yourmacOS scripts.
4. Select File > Export Items.
5. For File Format, select Certificate (.cer).
6. Click Save.
Note where you saved the .cer file
7. Open the Terminal application.
8. Navigate to the directory where you exported the certificate.
9. Execute the following openssl command to convert the .cer file to a .pem file. (In this example, thecertificate was saved in Certificate.cer.)
openssl x509 -inform der -in Certificate.cer -out root.pem

You will later upload this .pem file to Core.

Creating a shell script for macOSYou can create any shell script you want for execution on macOS devices, as long as the script can run within ashell script file. You can use wrappers if necessary. The execution of binary files from within a shell script is notsupported.
You can copy and modify existing scripts, or create your own.
Before you begin
Before you can run shell scripts on macOS devices, you must have instructed macOS device users to:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 664

Testing your shell script for macOSldownload and install Mobile@Work for macOSlregister with Core using Mobile@Work for macOS

Related topics
Registering macOS devices with Core using Mobile@Work for macOS
Shell scripting primer (on the Apple website)

Testing your shell script for macOS
MobileIron highly recommends you test your shell scripts before running them on macOS devices to ensure theirrobustness and quality. Run your script locally, and correct any errors that result.

Signing your shell script for macOS
Core requires you to sign your shell scripts using the MobileIron script signing tool.
Before you begin
Testing your shell script for macOS
Procedure
1. Download the signing tool provided to you by MobileIron, and place it in your $PATH .
2. Open a terminal window.
3. Sign your script by issuing a command with the following syntax:
sign -s “My Signer” -r yes script_name.sh“My Signer” is the signing identity you created in Creating certificates for your shell scripts for macOS-r yes is an optional parameter. Include it only if you want to run the script as root because the script

requires root permissions. Without -r yes , the script runs as the device user. This parameter is supportedwith Mobile@Work 1.1.0 for macOS through the most recently released version as supported by
MobileIron.
script_name is the name of your macOS script.

The script signing tool produces a signed script called script_name.sh.p7s , where script_name is the nameof the script.

Configuring a macOS script configuration on Core
Create a macOS script configuration for your macOS shell script. You can upload only one script file perconfiguration, but the file can include more than one signed shell script. You must then apply the macOS script

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 665

Configuring a macOS script policy on Coreconfiguration to a label or labels, so that you can run the script or set of scripts on a subset of macOS devices.
NOTE: After you have created a macOS script configuration, you cannot edit the configuration, forexample, by uploading a different script file to a configuration you had previously created. A
macOS script configuration is read-only after you create and save it. If you want to change aparticular macOS script configuration, delete the old configuration and create a new one.
Procedure
1. Select Policies & Configs > Configurations.
2. On the Configurations page, click Add New, and select Apple > macOS Only > Mobile@Work
macOS Script.
3. In the Mobile@Work macOS Script Configuration dialog box, add your macOS shell script.
Item

Description

Name

Enter a name for the configuration.

Description

Enter an explanation of the purpose of this configuration.

Select FileClick Browse and select the signed script file you want to use.

4. Click Save.
5. Select the configuration you just created, and apply it to the relevant labels.

Configuring a macOS script policy on Core
Create a policy for the macOS shell scripts you intend to run on macOS devices. The macOS script policy includes
the root certificate used to sign your scripts. Mobile@Work for macOS uses the certificate to validate the scripts
before running them.
Procedure
1. Select Policies & Configs > Policies.
2. On the Policies page, click Add New.
3. Select iOS and macOS > macOS Only > Mobile@Work macOS Script.
4. In the Add Mobile@Work macOS Script Policy dialog box, add the root certificate for your macOS shell
script, as described in Exporting the CA public key certificate for your macOS scripts.
Item

Description

Name

Enter a name for the policy.

StatusSelect the relevant radio button to indicate whether thepolicy is Active or Inactive.
Only one active policy can be applied to a device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 666

Viewing macOS script execution logs

Item

Description

Priority

Specifies the priority of this policy relative to the othercustom policies of the same type. This priority
determines which policy is applied if more than one
policy is available.
Select Higher than or Lower than, then select anexisting policy from the drop-down list.
For example, to give Policy A a higher priority than
Policy B, you would select “Higher than” and “Policy B”.

Description

Enter an explanation of the purpose of this policy.

Upload Public Key

Upload the .pem certificate file to the script policy.

Public Key

Once uploaded, the public key displays here.

Max Response Size (in KB)Enter the maximum response size for any macOS
scripts you run on devices. The maximum response
size limits the size of data Mobile@Work for macOS
returns to Core after running a script. This is the stdout
or stderr data that is returned when running a macOS
script.

5. Click Save.
6. Select the policy you just created, and apply it to the relevant labels.

Viewing macOS script execution logs
You can confirm the execution of macOS scripts sent to macOS devices by searching the logs for macOS script
execution results. Each log entry has a status, indicating whether the script ran successfully, and details regarding
the output of the script execution.
Procedure
1. Select Logs > Audit Logs.
2. On the list of filters, click Device.
3. Select the check box for Mobile@Work client script execution results.
4. Click Search.
The logs for macOS script execution are displayed.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 667

19
Using Mobile@Work for iOS
This section addresses the management of Mobile@Work for iOS.
l

Device management with the Mobile@Work My Devices tablManaging notifications in Mobile@Work for iOSl

Logging and enhanced logging for Mobile@Workl

Opening Mobile@Work for iOS logs in other appslEncrypting device logs with your own certificatelScreen orientation
NOTE: In iOS 13, the option to "Allow Always" was removed from the iOS Settings app. Instead, adialog box displays requesting device users to enable tracking when the Mobile@Work
app is running. Mobile@Work opens iOS Settings where device users can choose "Ask
Next Time" or "Never". MobileIron recommends device users to enable tracking. Thischange applies to all versions of iOS 13 through the latest version as supported by
MobileIron. Mobile@Work for iOS does not track device users' location without consent.

Device management with the Mobile@Work My Devices tab
Mobile@Work includes a self-service feature that allows device users to manage the device they are currently
using, as well as any other devices that they have registered with MobileIron Core. The device management
actions device users can take in the My Devices tab are generally similar to those available in the MobileIron Core
User Portal.
The self-service feature is in the My Devices page in Mobile@Work, and includes the following tabs:lll

Actions: Actions a device user can take on the device currently in use, or other devices registered to thatuser, such as locking, unlocking, wiping, and re-enrolling the device with MobileIron Core.
Info: Details about the selected device, such as the device model number, OS version, and device
registration date.
Map: The precise street location of the selected device.

Actions you can take on the current device
In the My Devices tab, you can take the following actions on the device you are currently using:l

Check for UpdateslRe-enroll Device

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 668

Authenticating with MobileIron Core from the My Devices tab in Mobile@Workl

Retire Device (only if the device user has the correct permissions to retire a device)

Actions you can take on your other devices
You can also use the My Devices tab to take the following actions on other devices registered to you, even if thosedevices are not currently at your disposal:lUnlock DevicelLock DevicelRetire DevicelWipe Device

You can lock, unlock, retire, or wipe one of your devices if you have the relevant roles assigned to you. If you only
have one registered device, you cannot unlock, lock, or wipe that device in the My Devices tab.
Device status
The My Devices tab lists all devices registered to the device user who is logged in to Mobile@Work. Each deviceshows the status of any actions taken on that device. For example, if you initiated a wipe on the third device in yourlist of devices, the status of that device might be “Wipe Pending”.
Related topicsl“Assigning and removing device user roles” in Getting Started with MobileIron Corel

Self-service User PortallAuthenticating with MobileIron Core from the My Devices tab in Mobile@Workl

Checking for MobileIron Core updates with Mobile@Workl

Re-enrolling a device with Mobile@Workl

Retiring a device with Mobile@Workl

Unlocking a device with Mobile@Workl

Locking a device with Mobile@Workl

Wiping a device with Mobile@Workl

Viewing device details in the Mobile@Work My Devices tablLocating an iOS device in the Mobile@Work My Devices tab

Authenticating with MobileIron Core from the My Devices tab in Mobile@Work
You must authenticate with MobileIron Core when:lmanaging your devices with the My Devices tab for the first timelthe connection between Core and Mobile@Work has timed outlafter you have exited and re-opened Mobile@Work.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 669

Checking for MobileIron Core updates with Mobile@Work

NOTE: Mobile@Work only persists the username if you successfully authenticate with MobileIron Core.
Procedure
1. In Mobile@Work, tap My Devices.
2. Tap Show my devices.
Mobile@Work shows the Authentication Required popup.
3. When authenticating for the first time after upgrading from previous versions of Mobile@Work, enter thedevice username and password in the space provided.
4. When authenticating thereafter, enter the device password at the prompt.
Mobile@Work shows the devices registered to the authenticated device user in the My Devices tab, withthe device currently in use at the top of the list.
Related topicsl

Checking for MobileIron Core updates with Mobile@Workl

Re-enrolling a device with Mobile@Workl

Retiring a device with Mobile@Workl

Unlocking a device with Mobile@Workl

Locking a device with Mobile@Workl

Wiping a device with Mobile@Workl

Viewing device details in the Mobile@Work My Devices tablLocating an iOS device in the Mobile@Work My Devices tab

Checking for MobileIron Core updates with Mobile@Work
The My Devices tab in Mobile@Work allows you to check for any updates available from MobileIron Core.
Updates may include modified Mobile Device Management (MDM) profiles, AppConnect policies, and certificate
enrollment settings, for example. If updates are available, MobileIron Core sends the updates to the device. You
can check for updates with the device you are currently using.
NOTE: You can only check for MobileIron Core updates on the device currently in use.
Procedure
1. In Mobile@Work, tap My Devices.
2. Tap the device on which you wish to take action.
Mobile@Work shows the Device Details page.
3. Tap Actions > Check for Updates.
Mobile@Work communicates with MobileIron Core to check for updates.
Related topics

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 670

Re-enrolling a device with Mobile@Workl

Authenticating with MobileIron Core from the My Devices tab in Mobile@Workl

Re-enrolling a device with Mobile@Workl

Retiring a device with Mobile@Workl

Unlocking a device with Mobile@Workl

Locking a device with Mobile@Workl

Wiping a device with Mobile@Workl

Viewing device details in the Mobile@Work My Devices tablLocating an iOS device in the Mobile@Work My Devices tab

Re-enrolling a device with Mobile@Work
You can re-enroll the device you are currently using with MobileIron Core. After requesting re-enrollment, Core
pushes the relevant profiles and configurations to the device again.
NOTE: You can only re-enroll the device currently in use.
Procedure
1. In Mobile@Work, tap My Devices.
2. Tap the device on which you wish to take action.
Mobile@Work shows the Device Details page.
3. Tap Actions > Re-enroll Device.
Mobile@Work sends a request to MobileIron Core to re-register the device.
Related topicslAuthenticating with MobileIron Core from the My Devices tab in Mobile@Workl

Checking for MobileIron Core updates with Mobile@Workl

Retiring a device with Mobile@Workl

Unlocking a device with Mobile@Workl

Locking a device with Mobile@Workl

Wiping a device with Mobile@Workl

Viewing device details in the Mobile@Work My Devices tablLocating an iOS device in the Mobile@Work My Devices tab

Retiring a device with Mobile@Work
You can remove from MobileIron Core management your current device, or any device you have registered withCore.
NOTE: You need to have the relevant role assigned to your user name to take this action. The role is auser portal role. For more information, see Assigning user portal device management roles.
MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 671

Unlocking a device with Mobile@Work

Procedure
1. In Mobile@Work, tap My Devices.
2. Tap the device on which you wish to take action.
Mobile@Work shows the Device Details page.
3. Tap Actions > Retire Device.
4. At the prompt, tap Retire Device.
5. Enter your password.
Mobile@Work sends a request to MobileIron Core to retire the device.
Related topicslAuthenticating with MobileIron Core from the My Devices tab in Mobile@Workl

Checking for MobileIron Core updates with Mobile@Workl

Re-enrolling a device with Mobile@Workl

Unlocking a device with Mobile@Workl

Locking a device with Mobile@Workl

Wiping a device with Mobile@Workl

Viewing device details in the Mobile@Work My Devices tablLocating an iOS device in the Mobile@Work My Devices tab

Unlocking a device with Mobile@Work
You can unlock another device you have registered with MobileIron Core from Mobile@Work on the registereddevice you are currently using.
NOTE: You need to have the relevant role assigned to your user name to take this action. The role is auser portal role. For more information, see Assigning user portal device management roles.
Procedure
1. In Mobile@Work, tap My Devices.
2. Tap the device on which you wish to take action.
Mobile@Work shows the Device Details page.
3. Tap Actions > Unlock Device.
4. At the prompt, tap Unlock Device.
5. Enter your password.
Mobile@Work sends a request to MobileIron Core to unlock the device.
Related topics

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 672

Locking a device with Mobile@Workl

Authenticating with MobileIron Core from the My Devices tab in Mobile@Workl

Checking for MobileIron Core updates with Mobile@Workl

Re-enrolling a device with Mobile@Workl

Retiring a device with Mobile@Workl

Locking a device with Mobile@Workl

Wiping a device with Mobile@Workl

Viewing device details in the Mobile@Work My Devices tablLocating an iOS device in the Mobile@Work My Devices tab

Locking a device with Mobile@Work
You can lock another device you have registered with MobileIron Core from Mobile@Work on the registered device
you are currently using.
NOTE: You need to have the relevant role assigned to your user name to take this action. The role is auser portal role. For more information, see Assigning user portal device management roles.
Procedure
1. In Mobile@Work, tap My Devices.
2. Tap the device on which you wish to take action.
Mobile@Work shows the Device Details page.
3. Tap Actions > Lock Device.
4. At the prompt, tap Lock Device.
5. Enter your password.
Mobile@Work sends a request to MobileIron Core to lock the device.
Related topicslAuthenticating with MobileIron Core from the My Devices tab in Mobile@Workl

Checking for MobileIron Core updates with Mobile@Workl

Re-enrolling a device with Mobile@Workl

Retiring a device with Mobile@Workl

Unlocking a device with Mobile@Workl

Wiping a device with Mobile@Workl

Viewing device details in the Mobile@Work My Devices tablLocating an iOS device in the Mobile@Work My Devices tab

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 673

Wiping a device with Mobile@Work

Wiping a device with Mobile@Work
You can wipe the app data and user data from another device you have registered with MobileIron Core, using
Mobile@Work on your current device.
NOTE: You need to have the relevant role assigned to your user name to take this action. The role is auser portal role. For more information, see Assigning user portal device management roles.
Procedure
1. In Mobile@Work, tap My Devices.
2. Tap the device on which you wish to take action.
Mobile@Work shows the Device Details page.
3. Tap Actions > Wipe Device.
4. At the prompt, tap Wipe Device.
5. Enter your password.
Mobile@Work sends a request to MobileIron Core to wipe the device.
Related topicslAuthenticating with MobileIron Core from the My Devices tab in Mobile@Workl

Checking for MobileIron Core updates with Mobile@Workl

Re-enrolling a device with Mobile@Workl

Retiring a device with Mobile@Workl

Unlocking a device with Mobile@Workl

Locking a device with Mobile@Workl

Viewing device details in the Mobile@Work My Devices tablLocating an iOS device in the Mobile@Work My Devices tab

Viewing device details in the Mobile@Work My Devices tab
You can use My Devices to view details about any device registered to the device user, such as model number,
iOS version number, registration date, and so on.
Procedure
1. In Mobile@Work, tap My Devices.
2. Tap the device whose details you wish to examine.
Mobile@Work shows the Device Details page.
3. Tap Info.
4. Mobile@Work shows the information available about the device, as shown in Table 114. The device
details page in Mobile@Work.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 674

Locating an iOS device in the Mobile@Work My Devices tab

NOTE: Any unavailable device information appears as N/A.
Reference

TABLE 114. THE DEVICE DETAILS PAGE IN MOBILE@WORK
Item

Description

Model

The model number of the iOS device.

VersionThe version of iOS installed to the device.

Registration Date

The date and time the device was registered with MobileIron Core.

Owner

The owner of the device, either company or employee.

Phone Number

The phone number assigned to the device, if relevant.

Carrier

The cellular operator to which the device is registered, if relevant.

IMEI

A 15 digit number unique to the mobile device.

Manufacturer

The manufacturer of the device.

Related topicslAuthenticating with MobileIron Core from the My Devices tab in Mobile@Workl

Checking for MobileIron Core updates with Mobile@Workl

Re-enrolling a device with Mobile@Workl

Retiring a device with Mobile@Workl

Unlocking a device with Mobile@Workl

Locking a device with Mobile@Workl

Wiping a device with Mobile@Workl

Locating an iOS device in the Mobile@Work My Devices tab

Locating an iOS device in the Mobile@Work My Devices tab
The My Devices tab allows you to view the map location and street address of any device registered to yourusername.
Note The Following:l

Mobile@Work can only locate devices on which you have enabled location services.
NOTE: In iOS 13, the option to "Allow Always" was removed from the iOS Settings app. Instead, adialog box displays requesting device users to enable tracking when the Mobile@Work
app is running. Mobile@Work opens iOS Settings where device users can choose "Ask
Next Time" or "Never". MobileIron recommends device users to enable tracking. This

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 675

Managing notifications in Mobile@Work for iOSchange applies to all versions of iOS 13 through the latest version as supported by
MobileIron. Mobile@Work for iOS does not track device users' location without consent.
l

You cannot copy addresses from the map.

Procedure
1. In Mobile@Work, tap My Devices.
2. Tap the device whose details you wish to examine.
Mobile@Work shows the Device Details page.
3. Tap Map.
Mobile@Work shows a map with a green indicator for the device.
4. Tap the green indicator to view the exact street address where the device is located.
5. Tap the blue indicator to view the location of another device registered to the same user.
Related topicslAuthenticating with MobileIron Core from the My Devices tab in Mobile@Workl

Checking for MobileIron Core updates with Mobile@Workl

Re-enrolling a device with Mobile@Workl

Retiring a device with Mobile@Workl

Unlocking a device with Mobile@Workl

Locking a device with Mobile@Workl

Wiping a device with Mobile@Workl

Viewing device details in the Mobile@Work My Devices tab

Managing notifications in Mobile@Work for iOS
Mobile@Work for iOS includes a Notifications tab shows notifications received from MobileIron Core. The
Notifications tab allows you to manage notifications, including the ability to receive notifications on the home
screen and view, save, or dismiss them. Notifications from Mobile@Work are displayed in the device Notifications
Center.
Notifications can be received and viewed when the device is locked. When Mobile@Work is running in the
background, all new notifications are sent to both Mobile@Work and the Notifications Center. When
Mobile@Work is running in the foreground, all new notifications are sent to Mobile@Work only. When
Mobile@Work is not running, all notifications are delivered only to the device Notification Center. Tapping themessage in the Notification Center opens Mobile@Work and delivers that particular message to Mobile@Work.
For example, if three messages have been sent to the Notification Center, the device user must tap each message
to deliver it to Mobile@Work.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 676

Logging and enhanced logging for Mobile@Work

Procedurel

You can do the following in the Notifications tab in Mobile@Work:oView additional notification details by tapping the chevron (>) next to a notification in the
Mobile@Work Notifications tab.

oSwipe right to left to delete a given notification.

oDelete all notifications by tapping Delete All on the top right of the Notifications tab.

oSave notifications by tapping them one at a time.

Logging and enhanced logging for Mobile@Work
If iOS device users experience issues with Mobile@Work, they can reproduce the issue and send the logs (loglevel Debug) to their support administrator. Enhanced Logging encrypts the logs for safe transport to the support
Admin.
NOTE: This feature is for troubleshooting, and is disabled by default. Logging requires Mobile@Work 9.0
through the most recently released version as supported by MobileIron.

Sending Mobile@Work logs to MobileIron Support
Procedure
1. Open Mobile@Work.
2. Tap Settings.
3. To enable encrypted logging of your phone information, tap Enhanced Logging.
If you do not require encryption, make sure Enhanced Logging is toggled off.
4. Reproduce the issue on the device.
5. Go back to Mobile@Work, and tap Settings > Send Mobile@Work Logs.
Select a method to send the log information to MobileIron support. Options include email, SMS, AirDrop,and others.
6. Enter a support address and tap Send.

Opening Mobile@Work for iOS logs in other apps
Mobile@Work for iOS allows you to use the iOS Open In feature for Mobile@Work logs. You can open
Mobile@Work log files in any app that supports that file type.
Procedure
1. On an iOS device, run Mobile@Work.
2. In Mobile@Work, tap Settings > Send Mobile@Work Logs.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 677

Encrypting device logs with your own certificate

3. Select Open In.
4. Open the log file in any available app.

Encrypting device logs with your own certificate
You can define a log encryption configuration that enables device users to send encrypted logs to an
administrator's email address from their devices. The configuration includes a certificate for encrypting logs and an
email address to which encrypted logs are to be sent. Devices sync with MobileIron Core and receive theconfiguration after you assign the configuration to the relevant labels.
This feature requires Mobile@Work 10.0.0 for iOS through the most recently released version as supported by
MobileIron.
Before you begin
Upload a certificate to Core, as described in Certificates settings.
Procedure
1. In the Admin Portal, select Policies & Configs> Configurations.
2. Click Add New and select LogEncryption. The New Log Encryption Setting dialog box opens.
3. Fill in the following:
Field

Description

Name

Enter a name for the configuration.

Email AddressEnter an email address to which encrypted logs may be sent. The To:
field of the email is automatically filled with this address. If you do notenter an email address here, the device user fills in the To: field.

Certificate

From the drop-down list, select a certificate you have alreadyuploaded to Core.

4. Click Save.
5. On the Configurations page, select the configuration you just defined.
6. Click Actions > Apply to Label, and select the label to which you want to apply the log encryption
configuration.

Screen orientation
Mobile@Work 10.1.0.0 through the most recently released version as supported by MobileIron supports only
portrait mode. It does not rotate to landscape mode.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 678

20Working with Events
This section addresses the components related to The Event Center.
l

About eventslManaging eventsl

Event settingslCustomizing Event Center messageslViewing and Exporting Events

NOTE: The features described in this section are supported on macOS devices, unless otherwise stated.

About eventsThe Event Center enables MobileIron administrators to configure events to specific alerts that can be sent to users,
administrators, or both. Event types include:lInternational Roaming Eventl

SIM Changed EventlMemory Size Exceeded Eventl

System Eventl

Policy Violations Eventl

Device Status Event

An alert is a message sent via SMS, email, or through a push notification. You can select a predefined message
template, or create a custom message to use for the alert.
For example, you can specify an SMS to be sent each time a user travels to a different country, informing the userthat different rates may apply.

Events pageUse the Logs > Event Settings page in Admin Portal to manage the events you are interested in and thecorresponding alerts you want to automate.

Required role
To edit settings on the Event Settings page, the administrator must have the Manage events role.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 679

Managing events

Managing events
The tasks that are common to all event types are:l

Creating an eventl

Editing an eventlDeleting an eventlEnsuring the alert is sent to the correct recipientsl

Applying the event to a labellSetting alert retries

Creating an event
Procedure
To create an event, in the Admin Portal:
1. Go to Logs > Event Settings.
2. Click Add New.
3. Select the type of event from the drop-down.
4. Complete the information for the selected event.
Each event type has settings specific to the event type. See Event settings for information on the settings.
5. Click Save.

Editing an event
Procedure
To edit an event, in the Admin Portal:
1. Go to Logs > Event Settings.
2. Select the event you want to edit.
3. Click Edit.
4. Make your changes.
5. Click Save.

Deleting an event
Procedure
To delete an event, in the Admin Portal:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 680

Ensuring the alert is sent to the correct recipients

1. Go to Logs > Event Settings.
2. Select the event you want to delete.
3. Click Delete.

Ensuring the alert is sent to the correct recipients
When you create an event, you designate recipients for the resulting alert. Each event type includes the alertconfiguration section shown in the following figure.

For each type of alert (i.e. SMS, email, and APNs push notification), you can select to send the alert to one of thefollowing:
l

None

l

User onlyl

User + Adminl

Admin only

If you select one of the Admin options, a CC to Admins section is displayed in the dialog box. This section
displays a list of devices. Under the Available heading , select a device (or devices), that is associated with anemail address that you want to notify, other than the device user. Core will send a notification to the email address
associated with the device or devices that appear under the Selected heading.

FIGURE 24. CC TO ADMINS

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 681

Applying the event to a label

NOTE: Only users who have registered devices can appear in the Apply to Users list.

Applying the event to a label
To specify the devices to which the event should apply, you select one or more labels when you create the event.
The amount of time it takes to apply an event to a label depends on the number of devices identified by the label.
Therefore, it may take some time for the label name to display as selected for the event.

Setting alert retries
You can specify the number of times MobileIron attempts to send an SMS alert or registration email.
Procedure
1. Enter the number of retries for SMS and registration email.
Reminders are sent at 48-hour intervals until the number of reminders specified are sent, or the device isregistered.
For example, if you use the default for Number of Retries for Email (which is 2), an email is sent
immediately after registration. If the device is not registered within 48 hours, a second email is sent. No
other reminders are sent because you specified two reminders.
2. Click Save.

Setting MobileIron SMS, email, and push notifications
You can designate specific hours for the sending of SMS, email, and push notifications. The default notification
time is 0300 (3 a.m.), which can be disruptive.
Procedure
To override the default notification schedule:
1. From the Admin Portal, go to Settings > System Settings > General > Alert.
2. Select the Override Default Schedule SMS, Email, Push notification check box. The section
expands.
3. Enter the notification start time and end time, in UTC hours.
4. Select the days of the week when sending notifications are allowed.
5. Click Save.

Event settings
Each event type has specific settings that need to be configured when you create or edit the event. This section
describes the settings for each type.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 682

International roaming event settingslInternational roaming event settingsl

SIM changed event settingslMemory size exceeded event settingsl

System event settingsl

System event field descriptionl

Policy violations event settingsl

Policy violations event field descriptionlDevice status event settings

International roaming event settings
This event type is not supported for macOS devices.
NOTE: International roaming detection is not supported for dual-mode devices (that is, devices thatswitch between GSM and CDMA).
Procedure
To create an international roaming event, in the Admin Portal:
1. Go to Logs > Event Settings.
2. Click Add New.
3. Select International Roaming Event from the drop-down menu. The New International Roaming Eventdialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 683

International roaming event settings

4. Use the following guidelines to create an international roaming event:
Field

Description

Name

Identifier for this notification.

Description

Additional text to clarify the purpose of this notification.

Generate Alert

Turns on/off the alert defined for this event.

Alert for Every Country
Visited in the Trip

Applies a compliance action for each country visited after the user
leaves the home country.

Maximum Alerts

Specifies whether there is a limit on the number of alerts generated for
all countries within a given trip. If you select Limited, then you canspecify the number of alerts to allow. Once the user returns to the homecountry, the count is returned to 0.

Severity

Specifies the severity defined for the alert: Critical, Warning, andInformation.

Template

Specifies the template to populate the resulting alert. Click View todisplay the content of the current template. Select an alternate templatefrom the drop-down or click Create to create a new template.
See Customizing Event Center messages for information on creating a

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 684

SIM changed event settings

Field

Description
new template.

Send SMS

Specifies whether to send an alert in a text message, and whether tosend it to the user, the admin, or both. Specify users in the Apply toUsers section or by selecting a label in the Apply to Labels section.
If you select “Admin only” or “User + Admin”, then the CC to Admins
section appears. Use this section to specify administrative users whoshould receive the alert.

Send EmailSpecifies whether to send an alert in an email, and whether to send it tothe user, the admin, or both. Specify users in the Apply to Users
section or by selecting a label in the Apply to Labels section.
If you select “Admin only” or “User + Admin”, then the CC to Admins
section appears. Use this section to specify administrative users whoshould receive the alert.

Send through Push
Notification

Specifies whether to send a message via, and whether to send it to theuser, the admin, or both. Specify users in the Apply to Users section
or by selecting a label in the Apply to Labels section.
If you select “Admin only” or “User + Admin”, then the CC to Admins
section displays. Use this section to specify administrative users whoshould receive the alert.
The length of the message is limited to 255 characters.

Apply to Labels

Associate this event with the selected labels. See the “Using labels toestablish groups” section in the Core MobileIron Getting Started Guide
for more information.

Search UsersEnter the user ID to find devices to which you want to apply this event.

Apply to Users

Associate this group of settings with the selected users.

Search Admins

Enter the admin ID to find devices to which you want to apply thisevent.

CC to Admins

If you selected “Admin only” or “User + Admin”, then the CC to Admins
section appears. Use this section to specify administrative users whoshould receive the alert.

5. Click Save.
NOTE: If more than one international roaming event applies to a device, only the last one you edited
and saved is triggered.

SIM changed event settings
This event type is not supported for macOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 685

SIM changed event settings

Procedure
To create a SIM changed event, in the Admin Portal:
1. Go to Logs > Event Settings.
2. Click Add New.
3. Select SIM Changed Event from the drop-down menu. The New SIM Changed Event dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 686

SIM changed event settings

4. Use the following guidelines for creating a SIM changed event.
Field

Description

Name

Identifier for this event.

Description

Additional text to clarify the purpose of this event.

Generate Alert

Turns on/off the alert defined for this event.

Severity

Specifies the severity defined for the alert: Critical, Warning, andInformation.

Template

Specifies the template to populate the resulting alert.
Click View to display the content of the current template. Select analternate template from the drop-down or click Create to create a new
template. See Customizing Event Center messages for information on
creating a new template.

Send SMS

Specifies whether to send an alert in a text message, and whether tosend it to the user, the admin, or both.
Specify users in the Apply to Users section or by selecting a label in
the Apply to Labels section. If you select “Admin only” or “User +Admin”, then the CC to Admins section appears. Use this section to
specify administrative users who should receive the alert.

Send EmailSpecifies whether to send an alert in an email, and whether to send it tothe user, the admin, or both.
Specify users in the Apply to Users section or by selecting a label in
the Apply to Labels section. If you select “Admin only” or “User +Admin”, then the CC to Admins section appears. Use this section to
specify administrative users who should receive the alert.

Send through Push
Notification

Specifies whether to send a message, and whether to send it to theuser, the admin, or both.
Specify users in the Apply to Users section or by selecting a label in
the Apply to Labels section. If you select “Admin only” or “User +Admin”, then the CC to Admins section appears. Use this section to
specify administrative users who should receive the alert.
The length of the message is limited to 255 characters.

Apply to Labels

Associate this event with the selected labels. See the “Using labels toestablish groups” section in the Core MobileIron Getting Started Guide
for more information.

Search UsersEnter the user ID to find devices to which you want to apply this event.

Apply to Users

Associate this group of settings with the selected users.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 687

Memory size exceeded event settings

Field

Description

CC to Admins

If you selected “Admin only” or “User + Admin”, then the CC to
Admins section displays. Use this section to specify administrative
users who should receive the alert.

5. Click Save.
NOTE: If more than one SIM changed event applies to a device, only the last one you edited and saved
is triggered.

Memory size exceeded event settings
This event type is not supported for macOS devices.
This section address how to create a memory size exceeded event.
Procedure
1. Go to Logs > Event Settings.
2. Click Add New.
3. Select Memory Size Exceeded Event from the drop-down menu.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 688

Memory size exceeded event settings

4. Use the following guidelines to create a memory size exceeded event:
Field

Description

Name

Identifier for this event.

Description

Additional text to clarify the purpose of this notification.

Used Memory Size
Exceeds

Specifies the percentage of total memory that triggers the alert.

Generate Alert

Turns on/off the alert defined for this event.

Alert every

Specifies the time, in days, after which the alert count is reset.

Severity

Specifies the severity defined for the alert: Critical, Warning, andInformation.

Template

Specifies the template to populate the resulting alert. Click View todisplay the content of the current template.
Select an alternate template from the drop-down or click Create to create
a new template.
See Customizing Event Center messages for information on creating a
new template.

Send SMS

Specifies whether to send an alert in a text message, and whether to send
it to the user, the admin, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.

Send EmailSpecifies whether to send an alert in an email, and whether to send it tothe user, the admin, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.

Send through Push
Notification

Specifies whether to send a message, and whether to send it to the user,
the admin, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.
The length of the message is limited to 255 characters.

Apply to Labels

Associate this event with the selected labels. See the “Using labels toestablish groups” section in the Core MobileIron Getting Started Guide formore information.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 689

System event settings

Field

Description

Search UsersEnter the user ID to find devices to which you want to apply this event.

Apply to Users

Associate this group of settings with the selected users.

CC to Admins

If you selected “Admin only” or “User + Admin”, then the CC to Admins
section appears. Use this section to specify administrative users whoshould receive the alert.

5. Click Save.
NOTE: Memory exceeded events are sent only once per week when the configured memory limit isreached. If more than one memory size exceeded event applies to a device, only the last one
you edited and saved is triggered.

System event settings
A system event applies a compliance action when a component of a MobileIron implementation is not working.
System alerts are intended for relevant administrators.
Procedure
1. In the Admin Portal, go to Logs > Event Settings.
2. Click Add New.
3. Select System Event from the drop down menu.
4. Use the guidelines in System event field description to complete the form:
5. Click Save.

System event field description
TABLE 115. SYSTEM EVENT FIELD DESCRIPTIONS
Field

Description

Name

Identifier for this event.

Description

Additional text to clarify the purpose of this notification.

Sentry (standalone and integrated) is
unreachable

Applies a compliance action if MobileIron Core is unable to contact
the MobileIron Sentry.

MobileIron gateway is unreachable

Select this option to send an alert if Core cannot connect to the
MobileIron gateway.

LDAP server is unreachable

Select this option to send an alert if Core cannot connect to any of theconfigured LDAP servers.

DNS server is unreachable

Select this option to send an alert if Core cannot connect to one of theconfigured DNS servers.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 690

System event field description

TABLE 115. SYSTEM EVENT FIELD DESCRIPTIONS (CONT.)
Field

Description

Mail server is unreachable

Select this option to send an alert if Core cannot connect to theconfigured SMTP server.

NTP server is unreachable

Select this option to send an alert if Core connect to the configured
NTP server.

Certificate Expired or Certificate Error

Select this option to send an alert for certificate expiration.
An alert is sent 60 days before expiration and on the expiration date.
Certificates supported include MDM APNS/Client (iOS only), Admin
Portal, and device certificates.

Provisioning Profile Expired

Generates an alert if an iOS provisioning profile distributed via
MobileIron has expired. In general, this profile will be associated withan in-house app.

SMTP Relay server is unreachable

Applies a compliance action if the configured SMTP relay (used for
SMS archive) does not respond to a ping or SMTP ping.

SMTP Relay server error

Applies a compliance action if the configured SMTP relay (used for
SMS archive) returns an error. The alert includes available details toenable troubleshooting.

System storage threshold has beenreachedApplies a compliance action if the system storage threshold has beenreached.
Refer to MobileIron Core System Manager Guide for information on
setting this threshold or manually purging the data.

Connector state events

Applies a compliance action if the health of the Connector changes.
MobileIron defines a healthy connector as one that connects to theserver at expected intervals and syncs successfully with the LDAP
server. An alert is generated if a Connector changes from healthy tounhealthy, or from unhealthy to healthy.

Connector requires upgrade

Applies a compliance action if the automated upgrade of theConnector fails. This alert prompts you to manually upgrade theConnector.

Connector can not connect to LDAP
server

Applies a compliance action if a configured LDAP server is no longer
reachable.

Connector is unreachable

Applies a compliance action if the MobileIron server does not receive
the expected response to the scheduled probe of the Connector.
This alert generally indicates network problems.

Application update failed

Alerts the administrator that the Apps@Work or Bridge update forWindows failed. For more information, administrators can the server
logs.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 691

System event field description

TABLE 115. SYSTEM EVENT FIELD DESCRIPTIONS (CONT.)
Field

Description

Certificate Revoked (MDM APNS)

Generates an alert if an iOS Mobile Device Management (MDM)
Apple Push Notification Service (APNS) certificate has been revoked.

Apple License Percentage Used. Alert
ThresholdGenerates an alert if the licenses used for an iOS app purchased via
Apple Licenses reaches the specified level.
The default threshold is 99 percent. An alert is generated when 99
percent of the license for any Apple License purchased-app have beenredeemed.

Mobile Threat Definition Update

Alerts administrators when a new version of the mobile threat
definition is available. The notification includes any impacts to theexisting MTD Local Action policies if threats were removed from thelatest update.

Generate Alert

Turns on/off the alert defined for this event.

Maximum Alerts

Specifies whether there is a limit on the number of alerts generated fora given event. If you select Limited, then you can specify the numberof alerts to allow. By default, compliance is checked every 24 hours.
See Managing Compliance and Creating an event for more
information.

Alert Every

Specifies the time, in days, after which the alert count is reset.

Severity

Specifies the severity defined for the alert. Select Critical, Warning,or Information.

Template

Specifies the template to populate the resulting alert. Click View todisplay the content of the current template.
Select an alternate template from the drop-down or click Create tocreate a new template. See Customizing Event Center messages for
information on creating a new template.

Send SMS

Specifies whether to send an alert in a text message, and whether tosend it to the user, the administrator, or both. Specify users in the
Apply to Users section or by selecting a label in the Apply to
Labels section. If you select “Admin only” or “User + Admin”, then the
CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.

Send EmailSpecifies whether to send an alert in an email, and whether to send it
to the user, the administrator, or both. Specify users in the Apply toUsers section or by selecting a label in the Apply to Labels section.
If you select “Admin only” or “User + Admin”, then the CC to Admins
section appears. Use this section to specify administrative users whoshould receive the alert.

Send through Push Notification

Specifies whether to send a message via Apple Push Notification

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 692

Policy violations event settings

TABLE 115. SYSTEM EVENT FIELD DESCRIPTIONS (CONT.)
Field

Description
service, and whether to send it to the user, administrator, or both.
Specify users in the Apply to Users section or by selecting a label in
the Apply to Labels section. If you select “Admin only” or “User +Admin”, then the CC to Admins section appears. Use this section to
specify administrative users who should receive the alert.
The length of the message is limited to 255 characters.

Apply to Labels

Send the alert to users in the selected labels. See the “Using labels toestablish groups” section in the Core MobileIron Getting Started Guide
for more information.
NOTE: In most cases, if you do select a label, it should not be alabel with broad coverage. System event alerts areusually not appropriate for device users.

Search UsersEnter the user ID to find users to which you want to send the alert.

Apply to Users

Send the alert to the selected users.

Policy violations event settings
Procedure
1. In the Admin Portal, go to Logs > Event Settings.
2. Click Add New.
3. Select Policy Violation Event from the drop- down menu. The New Policy Violations Event dialog box
opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 693

Policy violations event field description

4. Follow the guidelines in Policy violations event field description to complete the form.
5. Click Save.
NOTE: Apply only one Policy Violations event to each device. If more than one policy violations event
applies to a device, only the last one you edited and saved is triggered. Therefore, do not create
a separate policy violations event for each type of security policy violation.
In that one Policy Violations event, select all of the security policy settings that you want to trigger the event. Use
the template variable $DEFAULT_POLICY_VIOLATION_MESSAGE in your message template to specify the
security policy violation that triggered the event.

Policy violations event field description
The following table describes fields for configuring a policy violation event.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 694

Policy violations event field description

TABLE 116. POLICY VIOLATION EVENT FIELD DESCRIPTION
Field

Description

Name

Identifier for this event.

Description

Additional text to clarify the purpose of this notification.

Connectivity
Out-of-contact with Server for X
number of days

Select this option to send an alert when a device has been out of contact
for the number of days specified in the Security policy assigned to it.

Out-of-policy for X number of days

Select this option to send an alert when a policy has been out of date forthe number of days specified in the Security policy assigned to it.

Device Settings
Passcode is not compliant

Applies a compliance action if a device is detected having a passcodethat does not meet the requirements specified in the associated security
policy.

App Control
Disallowed app foundApplies a compliance action if an app that is specified as Disallowed isinstalled on a device.
Apps are specified as Required, Allowed, or Disallowed under Apps >App Control.

App found that is not in Allowed
Apps list

Applies a compliance action if an app that does not appear on the list ofallowed apps has been detected on a device.
Apps are specified as Required, Allowed, or Disallowed under Apps >App Control.

Required app not foundApplies a compliance action if an app that is specified as Required is notinstalled on a device.
Apps are specified as Required, Allowed, or Disallowed under Apps >App Control.

Data Protection/Encryption - iOS - Android
Data Protection/Encryption isdisabled

Applies a compliance action if data protection/encryption is disabled on an
iOS device.

Security - Windows
OS Build is less than the required
OS build

Select this option to apply a compliance action if the device build is lessthan the OS build defined in the Security policy.

Last Hotfix is less than therequired hotfix

Select this option to apply a compliance action if the device OS build isless than the hotfix build defined in the Security policy.

Last Hotfix installation date is out

Select this option to apply a compliance action if the device OS has not

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 695

Policy violations event field description

TABLE 116. POLICY VIOLATION EVENT FIELD DESCRIPTION (CONT.)
Field

Descriptionof datebeen updated in the time interval defined in the Security policy.

iOS
Disallowed iOS model foundSelect this option to apply a compliance action when a restricted iOS
model is registered.

Disallowed iOS version foundSelect this option to apply a compliance action when a restricted iOS
version is registered.

Compromised iOS device

Select this option to apply a compliance action when a compromised iOS
is registered or connects to the server. That is, an iOS device has been
compromised by circumventing the operator and usage restrictions
imposed by the operator and manufacturer.

iOS Configuration not compliant

Applies a compliance action if an iOS device does not have the expected
security policy or app settings. This state may indicate that a setting waschanged or was not applied successfully.

Restored Device connected toserver

Applies a compliance action if a previously wiped device has been
restored and attempts to connect through the MobileIron deployment.

MobileIron iOS App Multitasking
disabled by user

Applies a compliance action if the device user disables multitasking for
the MobileIron iOS app. Disabling multitasking increases the likelihoodthat a compromised device will go undetected for a significant period oftime.

Device MDM deactivated (iOS 5
and later)

Applies a compliance action when the MDM profile on a managed iOS 5
device is removed.

macOS
Disallowed macOS version foundApplies a compliance action if Core finds a registered device running aprohibited version of macOS.

Device MDM deactivated

Applies a compliance action if Core detects that MDM (Mobile Device
Management) has been deactivated on a registered macOS device.

FileVault encryption disabled

Applies a compliance action if Core detects a registered macOS device
with disabled FileVault encryption.

Android
Disallowed Android OS version
foundApplies a compliance action if an Android device having a disallowed OS
version is detected. You can specify disallowed versions in the security
policy.

Compromised Android device
detected

Applies a compliance action if a modified Android device is detected. Thatis, an Android device has been compromised by circumventing theoperator and usage restrictions imposed by the operator andMobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 696

Policy violations event field description

TABLE 116. POLICY VIOLATION EVENT FIELD DESCRIPTION (CONT.)
Field

Description
manufacturer.

Device administrator not activatedfor DM client or agent

Generate an alert when a managed Android device is found to have nodevice administrator privilege activated for Mobile@Work or the Samsung
DM Agent.

Actions
Generate Alert

Turns on/off the alert defined for this event.

Maximum Alerts

Specifies whether there is a limit on the number of alerts generated for agiven event. If you select Limited, then you can specify the number ofalerts to allow.

Alert Every

Specifies the time, in days, after which the alert count is reset.

Severity

Specifies the severity you define for this alert. Select Critical, Warning,or Information.

Template

Specifies the template to populate the resulting alert. Click View todisplay the content of the current template. Select an alternate templatefrom the drop down or click Create to create a new template.
See Customizing Event Center messages for information on creating a
new template.

Send SMS

Specifies whether to send an alert in a text message, and whether to send
it to the user, the administrator, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.

Send EmailSpecifies whether to send an alert in an email, and whether to send it tothe user, the administrator, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.

Send through Push Notification

Specifies whether to send a message via Apple Push Notification
service, and whether to send it to the user, the administrator, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.
The length of the message is limited to 255 characters.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 697

Device status event settings

TABLE 116. POLICY VIOLATION EVENT FIELD DESCRIPTION (CONT.)
Field

Description

Apply to Labels

Send the alert to users in the selected labels. See the “Using labels toestablish groups” section in the Core MobileIron Getting Started Guide formore information.

Search UsersEnter the user ID to find users to which you want to send the alert.

Apply to Users

Send the alert to the selected users.

CC to Admins

If you selected “Admin only” or “User + Admin”, then the CC to Admins
section appears. Use this section to specify administrative users whoshould receive the alert.

Device status event settings
The device status event applies only to Android and iOS devices. The following describes the steps to create adevice status event in the Admin Portal.
Procedure
1. Go to Logs > Event Settings.
2. Click Add New.
3. Select Device Status Event from the drop-down menu. The New Status Event dialog box opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 698

Device status event settings

4. Use the following guidelines to complete the form:
Field

Description

Name

Identifier for this event.

Description

Additional text to clarify the purpose of this notification.

Triggers when

Specifies the conditions on the device that will trigger an alert:• Device status is changed (Android and iOS)
• Android device reports policy/config errors• Android device reports policy/config warnings• Work schedule policy applied (Android and iOS)

Actions
Severity

Specifies the severity you define for this alert. Select Critical,
Warning, or Information.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 699

Device status event settings

Field

Description

Template

Specifies the template to populate the resulting alert. Click View todisplay the content of the current template. Select an alternate
template from the drop-down or click Create to create a new
template.
See Customizing Event Center messages for information on
creating a new template.

Send SMS

Specifies whether to send an alert in a text message, and whether
to send it to the user, the administrator, or both.
Specify users in the Apply to Users section or by selecting a label
in the Apply to Labels section. If you select “Admin only” or “User+ Admin”, then the CC to Admins section appears. Use thissection to specify administrative users who should receive thealert.

Send EmailSpecifies whether to send an alert in an email, and whether to send
it to the user, the administrator, or both.
Specify users in the Apply to Users section or by selecting a label
in the Apply to Labels section. If you select “Admin only” or “User+ Admin”, then the CC to Admins section appears. Use thissection to specify administrative users who should receive thealert.

Send through Push Notification

Specifies whether to send a message, and whether to send it tothe user, the administrator, or both.
Specify users in the Apply to Users section or by selecting a label
in the Apply to Labels section. If you select “Admin only” or “User+ Admin”, then the CC to Admins section appears. Use thissection to specify administrative users who should receive thealert.
The length of the message is limited to 255 characters.

Apply to Labels

Send the alert to users in the selected labels. See the “Using labels
to establish groups” section in the Core MobileIron Getting Started
Guide for more information.

Search UsersEnter the user ID to find users to which you want to send the alert.

Apply to Users

Send the alert to the selected users.

CC to Admins

If you selected “Admin only” or “User + Admin”, then the CC to
Admins section appears. Use this section to specify
administrative users who should receive the alert.

5. Click Save.
NOTE: If more than one device status event applies to a device, only the last one you edited and saved
is triggered.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 700

Customizing Event Center messages

Related topics
Work Schedule policy

Customizing Event Center messages
The MobileIron Event Center sends emails, SMSes, and push notification messages based on triggering events.
When you configure events, you can use the default message template or create a new one. Event Center
templates enable you to specify content and basic formatting using HTML markup.

Displaying Event Center templates
To display Event Center templates:
1. In the Admin Portal, go to Settings > Templates.

2. Select Event Center Templates.
This list includes the default template for each Event Center type. Default templates are not editable.
3. Click the View link for the message template you want to view.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 701

Adding custom Event Center messages

Adding custom Event Center messages
To add a custom Event Center message:
1. Either click the Create button in the event dialog or select the event type from Settings > Templates >Event Center Templates > Add New.
The following figure shows the event dialog.

2. The following figure shows the Event Center Templates menu.

The dialog for the corresponding event type opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 702

Using variables in Event Center messages

Event Center messages are displayed with the HTML markup that provides the basic formatting for thecontent.
3. In the Name field, enter a name for the template.
The name must be unique for events of the same type.
4. In the Edit Template for field, select the language this template will be used for.
Note that only those languages that have been enabled for the system will be displayed in this list.
5. Make changes to the displayed messages.
6. Click Save.

Using variables in Event Center messages
Supported and required variables for Event Center messages vary by the type of message. The following tablesummarizes these variables. You can also click the Variables Supported link to display this information. Note
that, unlike variables used for registration variables, Event Center variables do not end with $.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 703

Using variables in Event Center messages

TABLE 117. VARIABLES IN EVENT CENTER MESSAGES
Template Type

Required Variables

International Roaming$CURRENT_COUNTRY$HOME_COUNTRY$PHONE_NUMBER$SEVERITY$USER_NAME

Threshold Reached$PHONE_NUMBER$SEVERITY$THRESHOLD_ON$THRESHOLD_TYPE$THRESHOLD_UNIT$THRESHOLD_VALUE$USED_VALUE$USER_NAME

SIM Changed$CURRENT_PHONE_NUMBER$NEW_PHONE_NUMBER$SEVERITY$USER_NAME

Memory Size Exceeded$FREE_MEMORY_SIZE$MEMORY_SIZE_LIMIT$PHONE_NUMBER$SEVERITY$TOTAL_MEMORY_SIZE$USER_NAME

System Event$DEFAULT_SYSTEM_MESSAGE$SERVER_IP$SERVER_NAME$SEVERITY

Policy Violation$DEFAULT_POLICY_VIOLATION_MESSAGE$PHONE_NUMBER$SEVERITY$USER_NAME

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 704

Variable descriptions

Variable descriptions
The following table describes the variables used in Event Center messages.

TABLE 118. VARIABLE DESCRIPTIONS
Variable

Description$CURRENT_COUNTRY

The country in which the device is currently located.

$CURRENT_PHONE_NUMBER

The phone number currently associated with the device in
MobileIron Core, but not matching the phone number currently
used by the device.

$DEFAULT_POLICY_VIOLATION_MESSAGE

The hard-coded message associated with the policy violationthat triggered the alert.
NOTE: Due to the length limits of SMS and APNs, the text
might be truncated.

$DEFAULT_SYSTEM_MESSAGE

The third-party system message or error that triggered thealert.

$FREE_MEMORY_SIZE

The amount of free memory currently available on the device.

$HOME_COUNTRY

The home country of the device.

$MEMORY_SIZE_LIMIT

The threshold set for the device memory.

$NEW_PHONE_NUMBER

The phone number replacing the $CURRENT_PHONE_
NUMBER$ as a result of a SIM change.

$PHONE_NUMBER

The phone number used by the device.

$SERVER_IP

The IP address of the server triggering a system event alert.

$SERVER_NAME

The hostname of the server triggering the system event alert.

$SEVERITY

The defined severity of the system event, i.e., Information,
Warning, or Critical.

$THRESHOLD_ON

The total used for calculations, i.e., International Roaming or
Total Usage.

$THRESHOLD_TYPE

The type of usage measured, i.e., SMS, Data, or Voice.

$THRESHOLD_UNIT

The unit associated with the type of usage, i.e., minutes,
messages, or MB.

$THRESHOLD_VALUE

The defined threshold value for this event, e.g., 1000 (voice
minutes).

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 705

Specifying which template to use

TABLE 118. VARIABLE DESCRIPTIONS (CONT.)
Variable

Description$TOTAL_MEMORY_SIZE

The total memory reported by the device.

$USED_VALUE

The amount of memory currently used on the device.

$USER_NAME

The display name of the user associated with the device.

Specifying which template to use
When you create or edit an event, you specify which template to use for resulting alerts. To select a template:
1. Create or edit an event.
2. Select a template from the drop-down or click the Create button to create a new template.

Filtering Event Center messages
In the Event Center Templates page, you can filter messages by event type. Just select the preferred event typefrom the Event Type drop-down.

Editing Event Center messages
You can edit your custom Event Center templates. However, default Event Center templates are not editable.
To edit a custom Event Center template:
1. In Admin Portal, go to Settings > Templates > Event Center Templates.

2. Click the edit icon for the custom template you want to edit.
3. Make your changes.
4. Click Save.

Deleting Event Center messages
You can delete any of the Event Center messages you have created:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 706

Viewing and Exporting Events

1. In Admin Portal, go to Settings > Templates > Event Center Templates.
2. Select the items you want to delete.
3. Click Delete.

Viewing and Exporting Events
Use the Events screen to track the events that have triggered alerts. To display the Events screen, go to Logs >Events.

Marking as Read or Unread
To enable tracking of which events have been noted and/or addressed by an administrator, you can mark an event
as Read. Likewise, you can switch this flag back to Unread.
To set the Read/Unread flag:
1. Select one or more events.
2. Select Read or Unread or from the Actions menu.

Filtering events
You can display the events using the following filters:

TABLE 119. FILTERING EVENTSFilterDescription

Read/Unread

Select Read or Unread from the Show drop-down list. To resume displaying all
events, select All.

All

Select All to resume displaying all events.

LabelsSelect the preferred label from the Labels drop-down to filter based on the label
specified in the event.

User

Enter a user ID and click the search icon to filter based on the user IDs specified in
the event.

Start Date/End Date

Select dates in the Start Date and End Date fields to filter events by date range.

Event Type

Select an event type from the Type drop-down to filter by event type.

Event Status

Select an event status from the status drop-down to filter based on the event’s
lifecycle state.

Event lifecycle and status
Events go through the following lifecycle:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 707

Exporting event history

Created -> Dispatch Pending -> Dispatching -> Dispatched
The following two failure states may also occur:ll

Dispatch Failed: The process of generating the alert failed. This is usually the result of an SMTP problem.
Check the SMTP configuration in System Manager, as well as the health of your SMTP server.
Expired: Another event occurred that makes the alert obsolete, resulting in expiration before dispatch.

Exporting event history
To export a CSV file containing the currently displayed events on the Logs > Events page, click the Export
button.

Adding a note
You can add a note to one or more events to help track the work that has been done in response. Each event canhold one note; adding another note replaces the existing note. To add a note:
1. Select one or more events.
2. Click Actions > Add Note.

3. Enter the text of the note.
4. Click Add.
5. Press F5 to refresh the screen and confirm that the note displays in the Note field for the selected events.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 708

21Troubleshooting MobileIron Core and devices
This section addresses troubleshooting various aspects of Core and devices.
NOTE: The features described in this section are supported on macOS devices.
About Core logs
Audit log information
Best practices: label management
Device events
ActiveSync Device information
MDM events
Certificate events
App Tunnel events
Audit Logs use cases
MDM Activity
Certificate Management
Service Diagnostic tests
Pull client logs for client devices

About Core logs
As you oversee management and security of users, data and devices, you will need information about the actions
and events that occur in your MobileIron Core instance. MobileIron Core logs many actions that can impact yourCore instance, and provides the Audit Logs page for you to sort and view the logged information.
The following pages of logs, found in the Admin Portal under Logs, enable you to easily navigate through the
MobileIron log entries to find the information you need.
l

Audit Logs: for MobileIron device management entriesl

MDM Activity: for iOS and macOS entrieslCertificate Management: for certificate-related entries

Note The Following:llLogs are stored in the MobileIron Core file system, not in the MobileIron Core database. Therefore, the sizeof the logs does not impact Core performance.
Core will show up to 1 million audit log records.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 709

Audit logs

Audit logs
Using log entries, the Admin Portal tracks status and operations for each managed device. You can use log entries
to confirm that actions were completed and to investigate problems.
The Audit Logs page includes panels that:llenable you to filter through all events that Core has logged since the last time the logs were purgedshows either the events recorded since the logs were last purged, or the events matching the criteria you
specified in the Filters panel

FIGURE 25. AUDIT LOGS

Searching the information in the audit logs
Procedure
To search the information that Core logs:
1. In Admin Portal, go to Logs.
Core displays the Audit Logs page, which initially lists the events logged since the last time the logs were
purged.
2. In the Filters panel, click on the number of events in a category to display only that category’s events.
For example, click the 72 next to App.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 710

Setting event time criteria in audit logs.
3. Alternatively, click to expand one of the information types that you want to view (for example, App).
4. Check the items within that category that you want to view (for example, Add App and Install App).
5. Repeat Step 3 and Step 4 for each category that you want to include in this search.
6. (Optional) To search for events involving a particular administrator, or actions that contain a specific wordor phrase in the details, use the Search by Performed (On|By)/Details box in the Filters panel as follows:lenter the search string in the text box.

lfor example, to find events involving Mobile@Work, enter the text Mobile@Work.

7. (Optional) To limit the time frame of the actions, use the Action Date box (see Setting event time criteria in
audit logs)
8. Click Search.
The Audit Logs page shows all events matching your search criteria and time period. If you do not specify atime period, the default used is the period between the time you run the search and when the log data waslast purged.
9. To reset all search criteria, click Reset.

Setting event time criteria in audit logs
When you are working with audit logs, the default time frame for the events displayed is the time between thecurrent time and the last time the logs were purged (for information about setting the log retention time, see

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 711

Setting event time criteria in audit logs

Specifying how long log information is saved). For example, if the logs were purged two weeks ago, the Audit Logs
display all the events matching any criteria you set that occurred from two weeks ago to the current moment.
You can change the time frame of events you view in the Filters panel. You can select by time or date.
To specify a time frame for events you view from the audit logs:
1. In Admin Portal, go to Logs.
2. In the Filters panel, click the drop-down arrow in Action Date.

3. Select one of the times listed or Others.
Selecting a time displays the events matching criteria you set, if any, for the time period from the last time
the logs were purged until the time you specify.
Any events that occurred between the specified time period and the current moment are not displayed. For
example, if you select 1 hour ago, no events that happened within the last hour are displayed.
4. If you select Others:llusing the left column of time choices in Filters, you can specify an exact date, hour or minute (or any
combination of these criteria) as one end of the time frame and use the date of the last audit log purge
as the other end of the time frame
using the left and right columns of time choices in Filters, you can specify both the beginning and endof the time range.

Use the following table to help you set the time range for your search.

Note The Following:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 712

Setting event time criteria in audit logsllWhen you set only one end of the time frame, the date or time you specify must be later than the last date
the log data was purged. If the last log purge was May 13th, for example, May 12th would not be a valid
date for selecting events.
When you set both ends of the time frame, ensure that the time or date specified in the left column occurs
before the time or date specified in the right column. For example, if you specify 1 hour ago in the left
column and 1 day ago in the right column, Core will display a message asking you to reset your time
criteria because 1 hour ago happens after 1 day ago.

TABLE 120. TIME CRITERIA SELECTION EXAMPLESTime criteria
selected

Value selected

ResultIn the left column,
select both:• Others• Select date

Click May 12th in thedisplayed calendar

Displays all events matching your criteria that occurredfrom the last audit log data purge until May 12th.

In the left column,
select both:• Others• Select hour

Select 2AM from thelist of hours

Displays all events matching your criteria that occurredfrom the last audit log data purge until 2AM of the currentday.

In the left column,
select both:• Others• Select minuteSelect 15 from the listof minutes

Displays all events matching your criteria that occurredfrom the last audit log data purge until the 15th minute of
the current hour.

In the left column,
select:• Others• Select dateIn the left column:• Select April 10thfrom the calendar

Displays all events matching your criteria that occurred
between April 10th and 24 hours ago.

In the right column,
select:• a time interval from
Select time
In the left column,
select:• Others• Select hour

In the right column:• Select 1 day ago

In the left column:• Select 2AM

Displays all events matching your criteria for the time
period that started at 2AM the morning of the current day
and ended an hour ago.

In the right column:• Select 1 hour ago
In the right column,
select:• a time interval from
Select time

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 713

Viewing audit log information

Viewing audit log information
The Audit Logs page displays the information that MobileIron Core records for your Core instance. You specify
what information is displayed on this page when you use the controls in the Filters panel of the page. See
Searching the information in the audit logs for details.
To view the information that Core logs:
1. In Admin Portal, go to Logs.
Core displays the Audit Logs page. The information panel displays:
Action (for example, Admin Portal sign-in)lState (for example, Success)lPerformed By (for example, myadmin)lAction DatelCompleted AtlPerformed On (for example, Admin Portal)l

Details

2. (Optional) Enter a number in Page to specify what page to view.
3. (Optional) Select a number from per page to specify how many records are displayed on a page.
4. (Optional) Click Export to CSV to export the records that match the current search criteria.

Specifying how long log information is saved
You specify how long log data is retained on your server. Determining how long to retain data is a balance between
having data you need and having the available server resources to run your Core. The default value is 90 days.
To set how long log information is kept:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 714

Audit log information

1. In System Manager, go to Settings > Data Purge.
2. In Audit Logs Purge Configuration, select the number of days Core retains log information.
3. Click Apply.

Audit log information
Several categories of information are available for you to view and audit. The category list, displayed on the left
side of the Audit Logs page, includes:lDevicel

ActiveSync Device

l

MDM

l

Certificatel

App Tunnel

l

App

l

PolicylCompliance ActionlConfigurationl

DEP (Device Enrollment)

l

Admin

l

User

l

LDAP

l

Other

l

Label

l

Sentryl

AfWlContentl

VPP

l

Custom AttributeslCompliance Policyl

E-FOTAl

Migrationl

MTD (MobileIron Threat Defense)l

Access Integrationl

Derived Credential Providerl

Zebra FOTA

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 715

Best practices: label management

Best practices: label management
If Notes for Audit Logs is enabled, whenever a change is made to a label, a text box displays for the administrator
to provide a reason for the change.

Example text to enter would be a change ticket order number. This information then displays in the Audit logs, inthe Details column as "Reason."This affects the following label-related activities:l

Add/Edit/Delete/Save Label (Both filter and manual)l

In Devices & Users > Devices > Advanced Search > Save to Labell

Add/Edit/Remove Label to devices

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 716

Device eventsl

Add/Edit/Remove Label to configurationsl

Add/Edit/Remove Label to policiesl

Add/Edit/Remove Label to appsl

Add/Edit/Remove Label to iBooks

The Notes for Audit Logs feature is also applicable to any administrator-made changes to iOS andmacOS restrictions.
To enable this feature, see "Setup tasks" in Getting Started with MobileIron Core.

Device events
Device events record device-related actions taken by an administrator in the Admin Portal.
To monitor device actions, select one or more of the logged device actions in the Filters panel:lAllow App Tunnel: Manually allow app tunnels from the selected device.

l

Apply Label: Associate an item with a label.

l

Apply Multiple Labels to One Device: Associate an item with multiple labels.

lBlock App Tunnel: Manually disallow app tunnels from the selected device.

l

Cancel Wipe: Cancels pending "Wipe" command if it was not yet delivered to the device. Applies to allmodes.

l

Change Language: Change the language associated with a device.

lChange Ownership: Toggle device ownership between Employee and Company.

l

Check Available OS Update:l

Check Compliance: Check device against compliance criteria.

lDelete Retired Device: Remove entry for a device that is not longer managed.

lDevice Location:lDisable:lDisable Activation Lock: Turn off the activation lock feature for the selected iOS device.

lDisable Data Roaming: Turn off the ability to use data when the device is roaming.

lDisable due to out of compliance:lDisable Kiosk: Exit kiosk mode on the designated Android device.

lDisable KNOX Container: Turn off the Samsung KNOX container feature for the selected device.

lDisable Personal Hotspot: Prevent the device user from using the personal hotspot feature.

lDisable Voice Roaming: Turn off the ability to make voice calls when the device is roaming.

l

Download Available OS Update:lEnable:MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 717

Device eventslEnable Activation Lock: Turn on the activation lock feature for the selected iOS device.

lEnable Data Roaming: Turn on the ability to use data while roaming for the selected iOS device.

lEnable Kiosk: Start kiosk mode on the designated Android device.

lEnable KNOX Container: Turn on the Samsung KNOX container feature for the selected device.

lEnable MDM Lost Mode: Enable lost mode for the selected iOS device.

lEnable Personal Hotspot: Allow the device user to use the personal hotspot feature.

lEnable Voice Roaming: Turn on the ability to make voice calls when the device is roaming.

lFound: Designate the selected lost device as found.

lInstall Downloaded OS Update:lInstall Help@Work: Install the MobileIron Help@Work app.

l

Locate: Retrieve the last known location for the selected device.

l

Lock: Force the selected device to require a passcode for user access.

l

Lost: Designate the selected device as lost.

lMobileIron Bridge: Create a configuration for the MobileIron Bridge application for Windows 10
Management.

lPush Profile: Prompt a manual distribution of profiles to the selected device.

lRe-provision Device: Restart the provisioning process for the selected device.

l

Reboot: Reboot the selected Windows device.

lRegister Device: Start the registration process for the selected device.

lRemote Control: Establish a remote control session (Help@Work) on the selected Android device.

lRemote Display: Establish a remote view session (Help@Work) on the selected iOS device.

lRemove Device Attribute: Remove an attribute from a device.

lRemove Label: Remove the association between the specified label and the selected item.

lRemove Multiple labels from one device: Remove the association between the specified labels and theselected item.

lRequest Derived Credential: Device user request in user portal for a derived credential.

lRequest Unlock AppConnect Container (Android only): Initiate unlock AppConnect container.

lRequest Unlock Device: Initiate unlock device.

lRequest Unlock Passcode: Initiate unlock passcode.

l

Resend Provision Message: No longer supported.

lReset AppConnect Passcode: Device user request in user portal to reset the AppConnect passcode.

lReset Password:lRestart iOS Device: Restart iOS device.

l

Reset PIN: Generate a new registration PIN for the selected Windows device.

lRetire: End management of the selected device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 718

ActiveSync Device informationlSend Activation Lock Bypass Code: Send the bypass code to the selected iOS device.

l

Send Alert: Send compliance alert to the selected device.

l

Send APNS message: Launch a MobileIron client and authenticate against MobileIron Core.

l

Send Message: Send SMS message to the selected device.

l

Set Device Attribute: Set an attribute to a device.

l

Shutdown iOS Device: Shutdown iOS device.

l

Sign In: Launch a MobileIron client and authenticate against MobileIron Core.

lSign Out: End session between the MobileIron client and MobileIron Core.

l

l

l

Substitution Variable Change: Change a configuration due to a change in the value of a substitution
variable.
Unlock AppConnect Container (Android only): Begin unlock device and AppConnect container.
Unlock Device and AppConnect Container: (Android only): Begin unlock device and AppConnect
container.

l

Unlock Device Only: Clear the passcode for the selected device.

l

Update Device Comment: Change the Comment field in the record for the selected device.

l

Update OS Software: Update iOS software.

lWakeup: Force the device client to check in.

llWindows License: Alert administrators to upgrade the SKU of Windows 10 desktop devices. Options canbe Windows 10 Pro to Enterprise or Windows 10 Education to Enterprise.
Wipe: Return the device to factory default settings.

NOTE: Events beginning with Request, such as Request Unlock Device, are logged when an
administrator clicks the corresponding command in the Admin Portal. The corresponding event
without the word Request, such as Unlock Device, is logged when Core actually sends therequest to the device. Core sometimes delays sending requests to regulate Core performance.

ActiveSync Device information
These events do not apply to Mac devices.
To monitor ActiveSync device actions, select one or more of the logged ActiveSync device actions in the Filters
panellActiveSync Device Comment: Add or change the comment associated with an ActiveSync device entry.

l

Add Correlation:lAllow Device: Allow a blocked ActiveSync device to access the ActiveSync server.

lAssign ActiveSync Policy: Apply an ActiveSync policy to the selected device.

l

Block Device: Prevent the selected device from accessing the ActiveSync server.

l

Link To MI Device: Associate an ActiveSync device with a device registered with MobileIron Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 719

MDM eventslRemove: End the association between the MobileIron Core device and the ActiveSync device record.

lRemove Correlation:l

Revert ActiveSync Policy: Restore the Default ActiveSync Policy to the selected device.

MDM events
MDM events indicate when a device takes an action due to a MobileIron Core request. These events pertain only to
iOS and Mac devices unless otherwise noted.
To monitor these actions, select one or more of the logged MDM actions in the Filters panel.
l

Apply Redemption Code: Apply Redemption Code: Use a Apple License code.

l

Clear Passcode: Clear Passcode: Reset device passcode.

lDevice Lock: Set screen lock on device.

lInstall Encrypted Sub-Profile:lInstall Managed Application: Install a managed app.

l

Install MDM Profile: Install the MDM profile on the device.

lInstall Provisioning Profile: Install the provisioning profile for a managed app.

l

Lock Device (Android): Lock an Android device.

lProfile Change: Change the profile on an iOS or Android device.

lRemove Encrypted Sub-Profile:lRemove Managed Application: Uninstall a managed app.

lRemove MDM Profile: Remove the MDM profile from the device.

lRemove Provisioning Profile: Remove the provisioning profile for a managed app.

l

Settings: Modify device settings.

lUnlock Device (Android): Unlock an Android device and the AppConnect container on the device.

l

Unlock Device Only (Android): Unlock an Android device.

l

Wipe Device (called Erase Device in the MDM Activity tab): Restore the iOS device to factory defaults.

lWipe Device (Android): Restore the Android device to factory defaults.

NOTE: This MDM log information is also provided in the Logs > MDM Activity tab.

Certificate events
To monitor actions involving certificates, select one or more of the logged certificate actions in the Filters panel.
l

Apply User Provided Certificate: Use a certificate already provided by the user and sent to MobileIron
Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 720

App Tunnel eventslCreate Device Certificate: Issue a device certificate.

lCreate User Certificate: Issue a user certificate.

lDelete User Provided Certificate: Destroy certificate provided by the user via the self-service portal.

l

Device Certificate Expired: Warn on a device certificate that is no longer valid due to expiration.

l

Device Certificate Renewal: Re-enrolls a device certificate.

lReuse Device Certificate: Use an existing device certificate.

lReuse User Certificate: Use an existing user certificate.

l

Revoke Device Certificate: Reclaim a device certificate.

l

Revoke User Certificate: Reclaim a user certificate.

lUpload User Provided Certificate: Send certificate provided by the user via the self-service portal.

l

User Certificate Expired: Warn on a user certificate that is no longer valid due to expiration.

lUser Certificate Renewal: Re-enroll a user certificate.

NOTE: The contents of the Logs > Certificate Management shows information about certificates, suchas their expiration dates. It allows you to take actions, such as re-enroll, remove, and revoke on
the certificates.

App Tunnel events
To monitor actions involving app tunnels, select one or more of the logged app tunnel actions in the Filters panel.
lAllow App Tunnel: Permit the specified app tunnel.

l

App Tunnel Comment: Add a comment on the selected app tunnel.

l

Block App Tunnel: Do not allow the specified app tunnel.

lRemove App Tunnel: Delete the selected app tunnel configuration.

App information
These events do not apply to Mac devices.
To monitor actions involving apps, select one or more of the logged app actions in the Filters panel.
l

Add App: Add an app to the app catalog.

l

Add App Control Rule: Add an app control rule.

l

Add App Dependency:l

Add App Resource: Add screenshots or icons for an app.

l

Apply Label to App: Associate a label with an app.

lDelete App Control Rule: Remove an app control rule.

l

Edit App Control Rule: Change one or more attributes of an app control rule.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 721

Policy informationl

Install App: Send installation request for the selected app.

lManage VPP Labels: Specify labels and account for Apple License app distribution.

lModify App: Edit app catalog entry.

lRemove App: Delete entry from the app catalog.

lRemove Label From App: End the association between an app and a label.

l

Uninstall App: Remove the app from the device based on managed app criteria.

NOTE: For iOS devices, MobileIron Core does not log the action if users:- install apps using Apps@Work- uninstall apps

Policy information
To monitor actions involving policies, select one or more of the logged policy actions in the Filters panel.
lActivate Policy: Set flag to make the selected policy active.

l

Add Policy: Create a new policy.

lApply Label to Policy: Associate a policy and a label.

l

Deactivate Policy: Clear flag to make the selected policy inactive.

lDelete Policy: Delete a policy.

lExport Policy: Export a policy from MobileIron Core.

l

Import Policy: Import a policy into MobileIron Core.

lModify Policy: Change an attribute of an existing policy.

lModify Policy Priorities:lModify Policy Priority: Change the priority for an existing policy.

lRemove Label From Policy: End the association between a policy and a label.

Compliance Action events
To monitor compliance actions, select one or more of the logged compliance actions in the Filters panell

Add Compliance Action: Create a set of actions to be taken on devices that violate policies.

lDelete Compliance Action: Remove a set of actions to be taken on devices that violate policies.

llModify Compliance Action: Make changes to a set of actions to be taken on devices that violate
policies.
Modify Compliance Check Preferences: Make changes to compliance preferences.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 722

Configuration events

Configuration eventsl

Add Configuration: Create a new configuration.

lApply Label To Configuration: Associate a configuration with a label.

l

Export Configuration: Export a configuration from MobileIron Core.

l

Import Configuration: Import a configuration to MobileIron Core.

lModify Configuration: Change the settings in a configuration.

lRemove Configuration: Delete a configuration.

lRemove Label From Configuration: End the association between a configuration and a label.

lRemove Labels From Configuration: End the association between a configuration and multiple labels.

Apple Device Enrollment related events
These events are only for iOS devices.
l

l

l

l

l

l

l

Account Sync Completed:
Add Apple Device Enrollment Account: Specify an Apple Device Enrollment account for use with
MobileIron Core.
Add Apple Device Enrollment Profile: Specify an Apple Device Enrollment profile for use with
MobileIron Core.
Assign Devices To Apple Device Enrollment Profile: Associate devices to an Apple Device
Enrollment profile.
Check Updates For Apple Device Enrollment Accounts: Sync with Apple servers to update device
enrollment information.
Delete Apple Device Enrollment Account: Remove an Apple Device Enrollment account from
MobileIron Core.
Delete Apple Device Enrollment Profile: Remove an Apple Device Enrollment profile from MobileIron
Core.

l

Disable iOS Education:lEnable iOS Education:

l

l

l

Modify Apple Device Enrollment Account: Make changes to an Apple Device Enrollment accountassociated with MobileIron Core.
Modify Apple Device Enrollment Profile: Make changes to an Apple Device Enrollment profile
associated with MobileIron Core.
Sync iOS Education with ASM:Sync with Apple School Manager.

Admin eventsl

Add Space: Define a new delegated administration space.

lAdmin Portal Sign In: Start an Admin Portal session.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 723

User eventsl

Admin Portal Sign Out: End an Admin Portal session.

lAssign Space Admin: Specify an administrator for a space.

lChange Space Priority: Set a different priority for a space.

lDelete Space Admin: Remove space admin access from the user.

lModify Space: Make changes to rules that define a space.

lRemove Admin From Space: Remove the admin user from the space.

lRemove Space: Delete all rules that define a space and reallocate its devices.

lUpdate Device Space: Recalculate space rules to determine device membership.

lUser Locked Out: Prevent administrator from further attempts at signing in after limit on authentication
failures is exceeded.

User eventsl

Add User: Define a new MobileIron Core user.

lDelete User: Remove a MobileIron Core user.

l

Link to LDAP User: Associate a local MobileIron Core user with an LDAP user.

lModify User: Make changes to a user’s attributes.

lModify User Role: Make changes to the roles assigned to a user.

lRe-sync with LDAP: Synchronize LDAP data.

lRemove User Attribute: Remove an attribute from a user.

l

Renew Google Apps password: Manually regenerate a user’s Google Apps password.

lRequire Password Change: Force a local user to change their MobileIron Core password.

lSend Invitation: Invite a user to register with MobileIron Core.

l

Set User Attribute: Set an attribute for a user.

lUser Portal Sign In: Start User Portal session.

lUser Portal Sign Out: End User Portal session.

LDAP eventsl

Add LDAP: Integrate an LDAP server with MobileIron Core.

lDelete Admin LDAP Entity: Delete an Admin LDAP entity that has no roles.

lDelete LDAP: End the integration between an LDAP server and MobileIron Core.

lDelete LDAP Entity: Delete a user LDAP entity that has no roles.

lModify LDAP: Make changes to the record for an integrated LDAP server.

lModify LDAP Preferences: Make changes to the preferences for integrated LDAP servers.

lUpload LDAP Certificate: Add an LDAP certificate to MobileIron Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 724

Other events

Other eventslApplication Started: Start Core services.

l

Application Stopped: Stop Core services.

lComplete feature usage collection: Complete the current run of feature usage collection.

l

Feature usage collection error: Encountered error during collection.

l

Feature usage collection scheduling error: Encountered scheduling error during collection.

lInitiate feature usage collection: Start feature usage collection.

lPurge feature usage data: Purge collected feature usage information.

lPreference Config Changes: Make changes to the settings under Settings > System Settings in the
Admin Portal.

lRetrieve feature usage data: Start collecting feature usage data.

lRetrieve feature usage data file list: Start retrieval of the usage data file list.

Label eventsl

Add Label: Define a new label for MobileIron Core.

lDelete Label: Remove a label from MobileIron Core.

lModify Label: Make changes to a label.

l

Save As Label: Copy a label to a new label.

Sentry eventsl

Add Integrated Sentry: Establish a relationship between MobileIron Core and an Integrated Sentry.

l

Add Standalone Sentry: Establish a relationship between MobileIron Core and a Standalone Sentry.

lDelete Integrated Sentry: End the relationship between MobileIron Core and an Integrated Sentry.

lDelete Standalone Sentry: End the relationship between MobileIron Core and a Standalone Sentry.

lDisable Integrated Sentry: Suspend the interaction between MobileIron Core and an Integrated Sentry.

lDisable Standalone Sentry: Suspend the interaction between MobileIron Core and a Standalone Sentry.

l

Edit Integrated Sentry: Make changes to the settings for an Integrated Sentry.

l

Edit Standalone Sentry: Make changes to the settings for a Standalone Sentry.

lEnable Integrated Sentry: Start the interaction between MobileIron Core and an Integrated Sentry.

lEnable Standalone Sentry: Start the interaction between MobileIron Core and a Standalone Sentry.

lManage Certificate: Upload a certificate for Standalone Sentry.

lModify Sentry Preferences: Make changes to the settings under Services > Sentry.

lRegenerate Key: Generate a new control key for attachment encryption.

lRegenerate Attachment Encryption Control Key:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 725

Content eventslResync Integrated Sentry With Exchange: Force Integrated Sentry to synchronize mailbox data with
the Exchange server.

Content eventsContent events indicate changes to iBooks on MobileIron Core. These events apply only to iOS and Mac devices.
l

Add iBook: Add an iBook to MobileIron Core.

l

Apply Label to iBook: Associate a label with an iBook.

l

Install iBook: Install an iBook.

l

Modify iBook: Edit the iBook entry in MobileIron Core.

lRemove iBook: Delete the iBook from MobileIron Core.

lRemove Label from iBook: End the association between an iBook and a label.

l

Uninstall iBook: Uninstall an iBook.

VPP events
VPP events indicate changes made to apps that are part of Apple’s Volume Purchase Program (VPP).
l

Account Sync Completed: Complete a sync for a VPP account.

lApply VPP Labels: Apply VPP labels to the VPP app.

lChange VPP License Type: Change the VPP license from user-based to device-based, or vice versa.

lRemove VPP Labels: Remove labels associated with the VPP app.

l

Revoke All VPP Licenses: Revoke all licenses for a VPP app.

l

Revoke VPP License: Revoke the license for a VPP app from a given device.

Custom attributes eventsl

Add Custom Attribute: Create a new customer attribute definition.

lModify Custom Attribute: Modify a customer attribute definition.

Compliance policy eventsl

Add Compliance Policy Group: Add a new compliance policy group.

l

Add Compliance Policy Rule: Add a new compliance policy rule.

l

Apply Label to Compliance Policy Group: Apply one or more labels to a compliance policy group.

lModify Compliance Policy Group: Modify a compliance policy group.

lModify Compliance Policy Rule: Modify a compliance policy rule.

lRemove Compliance Policy Group: Delete a compliance policy group.

lRemove Compliance Policy Rule: Delete a compliance policy rule.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 726

Audit Logs use caseslRemove Label From Compliance Policy Group: Delete one or more labels from a compliance policy
group.

Audit Logs use cases
A wealth of information is available to you in the Audit Logs. Querying the events allows you to monitor your
MobileIron system and resolve problems. You can run queries for one type of event, several types of events, or as
many as you like. All you need to do is check the events you want to track, and then specify a time frame. The
default time frame is the time between the last time the logs were purged and the current time.
For example:
l

l

l

l

l

Use the certificate events to troubleshoot certificate issues. For example, query for certificates that have
expired or have been revoked.
Use the MDM events to troubleshoot MDM activity on devices. For example, query whether an MDM
profile was removed, or whether a managed app was installed.
Use the AppTunnel events to determine whether an administrator manually blocked or allowed AppTunnel
on a device.
Use the device events to determine activity taken on devices, such as unlocking the device, or deleting
retired devices.
Use the app events to determine whether an administrator has changed the app control rules in MobileIron
Core. A change to app control rules can result in Core taking, or not taking, compliance actions such as
blocking email on devices.

This section presents several scenarios and how you can use the audit logs to resolve the problems they present.

Personal information is wiped from devices
Suppose several of your users report that the personal information on their phones was wiped. How can you figureout how this happened? Using the audit logs, you can check the wipe actions recorded in the logs, and discover:l

who issued the Wipe commandslwhen they occurredlhow many users are impacted

To resolve this problem:
1. In the Admin Portal, select Logs.
2. Select Audit Logs.
3. Click Reset at the bottom of the Filters panel to ensure that the previous search values are cleared.
4. In the Filters panel, specify a time interval that you suspect the device wipe(s) happened.
5. Open the Device events list.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 727

Users are prompted for email passwords when not necessary

6. Select Wipe.

7. Click Search.
8. View the results of the search to determine:lwhen the devices were wipedlhow many devices were wipedlwhich admin user issued the wipe commands

Users are prompted for email passwords when not necessary
Suppose you set up your Exchange policy to not require your users to provide a password when they log in toemail, but your users are still prompted for a password each time they access email.
To check for any changes to the Exchange policy that could cause this problem:
1. In the Admin Portal, select Logs.
2. Select Audit Logs.
3. Click Reset at the bottom of the Filters panel to ensure that the previous search values are cleared.
4. In the Filters panel, specify a time interval that you suspect changes to the Exchange policy happened.
5. Open the Configuration events list.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 728

Users are prompted to create passwords

6. Select Modify Configuration.
7. Click Search.
8. View the results of the search to determine:lwhat changes were made recently to the Exchange policylwhich admin user made the changes

Users are prompted to create passwords
Suppose your users are prompted to create device passwords when that is not how you set up your MobileIron
Core. You can use the audit logs to discover if this requirement is set and when this change occurred.
To check for changes to mandatory passwords:
1. In the Admin Portal, select Logs.
2. Select Audit Logs.
3. Click Reset at the bottom of the Filters panel to ensure that the previous search values are cleared.
4. In the Filters panel, specify a time interval that you suspect changes to the security policy happened.
5. Open the Policy events list.

6. Select Modify Policy.
7. Click Search.
8. View the results of the search to determine:lwhat changes, if any, were made recently to the Security policylwhich admin user made the changes

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 729

Devices have lost their managed apps

Devices have lost their managed apps
If your users report missing managed apps, the cause is usually deleted labels.
NOTE: For Android devices 11 through the latest version as supported by MobileIron, the administrator
does not have the ability to manage app installs on the personal side.
To determine whether labels were deleted from your MobileIron Core:
1. In the Admin Portal, select Logs.
2. Select Audit Logs.
3. Click Reset at the bottom of the Filters panel to ensure that the previous search values are cleared.
4. In the Filters panel, specify a time interval that you suspect the labels were deleted.
5. Open the Label events list.

6. Select Delete Label.
7. Click Search.
8. View the results of the search to determine:lwhat labels, if any, were deleted recentlylwhich admin user made the changes

MDM Activity
The Logs > MDM Activity displays MDM-specific log entries.
NOTE: Many of these entries are also available in Logs > Audit Logs in the MDM category.
Filter the log entries using the following criteria:lPlatformlDate rangelStateslActions

l

User

l

DevicelError text

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 730

Viewing ErrorslDetail textlDate range

Viewing Errors
Errors result in the display of a View Error link in the Error column.
Click the link to display error details.

Certificate Management
The Logs > Certificate Management tab displays certificate-related log entries. You can:lview certificate log entrieslsearch certificate log entrieslremove selected certificates from the log

lrevoke selected certificates from the loglre-enroll selected certificates from the log

NOTE: Actions on certificates are logged in Logs > Audit Logsin the Certificate category.

How to search for certificate entries
When viewing the Certificate Management page, you can search for entries based on:lexpiration date

l

user

l

setting

Procedure
To search the Certificate Management page:
1. In the Admin Portal, go to Logs > Certificate Management.
2. Specify one or more of the criteria in the following steps to describe the certificates you want to display.
3. (Optional) To specify a time range within which the certificates expired:ll

In the Expiration Date Range field, click the calendar next to the field, and then click on a date. Thisdate is the earliest day the certificates you are searching for expired.
In the To field click the calendar next to the field, and then click on a date. This date is the latest day
the certificates you are searching for expired.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 731

How to search for certificate entries

NOTE: An error message displays if you select a day in the Expiration Date Range field earlier
than the day specified in the To field. For example you receive an error message ifyou:l

An error message displays if you select a day in the Expiration Date Range field earlier than the day
specified in the To field. For example you receive an error message if you:lselect November 13th in the Expired Date Range field (earliest time a certificate expired).

lselect October 15th in the To field (latest time a certificate expired).
NOTE: The search can return fewer than all the certificates that expired during the specified
time period if you specify other criteria in Step 4.

4. (Optional) In Search by User/Setting Name, enter a username or a setting name.
Certificate
Enrollment

Displays the name of the Certificate Enrollment setting.

Setting

Displays the configuration using the Certificate Enrollment.
The configuration displays only for a non-cached Certificate Enrollment.
Configuration names are not available for certificates created in VSP Version
6.0 or earlier.
For a cached Certificate Enrollment certificate, you will always see - in the
Setting Name, regardless of whether it was created prior to version 7.0 or
created in version 7.0.

5. Click Search.
Search results are displayed in a table with the following columns:
Item

Description

User

The user name of the device user identified by the identity certificate.

Phone Number

The phone number associated with the device user identified by the identity
certificate.

Email

The email address associated with the device user identified by the identity
certificate.

Certificate Enrollment
Name

The name of the certificate enrollment (such as SCEP, Local, Entrust) used
to issue the identity certificate.

Setting Name

The name of the setting that uses the certificate enrollment, such as an
Exchange or Web@Work setting.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 732

How to remove a certificate

Item

Description

Cert Type

Indicates whether the certificate is a user-provided certificate enrollment.
Otherwise, this field is left blank.

Expiration Date

The date by which the identity certificate will no longer be valid.

Content

Click the View link to see the contents of the identity certificate itself.

How to remove a certificate
This action removes the certificate from device, but does not remove the SCEP setting.
To remove a certificate:
1. Go to Logs > Certificate Management.
2. Select the certificate that you want to remove.
3. Click Actions > Remove.

How to revoke a certificate
You can revoke certificates created using a Local Certificate Authority, OpenTrust, Entrust API Version 9, andSymantec Web Service PKI. Revoking a certificate adds the certificate to the CRL (Certificate Revocation List).
When a device authenticates with MobileIron Core, the system first checks the CRL to verify that the certificate is
not on the list. If the certificate is on the list, authentication fails.
To revoke a certificate:
1. Go to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Click Actions > Revoke.
The certificate will be added immediately to the CRL so the next time the device attempts to authenticate,authentication will fail.

How to re-enroll a SCEP certificate
This feature is not supported on iOS Mac devices.

Service Diagnostic tests
The Service Diagnostic screen (Services > Overview) in the Admin Portal provides a health check for several
services. The diagnostic tests determine whether your Core instance can connect to these services. An error
indicates that you cannot reach the service.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 733

Service Diagnostic tests

The services checked are:

TABLE 121. SERVICE DIAGNOSTIC TESTS DESCRIPTIONS
Service

Test

AFW

Checks to see if:• Authentication server https://accounts.google.com/o/oauth2/token is reachable.
• API server https://www.googleapis.com/androidenterprise/v1/enterprises isreachable.

APNS

Checks to see if:• MDM-APNS service is reachable.
• ENTERPRISE-APNS - No Enterprise APNS certificate configured.
• MDM-APNS - feedback service (tccentos122.auto.mobileiron.com:2196) is notreachable.

APPCONFIG_COMMUNITY_REPO

Checks to see if the AppConfig Community Repository server is reachable:

APP_GATEWAY

Checks to see if App Gateway server is reachable:

https://d2e3kgnhdeg083.cloudfront.net/com.example.OneTouchConfiguration/current/
appconfig.xml

https://gwtest.mobileiron.com/gateway/gatewayServices/status.html
BYPASS

Checks the connection between your Core instance and the Apple activation lockbypass server

CERTIFICATEENROLLMENT

Checks to see if:• Certificate Enrollment : System - iOS Enrollment SCEP is reachable.
• Certificate Enrollment : System - iOS Enterprise AppStore SCEP is reachable.
• Certificate Enrollment : System - Windows Phone Enrollment SCEP is reachable.

CONFIGURATIONS

Tests the connection to the Certificate Enrollment server from your Core instance.

CONNECTOR

Two tests are run:
• One test checks whether Enterprise Connector is enabled (Services > Connector)• If Enterprise Connector is enabled, the other test sends an HTTP Post request fromyour Core instance to each Connector configured, checking whether the Connector
can communicate with your Core instance

DEP

Sends a sample GET request to test the connection between your Core instance andthe MDM server using Device Enrollment.

FCM

Checks whether Google Firebase Cloud Messaging (FCM) is reachable from your Coreinstance.

HEALTH_ATTESTATION_SERVICE

Checks if the Health Attestation Service serveris reachable.

LDAP

Two tests are run:https://has.spserv.microsoft.com/HealthAttestation/ValidateHealthCertificate/v1

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 734

Running Service Diagnostic tests

TABLE 121. SERVICE DIAGNOSTIC TESTS DESCRIPTIONS (CONT.)
Service

Test••

MAPQUEST

Checks LDAP from Core to verify the communication channel
For each Connector configured, checks the communication channel for the pathfrom the LDAP server to Core, then Core to Connector, and finally from Connector
to the LDAP server

Checks if the MapQuest Service server is reachable:
https://api.mqcdn.com/sdk/mapquest-js/v1.0.0/mapquest.js

PROXY

No proxy is configured.

SENTRY

Checks the connection between your Core instance and the Sentry used (either
integrated standalone). As part of this test, the connection between ActiveSync serverand Sentry is checked also.

SENTRY_WITH_
ACTIVESYNC

No Integrated Sentry server(s) configured.

SERVICES

Checks whether the IP addresses reserved for FCM are reachable.

VPP

Sends a GET request to verify the connection between Core and the Apple License
server.

No Standalone Sentry server(s) configured.

Running Service Diagnostic tests
To run the Service Diagnostic tests:
1. Go to Services > Overview.
2. To test one or all of the services:l

Click Verify All to test the listed serviceslClick Verify next to a specific service to test that service

Pull client logs for client devices
To troubleshoot challenging technical support issues when working with MobileIron Technical Support, you can pullclient logs of an Android or iOS client device without requiring any interaction from the end user. From the Admin
portal, use the Pull client log command to obtain client logs. The Pull client log action as well as the success or
failure of the event is captured in the Audit logs. This feature does not work on Windows and chromeOS devices.
NOTE: The Pull client log command is not available to delegated admin roles; only administrators who
have the Manage Devices role can use this feature.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 735

Pull client logs for client devices

When the Pull client logs command is delivered to the device, it instructs the Mobile@Work client to collect logs
running on the device. This may include logs from all the secure apps running on the device. These logs are pulled
to the server's file storage.
Potentially, there is one interaction that may cause a message to be displayed to a device user. If the device has
an AppConnect configuration and a number of secure apps installed, then the Mobile@Work client may
momentarily go to the foreground of the device display and request secure apps logs from the Secure AppManager
application. Under these conditions, a message is displayed on the device that states a device administrator ispulling Mobile@Work client logs and logs from the secure applications for analysis. Also, the message states that
this is a short interruption.
When you have an AppConnect configuration that is running and SecureApps Manager and the SecureApps
Manager does not communicate with Mobile@Work in a timely fashion, then the end user may be prompted to log
in again.
NOTE: You can retrieve the client logs from the System Manager. Select Troubleshooting > Logs in the
Export Logs section. Select Show Tech (All Logs). For more information see "Exporting logs" in the
MobileIron Core System Manager Guide.
Before you pull a client log, you may want to set log encryption and then upload this configuration on the device.
When you enable log encryption, the client will encrypt logs when the Pull client log action is taken. By default, log
encryption is set to off. To set log encryption, you can use the default log encryption certification or custom
certification.
To access the Pull client log command:
1. Go to Devices & Users > Devices.
2. Select the check box next to a device. You may only select one device.
3. Click the Actions button.
4. Select Pull Client Logs. The Pull Client Logs dialog box displays. The Devices field displays the nameof the device that you selected. You cannot add additional devices here.
5. (Optional) Add any notes about this action in the Notes section.
6. Click the Pull Client Logs button to launch this request to the server.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 736

22
Office 365
This section contains the overview, policies, configurations, user groups, reports and settings as pertains to Office365:lOffice 365 App Protection overviewlOffice 365 App Protection policieslOffice 365 App Protection configurationsl

Office 365 App Protection user groupsl

Office 365 App Protection reportsl

Office 365 App Protection settings

Office 365 App Protection overview
Office 365 App Protection provides important Data Loss Prevention (DLP) for Office 365 apps, such as Microsoft
Word, Excel, PowerPoint, and so on. It allows administrators to manage policies and configurations that securedata in Office 365 apps on iOS devices.
NOTE: Some Graph APIs can be in beta. Use this feature accordingly.
You can manage Office 365 apps by:l

Enforcing PIN for Office 365 appslDisabling contacts to sync from Office 365 appslPreventing users from printing from Office 365 appslPreventing outbound data sharing from Office 365 apps

Prerequisites for using Office 365 App Protection
Before you can use Office 365 App Protection, you must have:l

A valid MobileIron license.

l

A valid Intune subscription or a Microsoft EMS subscription that includes Intune.

l

A valid Office Enterprise or Business subscription with access to Office 365 apps on a mobile device.

l

One or more Office 365 apps.

lSynced your Active Directory users to your Azure Active Directory.

l

One Drive for Business installed on devices to protect data on Word, Excel, and PowerPoint.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 737

Office 365 App Protection windowllIntune Company Portal app installed on Android devices.
Device users are not required to sign in, but this app must be installed on the device to protect data on
device.

Office 365 App Protection window
NOTE: Before you register MobileIron as an Azure app, only the Services > Microsoft Graph > Settings tab
is enabled. Once you register MobileIron as an Azure app, all the tabs are enabled.
Access the Office 365 App Protection window by logging into the Admin Portal and going to Services > Microsoft
Graph. This window includes the following options:l

Policies: Use this tab to add and manage Office 365 DLP policies. You can perform the following actions
on each policy:oAssign one or more User groups to the policy.

oAssign apps to the policy.

oDelete the policy.

See Adding Office 365 App Protection policies for details on how to add a Office 365 App Protection policy.
lConfigurations: Use this tab to add and manage Office 365 DLP configurations. You can perform thefollowing actions on each policy:oAssign one or more User groups to the configuration.

oAssign apps to the configuration.

oDelete the configuration.

See Office 365 App Protection configurations for details on how to add a Office 365 App Protection
configuration.
lll

User Groups: Use this tab to search for and view user groups available to add to a policy or configuration.
Reports: Use this tab to view and download user and app reports and manage wipe requests. These
reports are populated with data that comes from Azure Active Directory during real-time syncs.
Settings: Use this tab to register MobileIron as an Office 365 app. These reports are populated with datathat comes from Azure Active Directory during real-time syncs.

Office 365 App Protection policies
Once you register MobileIron as an Azure app you can add and manage Office 365 App Protection policies in theMicrosoft Azure cloud for Office 365 apps.
This section includes the following topics:l

Adding Office 365 App Protection policieslEditing Office 365 App Protection policies

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 738

Adding Office 365 App Protection policieslManaging Office 365 App Protection policiesl

Add Office 365 App Protection policies window

NOTE: Before using this feature, complete the prerequisites described in the following section:
Prerequisites for using Office 365 App Protection.
Related topicsl

Office 365 App Protection overviewlOffice 365 App Protection configurationsl

Office 365 App Protection user groupsl

Office 365 App Protection reportsl

Office 365 App Protection settings

Adding Office 365 App Protection policies
Policies use data populated from Azure Active Directory during real-time syncs.
Procedure
1. Log into the Admin Portal.
2. Go to Services > Microsoft Graph > Policies > Add.
3. Complete the App protection policies form.
Refer to Add Office 365 App Protection policies window for details.
4. In the Compliance Actions section, select a Setting, enter the value, and select an Action. Refer to the App
protection policies fields table.
5. Click +Add to configure additional compliance actions.
6. Click Save to add the policy to the list of DLP policies on the Policies table.

Editing Office 365 App Protection policies
Policies use data populated from Azure Active Directory during real-time syncs.
Procedure
1. Log into the Admin Portal.
2. Go to Services > Microsoft Graph > Policies.
3. Click the name of a policy you want to edit.
4. Complete the App protection policies form.
Refer to Add Office 365 App Protection policies window for details.
5. In the Compliance Actions section, select a Setting, enter the value, and select an Action. Refer to the App
protection policies fields table.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 739

Managing Office 365 App Protection policies

6. Click +Add to configure additional compliance actions.
7. Click Save to save the policy edits.

Managing Office 365 App Protection policies
You can take any of the following actions on each Office 365 App Protection policy:lAssign User GroupslAssign Appsl

Delete Policies

Procedure
1. Log into the Admin Portal.
2. Go to Services > Microsoft Graph > Policies.
3. Locate a policy you want to manage and go to the Actions column.
4. Assign user groups to the App Protection policy.
a. Click the Assign User Groups icon.
b. Search for user groups.
c. Select one or more user groups to add to the policy.
d. Click Save.
5. Assign Office 365 apps to the app protection policy.
a. Click the Assign Apps icon.
b. Search for apps.
c. Select one or more apps to add to the policy.
d. Click Save.
6. Delete an Office 365 App Protection policy.
a. Click the Delete Policy icon.
b. Click Yes to confirm deletion of the policy.
The Office 365 App Protection policies take affect:l

After assigning the policy to a user group.

l

A user from the assigned user group logs into an Office 365 app using AAD credentials.

Add Office 365 App Protection policies window
Access this window by logging into the Admin Portal and selecting Services > Microsoft Graph > Policy andclicking Add or clicking a policy to edit.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 740

Add Office 365 App Protection policies window

The following table summarizes fields and descriptions in the Add App Policies window. Also, refer to the App
protection policies fields table.

TABLE 122. APP PROTECTION POLICIES FIELDS
FieldsDescription

Name

This required field is the name used to track the Office 365 App Protection
policy in Core.

Description

Describes the profile’s purpose (optional).

Platform

Select the platform for the Office 365 apps. The options are: iOS orAndroid. Some of the other options on this form will change depending on
which platform you select. Refer to the relevant platform's Device
Management Guide.

Data Relocation
Prevent iTunes and iCloud
backups

Choose Yes to prevent this app from backing up data to iTunes and iCloud.
Choose No to allow this app to back up data to iTunes and iCloud. (Thedefault is Yes.)

Allow app to transfer data toother apps

Use this option to specify what apps can receive data from this app. The
options are listed below.
l

l

l

l

l

Policy managed apps: Allow transfer only to other policymanaged apps.
All apps: Allow transfer to any app (default.)
None: Do not allow data transfer to any app, including other policymanaged apps.
Policy managed apps with OS sharing: Only allow transfer only
to other policy managed apps and file transfer to other MDM
managed apps on enrolled devices.
Policy managed apps with Open-In/Share filtering: Allowtransfer only to other policy managed apps and filter OS OpenIn/Share dialogs to only display policy managed apps.

When any of the above options except All apps are selected, the exempted
apps are listed to the right of the Allow app to receive data from other apps
field. Modifying these settings changes how data is transferred to otherapplications.
Allow app to receive data fromother apps

Select an option to specify what apps can transfer data to this app.
ll

Policy managed apps - Allow app to receive data from only otherpolicy-managed apps.
All apps With Incoming Org Data - Treat all incoming data
without a user identity as data from your organization.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 741

Add Office 365 App Protection policies window

TABLE 122. APP PROTECTION POLICIES FIELDS (CONT.)
FieldsDescriptionllPrevent "Save As "All apps Allow app to receive data from other apps (default.)
None - Do not allow app to receive data from any app, including
other policy-managed apps.

Select to disable the use of the Save As (a new document) option in any appthat uses this policy. De-select if you want to allow the use of Save As.
(Default is unchecked.)
Selecting Prevent Save As activates the Select which storage services
corporate data can be saved to field. The options are:Restrict cut, copy and pastewith other appslOneDrive for BusinesslSharePointl

Local Storage

Specifies when cut, copy, and paste actions can be used with this app. The
options are listed below.
l

l

l

l

Encrypt app data

Blocked: Do not allow cut, copy, and paste actions between thisapp and any other app.
Policy managed apps: Allow cut, copy, and paste actions
between this app and other policy-managed apps.
Policy managed with paste in: Allow cut or copy between thisapp and other policy-managed apps. Allow data from any app to bepasted into this app.
Any app: No restrictions for cut, copy, and paste to and from thisapp. (This is the default.)

Select to encrypt app data that is associated with an Intune mobile
application management policy, data is encrypted when the device is locked(the operating system provides device-level encryption). When a PIN or
fingerprint identification is required, the data is encrypted per the settings in
the mobile application management policy. The module used by iOS 7 are
FIPS 140-2 certified.
These values determine when the data is encrypted:lllWhen device is locked: All app data that is associated with thispolicy is encrypted while the device is locked. (This is the default.)
When device is locked and there are open files: All app dataassociated with this policy is encrypted while the device is locked,
except for data in the files that are currently open in the app.
After device restart: All app data associated with this policy is
encrypted when the device is restarted, until the device is unlocked

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 742

Add Office 365 App Protection policies window

TABLE 122. APP PROTECTION POLICIES FIELDS (CONT.)
FieldsDescription
for the first time.
l

Use device settings: App data is encrypted based on the default
settings on the device.

Disable contact sync

When this setting is enabled, users cannot sync contacts to the native
address book. Default is un-checked.

Disable printing

Select this to block printing protected data from the app. Default is unchecked.

Restrict web content to display
in the Managed Browser

Check this to enforce web links in the app to be opened in the Managed
Browser app.
Uncheck this to open web links in Safari. Default is de-selected.

Block third party keyboards

When this setting is enabled, a third-party keyboard cannot be used withprotected apps.

AccessRequire PIN for accessSelect this to require users to enter a PIN to access this app. The user is
prompted to set up this PIN the first time the app is run. Default is selected,
which activates all the fields in the Access section of this page.
You can also let users prove their identity by using Touch ID instead of a
PIN. When users tries to use this app with their account, they are prompted
to provide their fingerprint identity instead of entering a PIN. When thissetting is enabled, the App-switcher preview image will be blurred while
using the account. (The default is checked.)

Allow simple PIN

Allow simple PIN: Check this to allow users to use simple PIN sequences
like 1234 or 1111. Choose No to prevent them from using simple
sequences. (The default value is checked.)l

PIN length: Specify the minimum number of digits in a PIN
sequence. (The default value is 4.)

When the Require PIN for access field is de-selected, this field isdeactivated.
Allow Touch ID instead of
PIN for access (iOS 8+)

Select to allow the device user to use Touch ID instead of PIN for access.
Applicable for iOS 8 through the most recently released version as
supported by MobileIron.
When the Require PIN for access field is de-selected, this field isdeactivated.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 743

Compliance Actions

TABLE 122. APP PROTECTION POLICIES FIELDS (CONT.)
FieldsDescription

Override Touch ID with PIN
after timeout (minutes)

If required, depending on the timeout (minutes of inactivity), a PIN prompt
will override Touch ID prompts. If this timeout value is not met, the Touch
ID prompt will continue to show. This timeout value specified under"Recheck the access requirements after (minutes of Activity)". On iOS, thisfeature requires the app to have Intune SDK version 8.1.1 or above.
Inactivity timeout: Specify a time in minutes after which the PIN will
override the use of a Touch ID.
When the Require PIN for access field is de-selected, this field isdeactivated.

Disable app PIN when device
PIN is managed

Select to disable the app PIN when a device lock is detected on an enrolled
device. If you select this option, it overrides the requirements for PIN or
Touch ID. (The default is unchecked.)
When the Require PIN for access field is de-selected, this field isdeactivated.

Require corporate credentials
for accessSelect to require corporate credentials instead of a PIN for app access. Not
selecting this option overrides the requirements for PIN or Touch ID. The
user will be prompted to provide their corporate credentials. (The default isunchecked.)

Recheck the accessrequirements after (minutes)

Timeout for access requirements is measured in terms of the time ofinactivity between any policy-managed application.
lTimeout: Enter the number of minutes before the accessrequirements (defined earlier in the policy) are rechecked. For
example, an administrator turns on PIN in the policy, which means
a when device user opens a app, a PIN must be entered. Whenusing the Recheck the access requirements setting, the deviceuser would not have to re-enter the PIN on any app for another 30
minutes. (The default is 30.)

Compliance Actions
Use the Compliance Actions Settings to set the security requirements for your access protection policy. Several
settings are provided with pre-configured values and actions.
Procedure
1. Select a Setting, enter the value, and select an Action. Refer to the table below.
2. Click +Add to configure additional compliance actions.
3. At the top of the Policies tab, click Save.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 744

Compliance Actions

TABLE 123. COMPLIANCE ACTION SETTINGS
Setting

Description

Max PIN attempts (default)

Specify the number of tries the device user has to successfully enter thecorrect PIN before the configured action is taken. (Default value is 30
minutes.) Actions include:llReset PIN - The user must reset their PIN.
Wipe data - The user account that is associated with theapplication is wiped from the device.

Offline grace period (default)This is the number of minutes that apps can run offline. Specify the time (inminutes) before the access requirements for the app are rechecked. After
this period is expired, the app will Block Access. The default is 720
minutes (12 hours.)

Offline grace period (default)This is the number of minutes that apps can run offline. Specify the time (indays) before the access requirements for the app are rechecked. After thisperiod is expired, the app will Wipe data. The default is 90 days.

Jailbroken/rooted devicell

Min OS version

Wipe data - The device user account that is associated with theapplication is wiped from the device

Select this to require a minimum operating system to use this app. Enter thevalue in the following format [major].[minor] and select one of the following
actions:lll

Min App version

Block access - Prevent this app from running on jailbroken or
rooted devices. The device user continues to be able to use thisapp for personal tasks, but will have to use a different device toaccess data in this app.

Block access - The device user will be blocked from access if theversion on the device does not meet the requirement.
Wipe data - The device user account that is associated with theapplication is wiped from the device.
Warn - The user will see a notification if the operating systemversion on the device does not meet the requirement. This
notification can be dismissed.

Check this option to require a minimum app version to use the app. The user
will be blocked from access if the app version on the device does not meetthe requirement.
ll

Block access - The device user will be blocked from access if theapp version on the device does not meet this requirement.
Wipe data - The device user account that is associated with the

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 745

Office 365 App Protection configurations

TABLE 123. COMPLIANCE ACTION SETTINGS (CONT.)
Setting

Description
application is wiped from the device.
l

Min SDK version

Warn - The user will see a notification if the app version on thedevice does not meet the requirement. This notification can bedismissed.

Select to require devices to have a minimum iOS security patch released byApple. The value must be in the following format: [Major].[Minor] or [Major].
[Minor].[Build] or [Major].[Minor].[Build].[Revision]
Example: 1.5 or 1.5.50 or 1.5.50.101
Set the Action:ll

Device model(s)Block access - The device user will be blocked from access if the
iOS version on the device does not meet this requirement.
Wipe data - The device user account that is associated with theapplication is wiped from the device.

Specify a device manufacturer that is required to use this app. Actions
include:ll

Block access - Only devices that match the specified
manufacturer can use the app. All other devices are blocked.
Wipe data - The user account that is associated with theapplication is wiped from the device.

Office 365 App Protection configurations
Once you register MobileIron as an Azure app you can create custom configurations for Office 365 apps. App
Configurations can be used to specify custom app configurations for Office 365 apps. Configurations can include
setting a local encryption scheme for OneDrive, setting Skype parameters, and so on.
This section includes the following topics:lCreating Office 365 App Protection configurationslEditing a Office 365 App Protection configurationlManaging Office 365 App Protection configurations

NOTE: Before using this feature, complete the prerequisites described in the following section:
Prerequisites for using Office 365 App Protection.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 746

Creating Office 365 App Protection configurations

Related topicsl

Office 365 App Protection overviewlOffice 365 App Protection policieslOffice 365 App Protection user groupsl

Office 365 App Protection reportsl

Office 365 App Protection settings

Creating Office 365 App Protection configurations
Configurations use data populated from Azure Active Directory during real-time syncs.
1. Log into the Admin Portal.
2. Go to Services > Microsoft Graph > Configurations > Add.
3. Add a name (required) and description (optional).
4. Click Add+ to add one or more key-value pairs.
The values are strings with no limitations or restrictions.
5. Click Save to add the configuration to the list in the configurations table.

Editing a Office 365 App Protection configuration
Configurations use data populated from Azure Active Directory during real-time syncs.
Procedure
1. Log into the Admin Portal.
2. Go to Services > Microsoft Graph > Configurations.
3. Click the name of a configuration you want to edit.
Use the search field to search by name.
4. Make any necessary changes.
5. Click Save to update the configuration edits.

Managing Office 365 App Protection configurations
You can take any of the following actions on each Office 365 App Protection configuration:lAssign User GroupslAssign Appsl

Delete Policies

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 747

Office 365 App Protection user groups

Procedure
1. Log into the Admin Portal.
2. Go to Services > Microsoft Graph > Configurations.
3. Locate a configuration you want to manage and go to the Actions column.
a. Assign user groups to the app protection configuration.
b. Click the Assign User Groups icon.
c. Search for user groups.
d. Select one or more user groups to add to the configuration.
e. Click Save.
4. Assign Office 365 apps to the app protection configuration.
a. Click the Assign Apps icon.
b. Search for apps.
c. Select one or more apps to add to the configuration.
d. Click Save.
5. Delete an Office 365 App Protection configuration.
a. Click the Delete Configuration icon.
b. Click Yes to confirm deletion of the configuration.
Changes to the configurations take affect after:l

assigning the configuration to a user group.

la user from the assigned user group logs into an Office 365 app using AAD credentials.

Office 365 App Protection user groups
Use the User Groups tab to search for and view user groups available to add to one or more Office 365 App
Protection policies or configurations. Access a list of user groups by logging into the Admin Portal and selecting
Services > Microsoft Graph > User Groups.
NOTE: Before using this feature, complete the prerequisites described in the following section:
Prerequisites for using Office 365 App Protection.
Related topicsl

Office 365 App Protection overviewlOffice 365 App Protection policieslOffice 365 App Protection configurations

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 748

Office 365 App Protection reportsl

Office 365 App Protection reportsl

Office 365 App Protection settings

Office 365 App Protection reports
Reports for out of compliance data, devices, apps, and users, is populated from Azure Active Directory during realtime syncs. Access the reports by logging into the Admin Portal and selecting Services > Microsoft Graph >Reports. Use the Reports tab to:lsearch, view, or download a .csv report by userlsearch, view, or download a .csv report by applcreate and manage wipe requestslrefresh reports

This section includes the following topics:l

Office 365 App Protection reports windowlManaging Out of Compliance Users reportslManaging Selective Wipe reportsl

Downloading App Protection reportsl

Downloading App Configuration reports

NOTE: Before using this feature, complete the prerequisites described in the following section:
Prerequisites for using Office 365 App Protection.

Related topicsl

Office 365 App Protection overviewlOffice 365 App Protection policieslOffice 365 App Protection configurationsl

Office 365 App Protection user groupsl

Office 365 App Protection settings

Office 365 App Protection reports window
Manage reports from the Admin Portal by going to Services > Microsoft Graph to open the Office 365 App
Protection window. This window includes several options, which are listed in the left pane. When you select one,the right pane changes to include details of the selected option.
l

Out of Compliance Users: This option is selected by default. Use it to manage reports on users who areout of compliance.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 749

Managing Out of Compliance Users reports

l

l

l

Selective Wipe: Use this option to request Azure Active Directory wipe Office 365 app data from selected
devices.
App Protection Reports: Use this tab to view and download app protection reports by users and by apps.
These reports are populated with data from Azure Active Directory during real-time syncs.
App Configuration Reports: Use this tab to view and download app configuration reports by users andby apps. These reports are populated with data from Azure Active Directory during real-time syncs.

Managing Out of Compliance Users reports
Use this option to manage reports on users who are out of compliance.
Procedure
1. Log into the Admin Portal.
2. Select Services > Microsoft Graph > Reports > Out of Compliance Users.
3. Click Download Report to download a .csv report from Azure Active Directory of users who are out ofcompliance.
4. Click Refresh Report to get the most recent data from Azure Active Directory after the latest sync.
5. Select one or more of the users listed in the report or select all.
6. Click Wipe Apps Data to send a wipe request to Azure Active Directory for users.

Managing Selective Wipe reports
Use this option to create and manage requests you send to Azure Active Directory to wipe Office 365 app datafrom selected devices.

Creating wipe requests
Procedure
1. Log into the Admin Portal.
2. Select Services > Microsoft Graph > Reports.
3. Expand Selective Wipe.
4. Click Create Wipe Request.
5. Enter or search for a user name, then select one or more of the user’s devices.
6. Click Create Wipe Request to request Azure Active Directory wipe Office 365 app data from one or more
selected devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 750

Managing wipe requests

Managing wipe requests
Procedure
1. Log into the Admin Portal.
2. Select Services > Microsoft Graph > Reports.
3. Expand Selective Wipe.
4. Click Wipe Request.
5. Select one or more pending wipe requests and click Cancel Wipe Request.
6. Click Refresh to update the status of the pending wipe requests.

Downloading App Protection reports
App Protection Reports show applications protected by the policies that are created and assigned to them from the
Policies tab. Use this option to download app protection .csv reports by users or apps.

Downloading App Protection reports by user
Procedure
1. Log into the Admin Portal.
2. Select Services > Microsoft Graph > Reports.
3. Expand App Protection Reports.
4. Click User.
5. Search for, or enter a user name.
See App Protection User reports table for details.
6. Click Download Report.

App Protection User reports table
Select this option to view and download reports and to refresh the report data. This option provides app information
for a specified user. These reports are populated with data that comes from Azure Active Directory during real-timesyncs.

TABLE 124. APP PROTECTION USER REPORTS FIELDS
FieldsDescription

Bundle ID/Package ID

This column lists the unique identifier for the app.

Device Name

This column lists the name of the device.

Device Type

This column lists the type of device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 751

Downloading App Protection reports by app

TABLE 124. APP PROTECTION USER REPORTS FIELDS (CONT.)
FieldsDescription

Policies

This column lists the app protection policies assigned to this app.

StatusThis column lists the sync status of the app. The options for this column are:Synced, Synced, but out of date, and Not synced.

Last Check-In

This column lists the time stamp of the last time this app synced with Azure.

Downloading App Protection reports by app
Procedure
1. Log into the Admin Portal.
2. Select Services > Microsoft Graph > Reports.
3. Click App.
4. Complete the form.
See App Protection App reports table for details.
5. Click Download Report.
6. Expand App Protection Reports.

App Protection App reports table
This option provides user data for selected apps.These reports are populated with data that comes from Azure
Active Directory during real-time syncs.

TABLE 125. APP PROTECTION APP REPORTS
FieldsDescription

Platform

Select the OS platform for which you want to see apps. The options are Android and
iOS.

App

Select the single app for which you want to receive a report. This list changes
depending on the platform you select.

StatusSelect the user’s protection status from the list. The options are Protected andUnprotected.

User

This column lists the users that match the search criteria.

EmailThis column provides the user’s email address.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 752

Downloading App Configuration reports

Downloading App Configuration reports
App Configuration Reports show applications with configurations defined and assigned to them under theConfiguration tab. Use this option to download app configuration .csv reports by users or apps.

Downloading App Configuration reports by user
Procedure
1. Log into the Admin Portal.
2. Select Services > Microsoft Graph > Reports.
3. Expand App Configuration Reports.
4. Click User.
5. Search for, or enter a user name.
See App Configuration User reports table for details.
6. Click Download Report.

App Configuration User reports table
Select this option to view and download reports and to refresh the report data. This option provides app information
for a specified user. These reports are populated with data that comes from Azure Active Directory during real-timesyncs.

TABLE 126. APP CONFIGURATION USER REPORTS FIELDS
FieldsDescription

Bundle ID/Package ID

This column lists the unique identifier for the app.

Device Name

This column lists the name of the device.

Device Type

This column lists the type of device.

Configurations

This column lists the app protection configurations assigned to this app.

Last Check-In

This column lists the time stamp of the last time this app synced with Azure.

Downloading App Configuration reports by app
Procedure
1. Log into the Admin Portal.
2. Select Services > Microsoft Graph > Reports.
3. Expand App Protection Reports.
4. Click App.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 753

App Configuration App reports table

5. Complete the form.
See App Configuration App reports table for details.
6. Click Download Report.

App Configuration App reports table
This option provides user data for selected apps.These reports are populated with data that comes from Azure
Active Directory during real-time syncs.

TABLE 127. APP CONFIGURATION APP REPORTS
FieldsDescription

Platform

Select the OS platform for which you want to see apps. The options are Android and
iOS.

App

Select the single app for which you want to receive a report. This list changes
depending on the platform you select.

User

This column lists the users that match the search criteria.

EmailThis column provides the user’s email address.

Office 365 App Protection settings
Use the Settings tab to set up Office 365 App Protection policies to help protect your company's data.
License Required: This feature requires a separate license. In addition, this feature requires an Intune
subscription from Microsoft. Prior to using this feature, ensure your organization has purchased the required
licenses.
Related topicsl

Office 365 App Protection overviewlOffice 365 App Protection policieslOffice 365 App Protection configurationsl

Office 365 App Protection user groupsl

Office 365 App Protection reports

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 754

23
Azure Tenant
Overview
This section contains information describing the process for setting up MobileIron Core to Microsoft Azure Tenant.
A growing number of organizations are using Microsoft's productivity apps on mobile devices, such as Microsoft
365, OneDrive, etc. These kind of deployments give device users access to their organization's resources using
various devices and apps from anywhere and using only their credentials. If the credentials get compromised, any
unauthorized person can also login and get complete access to the organization's data. Just focusing on who canaccess the organization's resources is no longer sufficient; IT administrators must know how and from which
device the organization's resource is accessed from. They have to make sure that data is accessed from thedevices that meets the corporate compliance policy and have these corporate policies on each and every device.
Administrators should also be able to block access to unauthorized devices by defining conditional accesspolicies.
Using Microsoft's Intune device compliance APIs allow organizations to update the device compliance status in
the Microsoft Azure Active Directory (AAD.) Using conditional access from AAD, if the device is non-compliant,administrators can block the device from accessing apps. By connecting Core to the AAD, administrators will beable to use the device compliance status of MobileIron's managed devices for conditional access to Microsoft 365
apps.

Requirements
Microsoft
MobileIron Core customers must have a valid subscription to Microsoft Intune and assign a Microsoft Intune
license to device users supported by this integration.
For Microsoft licensing for Microsoft 365 App services, please see:https://www.microsoft.com/en-us/microsoft-365/enterprise/compare-office-365-plans

MobileIronl

MobileIron Core - Administrators will need Core version 11.0.0.0 through the latest version as supported by
MobileIron.
o

For instructions on how to set up Android Enterprise, see the MobileIron Core Device Management
Guide for Android and Android Enterprise Devices.

NOTE: If you do not have a link to your Core instance, contact your MobileIron Customer Success
Manager.
MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 755

Supported OS versionsl

MobileIron Mobile@Work for iOS (client) – version 12.0 through the latest version as supported by
MobileIron.

Supported OS versionsl

iOS 12.0 through the latest version as supported by MobileIron.

Note The Following:• The Microsoft website states:oOffice for iPad® and iPhone® (including Outlook for iOS) is supported on the two most recent versions of
iOS and iPadOS. When a new version of iOS or iPadOS is released, the Office Operating System
requirement becomes the two most recent versions: the new version of iOS or iPadOS and the previous
version.

o

For more information, see https://www.microsoft.com/en-in/microsoft-365/microsoft-365-and-officeresources?rtc=1#coreui-heading-3b8v07b

Unsupported OS versions
Behavior if unsupported device OS versions is used:l

For unsupported version iOS 11.4, the device user can complete the device registration for AAD and thedevice details are successfully uploaded to the Azure portal. However, Microsoft Apps (for example,
Outlook, Excel, Word and OneDrive) are not available in the App Store for the unsupported version.

Multiple Core support
If you have multiple Cores connected to the same Azure tenant, you should not disconnect from a single Core from
Azure tenant. Your options are:l

Disconnect from all CoreslDisable compliance policy for AAD compliance integration from a specific (single) Core so that it does not
upload device data to Azure

NOTE: Be sure to disable the compliance policy prior to disconnecting Core.

Technical support
For additional help with this feature, contact MobileIron Technical Support.

From the Core administrator's point of view
Below lists the process from the Core administrator's perspective.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 756

From the device user's point of view

1. Administrator applies Intune licenses to device users. See Apply the Intune license to device users.
2. Administrator logs into Azure Portal.
3. Administrator adds MobileIron as an Azure compliance partner. See Adding MobileIron as a compliancepartner.
4. Administrator creates the Conditional Access policy for the apps. See Creating a conditional access policyin Microsoft Endpoint Manager.
5. Administrator sets up the connection between MobileIron and Azure. This allows client devices to reportcompliance status to Azure. See Connecting Microsoft Azure to MobileIron Core.
6. Administrator creates the device compliance policy in Core. See Creating a partner device compliancepolicy.
7. When the device checks in, the device compliance status is sent to the Azure portal.
8. The Conditional Access policy goes into effect. Depending upon whether the device is compliant or not,the access to the app(s) is granted or denied.
9. Administrator can disconnect from Azure. See De-provisioning of the Azure tenant.
NOTE: MobileIron recommends the administrator run tests on each and every Microsoft app: Outlook,
Word, Excel, Powerpoint, OneDrive, etc.

From the device user's point of view
Below lists the process from the device user's perspective.
1. Device user's device is enrolled with MobileIron Mobile@Work. See Installing Mobile@Work for iOS andAndroid.
2. Log into the AAD account. This requires the Authenticator app to be installed on the device (see Required
MobileIron client device user action and use cases.)l

If Authenticator is available on device, device user logs into AAD account using their Microsoft
credentials.

l

If Authenticator is not installed on the device, device user is guided to install the Authenticator andthen log in using their Microsoft credentials.

Note The Following:l

If the device is compliant, device user can access Microsoft 365 apps.

l

If the device is not compliant, an error displays stating the app cannot be opened.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 757

Apply the Intune license to device users

Apply the Intune license to device users
MobileIron Core customers must have a valid subscription to Microsoft Intune and assign a Microsoft Intune
license to device users supported by this integration.
To bulk assign licenses to existing device users, follow the instructions listed below.

Group based assignment
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-groups-assign

Powershell based assignment
https://docs.microsoft.com/en-us/microsoft-365/enterprise/assign-licenses-to-user-accounts-with-microsoft-365powershell?view=o365-worldwide

Adding MobileIron as a compliance partner
This section addresses adding MobileIron as an Azure compliance partner.
Procedure
1. Login into: https://endpoint.microsoft.com.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 758

Adding MobileIron as a compliance partner

2. In the left panel of the Microsoft Endpoint Manager admin center page, click on Tenant Administrator.
Click on Connectors and Tokens > Partner Compliance Management.

3. To the right of the Search field, click + Add compliance partner.

The Create Compliance Partner page displays.
4. In the Basics tab, select MobileIron Device Compliance On-prem from the drop-down of theCompliance partner field.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 759

Adding MobileIron as a compliance partner

5. In the Platform field, select iOS or Android and then click Next.
6. Click the Assignments tab. In the Assign to drop-down, select the user / group of device users thecompliance status is for. Make sure to select the user / group that has the license.

7. Select Next.
8. Click the Create button.
9. The new compliance partner is created and displays on the Partner compliance management page under
the appropriate OS system. Once the consent is provided by the administrator on the MobileIron portal, theMobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 760

Creating a conditional access policy in Microsoft Endpoint Manager

partner status will change from "Pending" to “Active.”

Creating a conditional access policy in Microsoft Endpoint
ManagerThis section addresses defining the conditional access policy in Microsoft Endpoint Manager.
Procedure
1. Log in to Microsoft Endpoint Manager https://endpoint.microsoft.com.
2. In the Microsoft Endpoint Manager admin center page, go to Home > Endpoint Security > Conditional
Access.
3. Click on Policies and then click + New Policy.

The New conditional access policy page opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 761

Creating a conditional access policy in Microsoft Endpoint Manager

4. Enter the Name of the conditional access policy.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 762

Creating a conditional access policy in Microsoft Endpoint Manager

5. In Assignments, click to assign the policy to users and groups.

6. In the New conditional access Policy page, click Cloud apps or actions and then click Select. Search forand select the apps that are required to be protected as part of this new policy.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 763

Creating a conditional access policy in Microsoft Endpoint Manager

7. In the New conditional access policy page, click on Conditions and then click on Device Platform. Selectthe appropriate device platforms.

8. In the New conditional access policy page > Access controls, click on Grant and make the accessand block selections.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 764

Creating a conditional access policy in Microsoft Endpoint Manager

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 765

Connecting Microsoft Azure to MobileIron Core

9. To enable the new policy, click On.

10. Click the Create button. The new conditional access policy displays in the Conditional Access > Policies
page.

Connecting Microsoft Azure to MobileIron Core
This section covers setting up MobileIron Core to report the device compliance status to Microsoft Azure.
Procedure
1. Log in to MobileIron Core and go to Settings.
2. In the left navigational pane, click Microsoft Azure > Device Compliance for iOS. The Device Compliancefor iOS & Android page opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 766

Connecting Microsoft Azure to MobileIron Core

3. Enter the information for the following fields:lAzure Domain ID - This is the AAD Tenant ID.

lEnrollment URL - (Optional) If the device is not MDM enrolled, device users will be pointed to this URL
for enrollment. When configuring, use HTTPS format. If you host a page in your organization to redirect
your device users for Enrollment information, add that link here. For example: https://enroll.enterprise.com.
If this field is left empty, the device user will be directed to a default enrollment URL / page that is hosted
by Core.

lRemediation URL - (Optional) If the device is not in compliance, device users will be pointed to this URL
for remediation. When configuring, use HTTPS format. If you host a page in your organization to redirect
your device users for Remediation information, add that link here. For example:
https://remediation.enterprise.com. If this field is left empty, the device user will be directed to a default
enrollment URL / page that is hosted by Core.

4. Click Connect Account. The Connect Azure Account dialog box opens. You will need to provide consent
on the Microsoft Azure portal.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 767

Connecting Microsoft Azure to MobileIron Core

5. Click link. A new browser tab opens.
6. Log in using your Azure credentials.
7. A Microsoft partnership page displays asking permission to connect Azure to MobileIron Core. Review thepermissions and then click Accept.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 768

Connecting Microsoft Azure to MobileIron CoreNOTE: If you log in and the page refreshes asking that you log in again, close the browser tab / window.
8. Return to MobileIron Core. In the Connect Azure Account dialog box, select the I have provided theconsent check box and then click Confirm.
9. The Device Compliance for iOS & Android page refreshes to display Status: Enabled and two new button
options.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 769

Connecting Microsoft Azure to MobileIron Core

Note The Following:l

To edit the account, click Edit Account.

l

To disconnect the account, see De-provisioning of the Azure tenant.

lTo view the Azure information about the device, go to the Device Details page. See Advanced searchingfor definitions.

10. To make any changes or disconnect from Azure, click on the System Settings tab. In the Microsoft Azuretile, clicking the Device Compliance for iOS & Android link will open that page. See also De-

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 770

What the device user sees

provisioning of the Azure tenant.

What the device user sees
Device users may see screens that invite the device user to take action.
l

How do I access Microsoft 365 apps on my device?

l

Device out of compliance? Here's how to fix

Instructions for iOS and Android devices are provided on those pages for the device user to follow.

Azure account activity recorded in the logs
All activity of adding, editing, and deactivating an account are recorded in the Logs.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 771

Creating a partner device compliance policy

Creating a partner device compliance policy
Create a partner device compliance policy on Core and apply the desired label. The partner compliance policy
reports the device compliance status to Azure for conditional access. This is done through Microsoft Intune APIs.
Once the policy is pushed to the device enrolled in Core and after the first check-in of the device, the device's
compliance status will be reported to Azure. Thereafter, whenever there is a change in compliance status of thedevice - or once a week - the status will be reported. If there is no change in the compliance status, the status isreported to Intune once a week, as required by Microsoft. To view the Azure device compliance status, go to theDevice Details page under the specific device.
Before you begin
You must have an Azure Tenant ID set up. See Connecting Microsoft Azure to MobileIron Core.
Procedure
1. In Core, go to Policies & Configurations > Policies.
2. Click Add New > Partner Device Compliance. The Add Partner Device Compliance Policy dialog box
opens.
3. Use the below form to enter your settings:
Item

Description

Name

Enter a name for the policy.

StatusSelect the relevant radio button to indicate whether the policy is Active or Inactive.
Only one active policy can be applied to a device.

Priority

Specifies the priority of this policy relative to the other custom policies of the same
type. This priority determines which policy is applied if more than one policy isavailable.
Select Higher than or Lower than, then select an existing policy from the dropdown list.
For example, to give Policy A higher priority than Policy B, you would select“Higher than” and “Policy B”.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 772

Device status reporting

Item

Description

Description

Enter an explanation of the purpose of this policy.

Report Device
Compliance Status to

Selected by default. If you do not see this field, you need to set up your Azure
Tenant ID first. See Connecting Microsoft Azure to MobileIron Core.

Azure for iOS and

If the Report Device Compliance Status to Azure for iOS and Android devices

Android devices

check box is enabled, and the compliance policy is applied to the client, the client
will display the option in Settings under "Microsoft 365 Access." The compliancestatus of the device will be then reported to Azure under the following conditions:lwhen device is out of compliancelwhen the device is compliantlwhen the device returns to compliance after being out of compliancel

If there is no change in the status, a report is sent once a week / every
seven days.

4. Click Save.

Device status reporting
For the following cases, Core reports device inventory and compliance status to Azure.
lOn-device compliance state changelOn-device inventory change, for example, an OS upgradelOnce a week, Core reports compliance and inventory status to Azure

Depending on the action chosen in the compliance policy, the following device status will be sent to Azure:

TABLE 128. ACTIONS IN COMPLIANCE POLICY
ActionWhat Core sends to Azure

Block Email, AppConnect Apps

Non-compliant to Azure

Send Alert

Compliant to Azure

For more information, see Compliance actions policy violations.

De-provisioning of the Azure tenant
This section covers how to disconnect or de-provision the Azure tenant.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 773

Microsoft

If multiple Cores are enabled to use the same Azure tenant, do not de-provision from one Core; instead, deprovision from all Cores. If a single Core needs to stop using Azure, you can disable the partner compliance policy
for that Core only.
If the administrator performs a disconnect on Core, then Core stops reporting the device inventory and compliancestatus to Azure.
Procedure

Microsoft
1. Log in to Microsoft Azure.
2. Go to Intune > Conditional Access. Make sure the conditional access policy is disabled.

MobileIron
1. Log in to MobileIron Core and go to System Settings.
2. In the left navigational pane, click Microsoft Azure > Device Compliance for iOS & Android. The
Device Compliance for iOS & Android page opens.
3. Click on Disconnect Account.

4. In the Disconnect Azure Account dialog box, click Confirm.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 774

Retiring a device from Azure

Retiring a device from Azure
Upon device retirement, Core reports to Azure that the device is no longer under management and is noncompliant.
Azure deletes the retired device entry after 90 days.

Installing Mobile@Work for iOS and Android
This section addresses Mobile@Work for iOS or Android can be installed onto devices.

Installing MobileIron Mobile@Work for iOS
The administrator needs to have Mobile@Work version 12.11.0 or later (as supported by MobileIron) connected toCore as a Mandatory Silent App and applied to devices.
The device user needs to follow the instructions below.
Procedure
1. Install Mobile@Work from the Apple Store.
2. Launch the Mobile@Work client and complete the Registration.

Installing MobileIron Mobile@Work for Android
The administrator needs to have Mobile@Work 11.0.0.0 or later (as supported by MobileIron) connected to Core asa Mandatory Silent App and applied to devices.
The device user needs to follow the instructions below.
Procedure
1. Install Mobile@Work from the Google Play Store.
2. Launch the Mobile@Work client and complete the Registration.
3. Device users are to follow instructions based on the device type:l

On non-Samsung devices, device users will be prompted to update the latest Mobile@Work as part of the
Mandatory Apps Manager.

l

On Samsung devices, Mobile@Work is installed silently.

Required MobileIron client device user action and use cases
This section lists the required action that a device user needs to take in the Mobile@Work client.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 775

Client device user action

Client device user action
Device users will see a notification in the Mobile@Work app.

Android client
Procedure
1. On the Android device, device user taps on the Mobile@Work icon to open the app.
2. Tap Settings.
3. Tap on the Microsoft 365 Access button.
4. Device user logs in.
ll

If the Authenticator app is installed on the device – device user will be redirected to the Authenticator
app to enter login credentials.
If the Authenticator app is not installed on the device – device user will be redirected to the Google
Play Store to download the app before proceeding to next steps.

5. Once logged in, the Mobile@Work Home page displays.

iOS client
Procedure
1. On the iOS device, device user taps on the Mobile@Work icon to open the app.
2. Tap Settings. The Settings page opens.
3. Tap the Microsoft 365 Access button.
4. Device user logs in.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 776

Help@Work for iOS

If Authenticator app is installed on device
1. The device user will be redirected to the
Authenticator app to enter login
credentials.

If Authenticator app is NOT installed on device
1. The device user will be redirected to the AppleApp Store to download the app.
2. Once downloaded, open Mobile@Work and tap

2. Device user signs in with username andpassword and then taps Register.
3. When registration is completed, thedevice user is returned to the Settings
page with Microsoft 365 Access checked.

on Settings.
3. Tap on Microsoft 365 Access.
4. Device user is redirected to the Authenticator
app to enter login credentials. Device user signs
in with username and password and then taps
Register.
5. When registration is completed, the device user
is returned to the Settings page with Microsoft
365 Access checked.

Help@Work for iOS
This section addresses the components related to Help@Work for iOS with TeamViewer.
About Help@Work for iOS
How Help@Work for iOS works
Help@Work for iOS setup overview
Installing TeamViewer on your desktop
Requesting a TeamViewer accountCreating a TeamViewer app
Enabling Help@Work in MobileIron Core
Deploying the TeamViewer QuickSupport app
Starting a remote control session

About Help@Work for iOS
Help@Work for iOS with TeamViewer is an integration that enables administrators to remotely view supported iOS
devices managed by MobileIron Core. VPN is not required. After initiating a remote control session from the Admin
Portal, administrators can configure iOS devices and troubleshoot issues without having the devices in hand. The
remote control session displays on the administrator’s desktop, enabling point-and-click navigation of the device.
Help@Work requires that the TeamViewer QuickSupport app is installed on the iOS device. The TeamViewer
QuickSupport app must be an iOS managed app. That is, you must add it to the App Catalog on MobileIron Core for
distribution to iOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 777

Prerequisites

NOTE: Because the TeamViewer QuickSupport app must be an iOS managed app, which requires iOS
MDM (Mobile Device Management), MobileIron Core does not support Help@Work on MAMonly devices.

Prerequisites
Help@Work for iOS requires:llaccess to the MobileIron Customer Portal (http://help.mobileiron.com) during initial setup for one-time
license activation
a company email address (belonging to an organization rather than an individual) that can be used for the
TeamViewer account

TeamViewer componentsl

TeamViewer 10 Desktop editionl

TeamViewer QuickSupport app

Supported devices
MobileIron Core supports Help@Work using the TeamViewer QuickSupport app on iOS 10 through the mostrecently released iOS version as supported by MobileIron.
However, on iOS 10 devices, the TeamViewer QuickSupport app is limited to sharing screenshots. On iOS 11 andlater, the TeamViewer QuickSupport app supports real-time screensharing.

How Help@Work for iOS works
The following steps illustrate how Help@Work for iOS with TeamViewer establishes a remote control session.
1. Administrator selects a target device in the Admin Portal at Devices & Users > Devices.
2. MobileIron Core contacts the TeamViewer Server to create a remote session and retrieve a session ID.
3. Core sends an iOS managed app configuration to the TeamViewer QuickSupport app so that the app will
be able to start a remote session using the session ID.
4. Core launches the TeamViewer software on your desktop with the session ID.
5. The iOS device user launches the TeamViewer QuickSupport app.
6. TeamViewer app connects to the TeamViewer Server, using the session ID that it received from Core.
7. Administrator can view the device remotely.

Help@Work for iOS setup overview
The following diagram illustrates the setup process for Help@Work for iOS:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 778

Installing TeamViewer on your desktop

Installing TeamViewer on your desktop
This section explains how to install the TeamViewer full version software on your Windows or macOS computer.
1. Download the installation package for the TeamViewer full version for Windows or macOS from thefollowing location:
https://www.teamviewer.com/en/download/
2. Launch the TeamViewer installation program.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 779

Requesting a TeamViewer account

3. Select Basic Installation.
4. Select Company / Commercial use.
5. Click Accept - next.
When the installation is complete, the following screen displays.

Requesting a TeamViewer accountThis section explains how to get a TeamViewer account.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 780

Creating a TeamViewer app

1. Go to https://login.teamviewer.com/LogOn#register.

2. Click Sign Up.
3. Set a TeamViewer email address and password.
4. Check the email account for a TeamViewer activation email.
It might take several minutes for this email to arrive.
5. Complete the instructions in the email to activate your account.
When the account has been activated, the following page displays:

6. Bookmark this page for future reference.

Creating a TeamViewer app
This section explains how to create a TeamViewer app for use with your MobileIron Core.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 781

Creating a TeamViewer app

1. If you are not already logged in after TeamViewer account activation, to the TeamViewer Home page you
bookmarked in Requesting a TeamViewer account.

2. Click the Apps link at the bottom of the TeamViewer Home page (displayed after account activation).

3. Click Create app.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 782

Creating a TeamViewer app

4. Select Add web API.
5. Enter at least 5 characters to use as the app name.
Enter at least 5 characters to use as the app name.
6. For Redirect URI:
Enter it in the form of https://<mobileironcore>/mifs/teamViewerRedirect , where<mobileironcore> is the URL of your MobileIron Core installation.

Note: Using a redirect URI is required.
7. For Access level,select User.
8. For Session management, select Create, view own and edit own sessions.
9. Select I accept the App Developer Agreement.
10. Click Save.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 783

Enabling Help@Work in MobileIron Core

11. Copy the displayed Client ID and Client secret.
You will need this information for Enabling Help@Work in MobileIron Core.
12. Click OK.

Enabling Help@Work in MobileIron Core
This section explains how to enable Help@Work for Android and iOS in the MobileIron Core Admin Portal.
1. Log into the Admin Portal.
2. Select Settings > System Settings.
3. Select Additional Products > Licensed Products.
4. Select Help@Work for Android and iOS 10 and higher .
5. Accept the displayed TeamViewer license agreement and to open the Help@Work wizard.
6. Paste the Client ID and Client secret values you copied in Creating a TeamViewer app.
7. Click Validate.
8. In the displayed TeamViewer page, enter your TeamViewer email and password.
9. Click Allow to provide MobileIron Core with session management permission for your TeamViewer app.
10. Click Sign In.
11. Click Activate in the wizard to open the Customer Support login screen:
12. Enter your MobileIron Customer Support credentials.
13. Click Login.
14. Enter the email address you used for your TeamViewer account.
15. Click Submit.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 784

Deploying the TeamViewer QuickSupport app

NOTE: Though your license is now activated, your TeamViewer software will still display a notice about
trial software. Your licensing applies to the session established using the integration, so the trial
notice remains in the console.

Deploying the TeamViewer QuickSupport app
This section explains how to deploy the TeamViewer QuickSupport app to iOS devices managed by MobileIron
Core.
1. In the Admin Portal, go to Apps > App Catalog.
2. Click Quick Import > iOS.
3. In the Application Name field, enter teamviewer.
4. Click Search.
5. Find the TeamViewer QuickSupport app in the search results.
6. Click Import.
7. Dismiss the displayed message and the App Store Search dialog.
8. Under Apps > App Catalog, select the TeamViewer QuickSupport app.
9. Select Actions > Apply To Labels.
10. Select labels that represent the devices that should have the TeamViewer QuickSupport app added to theapp catalog.
11. Click Apply.
12. Instruct iOS users to install the app.
13. Instruct iOS users to set iOS settings as described in How can I share the screen on my iPad/iPhone with
TeamViewer?
14. Instruct iOS users to launch the app.

Starting a remote control session
This section explains how to start a Help@Work for iOS remote control session.
1. Ask the device user to install the TeamViewer QuickSupport app, if it is not already installed.
It should be displayed in the MobileIron app catalog on the device.
2. In the Admin Portal, go to Devices & Users > Devices.
3. Select the entry for the device.
4. Confirm that the device is supported by Help@Work for iOS.
See Supported devices.
5. Select Actions > iOS Only > Remote Display.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 785

To close a remote control session from the device

NOTE: This option is available only if you have added the TeamViewer QuickSupport app to
theMobileIron Core App Catalog.
6. If a page requesting a session ID displays, ignore it.

7. Launch the TeamViewer 10 application when prompted.
8. If your browser has pop-up blocking enabled, then allow pop-ups for your MobileIron Core URL.
9. On the device, launch the TeamViewer QuickSupport app.
You should now see the remote control session displayed on your desktop screen.

To close a remote control session from the device
To close a remote control session from the desktop:
1. Tap the TeamViewer QuickSupport app icon.

2. Tap the X in the upper right corner of the TeamViewer QuickSupport app.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 786

To close a remote control session from the desktop

To close a remote control session from the desktop
To close a remote control session from the desktop:
1. Launch the TeamViewer desktop.

2. Sign in using your TeamViewer credentials.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 787

For more information on using remote control

3. Select the session.
4. Click Close.

For more information on using remote control
For information on how to use TeamViewer remote control, see https://dl.tvcdn.de/docs/en/v10/TeamViewer10Manual-Remote-Control-en.pdf

If you accidentally close the session
If you close the session window on your desktop, you can re-establish the session using the URL displayed in the
Launch TeamViewer Session dialog.

This dialog displays at the beginning of each session, but might be hidden behind other windows. Copy and paste
the displayed URL in a browser window to regain access to the session. Make sure the session ID displayed in the
dialog matches the one displayed in the TeamViewer app on the device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 788

24
Language Support
This section addresses the language settings for MobileIron client apps (Mobile@Work.)lTranslated versions of MobileIron client appslSelecting languages for MobileIron Core messageslSetting the system default languagelChanging language selection from the Admin Portal

NOTE: The features described in this section are supported on macOS devices.

Translated versions of MobileIron client apps
MobileIron client apps (Mobile@Work) are localized to a number of languages. A device’s locale setting (orselected language) determines the language that the MobileIron client app appears in on the device. If the device’s
locale is not supported, the app appears in English (United States) by default.
Once the device communicates a language change to MobileIron Core, MobileIron Core sends messages to thedevice in the selected language, assuming the language is supported and selected in Core’s Settings > System
Settings > General > Language.
Please refer to the Core release notes for each release to see which languages and locales are supported.

Selecting languages for MobileIron Core messages
You can enable or disable languages for the messages sent from MobileIron Core to devices. For example, if you
have only Japanese-speaking users, you might want to remove the other message templates from the Admin
Portal.
To enable or disable languages:
1. Log into the System Manager.
2. Go to Settings > System Settings > General > Language.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 789

Setting the system default language

3. Move the languages you want to support from Disabled Languages to Enabled Languages.
4. Click Save.

Setting the system default language
The System Default Language setting under Settings > System Settings > General > Language determines
what language to use if the locale of the device cannot be determined, or the corresponding language is notsupported. It also determines the default language for the self-support user portal (SSP) pages. The languages
available for this setting are derived from the languages in the Enabled Languages list.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 790

Changing language selection from the Admin Portal

FIGURE 26. SETTING THE SYSTEM DEFAULT LANGUAGE FOR MOBILEIRON CORE.

Changing language selection from the Admin Portal
Administrators can manually change the language selection for devices that do not report their locale. In this case,language selection applies only to the messages sent from MobileIron Core (e.g., Event Center alerts). If thedevice later reports a different locale, then MobileIron Core honors the reported locale.
To change the language selection for a specific device:
1. In the Admin Portal, go to Devices & Users > Devices.
2. Select the check box next to the device.
3. Click Actions > Change Language.
The Change Language dialog appears.
4. From the Set Language drop-down, select the preferred language.
5. Click Change Language.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 791

25
Self-service User Portal
This section addresses device registration and its related components.
lDevice management with the user portall

Before enabling device registration in the User PortallAssigning user portal device management roleslRequiring user portal password changelConfiguring help desk contact informationl

User portal information for your usersl

Unlocking a macOS device

NOTE: The features described in this section are supported on macOS devices unless otherwise stated.

User portal overview
The MobileIron Core Mobile@Work self-service user portal (SSP) is a platform whereby device users can manage
their own devices. This section addresses the settings an administrator can create and maintain a self-service user
portal.
l

Benefits of the user portallImpacts of using the user portallUser portal authentication optionslAbout registering devices in the user portallAbout changing device ownership in the user portall

Associating a certificate with a user-provided certificate enrollment settinglAbout generating a one-time PIN for resetting a secure apps passcodelAbout getting Entrust derived credentials

The user portal allows your users to:lAccess MobileIron device management actions such as wipe and locklView their device audit/history logslView details of their registered deviceslRegister devices, including QR code and SMS/email options, and requesting derived credentialslReset the user PIN

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 792

Benefits of the user portallChange device ownership from company-owned to user-owned or the reverselUpload, as well as view, replace, and delete user-provided certificates
These certificates are used, for example, for S/MIME or for authenticating to internal servers.

ll

Generate a one-time PIN for resetting a forgotten secure apps passcode
Designate their device as "Untrusted" in risky public spaces and redesignate them as "Trusted" when in asafe area again.

One of your decisions when you distribute MobileIron Core management is whether or not to enable your users tomanage one or more device actions such as locking or unlocking a device. Your users access the actions you
assign them through the user portal.
To enable users to manage their devices, you assign them roles to perform any or all of the following actions:lWipe their devicelLock their devicelUnlock their devicelLocate their devicelRetire their devicelRegister their devicelChange device ownershiplReset their secure apps passcode

NOTE: The Trust and unTrust options do not require a role. Registered devices are Trusted devices bydefault.
Important: The Unlock command clears passcodes and TouchIDs from the managed device, compromising
device security. Never use this feature on lost or stolen devices.
The Device Registration role replaces the MyPhone@Work Registration role. The MyPhone@Work
Registration role is removed. The old user portal, MyPhone@Work, was available only through Core 8.0.1.

Benefits of the user portal
Giving users the ability to perform device management tasks:lDistributes mobile device managementl

Gives your users more control of their deviceslAdds efficiency to device registration by saving administrators’ time as well as wait time that device users
might experience

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 793

Impacts of using the user portal

Impacts of using the user portal
When you enable users to manage their own devices, you need to:lDefine which users have access to which device management actionslProvide your users with the information they need to use the user portallConsider how changing device ownership from company-owned to employee-owned or vice-versa may
impact:o

The policies and configurations that are applied to the device.

o

The apps that are available through Apps@Work.

oiBooks that are available on the device.
Devices are impacted when they check-in with MobileIron depending on the labels to which companyowned or employee-owned devices are applied.

User portal authentication options
You can allow device users to authenticate to the user portal with:l

A user name and password
These are the credentials a device user uses to register a device with MobileIron Core.

l

An identity certificate from a smart card
This authentication method is supported only on desktop computers. It is not supported with:o

Mobile devicesoFirefox

You can allow one or both of these authentication mechanisms. You make your selection in the MobileIron Core
System Manager. For information about how to configure the user portal authentication options, see “Advanced:
Portal authentication” in the MobileIron Core System Manager Guide.

About registering devices in the user portal
To allow device users to register devices in the user portal, you must assign those users the Device Registrationrole in the Admin Portal in Devices & Users > Users.

Configuring the Per-User Device limit
You can configure a global per-user device limit, and optionally, custom device limits for specific LDAP Groups.
Users will be limited to register only the number of devices specified in Settings > System Settings > Users& Devices > Registration > Per-User Device Limit.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 794

Registration PIN

Procedure
To configure standard device limits and LDAP group-specific device limits, follow these steps:
1. In the first drop-down menu, select a default per-user device limit of 1-50, or none.
2. If you would like to create different per-user device limits for selected LDAP groups, click Add+. The Add
LDAP Group Specific Device Limit menu opens.
3. From the Select LDAP Server drop-down menu, select the LDAP server that contains the LDAP group you
want to include.
4. From the Select LDAP Group drop-down menu, select the Group to include.
5. From the Select Device Limit Per User drop-down menu, select the per-user device limit for that LDAP group.
6. Click Add to save your changes.
7. The LDAP group you selected appears in the LDAP group specific device limit table, where you can copy, edit,
or delete it.

Registration PIN
Users who can register devices can also request and receive device registration PINs. To allow users to request aregistration PIN, PIN-based registration must be selected in Settings > System Settings > Users & Devices >Device Registration. Any option that includes Registration PIN will enable device users to obtain a PIN in theuser portal.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 795

About changing device ownership in the user portal

Note the following about registration PIN:ll

Even though a PIN is generated, device users will not be prompted to enter a PIN if the device platform
does not require PIN for registration.
If Registration PIN is selected for only iOS web-based registration, a PIN is generated and displayed in
the user portal, but the PIN is not included in the registration email sent to the device user. However, if
Registration PIN is selected for both In-app registration and iOS web-based registration, the PIN is
included in the registration email to the device user.

About changing device ownership in the user portal
To allow device users to change device ownership through the user portal, you must assign those users the
Change Device Ownership role in the Admin Portal in Devices & Users > Users.
Users cannot assign ownership of a device during device registration in the user portal. Device ownership is
automatically set to company-owned. Once users have registered their devices through the user portal, they canchange the ownership of the device from company-owned to user-owned or the reverse.

Associating a certificate with a user-provided certificate enrollment setting
When the user uploads a certificate, the user chooses a configuration to associate with the certificate. The
configuration refers to a user-provided certificate enrollment setting that you configured. When you configure auser-provided certificate enrollment setting, you specify a display name. The user portal presents the display namein its list of configurations for the user to choose.
For example, you might create a user-provided certificate enrollment setting for S/MIME signing, another for
S/MIME encryption, and another for server authentication. Each setting has a display name:l

S/MIME signingl

S/MIME encryptionlAuthentication

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 796

About uploading certificates in the user portal

When the user uploads a certificate, they see these display names as configurations, and they choose the one forthe certificate. The user can upload the same certificate or different certificates for each configuration.
If you have not created at least one user-provided certificate enrollment setting, the user portal disables the option
for the user to upload a certificate.
See also:lCertificate Enrollment settingslEnabling per-message S/MIME for iOS.

About uploading certificates in the user portal
On a desktop computer, device users can upload their own certificates in the user portal. They can use thesecertificates for different purposes, such as:l

S/MIME signingl

S/MIME encryptionlAuthenticating to servers, such as internal servers that support apps.

From Core release 10.8.0.0 through the latest release supported by MobileIron, users can upload files with multiple
aliases and friendly names.
NOTE: This capability is available in the user portal on desktop computers, but not on mobile devices.

About generating a one-time PIN for resetting a secure apps passcodeOn the AppConnect global policy, you can configure MobileIron Core to allow iOS device users to reset their secureapps (AppConnect) passcode when they forget it. When you have configured this option, device users who
registered with Core using a user name and password can enter those credentials in Mobile@Work for iOS toauthenticate themselves and then reset their secure apps passcode. However, device users who registered with
Core using a registration PIN need a different mechanism for authenticating themselves.
This mechanism involves these steps:
1. The user generates a one-time PIN on the user portal. The one-time PIN is valid for 24 hours.
2. In Mobile@Work for iOS on a device, the user follows the instructions for resetting a forgotten secure apps
passcode.
3. When prompted for his user credentials, the user enters his user name and the one-time PIN.
4. The user resets his secure apps passcode.

Configuration requirements to allow the user portal to generate a one-time PIN
The user portal displays the option to generate a one-time PIN only if you have configured all of the following in the
Admin Portal:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 797

Configuring the user portal to generate a one-time PINl

The user portal role that allows the user to reset their secure apps passcodel

A license for AppConnect third-party and in-house apps, Docs@Work, or Web@Workl

An AppConnect global policy for the device that allows users to recover their AppConnect passcodes.

Configuring the user portal to generate a one-time PIN
Configure the following in the Admin Portal to allow the user portal to generate a one-time PIN:
1. In Devices & Users > Users, select the user.
2. Select Actions > Assign Roles.
3. In the Assign Role(s) dialog box, select Reset Secure Apps Passcode.
4. Click Save.
5. In Settings > System Settings > Additional Products > Licensed Products, select at least one of thefollowing:l

AppConnect for Third-party and In-house Appsl

Docs@Workl

Web@Work

6. In Policies & Configurations > Policies, select the AppConnect global policy for the device.
7. In the Policy Details panel, click Edit. The Modify AppConnect Global Policy dialog box opens
8. In the AppConnect passcode section, select Passcode is required for iOS devices.
9. Select Allow iOS users to recover their passcode.
10. Click Save.

About getting Entrust derived credentials
When using certificate authentication to the user portal, you can set up MobileIron Core so that iOS users can get
their Entrust derived credentials when they get their Core registration PIN. Specifically, in the System Manager,
you provide Core with the Entrust IdentityGuard Self-Service Module (SSM) URL. This URL is a deep link thatpoints directly to the page on the Entrust self-service portal where a user can get a derived credential.
When the user requests a derived credential on the user portal, the user portal redirects the user to the URL you
provided. The user interacts with the Entrust self-service portal to get a derived credential, after which the Entrust
self-service portal redirects the user back to the MobileIron Core user portal. The user uses the PIV-D Entrust app
on a device to activate the derived credential.
For information about how to enable the user to get a derived credential on the user portal, see “Advanced: Portal
authentication” in the MobileIron Core System Manager Guide.
NOTE: This feature is not supported on macOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 798

Device management with the user portal

Device management with the user portal
This section addresses the settings your users need to use the user portal.
l

Logging in to the user portal with user name and passwordlLogging in to the user portal on a desktop computer with a certificatelWhat users see after they loginlUploading certificates in the user portal on a desktop computerlViewing, replacing, and deleting certificates in the user portallWhen a user-provided certificate is deleted

Before enabling device registration in the User Portal
On iOS devices, registering with MobileIron Core at http://<Core_Server_FQDN>/go does not automatically install
Mobile@Work on the device. You can prompt device users to install Mobile@Work after they complete registration
at http://<Core_Server_FQDN>/go.
To prompt device users to install Mobile@Work, do the following:
1. In the Admin Portal, go to Apps > App Catalog.
2. Click Quick Import > iOS to manually import Mobile@Work from the Apple App Store.:
The App Store Search window opens.
3. In Application Name, enter Mobile@Work and click Search.
4. Next to MobileIron Mobile@Work Client, click Import > OK.
5. Close the App Store Search window.
6. Click on MobileIron Mobile@Work Client in the list of apps.
7. Click Edit.
8. Under Managed App Settings, select Select installation request or send convert unmanaged to
managed app request (iOS 9 and later) on device registration or sign-in.
9. Click Save.
10. Click Back to list in the upper left corner.
11. Select MobileIron Mobile@Work Client in the list of apps and click Actions > Apply To Labels.
12. Select the appropriate labels and click Apply.
For detailed instructions, see “Manually importing iOS apps from the Apple App Store” in the MobileIron
Apps@Work Guide.
Note that in this scenario, device users do not have to reenter their credentials when they install and launch
Mobile@Work. However, for extra security, you can:MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 799

Assigning user portal device management roleslllimit this silent registration with Mobile@Work to one time only. In the Admin Portal, go to Settings >System Settings > Users & Devices > Device Registration and select Allow silent in-app
registration only once (iOS only).
add a silent registration grace period in Settings > System Settings > Users & Devices > Device
Registration and set the Silent in-app registration time limit (minutes) (iOS only) field.

Assigning user portal device management roles
The MobileIron Core user portal provides several device management options for your users. You give themaccess to these management tasks by assigning them roles in the Admin Portal.
Note The Following:l

The Trust and unTrust options do not require a role. Registered devices are Trusted devices by default.

l

The Locate option is not available for macOS devices.

Procedure
1. In Admin Portal, go to Devices & Users.
2. Select the users receiving device management privileges.
3. From Actions, select Assign Roles.
4. Check User Portal.
5. Check one or more roles to assign the corresponding management actions to the selected users.
6. User roles include:lWipe DevicelLock DevicelUnlock Device (See following Note)l

Locate DevicelRetire DevicelRegister DevicelChange Device OwnershiplReset PINlReset Secure Apps Passcodel

Use Google Device Account (for Android Enterprise devices only)lEnable Auth Only Role

Note The Following:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 800

Customizing the self-service user portall

The unlock feature works with Managed Device with Work Profile (COPE) mode (Android versions 810.) Upon upgrade to Android 11, administrators do not have the ability to unlock the device.

l

Unlock devices does not work for Work Profile devices starting from Android 7 and higher.

7. Click Save.

Customizing the self-service user portal
The self-service user portal can easily be customized to reflect your company branding, messaging, and layout.
The following elements can be customized:lCompany namelCompany logolLogin page messagel

Background colorlCascading stylesheet (CSS)

Procedure
1. From the Admin portal, navigate to Settings > System Settings > General > Self-Service Portal. The
Self-Service Portal page opens.

2. Company Name: Enter a customized company name.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 801

Customizing the self-service user portal

3. Company Logo: Upload a customized company logo. Images can be JPG or PNG format, and must notexceed 250 by 50 pixels.
4. Login Page Message: Modify or replace the existing message that displays on the Self-Service Portal's
log in page, up to 1,000 characters.
5. Background color:a. Check Enable customized background color and either:lType in a HEX color value, orlOpen the Background color menu.

b. Select or enter a value for the background color.
NOTE: Based on your choice of background color, Core will automatically determine thehighest-contrast text color (black or white) for that color.
c. Click OK to exit the menu.
6. CSS: By default, your message is formatted using the default cascading style sheet (CSS) supplied by
MobileIron. You can import and edit a custom CSS file, modify the default CSS file, or leave the default.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 802

MobileIron user portal default stylesheet

Options are:l

Import a CSS file: Click to browse to a valid CSS file on your local drive. Select the file and click
Open. The CSS file opens in the edit window. You will be asked to confirm the change.
NOTE: Invalid CSS files will not be imported, and an error message will display.

l

Reset: Click to reset the style sheet to the default values. You will be asked to confirm the reset.

lPreview: Click to see a preview of your message as users will see it.

l

Download: Downloads a copy of the default CSS file to your browser's Download folder for you tokeep and modify. Alternately, you can copy and paste the default CSS file into the CSS text window.

7. Show View Activity in SSP Portal: This option is enabled by default, and allows your device users to
see their activity logs from the View Activity page in the SSP. To hide activity logs on the SSP, seeDisabling device history logs in the self-service user portal.
8. When all of your changes are made, click Save (at the top of the page) to keep your options. A confirmation
message displays.
9. Verify the new custom portal page on Core by substituting your Core hostname and SSP user name:https://<hostname>/mifs/<user>

MobileIron user portal default stylesheet
You can copy-and-paste the following default stylesheet into the CSS text window and modify it for your needs.
.backgroundColor {background:#33ccff!important;}.foregroundColor > p,label,div,.user-accessibility-color * {MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 803

MobileIron user portal default stylesheet

color: #000066!important;}.white-bg,.light-gray {background:#33ccff!important;}.pbl,.big-font,.x-form-display-field-default {color: #000066!important;}.x-menu-default,.x-menu-body-default,.link-menu-item-blue span{
Background:#e6f9ff!important;}.btn-new-color,.x-btn-accessblue-medium {background:#000066!important}.link-menu-item-blue span {line-height: 16px;
font-size: 14px;
font-family: Helvetica,Arial,sans-serif;
margin-left: 5px;
color: #2d70b5;}.x-menu-item-text-default {
font: normal 11px helvetica,arial,sans-serif;
line-height: 21px;
padding-top: 1px;
color: #222;
cursor: pointer;}.x-btn-inner-accesswhite-medium {
font: normal 12px/24px arial,verdana,sans-serif;
color: #2d70b5;
padding: 0 10px;
max-width: 100%;}.x-btn-inner {display: inline-block;vertical-align: middle;
overflow: hidden;
text-overflow: ellipsis;}.x-autocontainer-innerCt {display: table-cell;height: 100%;

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 804

MobileIron user portal default stylesheet

vertical-align: top;}
.x-autocontainer-outerCt {display: table;}.x-grid-empty {padding: 10px;
color: gray;background-color: white;
font: normal 12px helvetica,arial,sans-serif;}.x-grid-header-ct {background-color: #edf0f2;}.x-grid-header-ct {border: 1px solid #d0d0d0;
border-bottom-color: #a0a7ad;
background-color: #a0a7ad;}.x-column-header-inner {padding: 8px 8px 6px 8px;}
.x-leaf-column-header {height: 100%;}.x-column-header-inner {white-space: nowrap;
position: relative;
overflow: hidden;}.x-column-header-text {background-repeat: no-repeat;
display: block;overflow: hidden;
text-overflow: ellipsis;
white-space: nowrap;}.x-grid-item-container {min-height: 1px;
position: relative;}.x-panel-default {border-color: #d0d0d0;

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 805

Disabling device history logs in the self-service user portal

padding: 0;}

Disabling device history logs in the self-service user portal
When users log into the MobileIron self-service portal (SSP), they can view their activity log by default. If yourorganization prefers not to show users the View Activity page, an administrator can disable the feature from the
Self-Service Portal page of the Core admin portal.
Procedure
1. Go to Settings > System Settings > General > Self-Service Portal page, and scroll to the bottom.
2. Deselect Show View Activity in SSP Portal by clicking it.
3. Click Save.
Related topics
To disable the QR code and authentication URL for device registration, see Disabling the QR code and registration
URL.

Configuring an end user Terms of Service agreement
Device users must sign a Terms of Service (ToS) agreement to use Mobile@Work. You can create custom ToS
agreements to align with your user languages and countries. When a user accepts the agreement, an audit email is
automatically sent to the admin user identified in the EMail ID field.
Procedure
1. From the Admin portal, navigate to Settings >System Settings > Users & Devices > Registration
page > End User Terms of Service.
2. Click Add+. The Add End User Terms of Service agreement window opens.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 806

Configuring an end user Terms of Service agreement

3. In the Language drop-down, select the language for the agreement.
4. In the Country / Region drop-down, select the primary country or region.
5. In the Type drop-down, select the type of agreement:a. System - Select for iOS, macOS and Android devices.
b. AAD enrollment - Select for Windows devices.
6. In the Agreement Content text box, enter your agreement text. The text field permits basic formatting.
7. In the EMail ID field, enter an email address to receive confirmation emails when the users accept theagreement.
8. Click Save. Your new agreement appears in the End User Terms of Service table.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 807

Admin notification email

Admin notification email
The notification email consists of a message and identifying client information: "The following user has accepted
device registration terms and has attempted to enroll a new device:"l

User namelDisplay namel

Email addresslDate and timelIP addressl

PlatformlEmployee owned (true/false)

Requiring user portal password change
You can require local users to change their user portal password the next time the device checks in with MobileIron
Core. This feature is not available for LDAP users.
To require a local user to change their user portal password:
1. In Admin Portal, go to Devices & Users.
2. Click Users.
3. Select one or more local users you want to change their user portal passwords the next time they check inwith Core.
4. Click Actions.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 808

Limiting devices per user by LDAP group membership

5. Select Require Password Change.
Core prompts you to confirm the requirement.
6. Click Yes to require the selected users to create a new password at the next check in.

Limiting devices per user by LDAP group membership
You can limit the number of allowed devices per user, using LDAP group membership as the conditional limiter.
You can:lSelect a global device limit of 0-50 devices per userl

Add LDAP user groups to the LDAP group-specific device limit tablel

Edit LDAP user groupslDelete LDAP user groups from the device limit tablel

Set the device limit precedence setting: you can choose whether the standard device limit takes
precedence over LDAP membership-specific device limits, or LDAP group-specific device limits takeprecedence over the standard device limit (for all applicable users)
For example, you could set a global device limit of four devices, but restrict members of specific LDAP
groups to one or two devices.

Before you begin
You must have previously configured an LDAP server to support LDAP groups before you can set per-user device
limits.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 809

Limiting devices per user by LDAP group membership

Procedure
1. From the Admin Portal, go to Settings > System Settings > Users & Devices > Registration page
2. In the Per-User Device Limit section, enter the following information:

3. Per-User Device Limit (1-50, or none): Set the default number of devices each user can register with
Core. This is the "standard" device limit, that by default takes precedence over LDAP membershipspecific device limits.You can change this priority by selecting a device limit precedence setting (step 5).
4. LDAP group specific device limit: This setting allows you to create LDAP group-specific device limits
that vary from the default device limit you set as the per-user device limit.
a. From below the LDAP group table, click Add+. The Add LDAP Group Specific Device Limit dialog
opens.

b. Select a configurable LDAP server from the Select LDAP Server drop-down.
c. Select a group from the LDAP Group drop-down.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 810

Editing or Deleting an LDAP group-specific device limit

d. Select the device limit (1-50) from the Select device limit field.
e. Click Add.
5. Select a device limit precedence setting:a. Standard device limit takes precedence over LDAP membership-specific device limit for all applicableusers.
b. LDAP group-specific device limit takes precedence over standard device limit for all applicable users.
6. Click Add to save your changes.

Editing or Deleting an LDAP group-specific device limit
You can modify or delete your LDAP group-specific device limits from the LDAP group-specific device limit table.
Procedure
1. Locate the LDAP group that you want to edit or delete in the LDAP group-specific device limit table.

2. Click Edit to re-open the Add LDAP Group Specific Device Limit dialog.
3. Click Delete to delete the LDAP group-specific device limit.

Configuring help desk contact information
MobileIron Core administrators with Manage settings and services permission can configure the help desk
contact information to display in the self-service user portal.
Procedure
1. In the MobileIron Core Admin Portal, go to Settings > General > Helpdesk.
2. Enter the following information:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 811

User portal information for your users

Item

Description

Name

Enter a name for the configuration.

Description

Enter a brief description for the configuration.
Maximum characters allowed is 100.

Contact(s)Enter one or more phone numbers. Valid number strings include:l

Up to 24 digits for numbers beginning with the + symbol.

l

Up to 22 digits for numbers without the + symbol.

If you are entering multiple phone numbers, enter a comma-separated list.
Email(s)Enter one or more email addresses.
If you are entering multiple email addresses, enter a comma-separated list.

NOTE: Either a phone number or an email address is required.
Related topics
Viewing the help desk contact information.

User portal information for your users
This section presents the information that your users need to use the user portal.
The user portal displays:l

Icons for each device management action the user is allowed to perform.

lUser and device information, including:odevice type (iPod touch, 4th gen in the example)ostatus (Active, for example)olast check-in (example, 2 hours ago)ophone numberoOS and version (to 3 digits, iOS 7.1.1, for example)ocarrier (for example, AT&T)

o

IMEI value, if applicableomanufacturerodate the device was registered with MobileIronl

Accounts settings and certificates uploaded by the device user.

l

Helpdesk contact information configured by the MobileIron Core administrator.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 812

Logging in to the user portal with user name and password

FIGURE 27. USER PORTAL SHOWING USER'S DEVICE INFORMATION

Logging in to the user portal with user name and password
Device users can log in to the user portal to register and manage their devices.
Procedure
1. Go to https://<MobileIron server>, where <MobileIron server> is the address of your MobileIron server.
Contact your administrator if you do not have this address.
2. If you are not logged in, provide your user name and password, when prompted, and then select Sign In
with Password.
The user portal displays on your device. You can:lclick the icon for one of the available device management actions available to you.

lview your device information.

Logging in to the user portal on a desktop computer with a certificate
If set up by the MobileIron Core administrator, device users can log in to the user portal on a desktop computer
using an identity certificate on a smart card.
Procedure
1. Attach your smart card reader with your smart card to a USB port on the desktop computer.
If your computer has a built-in smart card reader, insert your smart card.
2. Go to https://<MobileIron server>, where <MobileIron server> is the address of your MobileIron server.
Contact your administrator if you do not have this address.
3. If you are not logged in, select Sign In with Certificate.
A prompt appears to select your certificate
4. Select the certificate from the smart card.
5. If prompted, enter the password of the private key of the identity certificate on your smart card.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 813

What users see after they login

The user portal displays. You can:l

Select the icon for one of the available device management actions available to you.

l

View your device information.

What users see after they login
Depending on the user portal role enabled, device users may have a different view of the user portal.

Welcome menu
The Welcome menu is in the top-right of the user portal. From this menu, you can perform the following actions:llView Activity - See a list of all device activity. See Viewing device history logs from the self-service user
portal.
Helpdesk - Configure the help desk contact information to display in the user portal. See Configuring help
desk contact information.

lSettings - View user portal settings.

lSign Out - Sign out of the self-service user portal.

If Register Device role is enabled
If the Register Device role is enabled, device users will be able to send an invitation from the user portal to register
their device.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 814

If Register Device role is enabled

FIGURE 28. SEND INVITATION TO REGISTER

After the invitation is sent, the device status is seen as Pending.

FIGURE 29. REGISTRATION PENDING FOR DEVICE

Device users can complete the registration on their mobile device at https://<Core_Server_FQDN>/go.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 815

Registration instructions

FIGURE 30. COMPLETE DEVICE REGISTRATION

After registration is completed on the mobile device, the status for the device is changed to Active.

FIGURE 31. ACTIVE DEVICE STATUS

Registration instructions
On iOS devices, Mobile@Work is installed only if it was set up for distribution through MobileIron Core. If not,users can download Mobile@Work from the Apple App Store. Instructions for downloading Mobile@Work from theApple App Store are provided in the email sent to the device user.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 816

If PIN-based registration is enabled

If PIN-based registration is enabled
If PIN-based registration is enabled, device users will see Request Registration PIN. Clicking on Request
Registration PIN allows device users to send an invitation for registration as well as generate a PIN.

FIGURE 32. REGISTRATION WITH PIN

Device users can complete the registration on their mobile device at https://<Core_Server_FQDN>/go. They will
have to enter the PIN if prompted.

If QR-code registration is enabled
If Quick Response (QR) code-based registration is enabled, device users will see Generate QR Code. Clicking on
Generate QR Code allows device users to complete the device registration process.
When users log into the Self-service portal (SSP) home page, they can click one of two registration buttons:lSend Invitation – Receive registration information by SMS message and email.

lGenerate QR Code – Scan to be redirected to the appropriate registration page.

Users scan the QR code and are redirected to a browser to enter their pin or password:

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 817

If getting an Entrust derived credential is enabledl

iOS users: Once authenticated, iReg profile installation starts, completing device registration.

lAndroid users: Once authenticated, the user is redirected to Google Play to download the registration app.
Users open the app to complete device registration.

FIGURE 33. REGISTRATION WITH QR CODE

If getting an Entrust derived credential is enabled
NOTE: This feature is not supported on macOS devices.
If you enabled getting an Entrust derived credential in the System Manager, device users will see Request
Derived Credential when they receive their registration PIN for a device. Before using the registration PIN toregister Mobile@Work to MobileIron Core, the device user should request a derived credential.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 818

If Change Device Ownership role is enabled

FIGURE 34. REQUEST DERIVED CREDENTIALS

To get a derived credential:
1. Click Request Derived Credential.
The user is directed to the Entrust IdentityGuard self-service module URL that you specified in the System
Manager.
2. The user interacts with the Entrust self-service portal to get a derived credential, including naming thederived credential.
The Entrust self-service portal provides a Derived Mobile Smart Credential Activation Password.
Important: The user must record this password for later use in activating the derived credential.
3. After recording the password, the user follows directions to indicate he is done.
The user is directed back to the user portal. A brief message indicates whether getting the derived
credential was successful. If it was successful, Request Derived Credential is disabled.
The user then does the following:
1. Use Mobile@Work to register the device to MobileIron Core.
2. Use the PIV-D Entrust app on the device to activate the derived credential.

If Change Device Ownership role is enabled
If the Change Device Ownership role is enabled, device users will see the option to change the device
ownership.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 819

If generating a one-time PIN for resetting the secure apps passcode is enabled

FIGURE 35. CHANGE DEVICE OWNERSHIP OPTION

Clicking on Change Ownership allows the user to change the device ownership.

FIGURE 36. CHANGE DEVICE OWNERSHIP SETTINGS

If generating a one-time PIN for resetting the secure apps passcode is enabled
If you have configured MobileIron Core as described in About generating a one-time PIN for resetting a secure apps
passcode, the device user sees the option Reset Secure Apps Passcode. This option is among the device
management actions presented to the user for iOS and Android devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 820

Trust and Untrust options

FIGURE 37. RESET SECURE APPS PASSCODE

Procedure
1. Click Reset Secure Apps Passcode.
2. On the next screen, click the button Reset Secure Apps Passcode.
3. A dialog box displays containing the one-time PIN.
4. In Mobile@Work on an iOS device, or in the Secure Apps Manager on an Android device, follow the
instructions for resetting a forgotten secure apps passcode.
5. When prompted for user credentials, enter the user name and the one-time PIN.
6. Follow the instructions to create a new secure apps passcode.

Trust and Untrust options
Two device management actions that all client users can access from the SSP Devices page are the Trust and
UnTrust options.

FIGURE 38. TRUST AND UNTRUST OPTIONS IN SSPl

UnTrust: Select this option to temporarily remove confidential information and applications from yourdevice. Use this option before entering a location where device security may be at higher than normal risk,such as in airports.

l

Trust: Select this option to restore confidential information and applications on your device. Use this option
when no unusual device security risks exist.

Uploading certificates in the user portal on a desktop computer
NOTE: This feature is not supported on macOS devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 821

Viewing, replacing, and deleting certificates in the user portal

Device users can upload a certificate in the user portal on a desktop computer (available only if at least one userprovided certificate enrollment setting has been created).
Procedure
1. Go to https://<Core_Server_FQDN>/user.
2. Click on the device user’s name in the top right corner.
3. Click on Settings in the drop down menu.

FIGURE 39. USER PROVIDED CERTIFICATE MANAGEMENT

4. Click Upload New Certificate.
5. In the Configuration field, select a value from the drop-down list that corresponds with how you want to
use the certificate.
NOTE: If you select a configuration for which you have already uploaded a certificate, thepreviously uploaded certificate will be replaced.
6. Click Browse next to the User-Provided Certificate File field.
7. Select a PKCS 12 file to upload. You can use an alias or "friendly name" for the files.
8. If a Password field displays, enter the password of the certificate’s private key.

Viewing, replacing, and deleting certificates in the user portal
Device users can view, replace, or delete certificates in the user portal.
Procedure
1. Go to https://<Core_Server_FQDN>/user.
2. Click on the device user’s name in the top right corner.
3. Click on Settings in the drop down menu.
The User-Provided Certificate Management page appears.
4. To view information about an uploaded certificate, click the “i” next to the certificate.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 822

When a user-provided certificate is deleted

5. To replace a certificate, click the edit icon next to the certificate.
6. To delete a certificate, click the delete icon next to the certificate.

When a user-provided certificate is deleted
The user can delete the private key from the PKCS 12 file, and password if provided, from the Core file systemusing the user portal. A web services API is also available to delete them. Whether you want the private key andpassword deleted from Core depends on your security requirements.
WARNING: This action means that the certificate and private key in the PKCS 12 file (and password if
provided) are still available and usable on existing devices that already had received themfrom Core. Because the private key was deleted from the Core file system, the certificate is
not available to newly registered devices or to re-provisioned devices.
Because the certificate without the private key is still available on Core, you can view information about thecertificate, such as its expiration date. This information can help you manage devices still using the certificate.

Viewing the help desk contact information
If the help desk contact information is configured in the MobileIron Admin Portal, device users can view the contact
information in the self-service user portal.
For information about configuring the help desk contact information see, Configuring help desk contact information
Procedure
1. Go to https://<Core_Server_FQDN>/user.
2. Click on the device user’s name in the top right corner.
3. Click Helpdesk in the drop down menu.
The Helpdesk page appears.

FIGURE 40. HELPDESK CONTACT INFORMATION

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 823

Viewing device history logs from the self-service user portal

Viewing device history logs from the self-service user portal
Mobile@Work users can access their audit/device history logs from the self-service user portal. From the user
portal Welcome drop-down menu, select View Activity. The device activity page opens, displaying search tools
and a scrolling table of log entries. Users can access this page from their laptop and mobile devices.
Procedure
1. From the user portal Welcome drop-down menu, select View Activity.

FIGURE 41. SELECT VIEW ACTIVITY FROM THE WELCOME MENU

2. The Device Activity page opens, displaying search tools and a scrolling table of log entries.

FIGURE 42. USER DEVICE LOGS FROM SELF-SERVICE USER PORTAL

Users can access this page from their laptop and mobile devices.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 824

Unlocking a macOS device

Unlocking a macOS device
While it is possible to lock a macOS device from the User Portal, you cannot unlock a macOS device from theUser Portal. Instead, unlocking a macOS device requires entering an unlock passcode on the device when
prompted. The passcode can be found in the MDM logs for the macOS device, which are listed in the Admin Portal.
The procedure is almost identical for unlocking wiped macOS devices.
For wiped macOS devices, you can push the MobileIron MDM profiles back to the device following recovery.
Important: The Unlock command clears passcodes and TouchIDs from the managed device, compromising
device security. Never user this feature on lost or stolen devices.
Procedure
1. In the Admin Portal, go to Devices & Users > Devices.
2. Go to the locked or wiped macOS device and click the carat (^) next to it.
3. In the device details, click Logs.
4. A list of device logs is displayed.

5. Click MDM Log.
6. The mobile device management log is displayed.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 825

Unlocking a macOS device

7. Find the Lock or Erase Device action in the Action column.
Alternatively, you can search for the relevant action by selecting a date range and the name of the action
from the Actions drop-down list on the left.
8. Make note of the corresponding PIN associated with the lock or wipe action.
The PIN is located in the Detail column.
9. When prompted, enter the PIN on the macOS device you are trying to unlock.
NOTE: If the macOS device has been locked and wiped, you must enter the corresponding PIN
when prompted in the order that the actions occurred. For example, if you locked thedevice, and then wiped it, you would need to enter the lock PIN when prompted on themacOS device, follow the on-screen instructions, and then enter the wipe PIN when
prompted.
10. For wiped devices:a. Retire the macOS device.
b. Re-register the macOS device. Alternatively, instruct the user to register the device again.

MobileIron Core 11.1.0.0 Device Management Guide for iOS and macOS | 826