MobileIron Core 11.0.0.0 Device
Management Guide
for Windows Devices
December 3, 2020
For complete product documentation see:
MobileIron Core Product Documentation Home Page

Proprietary and Confidential | Do Not DistributeCopyright © 2009 - 2020 MobileIron, Inc. All Rights Reserved.
Any reproduction or redistribution of part or all of these materials is strictly prohibited. Information in this publication
is subject to change without notice. MobileIron, Inc. does not warrant the use of this publication. For some phone
images, a third-party database and image library, Copyright © 2007-2009 Aeleeta's Art and Design Studio, is used.
This database and image library cannot be distributed separate from the MobileIron product.
“MobileIron,” the MobileIron logos and other trade names, trademarks or service marks of MobileIron, Inc.
appearing in this documentation are the property of MobileIron, Inc. This documentation contains additional trade
names, trademarks and service marks of others, which are the property of their respective owners. We do notintend our use or display of other companies’ trade names, trademarks or service marks to imply a relationshipwith, or endorsement or sponsorship of us by, these other companies.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 2

Contents

Contents
Contents3

New features and enhancements

21

Registering Devices

22

Registration methods

22

Admin invites users to register

23

Registration restrictions for Android devices

23

Users register additional devices

25

Admin registers ActiveSync devices

25

Terms of service

25

Creating a terms of service agreement

26

Searching for devices by terms of service agreement criteria

27

Terms of Service for users

29

Invite users to register

29

ActiveSync device registration

31

Managing operators and countries

31

Enabling operators

31

Enabling additional countries for registration

31

Disabling operators

32

Filtering operators

32

Searching for an operator

32

Displaying operators by country

32

Displaying operators by status

32

Specifying eligible platforms for registration

33

Setting the registration PIN code length for device user registration

33

Limit for failed attempts to enter a registration password

34

PIN-based authentication for all available Windows devices

34

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 3

Contents

Customizing registration messages

34

Viewing registration templates

35

Editing registration messages

35

Using variables in registration messages

36

Registration message variables

36

Variables used inside registration messages

37

Filtering registration messages

38

Restoring registration messages to default content

38

Configuring the default ownership for newly registered devices

39

Disabling analytics data collection

39

Searching for Devices

40

Basic searching

40

Advanced searching

41

Searchable fields

42

Device field definitions

42

Using the query builder

57

Using a manually edited search expression

57

Using both the query builder and manual editing

58

Negative operators with advanced search

60

Examples for advanced search with negative operators

60

Clearing an advanced search

61

Searching for retired devices

61

Searching for blocked devices

62

Saving a search criterion to a label

62

Securing Devices

63

Registration-related features and tasks

64

Reprovisioning a device

64

Retiring a device

64

Retiring and deleting unused and retired devices

65

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 4

Contents

Assigning an administrator the role to delete retired devices

65

Creating a schedule to retire or delete devices

66

Retiring or deleting retired devices by threshold

67

Managing Duplicate Devices

69

Security-related features and tasks

70

Lock

71

Unlock71

Encryption

72

Wipe

72

Cancel Wipe73

Selective Wipe73

Block AppTunnels

74

Lost

74

Found

74

Locate74

Reset device PIN

74Force Device Check-In

74

Setting up background check-ins with APNs

75

Managed iBooks

75

Personal hotspot on/off switch

75

Custom SyncML

75

Preparing to use SyncML

76

How to use SyncML76

Reporting on managed devices

77

Exporting records to CSV

78

Export to CSV Field Options

78

Setting the time zone of a device

80

Managing Custom Attributes
Assigning a custom attributes role81
81

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 5

Contents

Adding custom attributes to users and/or devices

82

Viewing custom attributes available for users and/or devices

82

Viewing custom attributes assigned to users

83

Viewing custom attributes assigned to devices

83

Editing custom attributes for users and/or devices

83

Searching for custom attributes for users and/or devices

83

Exporting a log of the custom attributes for users and/or devices

84

Deleting custom attributes from users and/or devices

84

Setting custom attribute values for device or users

84

Applying custom attributes to labels
Pushing label attribute changes to devices and users
Managing Policies

85
85
86

Working with default policies

86

Importing and exporting policies

87

Exporting policies or configurations

87

Importing policies or configurations

88

Viewing policy status and platform support

88

Displaying policy status

89

Displaying supported platforms for policies

89

Edge Browser settings

90

How to disable Edge browser settings

90

Sync policies and battery use

90

Country changes and alerts

90

Working with Windows Update policies

91

Notifications of changes to the privacy policy

92

Exporting the devices in the WatchList

92

Managing Compliance

93

Managing device compliance checks
Setting the device compliance check interval

93
94

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 6

Contents

Updating device compliance status

94

Compliance triggers and actions

95

Server compliance conditions and actions

95

Local compliance conditions and actions

98

Tiered compliance

100Compliance actions policy violations

100

Default compliance actions

101

Custom compliance actions

101

Creating a compliance action

102

Add Compliance Action table

102

When the compliance action takes effect103

Viewing quarantine information

104

Viewing configurations removed due to quarantine

104

Dashboard page: Device by Compliance chart

104

Custom compliance policies

105

Assigning compliance roles

105

Managing compliance policy rules

106

Substitution variables for compliance policy rules

109

Managing compliance policy groups

110

Device search fields for compliance rules

113

Managing Device Settings with Configurations

116

Management of device settings with configurations

116

Configurations page

117

Default configurations

117

Displaying configurations status

118

Adding new configurations

118

Editing configurations

119

Deleting configurations

119

Exporting configurations

119

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 7

Contents

Importing configurations

120

Applying configurations to labels

120

Exporting the devices in the WatchList

120

Impact of changing LDAP server variables

121

Configuring Email122

Exchange settings

122

Configuring POP and IMAP email settings

127

Synchronizing Google account data

127

Using OAuth to enable access to Google APIs

128

Uploading OAuth credentials to the Google Admin Console

129

Linking Google Apps credentials with MobileIron Core

129

Setting up your Exchange setting for access to Google Apps data

131

Renewing the Google Apps password for a given set of users

133Managing Wi-Fi Settings

134

Wi-Fi settings

134

Wi-Fi profiles and password caching

134

Wi-Fi authentication types

134

Open authentication

134

Shared authentication

137

WPA Enterprise authentication

140

WPA2 / WPA3 Enterprise authentication

142

WPA Personal authentication

144

WPA2 Personal authentication

145

WPA2 / WPA3 Personal authentication

146

Supported variables for Wi-Fi authentication

147

Managing VPN Settings

148

VPN settings overview

148

Configuring new VPN settings

149

About VPN settings for Windows devices

149

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 8

Contents

Check Point Capsule

150

Proxy - None (default)

150

Proxy - Manual151

Proxy - Automatic

153

Windows Configuration

155

Custom Data

155

Cisco AnyConnect (iOS only)

156

Cisco Legacy AnyConnect

156

Proxy - None (default)

156

Proxy - Manual

158

Proxy - Automatic

160

Windows Configuration

161

Custom Data

162

F5 SSL162

Proxy - None (default)

162

Proxy - Manual

164

Proxy - Automatic

166

Windows Configuration

167

Custom Data

168

IKEv2 (iOS Only)

168

IKEv2 (Windows)

168

Proxy - None (default)

169

Proxy - Manual

170

Proxy - Automatic

172

Windows Configuration

173

Custom Data

174

IPSec (Blue Coat)

174

IPSec (Cisco)

174

Juniper SSL

174

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 9Contents

Proxy - None (default)

175

Proxy - Manual

176

Proxy - Automatic

178

Windows Configuration

180

Custom Data

180

L2TP

180

Proxy - None (default)

181

Proxy - Manual

182

Proxy - Automatic

184

MobileIron Tunnel (iOS and macOS)

185

MobileIron Tunnel (Android)

186

MobileIron Tunnel (Samsung Knox Workspace)

186

MobileIron Tunnel (Windows)

186

NetMotion Mobility VPN (iOS)186

OpenVPN

186

Palo Alto Networks GlobalProtect

186

PPTP

186

Proxy - None (default)

187

Proxy - Manual

188

Proxy - Automatic

189

Pulse Secure SSL

191

Proxy - None (default)

191

Proxy - Manual

193

Proxy - Automatic

195

Windows Configuration

196

Custom Data

197

Samsung Knox IPsec

197

SonicWall Mobile Connect

197

Proxy - None (default)

198

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 10

Contents

Proxy - Manual

199

Proxy - Automatic

202

Windows Configuration

204

Custom Data

205

Custom SSL

205

Application-triggered VPN for Windows devices

205

Configuring VPNs triggers

206

How to set up exclusions for VPN traffic

206

How to get the app GUID for a Windows Phone 8.1 device app

207Managing Certificates and Configuring Certificate Authorities

208

Certificates overview

208

Types of certificates

209

Managing certificates issued by certificate enrollment configurations

210

Supported certificate scenarios

211

MobileIron Core as a certificate authority

211

Using MobileIron Core as a certificate proxy

211

Using MobileIron Core as a certificate enrollment reverse proxy212

Certificate scenarios supported for Windows 8.1 Phone212

MobileIron Core as a certificate authority

212

Configuring MobileIron Core as an independent root CA (Self-Signed)

213

Generating a self-signed certificate

213

Creating a local certificate enrollment setting

215

Configuring MobileIron Core as an intermediate CA

216

Mutual authentication between devices and MobileIron Core

216

Scenarios that can use mutual authentication

217

Core port usage with devices, with and without mutual authentication

217

The mutual authentication setting on MobileIron Core

218

When devices use mutual authentication

219

Mutual authentication identity certificate for MobileIron Core

221

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 11Contents

Mutual authentication client identity certificate

221

Supported custom attributes for mutual authentication certificates

222

Handling client identity certificate expiration for Android devices

222

Handling client identity certificate expiration for iOS devices

223

Mutual authentication and Apps@Work224

Enabling mutual authentication for Apple and Android devices

224

Enabling TLS inspecting proxy support when using mutual authentication

225

Migrating Mobile@Work for Android to use mutual authentication

226

Certificates settings

226

Adding a certificate setting

227

Certificate Enrollment settings

227

If Certificate Enrollment integration is not an option

228

Supported variables for certificate enrollment

228

Configuring a client-provided certificate enrollment setting

229

Overview of client-provided certificate enrollment settings

230

Specifying a client-provided certificate enrollment setting

231

Configuring an Entrust CA

232

Revoking the certificate

233

Configuring a GlobalSign CA

233

GlobalSign Prerequisites

234

Revoking the certificate

235

Configuring MobileIron Core as the CA

235

Revoking the certificate

236

Configuring OpenTrust CA

237

Revoking the certificate

238

Configuring a single file identity certificate enrollment setting

239

Configuring SCEP

240

X.509 Codes

242

SCEP proxy functions

242

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 12Contents

Configuring Symantec Managed PKI

243

Prerequisites

243

Using a proxy244

Configuring Symantec Web Services Managed PKI
Revoking the certificate

245
246

Configuring a user-provided certificate enrollment setting
Azure Services

247
250

Azure Services Overview

250Standard prerequisites for all Azure services

250

Register devices in AAD and MDM

250

OOBE sign up for AAD enrollment

251

Post OOBE sign up for AAD enrollment

251

Workplace sign up for AAD enrollment

252

Terms of Service Customization

252

Join Azure and MobileIron for Windows 10

252

Prerequisites for joining Azure and MobileIron

252

Join Azure and MobileIron work flow

253

Set up Azure to join with MobileIron

253

Add the MDM application

253

Configure the application

253

Set up MobileIron to join with Azure

255

Manage device compliance

255

Azure Compliance Setting

256

Windows Information Protection

256

Recommendations for using WIP
Verify WIP profiles

256
256

WIP work flow

257

Set up App Control rule

257

Setting up an App Control rule

257

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 13

Contents

Creating a Windows Information Protection policy

258

New Windows Information Protection window

258

Apply the profile to a label

261

Business Store Portal

262

Prerequisites for BSP

262

BSP work flow262

Add a BSP app in Azure262

BSP set up

263

MobileIron Setup

264

Deploying applications

264

Windows PIN management for PassPort For Work/Windows Hello264

Enabling Microsoft Azure Menu

265

Enabling PassPort For Work/Windows Hello with Microsoft Azure

265

Creating a PassPort For Work/Windows Hello policy

265

New Windows PassPort For Work/Windows Hello Policy window

265

Viewing status in device details

267

Windows license management267

Upgrading Windows Licenses

268

MobileIron Bridge

269

MobileIron Bridge overview

269

Setting up MobileIron Bridge

270

Creating the MobileIron Bridge certificate

270

Enabling the MobileIron Bridge certificate

271

Deploying the MobileIron Bridge app

271

Verifying MobileIron Bridge installation

272

Uploading scripts

272

Uploading scripts using configurations

272

Pushing a single-use script to a device

272

MobileIron Bridge script reversal

273

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 14

Contents

Resetting Windows 10 devices

273

Disabling MDM un-enrollment

273

Configuring reversal scripts

274

Supported variables as script arguments
Enabling BitLocker

274
275

Bit Locker data encryption

275

Managing Windows device updates

276

Setting hotfix options

277

Setting up a compliance policy for device updates

278

Windows 10 Desktop device management

278

Restricting access to device OS controls

278

Removable storage device management279

Restricting access to removable storage devices

279

Creating a whitelist for removable storage devices

280

Windows 10 Desktop customization
Customizing desktops

280
280

Customized device desktop

282

Browser Settings for Windows 10 Desktop

282

Using browser settings

282

Browser Settings/Restrictions window

282

MobileIron logs overview

285

Sending a request to the device

285

Viewing a MobileIron Bridge log

286

Removing unwanted applications

286

Using the GPO Editor

287

Adding a Windows 10 GPO

288

Adding an ADMXGPO

288

ADMX file structure289

Disabling a GPO setting

289

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 15

Contents

Printer management289

Adding a shared printer290

Adding a network printer290

MobileIron Bridge reporting

291

Viewing MobileIron Bridge reports

291

Using MobileIron Bridge advanced search

291

Managing Win32 apps

291

Viewing Win32 app information

292

Deploying legacy apps

292

Apply legacy apps to label

293

Removing legacy apps

293

Working with Events

294

About events

294

Events page294

Required role294

Managing events

295

Creating an event

295

Editing an event

295

Deleting an event

295

Ensuring the alert is sent to the correct recipients

296

Applying the event to a label

297

Setting alert retries

297

Setting MobileIron SMS, email, and push notifications

297

Event settings

297

International roaming event settings

298

SIM changed event settings

298

Memory size exceeded event settings

298

System event settings

300

System event field description

300

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 16

Contents

Policy violations event settings

303

Policy violations event field description

304

Device status event settings

308

Customizing Event Center messages

311

Displaying Event Center templates

311

Adding custom Event Center messages

311

Using variables in Event Center messages

313

Variable descriptions

315

Specifying which template to use

316

Filtering Event Center messages

316

Editing Event Center messages

316

Deleting Event Center messages

316

Viewing and Exporting Events

317

Marking as Read or Unread

317

Filtering events

317

Event lifecycle and status

317

Exporting event history

318

Adding a note318

Troubleshooting MobileIron Core and devices

319

About Core logs

319

Audit logs

319

Searching the information in the audit logs

320

Setting event time criteria in audit logs

321

Viewing audit log information

324

Specifying how long log information is saved

324

Audit log information

325

Best practices: label management326

Device events

327

ActiveSync Device information

329

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 17

Contents

MDM events

330

Certificate events

330

App Tunnel events

331

App information

331

Policy information

332

Compliance Action events

332

Configuration events

332

Admin events

333

User events

333

LDAP events

333

Other events

334

Label events

334

Sentry events

334

Custom attributes events

335

Compliance policy events

335

Audit Logs use cases

335

Personal information is wiped from devices

336

Users are prompted for email passwords when not necessary

337

Users are prompted to create passwords

338

Devices have lost their managed apps

338

Viewing Errors

339

Certificate Management339

How to search for certificate entries

339

How to remove a certificate

341

How to revoke a certificate

341

How to re-enroll a SCEP certificate

341

Service Diagnostic tests

342

Running Service Diagnostic tests
Language Support

343
344

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 18

Contents

Translated versions of MobileIron client apps

344

Selecting languages for MobileIron Core messages

344

Setting the system default language

345

Changing language selection from the Admin Portal

346

Self-service User Portal

347

User portal overview

347

Benefits of the user portal

348

Impacts of using the user portal

348

User portal authentication options

349

About registering devices in the user portal

349

Configuring the Per-User Device limit

349

Registration PIN

350

About changing device ownership in the user portal

350

Associating a certificate with a user-provided certificate enrollment setting350

About uploading certificates in the user portal

351

Device management with the user portal

351

Assigning user portal device management roles

352

Customizing the self-service user portal

352

MobileIron user portal default stylesheet

355

Configuring an end user Terms of Service agreement

357

Requiring user portal password change

358

Limiting devices per user by LDAP group membership

359

Editing or Deleting an LDAP group-specific device limit

361

Configuring help desk contact information

361

User portal information for your users

362

Logging in to the user portal with user name and password

363

Logging in to the user portal on a desktop computer with a certificate

363

What users see after they login

364

Welcome menu

364

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 19Contents

If Register Device role is enabled

364

Registration instructions

366

If PIN-based registration is enabled367

If QR-code registration is enabled367

If Change Device Ownership role is enabled368

Uploading certificates in the user portal on a desktop computer369

Viewing, replacing, and deleting certificates in the user portal

370

When a user-provided certificate is deleted

371

Viewing the help desk contact information

371

Viewing device history logs from the self-service user portal

372

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 20

1
New features and enhancements
This guide documents the following new features and enhancements:l

Set Time Zone: The administrator can now set the time zone for one or more devices from within the
Devices Details page using the Actions > Set Time Zone option. The time zone device action is also
displayed in the Device Details page of a device. This feature is applicable to iOS 14.0 and tvOS 14.0
through the latest version as supported by MobileIron. For more information, see Setting the time zone of adevice.

lSend email when using the Wipe or Cancel Wipe command on a device: Administrators now havethe ability to customize or suppress emails that are automatically generated when a Wipe command orCancel Wipe command is sent. This Send Notification of wipe to registered user field is useful for usersthat have multiple devices. The email notification would help prevent confusion to device users who may
think Core is wiping their current, active device. For more information, see Wipe or Cancel Wipe.

l

VPN chapter updated: To make it easier for customers to quickly find information, the Managing VPN
Settings chapter has been revised in full.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 21

2Registering Devices
A device is available for management by MobileIron Core after it has been registered by a device user oradministrator.
The topics in this section include the following advanced topics:l

Registration methodslTerms of servicelInvite users to registerlActiveSync device registrationlManaging operators and countrieslSpecifying eligible platforms for registrationlSetting the registration PIN code length for device user registrationlCustomizing registration messageslConfiguring the default ownership for newly registered deviceslDisabling analytics data collection

Refer to the Getting Started with MobileIron Core for the most commonly used registration topics, such as:lSingle device registrationlBulk device registrationlTracking registration statusl

Restricting the number of devices a user registerslRegistration considerations

Registration methods
Registering a device designates it for management by MobileIron Core.
Before you begin
Setting the registration PIN code length for device user registration
The following registration methods are available:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 22

Admin invites users to registerlAdmin invites users to registerlAdmin registers ActiveSync devices

The process resulting from these methods may vary by device OS.

Admin invites users to register
For users who are mobility savvy and do not require significant assistance, you can send an invitation and enable
them to register their own phones. You can send an invitation to multiple users from the Users Management
screen. The invitation includes instructions on how to log into the user portal to register phones.
NOTE: This does not work for Connected Cloud.
The user needs to know the following information for the device:lphone number (if any)lcountrylplatform

Related topics
Invite users to register

Registration restrictions for Android devices
From the Device Registration page, you can specify conditions that Android devices must meet to qualify forregistration. You can limit Android devices by operating system (OS) version, security patch level, or by
manufacturer and model.
Before you beginlComplete Registration methods.

Procedure
1. From the Settings > System Settings > Users & Devices > Device Registration page, scroll down to
the Restrictions for Android section. Choose from these optional filter settings:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 23

Registration restrictions for Android devices

FIGURE 1. REGISTRATION RESTRICTIONS FOR ANDROID DEVICES

2. Minimum OS version: Select a minimum OS version from the drop-down menu from Android 5.0 through11.0 (or the highest release as supported by MobileIron). The default is None.
3. Minimum Security Patch Level: Enter an integer specifying within how many days a device can be noncompliant for the minimum security patch level before rejecting the device. The default is None.
4. Allowed/Blocked devices list: The options are:l

None: The default. Do not create an Allowed or Blocked devices list.

lCreate a list of Allowed devices: Only allow devices of these makes and models to be registered.

lCreate a list of Blocked devices: Prevent devices of these makes and models to be registered.

To enter specific manufacturers and models, click Add+ to open text fields in the Manufacturer Nameand Model columns. Enter allowed or restricted device information.
5. Click Save.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 24

Users register additional devices

Users register additional devices
Once a device has been registered, an authorized user can use the user portal to register additional devices without
administrative help. This is often used with adding devices for users who do not require assistance.
PrerequisiteslUsers must have the User Portal role assigned, with the Device Registration option enabled.

l

The user needs to know the following information for the device:ophone number (if any)ocountryoplatform

Related topics
Self-service User Portal

Admin registers ActiveSync devices
If you have a MobileIron Sentry configured, then you can see the devices that are connecting to your ActiveSync
server. To incorporate these devices into your MobileIron Core inventory, you can use the Register button in the
ActiveSync Associations screen. This is often used with devices accessing email via ActiveSync.
Prerequisitesll

MobileIron Sentry must be installed and configured.
The user (local or LDAP) associated with the device must be available for selection at the time ofregistration.

l

For iOS, Android, and Windows devices, the User Portal role must be assigned to the user.

l

You need to know the following information for the device:ophone number (if any)ocountry codeoplatform

Related topics
ActiveSync device registration

Terms of service
You can optionally define terms of service text to be displayed to users during:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 25

Creating a terms of service agreementldevice registration on iOS, macOS, Android, and Windows devicesllogging into AppConnect apps on iOS and Android devices

Device users must accept the terms of service before they can continue with registration or with accessing
AppConnect apps.
You can search for users by terms of service acceptance and date of acceptance. You can create one terms ofservice agreement for each supported language. The same terms of service text is used for both registration and
AppConnect app access.
Regarding terms of service during registration:lllPresenting the terms of service is part of the registration process when using Mobile@Work. Users must
accept the terms of service agreement in order to complete registration.
Configuring a terms of service agreement or updating it applies only to users who register after you
complete the configuration. Previously registered users do not accept the terms of service agreement.
However, you can require existing users to accept the terms of service agreement by retiring their devices
and requesting them to re-register.
If both custom terms of service and the privacy policy are enabled, users will have to accept the privacy
policy first.

Regarding terms of service for accessing AppConnect apps:
l

l

l

l

In addition to providing the terms of service text, you must enable terms of service on the AppConnect
global policy.
Also on the AppConnect global policy, you indicate whether:ousers must accept the terms of service each time they are prompted for their AppConnect passcode orbiometric authentication. If you update the terms of service text for a user's language, the user sees
the updated text on all subsequent AppConnect logins.

othe user must accept the terms of service only once. However, if you update the terms of service text
for a user's language, on the next AppConnect login, the user is prompted once more to accept theterms of service.

If you delete the terms of service, but do not disable it on the AppConnect global policy, users continue tobe prompted to accept the terms of service with whatever the last terms of service text was.
For information about enabling terms of service when logging into AppConnect apps, see "Configuring the
AppConnect global policy" in the MobileIron Core AppConnect and AppTunnel Guide for MobileIron Core.

Creating a terms of service agreement
Before you begin
Set up the system default language as described in Setting the system default language .

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 26

Searching for devices by terms of service agreement criteria

If there is no terms of service available in the primary language of a given device, or if more than one agreement isdefined for more than one device language on a device, the terms of service agreement defaults to the systemdefault language.
Procedure
1. In the Admin Portal, go to Settings > System Settings > Users & Devices > Registration.
2. Scroll down to the End User Terms of Service section.
3. Click Add+.
4. Select the language for the terms of service.
5. For Type, select System for iOS, macOS and Android devices. Select AAD enrollment for Windows
devices.
6. Enter the text for the terms of service.
You can adjust the editor to use rich or plain text by clicking the Source Edit icon.
7. Click Save.
8. Optionally, repeat steps 3 through 6 to add a terms of service agreement for each supported language, andfor Windows devices versus iOS, macOS, and Android devices.
Note The Following:l

To edit a terms of service agreement, click the Edit link next to the relevant language.

l

To delete a terms of service agreement, click the Delete button next to the relevant language.

Related topics
Register devices in AAD and MDM

Searching for devices by terms of service agreement criteria
You can search for devices based on whether users have agreed to the terms of service, and the date on whichterms of service were accepted.
The following table describes the searchable criteria related to terms of service. Corresponding fields are displayedon each device's Device Details tab.

TABLE 1. SEARCHABLE CRITERIA FOR TERMS OF SERVICE
Criterion

Description

Terms of Service Accepted

A false value means the user did not accept the terms of service atregistration, which means the device was registered before a terms ofservice agreement was required, or a terms of service agreement wasnever configured.
A true value indicates the device user accepted the terms of service
agreement at registration.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 27

Searching for devices by terms of service agreement criteria

Criterion

Description

Terms of Service Accepted
Date

Filters for the exact time users accepted the terms of service agreement at
registration. This search is useful if you want to locate the version of theterms of service agreement accepted by a specific user for a particulardevice.

AppConnect Terms ofService

The value DECLINED means the user did not accept the terms of service
for using AppConnect, which means the device user logged into
AppConnect before a terms of service agreement was required, or a termsof service agreement was never configured.
The value ACCEPTED indicates the device user accepted the terms ofservice agreement when logging into AppConnect.

AppConnect Terms ofService Date

Filters for the exact time users accepted the terms of service agreement
when logging into AppConnect. This search is useful if you want to locate
the version of the terms of service agreement accepted by a specific user
for a particular device.

Procedure
1. In the Admin Portal, go to Devices & Users > Devices.
2. Click Advanced Search.
3. Add one or more of the search rules regarding terms of service.
a. From the Field drop-down list, select the field of interest:lCommon Fields > Terms of Service Accepted.

lCommon Fields > Terms of Service Accepted Date.

lCommon Fields > AppConnect Terms of Service.

lCommon Fields > AppConnect Terms of Service Date.

b. Provide the appropriate value:lllTerms of Service Accepted: Select true or false in the Select Value field.
Terms of Service Accepted Date: Enter the number of units in the Value field and select theunits (such as days, weeks, or months) in the Date field.
AppConnect Terms of Service. Enter ACCEPTED or DECLINED in the Value field

AppConnect Terms of Service Date. Enter the number of units in the Value field and select theunits (such as days, weeks, or months) in the Date field.
The search criteria you selected are displayed in the search field.
l

4. Click Search.
5. The results are displayed.
6. Optionally, save your search to a label by clicking Save to Label.
7. If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click
Confirm. For more information, see Best practices: label management.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 28

Terms of Service for users

Terms of Service for users
Device users can easily scroll through and accept an administrator-defined terms of service agreement in their web
browser or Mobile@Work client, as in the following example.

FIGURE 2. TERMS OF SERVICE FOR USERS

Invite users to register
This feature is supported on macOS devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 29

Invite users to register

Administrators can invite users to perform self-service registration through the user portal. See Self-service User
Portal for information on this self-service user portal. The administrator sends invitations that provide theinstructions necessary to complete the registration process.
NOTE: Language-specific templates are not currently available for invitations.
See Registration methods for points to consider before using this registration method.
Procedure
1. Go to Devices & Users > Users.
2. Select the type of user accounts you want to work with:a. Select Authorized Users from the To drop-down list to select from local user accounts.
b. Select LDAP Entities from the To drop-down list to select users from the configured LDAP server.
3. Click the check box next to each user you want to invite.
4. Click Actions and then click Send Invitation.

5. Review the default text for the invitation and make any changes.
The text is displayed here with HTML markup. The user will receive the formatted version.
6. Click Send.
What the user sees
This registration method results in user notification via email. The email contains instructions for registering
devices via the user portal. See Self-service User Portal for information on what the user is expected to do tocomplete the registration process.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 30

ActiveSync device registration

ActiveSync device registration
The ActiveSync view displays the devices that are accessing ActiveSync. This view is populated only if you havea MobileIron Sentry configured. From this view, you can decide to register selected devices.
See Registration methods for points to consider before using this registration method.
Procedure
1. Go to Devices & Users > ActiveSync.
2. Select a device to be registered.
3. Click Actions > Register.
4. See “Single device registration” in the Getting Started with MobileIron Core for instructions oncompleting the registration process.

Managing operators and countries
MobileIron provides a default list of operators for users to select from during registration. You can enable or disable
operators to determine whether they appear in the list of operators displayed during registration of US devices andother devices having a country code of 1.
For non-US devices, country selection is an important part of the registration process. MobileIron also provides adefault list of countries enabled for registration purposes. You may need to adjust this list to enable additionalcountries.
This section explains how to customize displayed operators and countries.

Enabling operators
Enabling an operator displays it in the list of operators presented to users during registration.
Procedure
1. In the Admin Portal, go to Services >Operators. By default, the Operators screen shows only Enabled
operators.
2. Select Disabled or All from the Status drop-down.
3. Click the check box next to each operator you want to enable.
4. Click Actions > Enable.

Enabling additional countries for registration
A subset of countries are enabled for device registration by default. You should check this list and determine if anyof your users have home countries not represented in the default list.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 31

Disabling operators

Procedure
1. In Admin Portal, go to Settings > System Settings > Users & Devices > Registration.
2. Scroll to the Countries for Registration section.
3. Select countries from the Disabled Countries list.
4. Click the arrow button to move them to the Enabled Countries list.
5. Click Save.

Disabling operators
Disabling an operator removes it from the list of operators presented to users during registration.
Procedure
1. In the Admin Portal, go to Services >Operators.
2. By default, the Operators screen shows only Enabled operators.
3. Click the check box next to each operator you want to disable.
4. Click Actions > Disable.

Filtering operators
You can use filters to display only those operators you want to work with in the Operators screen. You can:l

Search for a specific operatorlDisplay operators by countryl

Display operators by status

Searching for an operator
Procedure
1. Enter a portion of the operator’s name in the Search by Name field.
2. Click the search icon to display the matching operators.
3. Click the x that appears in the search field to return to the default display.

Displaying operators by country
To narrow the list of operators by country, select a country from the Country drop-down list.

Displaying operators by status
To display operators by status, select from the Status drop-down list. The following options are available:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 32Specifying eligible platforms for registrationlEnabledlDisabledlAll

Specifying eligible platforms for registration
In some cases, you may want to exclude from registration all devices of a particular platform. For example, if
corporate policy dictates that a particular device platform will not be supported, you may want to prevent users fromselecting the platform during self registration. Likewise, you may want to prevent help desk personnel frommistakenly registering the unsupported platform in the Admin Portal.
Procedure
1. In Admin Portal, go to Settings > System Settings > Users & Devices > Registration.
2. Scroll to the Platforms for Registration section.
3. In the Enabled Platforms list, select the platform you want to exclude.
Shift-click platforms to select more than one.
4. Click the left arrow button to move the selected platforms to the Disabled Platforms list.
5. Click Save.
All methods of registration now exclude the selected platforms.

Setting the registration PIN code length for device user
registration
This feature is supported on Android, iOS and macOS devices.
By default, device users must enter a password to register a device. You have the option to require a MobileIrongenerated Registration PIN in place of or in addition to the password.
Procedure
1. In Admin Portal, go to Settings > System Settings > Users & Devices > Registration.
2. Select a Registration PIN code Length, which is the minimum length for the PIN (6-12 characters).
3. Click Save.
For setting Android registration authentication, see Registration methods.
For iOS and macOS registration authentication, see Registering iOS and macOS devices through the web

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 33

Limit for failed attempts to enter a registration password

Limit for failed attempts to enter a registration password
After the sixth failed attempt to enter a registration password, MobileIron Core locks the device user’s account for
30 seconds. The device user sees a message stating that the account is locked and will be released after the
specified interval.

PIN-based authentication for all available Windows devices
If only PIN registration is enabled, password is not required. However you will be asked to enter your email during
registration.
If the user removes the MobileIron account from the Windows device, a new PIN is required to re-register thedevice.
If the PIN expires you must first retire the device in the Admin Portal, then re-register the device. This generates a
new PIN. Re-provisioning is not supported (Devices & Users > Devices > Action > Actions > Re-provision
Device).
The User Portal role is required even if PIN registration is configured.

Customizing registration messages
This feature is supported on iOS, macOS, Windows, and Android devices.
The registration process is a critical part of deployment. You can customize the registration messages involved inthis process by editing the registration templates. Registration templates enable you to specify content and basic
formatting using HTML markup.
MobileIron sends multiple messages related to registration:lregistration SMSlregistration email and reminder emaillpost registration email

These messages may vary by:lplatformllanguage

In addition, messages may vary by device type:lphonesl

PDAs

To accommodate this range of messages:
MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 34

Viewing registration templatesl

Separate registration templates are provided for each language/platform combination.

lEach registration template contains separate text for each registration message type.

l

Each registration template contains separate text for phones and PDAs.

l

For when Core discovers device users that have not downloaded the MDM profile, reminder email
scheduling capabilities are provided

Viewing registration templates
To view MobileIron message templates:
1. In Admin Portal, click Settings > Templates.
2. Select Registration Templates.
3. Click the View link for the template you want to view.

Editing registration messages
To edit registration messages:
1. In Admin Portal, select Settings > Templates > Registration Templates.
2. Select the template you want to edit and click the Edit pencil icon.

Registration messages are displayed with the HTML markup that provides the basic formatting for thecontent.
3. Make changes to the displayed registration messages.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 35

Using variables in registration messages

NOTE: Do not add the <head> html tag in the registration template fields.

4. Click the Variables Supported link in the right corner of the dialog box to display a guide to the supported
variables. See Using variables in registration messages on page 36 for additional details.
5. Click Save.
Next steps
Customizing registration messages

Using variables in registration messages
Each field in a registration template has a set of supported variables, most of which are required. Supported andrequired variables also differ by OS. Use the following variables to guide your customization. You can also click the
Variables Supported link to display this information. All variables except $BRANDING_COMPANY_NAME$
are also required in the specified field.

Registration message variables
The following table gives the of variables used in types of registration messages.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 36

Variables used inside registration messages

TABLE 2. VARIABLES USED IN DIFFERENT TYPES OF REGISTRATION MESSAGES
Type

Supported Variables

Registration SMS (Phones)$REG_LINK$

Registration Email
Subject (Phones)$ENT_NAME$, $USER$, $PHONE$

Subject (PDAs)$ENT_NAME$, $USER$, $PHONE$

Body (Phones)$ENT_NAME$, $BRAND_COMPANY_NAME$, $PHONE$,$PASSCODE$, $PASSCODE_TTL$, $REG_LINK$

Body (PDAs)$PASSCODE$, $PASSCODE_TTL$, $REG_LINK$

Reminder Subject (Phones)$ENT_NAME$, $USER$, $PHONE$

Reminder Subject (PDAs)$ENT_NAME$, $USER$, $PHONE$

Reminder Body (Phones)$ENT_NAME$, $BRAND_COMPANY_NAME$,$PHONE$,$PASSCODE$, $PASSCODE_TTL$, $REG_LINK$

Reminder Body (PDAs)$PASSCODE$, $PASSCODE_TTL$, $REG_LINK$

Post-Registration Email
Subject (Phones)$BRAND_COMPANY_NAME$, $USER$, $PHONE$

Subject (PDAs)$BRAND_COMPANY_NAME$, $USER$, $PHONE%

Body (Phones)$BRAND_COMPANY_NAME$, $PHONE$

Body (PDAs)$BRAND_COMPANY_NAME$, $PHONE$

Variables used inside registration messages
The following table gives the description of variables used inside registration messages.

TABLE 3. DESCRIPTION OF VARIABLES IN REGISTRATION MESSAGES
Variable

Description$BRAND_COMPANY_NAME$

An internal variable.

$ENT_NAME$

The name of the organization using MobileIron Core to secure thedevice. See the field EnterpriseName in Settings > System
Settings > General > Enterprise.

$INAPP_REG_STEPS$

Combines $SERVER_URL$, the user’s LDAP password,$PASSCODE$, and $USER_ID$.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 37

Filtering registration messages

TABLE 3. DESCRIPTION OF VARIABLES IN REGISTRATION MESSAGES (CONT.)
Variable

Description$PASSCODE$

The registration PIN generated for the device by Core.

$PASSCODE_TTL$

The number of hours that the registration PIN remains valid. See
the field Passcode Expiry in Settings > Systems Settings >Users & Devices > Registration.

$PHONE$The phone number associated with the device.

$REG_LINK$The URL that users access to complete the registration process(i.e., https://server name:port/v/passcode for Windows and otherplatforms).

$SERVER_URL$

The MobileIron Core server address used for registration.

$USER$The name of the user associated with the device, as displayed in
MobileIron Core.

$USER_ID$

The user ID for the user associated with the device, as defined in
the user account on Core.

Filtering registration messages
In the Registration Templates page, you can filter registration messages by:llanguagelplatform

Procedure
1. If you want to restrict the templates displayed based on language, select the preferred language from theLanguage list.
2. If you want to restrict the templates displayed based on device platform, select the preferred platform fromthe Platform list.

Restoring registration messages to default content
To restore a registration message to the default content provided by MobileIron:
1. In the Settings > Registration Templates page, select the template you want to restore.
2. Click Restore to Factory Default.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 38

Configuring the default ownership for newly registered devices

Configuring the default ownership for newly registered devices
By default, all newly registered devices are configured as company-owned. You can change this default setting toemployee-owned (and back) on the Registration page.
Alternatively, you can change the ownership of a device after registration by:llselecting More > Change Ownership in the User Portal. For more information, see About changing
device ownership in the user portal on page 350.
selecting Devices & Users > Devices > Actions > Change Ownership in MobileIron Core.

Procedure
1. In MobileIron Core, go to Settings > System Settings > Users & Devices > Registration.
2. For the Default ownership for a newly registered device setting, select the relevant radio button:
Company owned
OR
Employee owned
3. Click Save.

Disabling analytics data collection
MobileIron collects data to analyze the use of MobileIron Core to help us provide customer support, perform bug
fixes, improve product functionality and reliability and fulfill obligations to our customers. You can view details
about data collected in our product privacy notice: https://www.mobileiron.com/en/legal/product-privacy.
The data is collected from:l

Mobile@Workl

Apps@Work

Procedure
1. In MobileIron Core, go to Settings > System Settings > General > Analytics.
2. Select the Disable data collection from Mobile@Work and Apps@Work check box.
3. Click Save. A confirmation dialog opens.
4. Click Yes to confirm or No to cancel and allow analytics data collection.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 39

3
Searching for Devices
The Devices page in the Admin Portal, offers both basic and advanced searching features. The basic searchfeatures provide a way to find devices or users using a limited set of criteria. The Advanced search features allow
you to create complex search queries using the full set of available criteria. You can also apply advanced search
criteria to a new or existing/unassigned or existing/unused label.
The topics in this chapter include the following advanced topics:l

Basic searchinglAdvanced searchinglUsing the query builderlUsing a manually edited search expressionlUsing both the query builder and manual editingl

Negative operators with advanced searchlClearing an advanced searchlSearching for retired deviceslSearching for blocked devicesl

Saving a search criterion to a label

Refer to the Getting Started with MobileIron Core for the most commonly used topics for managing devices, suchas:lUsing the DashboardlCreating custom attributeslDeleting retired devices

Basic searching
You can quickly search for devices based on the following criteria:
l

Label

l

User Principal/IDl

User Email AddresslUser First/Last Name

To search by label, you can:MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 40

Advanced searchinglselect the appropriate label name from the Labels list.

lenter the initial letters of the label name in the Labels list.
The list changes to show only label names containing the letters you entered.

FIGURE 3. SEARCH BY LABEL

To search by the other criteria, select any label in the Labels list then use the following syntax in the Search byUser or Device field:luid:<User Principal/ID>

lmail:<User Email Address>l

name:<User First/Last Name>

NOTE: The prefixes mail: and name: are optional. All others are required. For example, to find thedevices registered with the email address jdoe@mobileiron.com, you can enter the following:
mail:jdoe@mobileiron.com
or justjdoe@mobileiron.com

Advanced searching
As data sets get larger, it is increasingly important to have a powerful search. You can use advanced search tobuild complex queries using the full set of available criteria. You can also create a new label using the advanced
search criteria.
To access advanced search:
1. Log into the Admin Portal.
2. Go to Device & Users > Devices.
3. Click the Advanced Search button located at the top right, above the table to display the query builder.
4. Enter search criteria using the query builder, or type the search expression directly. See Device fielddefinitions.
5. Click Search. Verify your results.
6. (Optional) Click Save to Label button. This will save your new search query as a new label and in Devices& Users > Labels, you can utilize this new label as a filtered label.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 41

Searchable fields

7. If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click
Confirm. For more information, see Best practices: label management.

Searchable fields
To see the complete list of searchable fields in the query builder:
1. Click Field to see the categories
2. Click Expand All.
The fields are organized alphabetically into the following categories for convenience:l

Device fields: apply to device type based on their operating system.

lOS-specific fields: apply to devices of the selected platform.

lUser fields: apply to the device’s user, including LDAP fields for groups and custom attributes.

Device field definitions
This section covers the device field definitions found in the Devices & Users > Devices page. They also display
in the Advanced Search field on the same page.

TABLE 4. DEVICE FIELD DEFINITIONS
Device Type

Field

Description

Android Fields

Admin ActivatedTrue / false if device activated by admin.

Android AutomatedEnrollment

Once automated Android registration is completed, thefollowing values display:• Google Zero Touch• Knox Mobile Enrollment• Non Zero Touch AE Enrollment - this is for Managed
Devices / Device Owner types (afw#, QR code, NFC)
• Unknown - this value displays if versions before Core
10.6.0.0 were used. This means the "In-App Registration
Requirement field in Settings > System Settings > Users& Devices > Device Registration was used. It can alsomean that an old client was used with Core version
10.6.0.0 or later.

(This field is valid forCore 10.6.0.0 through thelatest version as
supported by MobileIron.)

Android Client Version
Code

Version code of the client.

Android for WorkCapableTrue if the device is Android enterprise capable, otherwise
false.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 42

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Attestation

Result of Samsung Attestation.

Brand

Brand of the device.

C2DM Token

C2DM token of the device if present, otherwise blank.

Code Name

Code name of the Mobile@Work client

Developer Mode

True if the Android device has Developer mode enabled,
otherwise false. This is reported on all Android device
configurations and also on KNOX.

DeviceBrand name of device, for example, Mako.

Device Encryption
StatusDevice encryption status.

Device Roaming Flag

True if the device is roaming, otherwise false.

File encryption

True if the Android device has enabled file encryption,otherwise false. This is reported on all Android device
configurations and also on KNOX.

GCM/FCM Token
Present

GCM token of the device if present, otherwise blank.

Google Device AccountPresent

True if the device has a Google Device Account (eg: Android

ICCID

Integrated Circuit Card Identifier number.

Kiosk EnabledTrue if the device is kiosk enabled, otherwise false.

Manufacturer OS Version

Manufacturer OS version.

MDM EnabledTrue if MDM is enabled, otherwise false.

Media Card Capacity

Amount of memory capacity of the media / SD card.

Media Card Free

Amount of free memory on the media / SD card.

Multi MDM

Indicates true/false.

OS API Level

The Android OS API level. See

enterprise), false otherwise.

https://developer.android.com/studio/releases/platforms formore details.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 43

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description
This number is used so administrators can use a numericalcomparison of OS versions.

OS Build Number

OS build number.

OS Update Path

OS Update Path.

OS Update Status

OS Update Status.

OS Version

Lists the OS version of the device.

Password/PIN Days

Represents the number of days before the password / PIN

Before Expiring

will expire. This numerical value is controlled by the Security
policy's Maximum Password Age field value. This field is a
dynamic field, its value decreases every day by 1 until the
password / PIN is renewed. At renewal, the value returns to
the original number stated in the Maximum Password Agefield and starts a new daily count-down. See Working withdefault policies.

Platform Flags

Internal string representing the capabilities of the
Mobile@Work application.

Registration Status

Registration status of the device. Registration Status can beused as part of a dynamic label evaluation and criteria for tiercompliance.
In the Select Type drop-down, select one of these options:
•
•
•
•
•
•
•

Device Admin
Device Admin Not Required
Work Managed Device
Managed Device with Work Profile
Work Profile
Work Profile for Company Owned Device
Unknown

SafetyNet EnabledTrue if SafetyNet is enabled, false otherwise.

SafetyNet Exception

SafetyNet exception during error.

SafetyNet Status

SafetyNet status if enabled and no error.

SafetyNet Timestamp

Timestamp of when last SafetyNet check was run.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 44

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Samsung Carrier CodeSamsung Carrier code.

Samsung E-FOTA
CapableTrue if the device supports Samsung E-FOTA, false

Samsung KNOX Version

Knox version, if present.

Samsung Model Number

Samsung Model Number.

Samsung SAFE Version

Samsung Safe Version.

Screenlock PIN Change

Indicates if device user was prompted to change the device's

Prompt – Showing

screen lock password / PIN and the device user skipped theotherwise.

prompt. Values are:•••Unknown - If coming from an older client device, value is
unknown.
True - Indicates the PIN is to expire in 7 days or less.
False - (default) Indicates the device user is not being
prompted to change the password / PIN (it has notreached its 7-day expiration window.)

The value listed stays until the device user successfullychanges the password /PIN on the device. See Working withdefault policies.
Secure Apps EnabledTrue if Secured Apps / AppConnect is enabled, otherwise
false.

Secure Apps Encryption
Enabled

True if Secured Apps Encryption is enabled, otherwise false.

Secure Apps Encryption
ModeType of Secured Apps / AppConnect Encryption.

Security Detail

Reason for security failure if it occurs.

Security Patch Level

Security Patch Level string or timestamp.

Security Patch Level
Date

Date of the Security Patch Level of the OS.

Security Reason

Reason device is considered jailbroken.

USB Debugging

True if USB debugging is enabled, otherwise false.

Wear OS Client installed

True only if one or more paired-watches have Mobile@Work
installed on the Wear OS device.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 45

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Wear OS Device isPairedTrue if one or more Wear OS device is paired to device via
Bluetooth.

Zebra Build Fingerprint

Fingerprint of the firmware build currently present on the Zebra
device.

Zebra Device Build Id
Zebra Device System
UpdateCurrent Build ID of the Zebra device.
l

l

l

l

l

Zebra OTA Capable

Unknown - Not supported by client or OS version
Current - The most current update is installed.
Applicable to Android 8 through the most recently
released version as supported by MobileIron.
Applicable to Zebra 6 through the most recently
released version as supported by MobileIron.
Pending - The client has accepted a system update
configuration, but the update is not yet downloaded or
installed. Applicable for Zebra 6 through the mostrecently released version as supported by MobileIron.
Downloading - An update is being downloaded.
Applicable for Zebra 6 through the most recently
released version as supported by MobileIron.
Available - An update is available (Android 8 throughthe most recently released version as supported by
MobileIron) or downloaded (Zebra 6 through the mostrecently released version as supported by MobileIron)
but is not yet installed.

True if the device supports Zebra OTA (Over The Air),otherwise false.

Zebra Patch Version

The version of firmware for the Zebra device to be upgraded
to. This is the target firmware version of the firmware applied
to the Zebra device through firmware policy.

CommonFieldsAPNS Capable

Only true if there is an APNS token for the Mobile@Work
client, otherwise false.

AppConnect Term s ofServiceTrue/false for if the AppConnect Terms of Service was

AppConnect Terms ofService Date

Represents the date/time the AppConnect Terms of Service

accepted.

was accepted.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 46

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Authenticator Only

True/false if the device is registered in Authenticator Only
mode.

Azure Client Status

Indicates whether device is connected to Azure. The possible

Codevalues are:l

Success - Able to retrieve device ID.

lInternal_Error - An unrecoverable error occured either
within the client or on server side.

lWorkplace_Join_Required - Registration of device
required. Device user can mitigate this status.

lInteraction_Required - An interactive log-in isrequired. Device user can mitigate this status.

lServer_Declined_Scopes - Some scopes were notgranted access to.

lServer_Protection_Policies_Required - The
requested resource is protected by an Intune
Conditional Access policy.

lUser_Canceled -The device user cancelled the web
Auth session by tapping the "Done" or "Cancel"
button in the web browser.

l

Account_logged_out - Account logged out.

Azure Device

Lists the device's compliance status in Azure. Possible

Compliance Reportvalues are:

Statusl

In-progresslSuccessfullFailedAzure Device

The time Core reported the device compliance status toCompliance Report Time

Microsoft Intune. A blank field indicates the device data or
status is not reported to Microsoft. It could be:lbecause that feature is disabledlCore just received the data and has yet to call theMicrosoft API

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 47

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Descriptionlthere is an error such as user_Cancelled or Internal
Error so server will not report the device to Microsoft

Azure Device

Indicates Azure account has been deactivated or the device

Compliance Status

is not in compliance. Possible values are: Compliant / Not
Compliant.

Azure Device Identifier

The device ID reported by Microsoft to the iOS or Android
device. For example: 007c8232-9489-4074-9b35345b16f0a72d. This is Microsoft’s ID for that device. Core
receives this device ID as device users are required toregister to Microsoft Authenticator application in order to use
this feature.
If unable to retrieve the Device ID, this field is left blank.

Background Status

True if iOS background status is enabled, otherwise false.

Battery Level

Percentage of battery left.

Block Reason

A list of reasons why the device is blocked.

Blocked

True if the device is blocked, otherwise false.

Cellular Technology

GSM, CDMA, or blank if the device does not support cellular.

Client Build Date

The build date of the client, if registered with Mobile@Work
client.

Client Id

The unique client ID if the device was registered with
Mobile@Work client.

Client Last Check-in

Date/Time of last check-in.

Client Migration Status

Status of Mobile@Work client migration from Core to Cloud(true/false).

Client Name

The name of the client, if registered with Mobile@Work client.

Client Version

The version of the client, if registered with Mobile@Work
client; otherwise, false.

Cloud Migration Status

Status of device migration from Core to Cloud (true/false).

Comment

A field that the admin uses to add their own comments for thedevice.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 48

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

CompliantTrue if the device is in compliance, otherwise false.

Creation Date

The creation date of this device record.

Current Country CodeCurrent country code of the device.

Current Country Name

Current country name of the device.

Current Operator Name

Short name of the cellular carrier, if there is a cellular service.

Current Phone Number

Current phone number of device, if the device has cellular
service.

Device Admin EnabledTrue if device admin (Android) is enabled, otherwise false.

Device Encrypted

True if the device is encrypted, otherwise false.

Device is Compromised

True if the device is compromised, for example, jailbroken.

Device Locale

Locale of the device.

Device Owner

Company or Personal.

Device Space

Name of the space the device belongs to.

Device UUID

Unique ID of the device generated from Core.

Display Size

Size of device's display.

EAS Last Sync Time

Exchange ActiveSync last sync time.

Ethernet MAC

Ethernet MAC ID.

Home Country CodeHome (Initial) country code of the device.

Home Country Name

Home country name of the device.

Home Operator Name

Home Operator Name.

Home Phone NumberHome Phone Number.

IMEI

IMEI (International Mobile Equipment Identity) number.

IMSI

ISMI (International Mobile Subscriber Identity) number.

IP Address

Current IP address of the device.

Language

Language of the device.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 49

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Last Check-in

Last check-in time of the device.

Manufacturer

Manufacturer of the device.

MDM Last Check-in

Last MDM check-in time of the device.

MDM Managed

True if the device is MDM managed, otherwise false.

Memory Capacity

Memory capacity of the device.

Memory Free

Amount of free memory in the device.

MobileIron Threat
Defense Status

MobileIron Threat Defense Status.

MobileIron Tunnel App
Installed

True / false if the MobileIron Tunnel app was installed.

Model

Model of the device.

Model Name

Model name of the device.

Modified Date

Date/Time for last updates to device details.

MTD Anti-Phishing
StatusMTD Anti-Phishing Status.

Non-compliance Reason

Reason why the device is not in compliance.

OS Version

OS version number string.

Passcode

Contains registration PIN for a preregistered device, empty ifnone exists.

Passcode ExpirationTime

The expiration time for the registration pin for a prereigstered

Platform

Operating system of the device.

Platform Name

Operating system and OS version of the device.

Processor Architecture

Architecture of the processor for the device.

Quarantined

True if the device is quarantined, false otherwise.

Quarantined Reason

Reason for quarantined, empty if the device is notdevice, empty if none exists.

quarantined.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 50

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device TypeiOS Fields

Field

Description

Registration Date

Registration date of the device.

Registration IMSI

Registration of ISMI (international mobile subscriber identity)
number.

Registration UUID

Unique ID when registering from the client.

Retired

True if the device is retired, otherwise false.

Roaming

True if the device is roaming, otherwise false.

SD Card Encrypted

True/faise if SD card is encrypted.

Security State

Security state of the device.

Serial Number

Serial number of the device.

StatusStatus of the device.

Storage Capacity

Total storage capacity, in bytes, of the device.

Storage Free

Number of bytes of free storage on the device.

Terms of Service
Accepted

True if the End user Terms of Service was accepted,

Terms of Service
Accepted Date

Date for when the End User Terms of Service was accepted,

Wi-Fi MAC

Wi-FI MAC address of the device.

Activation Lock Bypass
Code

Code to bypass activation lock.

Activation Lock is
Enabled

True if Activation Lock is enabled on the device, otherwise

APNS Token

Mobile@Work client APNS wakeup token. Applicable to iOS.

Apple Device Mac
Address

iPhone (media access control address) MAC address.

Apple Device Version

iPhone version code. Applicable to iOS and OS X.

Apple OS Update
Product Key

Available OS update product key. Applicable to iOS andotherwise false.

otherwise blank.

false. Applicable to iOS.

Applicable to iOS and OS X.

macOS.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 51

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Apple OS Update
Product Version

Available OS update product version. Applicable to iOS andmacOS.

Apple OS Update Status

OS update status. Applicable to iOS and macOS.

Bluetooth MAC

Bluetooth MAC address. Applicable to and OS X.

Build Version

MDM build version. Applicable to iOS and OS X.

Carrier Settings Version

Carrier settings version. Applicable to iOS.

Current Mobile Country
Code

Current mobile country code. Applicable to iOS.

Current Mobile Network
Code

Current mobile network code. Applicable to iOS.

Data Protection

Applicable to iOS.

Data Roaming EnabledTrue if device is data roaming enabled, otherwise false.
Applicable to iOS.

DEP Device

True if the device is Apple Device Enrolled, otherwise false.
Applicable to iOS, macOS, and tvOS.

DEP Enrolled

True if the device is Apple Device Enrolled, otherwise false.
Applicable to iOS.

Device Locator Service
is EnabledTrue if device locator service is enabled, otherwise false.

Device Name

Name of the device. Applicable to iOS and OS X.

Do Not Disturb is in
EffectTrue if Do Not Disturb is enabled, otherwise false. Applicable
to iOS.

Force Encrypted Backup

True if backups are forced to be encrypted, otherwise false.

Applicable to iOS.

Applicable to iOS.
Full Disk Encryption
Enabled

True if full disk encryption is enabled, otherwise false.

Full Disk Encryption Has
Institutional Recovery
Key

True if full disk encryption has institutional recovery key,

Full Disk Encryption Has
Personal Recovery Key

True if full disk encryption has personal recovery key,otherwise false. Applicable to macOS 10.9+.

Applicable to macOS 10.9+.

otherwise false. Applicable to macOS 10.9+.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 52

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

Hardware Encryption
Caps

Hardware encryption capabilities. Applicable to iOS.

iCloud Backup is
Enabled

True if Cloud backup is enabled, otherwise false. Applicable

iOS Background Status

True if iOS background status is enabled, otherwise false.
Applicable to iOS.

iOS ICCID

Device's integrated circuit card identifier number. Applicable

to iOS.

to iOS.
IT Policy Result

Applicable to iOS.

iTunes Store Account
Hash

iTunes Store Account Hash.

iTunes Store Account is
ActiveTtrue if iTunes Store Account is active, otherwise false.
Applicable to iOS.

Languages

Language of the device. Applicable to tvOS.

Last Acknowledged LockPIN

PIN to unlock a locked macOS device. Applicable to macOS.

Last Acknowledged
Wipe PIN

PIN to proceed after wiping a macOS device. Applicable toLast iCloud Backup Date

Last iCloud backup date. Applicable to iOS.

Last MTD Sync Time

Last MTD check-in time. Applicable to iOS.

Locales

Locale of the device. Applicable to tvOS.

macOS User ID

macOS user ID. Applicable to OS X.

macOS User Long NamemacOS user's long name. Applicable to OS X.

macOS User Short
Name

macOS user's short name.Applicable to OS X.

Maximum Resident
Users

Only for use with iOS Education Shared iPads. Tells themacOS.

device how many users will have their data cache on thedevice. When the device reaches this number, the next
logged-in user that is not already present will be cached andone of the cached users will be removed from the cache (up toApple which user.) Applicable to iOS.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 53

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

MDM Lost Mode EnabledTrue if MDM Lost Mode is enabled, otherwise false.
Applicable to iOS.

MDM Service Enrolled

True if the device is was enrolled via MDM Service (non-overair Apple Device Enrollment), otherwise false. Applicable to
iOS.

MEID

Mobile Equipment Identity Number.

Modem Firmware
Version

Modem firmware version. Applicable to iOS.

Network Tethered

True if the device was reported as currently network tethered,otherwise false. Applicable to macOS.

Organization Info

Organization for the device. Applicable to iOS.

Passcode Compliant

True if passcode is in compliance, otherwise false. Applicable
to iOS.

Passcode Compliant
with Profiles

True if passcode is compliant with rules specified from

Passcode Present

True if Passcode is present on device, otherwise false.

profiles. Applicable to iOS.

Applicable to iOS.
Personal Hotspot
Enabled

True if Personal Hotspot is enabled, otherwise false.

Product CodeiPhone Product code. Applicable to iOS and OS X.

Product Name

Product name. Applicable to iOS and OS X.

Security Reason Code

Security reason code. Applicable to iOS.

SIM Label 1, 2, 3

SIM label associated to the phone number.

SIM MCC 1, 2, 3

SIM card mobile country code associated to the phone
number.

SIM MNC 1, 2, 3

SIM card mobile network code associated to the phone
numberSIM Phone Number 1, 2,
3

The phone number associated with the SIM card / eSIM.

SIM EID 1, 2, 3

The SIM ID of the carrier assigned to the SIM of a specific

Applicable to iOS.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 54

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description
device. The EID will be included in the response of thesimdetails API call. (For more information, see the

MobileIron Core V2 API Guide.)
In the Device Details page, clicking on the number in the field
opens the SIM Information dialog box allowing theadministrator to see SIM information, including the EID.
Applicable to iOS 14.0 through the latest version of
MobileIron.
SIMs

•
•
•

User Fields

Lists the number of SIMs associated to the device. This
includes embedded SIMs (eSIM) and physical SIMs.
There can be multiple SIMs associated with the eSIM.
For eSIMs in iPhone XS, iPhone XS Max, or iPhone XR
with iOS 12.1 or later through the most recently released
version as supported by MobileIron.

Subscriber Carrier
Network

SIM card subscriber carrier network. Applicable to iOS.

Subscriber MCC

SIM card mobile country code. Applicable to iOS.

Subscriber MNC

SIM card mobile network code Applicable to iOS.

Supervised

True if the device is MDM supervised, otherwise false.
Applicable to iOS.

Time Zone

Lists the time zone applied to the device.

UDID

iPhone unique device identifier. Applicable to iOS and OS X.

Voice Roaming EnabledTrue if voice roaming is enabled, otherwise false. Applicable
to iOS.

VPN IP Address

VPN IP address. Applicable to iOS and tvOS.

Wakeup Status

Device Wakeup status.

Display Name

The display name of the device user.

Email Address

Device user's email address.

First Name

Device user's first name.

Last Admin Portal Login
Time

Date of admin's last log in into Core.

Last Name

Device user's last name.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 55

Device field definitions

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

LDAP > Attribute
Distinguished Name

The Attribute Distinguished Name for an LDAP user.

LDAP > Groups >LDAP GroupDistinguished Name

LDAP Users who are members of an LDAP group with a
specific group distinguished name.

LDAP > Groups > Name

LDAP Users who are members of an LDAP group with a
specific group name.

LDAP > LDAP User
Distinguished Name

The LDAP distinguished Name of the user.

LDAP > LDAP User
LocaleAn LDAP User who are members of a specific locale.

LDAP > Principal

Value of the attribute specified as the User ID in the LDAP
server configuration.

LDAP > upn

Value of the attribute specified as the User Principal Name in
the LDAP server configuration.

LDAP > User AccountControl > AccountDisabled

Indicates whether the LDAP user account is disabled(true/false).

LDAP > User AccountControl >Indicates whether the LDAP user account is locked out(true/false).

Locked Out
LDAP > User AccountControl >Indicates whether the LDAP user 's password has expired(true/false).

Password Expired
LDAP > User Attributes>

The value of the LDAP user attribute is defined in Services >LDAP.

custom1
LDAP > User Attributes>

The value of the LDAP user attribute is defined in Services >LDAP.

custom2
LDAP > User Attributes>

The value of the LDAP user attribute is defined in Services >LDAP.

custom3

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 56

Using the query builder

TABLE 4. DEVICE FIELD DEFINITIONS (CONT.)
Device Type

Field

Description

LDAP > User Attributes>

The value of the LDAP user attribute is defined in Services >LDAP.

custom4
LDAP > User Attributes>

The value of the LDAP user attribute is defined in Services >LDAP.

memberOf
SAM Account Name

The security account name. This was the login name forearlier versions of Windows.

User ID

The LDAP user ID.

User UUID

The LDAP Universally Unique Identifier.

For Windows field definitions, see https://docs.microsoft.com/en-us/windows/clientmanagement/mdm/healthattestation-csp.

Using the query builder
To use the query builder:
1. Select a field on which to search. Hint: you can type a few letters of the field name to see a short list ofmatching fields, or press Expand All within the field list to see all the fields.
For example, if you select Status, the search engine provides only values available for Status.
2. Select an operator, such as Equals.
3. Click in the Value field to enter a value you want to search.
4. Some fields have predetermined values that you can select.
5. Select additional fields and criteria as needed.
6. Click All to combine the criteria with a logical AND or click Any to combine the criteria with OR.
7. Click Search to display the matching devices and their owners.
NOTE: To include retired devices in the results, uncheck the check box to the left of the Search button.

Using a manually edited search expression
To enter a search expression directly into the expression field:
1. Type or paste the search criteria into the expression field. The automatic syntax check displays a status
icon next to the expression field. A green icon indicates that the syntax is correct, and a red icon if

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 57

Using both the query builder and manual editing

incorrect.
2. When the syntax is correct, click Search to display the matching devices and their owners.

Using both the query builder and manual editing
Use the query builder to start an expression, look up field syntax, and select predetermined values. Then, edit theexpression directly as needed.
1. Select fields and criteria.
2. Click All to combine multiple criteria with a logical AND or Any to combine multiple criteria with OR. You
can manually edit individual logical operators in the expression field.
3. In the expression field, edit the expression directly.
4. For example, you can add parentheses, change logical operators, or manually edit field names or values.
5. The automatic syntax check displays a status icon next to the expression field. A green icon indicates thatthe syntax is correct, and a red icon if incorrect.
6. When the syntax is correct, click Search to display the matching devices and their owners.
Once you manually edit the expression, the query builder is covered with a gray box to indicate it no longer
represents the current state of the expression. Click the Reset link to remove your manual edits and continue using
the query builder.
Example: Find all iOS or Android devices that use AT&T as their service operator.

FIGURE 4. SERVICE OPERATOR IN QUERY BUILDER

Build the expression to match the above example.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 58

Using both the query builder and manual editing

1. Click Advanced Search to open the query builder.
2. Select Platform in the first field, select Equals for the operator, then select iOS as the platform.
3. Click the plus icon to add another row for criteria.
4. Select Platform, Equals, and Android as the field, operator, and platform value, respectively.
5. Click the plus icon to add a third row for criteria.
6. Select Home Operator Name for the field and Equals for the operator.
Notice that the value field adjusts automatically to display service operator values by country.
7. Accept the first value field and select AT&T in the second value field.
Manually edit the expression.
1. Replace the first AND with OR.
The syntax is checked automatically as you type. Note a red icon indicating incorrect syntax while you edit
the expression.
2. Add parentheses around the phrase to read:("common.platform" = "iOS" OR "common.platform" = "Android") AND“common.home_operator_name” = “ATT&T”

Note a green icon indicating correct syntax has replaced the red icon. Your advanced search will look thesame as the original image (see below).

To revert to the original expression without your manual edits, click the Reset link to the right of theexpression.
3. Click Search to display the matching devices and their owners.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 59

Negative operators with advanced search

Negative operators with advanced search
Using negative operators enables you to create filters that exclude devices instead of including them. For example,
you can search for:l

Devices that use any platform other than iOSl

Devices with a current country code other than US

TABLE 5. NEGATIVE OPERATORS WITH ADVANCED SEARCH
Operator

ActionExampleDoes not equal

Returns a list of devices that do
not match the criteria specified in
the value field for the selected
field.

Select:• Home Country Name as the field• Does not equal in Operator• United States in Country Name
The search returns a list of devices that do not have
United States as their home country name.

Does not contain

Returns a list of devices that do
not contain the string specified in
the selected field.
• Used only with strings.
• Available only in theexpression field.

Select or enter:• Go to Common Fields and select Device
Space.
• In the expression field, enter:
does not contain• Place the cursor between the two quote marks inthe expression field and enter:
GlobalThe search returns a list of devices that are notassigned to the Global space.

Examples for advanced search with negative operators
To display a list of devices that have countries other than the United States as the assigned home country, createan advanced search expression that provides the necessary information.
1. Go to Device & Users > Devices.
2. Click the large magnifying glass icon located at the top right to initiate an advanced search.
3. In Field, select Common Fields.
4. Select Home Country Name.
5. Select Does not equal from the list in Operator.
6. Select United States from the list of countries in Country Name.
7. Click Search.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 60

Clearing an advanced search

8. Optional: To save the search to a label, click Save to Label and then provide an existing label name or a
new label name and description.
9. If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click
Confirm. For more information, see Best practices: label management.
Suppose you want to list users within an LDAP group that have a Home Country Code other than the United States(US).
To create the advanced search expression that provides the needed list:
1. Go to Device & Users > Devices
2. Click the large magnifying glass icon located at the top right to initiate an advanced search.
3. In the expression field enter the following, including quote marks:“user.ldap.groups.name” = “Corp_Users” AND “common.home_country_code” != “US”
4. Click Search.
5. Optional: To save the search to a label, click Save to Label and then provide a new label name anddescription.
6. If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click
Confirm. For more information, see Best practices: label management.

Clearing an advanced searchl

In the advanced search, click the Clear link, orlApply a different search by entering a basic search.

Closing the advanced search query builder does not clear the search.

Searching for retired devices
By default, retired devices are excluded from search results. To include them, uncheck the Exclude Retired
Devices From Search Results check box, located to the left of the Search button in advanced search.
To find only retired devices:
1. Uncheck the check box to exclude retired devices
2. Select the following in the advanced search query builder:lField: RetiredlOperator: EqualslValue: true

3. Click Search.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 61

Searching for blocked devices

The matching records are displayed.

Searching for blocked devices
You can search for devices for which the status field value is Blocked, which means that the device is blockedfrom accessing the ActiveSync server. However, the Status column does not show the value Blocked. Instead,the ActiveSync Association view shows this information. See “Viewing ActiveSync associations” in the MobileIron
Sentry Guide.

Saving a search criterion to a label
Once you create a search criterion, you can save it to a label. Click the Save To Label button in advanced searchto create a new label using the search criterion. Type a new label name in the Label field and type a description.
The new filter label is created with the advanced search criterion applied.

FIGURE 5. SAVING A SEARCH CRITERION TO A LABEL

If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then click Confirm.
For more information, see Best practices: label management.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 62

4Securing Devices
Securing devices is at the heart of MobileIron Core. The topics in this chapter include the following advanced
topics:lRegistration-related features and tasksl

Reprovisioning a devicelRetiring a devicelDeletion of retired deviceslSecurity-related features and tasks

l

Lock

l

Unlockl

Encryption

l

Wipe

l

Cancel Wipel

Selective WipelBlock AppTunnels

l

Lost

l

Found

l

LocatelReset device PINlForce Device Check-InlSetting up background check-ins with APNslManaged iBooksl

Personal hotspot on/off switchl

Custom SyncMLlReporting on managed deviceslSetting the time zone of a device

Refer to the Getting Started with MobileIron Core for the most commonly used topics for managing devices, suchas:lDisplaying device assetslRestricting the number of devices a user registers

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 63

Registration-related features and tasks

Registration-related features and tasks
The following table summarizes features and tasks related to registration.

TABLE 6. REGISTRATION-RELATED TASKS
FeatureDescription

Reprovisioning a device

This feature is not supported on
Windows devices.

RetireEnds the registration (and MobileIron
management) for a device

Use Case

Moving devices out of inventory

Reprovisioning a device
This feature is not supported on Windows devices.

Retiring a device
Retiring a device archives the data for that device and removes the configurations and settings applied by
MobileIron Core (no personal information or settings on the device are impacted). The entry for the device no longer
appears in the Device & Users page (unless you specifically search for retired devices), and the user is notified
that the software has been removed.
If the retired device is also in the ActiveSync Association view, it remains there. However, because the device isretired, it can no longer access the ActiveSync server. You can manually remove the device from the ActiveSync
Association page. See “Removing ActiveSync phones” in the MobileIron Sentry Guide.
If you have duplicate devices, see Managing Duplicate Devices.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Click Actions > Retire.
The Retire dialog appears.
4. In the Retire dialog, confirm the user and device information and enter a note.
5. Click Retire.
The user receives notification of the action.
To see a list of retired devices, see “Searching for retired devices” in the Getting Started with MobileIron
Core.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 64

Retiring and deleting unused and retired devices

For Windows devices, applying the Retire action to a device removes all Wi-Fi profiles. However, if the device isconnected to a Wi-Fi profile pushed from Core, that Wi-Fi profile is not removed immediately, but after the user
disconnects from that Wi-Fi.

Retiring and deleting unused and retired devices
As device users leave your enterprise or change to new devices, more and more devices in the MobileIron Core
database are retired or never activated. When you retire a device, MobileIron Core de-registers it and no longer
manages or secures the device. All the configurations and settings that Core had applied to the device areremoved. The device can no longer access enterprise data or apps.
However, MobileIron Core retains retired and unregistered devices in its database. Deleting these devices from thedatabase improves Core performance and frees up disk space. Although Core also provides a web services API
and a CLI command to delete these devices, using the Admin Portal display is easier. It also provides an easy way
to automatically delete or retire devices on a regular schedule.
With this Admin Portal display, you can:lEasily navigate to lists of unregistered and retired devices.

l

Retire or delete devices that have been retired or not checked in for more than a specified number of days.

lConfigure Core to automatically retire or delete devices daily, weekly, or monthly.

NOTE: You can use this display only if you are assigned to the global space and you are assigned theadmin role Delete retired device. Otherwise, the actions on this display are disabled.
When Core retires or deletes retired devices due to your actions on this display, it records Delete Retired Device
events in the audit log. Personal data related to retired devices can be deleted by deleting the local user. However,
LDAP users cannot be permanently deleted unless the LDAP server or group has been deleted, in which case the
LDAP users become local users and can be deleted. If a user is deleted on the LDAP server, the user is
automatically removed from MobileIron Core during the next LDAP sync.

Assigning an administrator the role to delete retired devices
If you are a super administrator, you can assign another administrator the capability to delete retired devices. You
are a super administrator if you are:l

Assigned to the global space.

lAssigned the role Manage administrators and device spaces.

Procedure
1. In the Admin Portal, go to Admin > Admins.
2. Select an administrator.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 65

Creating a schedule to retire or delete devices

3. Select Actions > Edit roles.
4. For Admin Space, select Global.
5. Select the Device Management role Delete retired device.
6. Click Save.

Creating a schedule to retire or delete devices
You can enable a regular schedule to retire unused devices and delete retired devices. The schedule tool works
identically for each task.
Procedure
1. In the Admin portal, navigate to Settings > System Settings > Users & Devices > Retire and Delete
Retired Devices.
2. Click Automatically Delete Retired Devices on a Schedule, or Automatically Retire Devices on a
Schedule. The Schedule Configuration opens.
3. Frequency: Select Daily, Weekly, or Monthly.
a. Daily: Select the run time from the At: drop-down menu. The default is midnight.

b. Weekly: Select the day and time for the clean up. Default value is Sunday at midnight.

c. Monthly: Select the time for a first-day-of-the-month schedule frequency. Default is first day of the

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 66

Retiring or deleting retired devices by thresholdmonth at midnight.

4. Click Save.

Retiring or deleting retired devices by threshold
A common task, although not necessarily a daily task, is retiring unused or deleting retired devices. You can retiredevices that have not checked in or delete retired devices by a threshold amount of time. Deleting these devices
from the database improves Core performance and frees up disk space.
Prerequisites
Make sure you are assigned the required admin role. To delete or retire devices, you must be:lAssigned to the global spacelAssigned the admin role Delete retired device

Procedure
1. From the Admin Portal, go to Settings > System Settings.
2. Select Users & Devices > Retire and Delete Retired Devices. The Retire and Delete Retired Devices
configuration page opens.
The settings to retire unused devices (top half of the page) are identical to the settings to delete retired
devices (bottom half of page). The following steps are correct for either task, and all are optional steps,
except saving the configuration.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 67

Retiring or deleting retired devices by threshold

3. Specify the number of days after which devices should be retired/deleted, or accept the default of 30 days.
4. Specify the maximum number of devices to retire/delete in each session, or accept the default of 100
devices.
5. To set up a regular schedule for retiring/deleting devices, click Automatically Retire Devices on a
Schedule or Automatically Delete Retired Devices on a Schedule to configure the schedule. See
Creating a schedule to retire or delete devices.
6. Click Retire Now or Delete Now to retire or delete the devices that meet the new criteria.
7. Click Save to save the configuration.
NOTE: If the Retire Now/Delete Now button is disabled, only an administrator who is a “superadministrator” can assign you to the global space and assign the Delete retired device adminrole to you. The procedure for the super administrator and definition of a super administrator are
in Retiring or deleting retired devices by threshold on page 67.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 68

Managing Duplicate Devices

Managing Duplicate Devices
This section is applicable to iOS andWindows 8 devices.
Before Core version 10.6, duplicate devices with an "active" state were retired. From Core version 10.6 through thelatest version as supported by MobileIron, administrators can set duplicate active devices to the “Unknown” statusby selecting Enable managing duplicate devices.
Removal of device records from the Core database applies to the following retired device types:lActive Devices with no device details (iOS andWindows 8 devices)l

Devices with no subject holder (iOS andWindows 8 devices)l

Devices with the below statuses (iOS Only)o

Enrollment VerifiedoEnrollingoEnrolled

Core also supports Daily, Weekly and Monthly options for scheduling this feature.
Procedure
1. In the Admin portal, go to Settings > System Settings.
2. Expand Users & Devices and then click Manage Duplicate Devices.
The Manage Duplicate Devices page displays.
3. Select Enable managing duplicate devices.
The page expands to display more options.
NOTE: To disable this feature, simply de-select this field.
4. Make your settings using the guidelines below.
5. Click Save.

TABLE 7. MANAGING DUPLICATE DEVICES SETTINGS
Item

Description

Scan Schedule Frequency

Select the appropriate radio button and make the setting:•••

Device Action

Daily - Select the time of the scan of the duplicate device. This is the timeon the Core server.
Weekly - Select the day and time of the of the duplicate device. This is thetime on the Core server.
Monthly - Select the time of the scan of the duplicate device to occur on
the first day of the month. This is the time on the Core server.

Select one option:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 69

Security-related features and tasks

TABLE 7. MANAGING DUPLICATE DEVICES SETTINGS (CONT.)
Item

Description••

Retire the old device - (default)Mark the old device as "Unknown"

Related topics
Retiring a device

Security-related features and tasks
The following table summarizes the features and tasks related to security.

TABLE 8. SECURITY-RELATED FEATURES AND TASKS
FeatureDescription

Use Case

Lock

Forces the user to enter a password
before accessing the device

Dealing with lost and stolen devices

UnlockThis feature is not supported on
Windows devices.

Accessing the device when thepasscode has been forgotten orreassigning the device to a different
user
NOTE: For security reasons, it isinadvisable to execute thiscommand on lost or stolen
devices.

Unlock AppConnect
Container

This feature is not supported forWindows devices.

This feature is not supported forWindows devices.

Device Encryption Status

Displays the encryption status of
the device in the Device Details tab.

Dealing with lost and stolen devices.

Wipe

Removes content and settings toreturn the device to factory default
settings.

Dealing with lost and stolen devices

This feature is not supported forWindows devices.

This feature is not supported forWindows devices.

Attempts to cancel a wipe action fordevices.

Reversing an inadvertent Wipe
command.

Cancel Wipe

Preparing a device for a different user

NOTE: Wipe cannot be reversed
after it completes.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 70

Lock

TABLE 8. SECURITY-RELATED FEATURES AND TASKS (CONT.)
FeatureDescription

Block AppTunnels

This feature is not supported on
Windows devices.

Lost

This feature is not supported on
Windows devices.

Found

This feature is not supported on
Windows devices.

LocateThis feature is not supported on
Windows 8.1 Phone devices.

Reset PIN

NOTE: This feature is supported
on Windows devices.
Resets the device PIN.

Use Case

If a user forgets the device PIN, or you
locked the device

Lock
Locking a device forces the user to enter a password to access the device and prevents the user from reversing
this restriction. The user is informed of this action via email. If the user has set a password for the device, then thatpassword must be entered.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Select Lock from the Actions menu.
NOTE: If the Apps@Work app on the selected device is currently connected, then this action will beapplied immediately. If the Apps@Work app is not currently connected, then MobileIron Core
attempts to complete the operation by means of the operator’s SMTP service. If SMTP is used, it
may take more time to execute the operation, and the time required may vary by operator.

UnlockUnlocking the device passcode is supported as follows:
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Click Actions > Unlock.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 71

Encryption

Encryption
The encryption status for a device is now reported on the device details tab.
To check the encryption status of a device:
1. Log into the Admin Portal.
2. Go to Device & Users > Devices > Device Detail.
The device encryption status displays as Activating, Active, Active Per User, Active Default Key,
Inactive, Unsupported, or None.

Wipe
When wiping a device, MobileIron Core informs the user of this action via email.
WARNING: Wiping a device returns it to factory defaults, which can result in loss of data.
Required Role: The Device Management: Wipe device role is required to use this feature.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device to be wiped.
3. Click Actions > Wipe.
4. Optionally, select one or more of the following options:lllPreserve data plan (iOS 11 and later devices only) - Select this option to retain the data plan on
devices running iOS 11, if one exists.
Skip Proximity Setup (iOS 11.3 and later devices only) - Select this option to skip the proximity
setup pane in the iOS Setup Assistant.
Send Notification of wipe to registered user - Select (default) to allow an email / notification to be
automatically generated when a Wipe command is sent. The Send Notification of wipe to registereduser field is useful for users that have multiple devices. An email / notification will be automaticallygenerated when the Wipe command is sent and prevents confusion to device users who may thinkCore is wiping their current, active device De-select the check box to suppress notification when the
Wipe command is used.
NOTE: To customize the email notification, go to System Settings > Settings > Templates >Other. Select the template type Action on Device.

5. Click Wipe.
NOTE: If the Apps@Work app on the selected device is currently connected, then this action will beapplied immediately. However, if the Apps@Work app is not currently connected, then
MobileIron Core will attempt to complete the operation by means of the SMTP configuration.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 72

Cancel Wipe

Related topics
Cancel Wipe

Cancel Wipe
Cancel Wipe attempts to cancel a wipe command for one or more devices. The ability to cancel a device wipe
action helps you avoid mistakes that can be difficult and costly to fix.
A device wipe action does not take effect until the device checks in with MobileIron Core. Using Cancel Wipe, you
may be able to stop the wipe action.
A successful Cancel Wipe action sets the device state to Active.
1. In the Admin Portal, go to Device & Users > Devices.
2. Check the status of the devices for which you need to cancel the device wipe.
3. Select the devices you do not want to wipe that have status Wipe pending or Wiped.
4. Click Actions > Cancel Wipe.
5. In the Cancel Wipe dialog box, select the Send Notification of wipe to registered user check box. The
Send Notification of wipe to registered user field is useful for users that have multiple devices. An email /notification will be automatically generated when the Cancel Wipe command is sent and prevents
confusion to device users who may think Core is wiping their current, active device. De-select the checkbox to suppress notification when the Cancel Wipe command is used.
NOTE: To customize the email notification, go to System Settings > Settings > Templates >Other. Select the template type Action on Device.
6. Click Cancel Wipe.
The Cancel Wipe action sets the device state to Active.
Related topics
Wipe

Selective Wipe
The Selective Wipe command is no longer supported, however, the functionality is available using the following
methods:lSelective wipe of email for Windows devices is accomplished through security compliance actions,removing the device from the associated label, or retiring the device.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 73

Block AppTunnels

Block AppTunnels
This feature is not supported on Windows devices.

Lost
This feature is not supported on Windows devices.

Found
This feature is not supported on Windows devices.

LocateThis feature is not supported on Windows devices.

Reset device PIN
If a user forgets the device PIN for a Windows Phone 8.1 managed by MobileIron, or if you locked the device, you
can reset the device PIN from the Admin Portal.
To reset the device PIN:
1. In the Admin Portal, go to Device & Users > Devices.
2. Select the Windows Phone device.
3. Click on Actions > Windows Phone Only > Reset PIN.
4. In the Reset PIN pop-up, click Reset PIN.
A new PIN is displayed.
The device user can unlock the device using the new PIN.
Note the following about the Reset action:l

The new PIN is generated by the device and communicated to MobileIron Core.

l

Since the new PIN may contain complex characters, we recommend that the user reset the PIN.

Force Device Check-In
You can use the Force Device Check-in feature to force the device to connect to the MobileIron Core. You might
use this feature if Mobile@Work has not connected for some time, or you want to override a long sync interval to

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 74

Setting up background check-ins with APNs

download updates.
You can use this feature to troubleshoot MobileIron operations.
Procedure
1. Go to Device & Users > Devices.
2. Select the check box for the device.
3. Click Actions > Force Device Check-in.
4. The Force Device Check-In dialog appears.
In the dialog, confirm the user and device information and enter a note.
5. Click Force Device Check-in.

Setting up background check-ins with APNs
This feature is not supported on Windows devices.

Managed iBooks
This feature is not supported on Windows devices.

Personal hotspot on/off switch
This feature is not supported on Windows devices.

Custom SyncML
SyncML is a markup language and the Windows standard of xml. MobileIron allows administrators to upload
SyncML files, however, SyncML is not a technology that MobileIron created. For information or support, bestpractices, and creating customized SyncML, contact Microsoft.
The Windows Advanced Menu allows you to enable custom features, including SyncML. Custom SyncML isturned off, by default and you must enable it first before you can upload a SyncML file to apply it to a label.
Enterprises can modify policies outside of Core by enabling and using SyncML that allow administrators the ability
to delegate the task to someone who does not have access to Core to create SyncML files or modify scripts.
By using custom SyncML, you understand and assume all associated risks. You should always verify the content
of the uploaded file with the latest Microsoft specification. MobileIron does not validate custom SyncML and takes
no responsibility for damages to devices, including, but not limited to, lost data or unresponsive devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 75

Preparing to use SyncML

Preparing to use SyncML
Before you try to use SyncML, verify that you have the following details in place:
1. Custom SyncML file to upload that will turn on an action (Allow Notepad, as an example call).
2. Custom SyncML file to upload that will turn off the same action (Deny Notepad, as an example reversal call for
Allow Notepad).
In cases where the call will not have a feature to turn off (Remote Lock, for example) the device would happen
only once and would not need a reversal call.
NOTE: We recommend that if your custom file turns on a behavior you should have another file thatturns off the same behavior. Administrators implement the behavior (turn actions on or off, forexample) via labels. However, the labels (and therefore, the behavior) must be managed
manually. Core uses only the last setting sent.

How to use SyncML
WARNING: By using custom SyncML, you understand and assume the associated risks. You should always
verify the content of the uploaded file with the latest Microsoft specification. MobileIron does not validate custom
SyncML and takes no responsibility for damages to devices, including, but not limited to, lost data or unresponsive
devices.
This is a three-step process that requires you to:Step 1: Enable custom SyncML.
Step 2: Upload SyncML files.
Step 3: Apply SyncML settings to labels.
To enable custom SyncML:
1. In MobileIron Core, go to Settings > System Settings > Windows > Advanced Menu.
2. Select Enable Custom SyncML Menu.
3. Click Save and OK after Core successfully enables this feature.
To upload SyncML files:
1. Log into the Admin portal.
2. Go to Policies & Configs > Add New > Windows > Custom SyncML.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 76

Reporting on managed devices

FIGURE 6. NEW CUSTOM SYNCML

3. Enter a name and description for the setting.
4. Click Browse to locate and upload the SyncML .xml file.
Custom SyncML files must have an .xml extension.
5. Read the warning.
6. Click I Agree.
7. Click Save.
8. Repeat these steps for the partner file.
To apply SyncML settings to labels:
1.
2.
3.
4.
5.

Go to Policies & Configs > Configurations.
Select the newly added SyncML setting.
Select Actions > Apply to Label.
Select one or more labels.
Click Apply then OK to apply the setting the next time the device checks in.

Reporting on managed devices
MobileIron provides a Web Services API that enables you to create reports for many aspects of your managed
devices. See the MobileIron API documentation for information. You can create reports in the following ways:l

Exporting records to CSVlUsing APIs for reportingl

For details, refer to the Feature Usage and Get Last Sync Time and State of ActiveSync Devices
sections in the MobileIron Core v2 API Guide.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 77

Exporting records to CSVExporting records to CSV
The enhanced Export to CSV feature provides access to numerous additional device attributes that werepreviously unavailable. The attributes are organized into platform-specific groups to make it easy to report on therelevant attributes for the devices you’re working with.
Procedure
1. In the Admin Portal, go to Device & Users > Devices.
2. Use the Advanced Search feature or select a label to filter the devices you are interested in. All of thedevices in the table will appear in the exported file.
3. Click Export to CSV to open the Export CSV Spreadsheet dialog.
4. Select the information to export. The exported fields for each selection are listed below.
5. Click Export. to export the DeviceSearchResult.csv file is to your computer.

Export to CSV Field Options
Below describes what is contained inside a .CSV file.

TABLE 9. EXPORT TO CSV FIELD OPTIONS
TypeSupported Variables

Selection

Description

Include Only Basic Device
Information

User ID, Device UUID, Current Country Name, Current Operator
Name, Current Phone Number, Device Owner, Display Name, Email
Address, Home Country Name, Language, Last Check-In,
Manufacturer, Model, Passcode, Passcode Expiration Time, Platform
Name, Registration Date, Status

Include all device data, including
the following options below.

(Select one or more options below)

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 78

Export to CSV Field Options

TABLE 9. EXPORT TO CSV FIELD OPTIONS (CONT.)Type

Supported Variables

User Attributes

User ID, Device UUID, account_disabled, Attribute DistinguishedName, custom1, custom2, custom3, custom4, Display Name, Email
Address, First Name, Last Admin Portal Login Time, Last Name,
LDAP Group Distinguished Name, LDAP User Distinguished Name,
LDAP User Locale, locked_out, memberOf, Name, password_expired,Principal, sam_account_name, upn, User UUIDNOTE: If defined in LDAP settings, custom attributes appear
here also.

Common Device Attributes

User ID, Device UUID, APNS Capable, Background Status, Battery
Level, Block Reason, Blocked, Cellular Technology, Client Build Date,
Client Id, Client Last Check-in, Client Name, Client Version,
Comment, Compliant, Creation Date, Current Country Code, Current
Country Name, Current Operator Name, Current Phone Number,
Device Admin Enabled, Device Encrypted, Device Is Compromised,
Device Locale, Device Owner, Device Space, Display Size, EAS Last
Sync Time, Ethernet MAC, Home Country Code, Home Country
Name, Home Operator Name, Home Phone Number, IMEI, IMSI, IP
Address, Language, Last Check-In, Manufacturer, MDM Managed,
Memory Capacity, Memory Free, Model, Model Name, Modified Date,
Non-compliance Reason, OS Version, Passcode, Passcode
Expiration Time, Platform, Platform Name, Processor Architecture,
Quarantined, Quarantined Reason, Registration Date, Registration
IMSI, Registration UUID, Retired, Roaming, SD Card Encrypted,
Security State, Serial Number, Status, Storage Capacity, Storage
Free, Terms of Service Accepted, Terms of Service Accepted Date,
Wi-Fi MAC

Windows Phone Attributes

User ID, Device UUID, AAD Enrolled, Antivirus Signature Status,
Antivirus Status, Bitlocker Recovery Password, Bitlocker Startup
Password, Bitlocker Startup Pin, DM Client Version, DM Client
Version, Exchange ID, Firmware Version, Hardware Version, Health
Data: AIK Present, Health Data: Bit locker Status, Health Data: Boot
App SVN, Health Data: Boot Debugging Enabled, Health Data: Boot
Manager Rev List Version, Health Data: Boot Manager SVN, Health
Data: Boot Rev List Info, Health Data: Code Integrity Enabled, Health
Data: Code Integrity Rev List Version, Health Data: DEP Policy,
Health Data: ELAM Driver Loaded, Health Data: Issued, Health Data:
OS Kernel Debugging Enabled, Health Data: OS Rev List Info, Health
Data: PCR Hash Algorithm ID, Health Data: PCR0, Health Data:
Reset Count, Health Data: Restart Count, Health Data: Safe Mode,
Health Data: SBCP Hash, Health Data: Secure Boot Enabled, Health
Data: Test Signing Enabled, Health Data: VSM Enabled, Health Data:
Win PE, IMEI2, IMSI2, Last Hotfix ID, Last Hotfix Installed On, Local
Time, Management Service Address, Network Adapter, OS Edition,

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 79

Setting the time zone of a device

TABLE 9. EXPORT TO CSV FIELD OPTIONS (CONT.)Type

Supported Variables
Phone, Processor Type, Phone Number2, Processor Type, Roaming
2, Signed DM ID, WNS Channel URL, WP Publisher Device ID, WP
Radio SWV

Setting the time zone of a device
This feature is applicable to: iOS 14.0 and tvOS 14.0 devices through the latest version as supported by MobileIron
Core. This feature is applicable for supervised devices only and does not require Location Services.
l

The time zone device action is also displayed in the Device Details page of a device.

lTime zone changes made in the device will also reflect in the MobileIron Core server.
NOTE: This device action triggers an error if the Force automatic Date & Time restriction isenabled in iOS Restrictions configuration.

lAdministrators can search for a time zone. See Advanced searching.

Procedure
1. Go to Devices & Users > Devices.
2. Select one or more devices.
3. Click Actions > iOS Only > Set Time Zone for the selected device(s).
4. Enter the timezone string in the Olson Time Zone ID format, such as Pacific / Midway.
5. Click Set Time Zone.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 80

5Managing Custom Attributes
This section addresses all components relating to custom attributes.
lAssigning a custom attributes rolelAdding custom attributes to users and/or deviceslViewing custom attributes available for users and/or deviceslViewing custom attributes assigned to userslViewing custom attributes assigned to deviceslEditing custom attributes for users and/or deviceslSearching for custom attributes for users and/or devicesl

Exporting a log of the custom attributes for users and/or deviceslDeleting custom attributes from users and/or deviceslSetting custom attribute values for device or usersl

Pushing label attribute changes to devices and users

Assigning a custom attributes role
An administrator the assigned role of Manage custom attributes, can add, view, edit, search, or remove custom
user or device attributes. Custom attributes is a role for the global admin space.
Procedure
1. Log into the Admin Portal.
2. Go to Admin > Admins.
3. Select an administrator to assign the custom attributes role.
This role is for the Global admin space.
4. Select one of the following options for the selected administrator:lActions > Assign to Space > Global if the global space has not been assignedlActions > Edit Roles if the global space has been assigned

5. Scroll down to the Settings and Services Management section.
6. Click the Manage custom attributes option and click Save.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 81

Adding custom attributes to users and/or devices

Adding custom attributes to users and/or devices
You can add up to 300 custom attributes for users and 300 custom attributes for devices.
Procedure
1. Log into the Admin Portal.
2. Go to Settings > System Settings > Users & Devices > Custom Attributes.
3. In the Custom Device Attributes section, click Add+.
4. Enter the information for the custom attribute for devices, including:Field

Description

Attribute NameEnter a name for the custom attribute.

Attribute Description

Enter a meaningful description for the custom attribute.

Value Type

Select one of three value types: boolean, integer or string.

Variable Name

This field is read-only and displays the machine-generated name ofthe device that is used as a substitution variable in policies andconfigurations. For example, the substitution variable$USERNAME$ is replaced with the actual device username.

Actions

Click Save. The new custom device attribute is created and displaysin the table.

5. (Optional) For Apple School Manager, click Add+and create a new Custom Device Attribute for devicecarts, for example, DeviceCartName, and choose the string value type. Remember this custom attributename as you will need it when you turn on Apple Education in Core.
6. In the Custom User Attributes section, click Add+.
7. Referring to the table above, enter the information for the custom user attributes.
8. Click Save. The new custom user attribute is created and displays in the table.
9. (Optional) Repeat the steps, as needed.

Viewing custom attributes available for users and/or devices
Procedure
1. Log into the Admin Portal.
2. Go to Settings > System Settings > Users & Devices > Custom Attributes.
3. View all available custom attributes for users and/or devices.
Search for the attribute, if necessary, to see all available attributes.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 82

Viewing custom attributes assigned to users

Viewing custom attributes assigned to users
Procedure
1. Log into the Admin Portal.
2. Go to Devices & Users > Users.
3. Locate a single user and expand the details.
4. Click the Custom Attributes tab.

Viewing custom attributes assigned to devices
Procedure
1. Log into the Admin Portal.
2. Go to Devices & Users > Devices.
3. Locate a single device and expand the details.
4. Click the Custom Attributes tab.

Editing custom attributes for users and/or devices
Procedure
1. Log into the Admin Portal.
2. Go to Settings > System Settings > Users & Devices > Custom Attributes.
3. Locate the attribute you want to edit.
Search for the attribute, if necessary.
4. Click in the ATTRIBUTE DESCRIPTION field and modify the description.
This field has a 255 characters limit.
5. Click Save.

Searching for custom attributes for users and/or devices
Procedure
1. Log into the Admin Portal.
2. Go to Settings > System Settings > Users & Devices > Custom Attributes.
3. Enter the search criteria for the name or description.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 83

Exporting a log of the custom attributes for users and/or devices

Exporting a log of the custom attributes for users and/or
devices
Procedure
1. Log into the Admin Portal.
2. Go to Logs.
3. Scroll down the list of filters to Custom Attributes.
4. Click the number link of the custom attributes to display the complete list in the details pane.
5. Click Export to CSV to export all records to a single file.

Deleting custom attributes from users and/or devices
You can delete an attribute if it has only been assigned to a user or a device. An attempt to delete a custom
attribute assigned to a label will prompt an error message that provides a list of labels to which it has been
assigned.
Procedure
1. Log into the Admin Portal.
2. Select Settings > System Settings > Users & Devices > Custom Attributes.
3. Locate the attribute you want to remove.
Search for the attribute, if necessary.
4. Click Delete.

Setting custom attribute values for device or users
Setting custom attribute values for device or user requires Edit custom device attribute values and Edit custom
user attribute values roles.
To set custom attributes for devices:
1. Log into Admin Portal.
2. Select Devices & Users > Devices.
3. Check the box next to one or more devices.
4. Click Actions > Set Custom Attributes.
5. Set the value for attributes and click Save.
You can also clear the value for an attribute by checking the Clear Value box and save.
To set custom attributes for users:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 84

Applying custom attributes to labels

1. Log into Admin Portal.
2. Go to Devices & Users > Users.
3. Check the box next to one or more users.
4. Click Actions > Set Custom Attributes.
5. Set the value for attributes and click Save.
You can also clear the value for an attribute by checking the Clear Value box and save.
NOTE: If you choose a single device or user when setting attribute values, the current attributevalues are displayed. If you choose multiple devices or users, the current attribute values
are not displayed.

Applying custom attributes to labels
Applying custom attributes to labels, requires Label Management permissions.
Procedure
1. Log into the Admin Portal.
2. Go to Devices & Users > Labels.
3. Click Add Label > Filter.
4. Locate the attribute using one of the following options:lSearch for it in the Field, Operator, or Value fields.

lExpand Field > Custom Attributes > Device Attributes.

lExpand Field > Custom Attributes > User Attributes.

For more information about field definitions, see Device field definitions.
5. Complete the criteria.
6. Click Save.

Pushing label attribute changes to devices and users
Changing attribute values for a user or device label does not trigger an automatic update. If you have changed theattribute values for a label, by default, changes will take effect:l

For devices: the next time the device checks inl

For users: the next scheduled LDAP sync

If you want the changes to go into effect immediately, take the following action:ll

For devices: force a device check-in. See Force Device Check-In.
For users: force an LDAP sync. See "Synchronizing with the LDAP server" in Getting Started with
MobileIron Core.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 85

6Managing Policies
MobileIron Core uses policies to regulate the behavior of the devices it manages. Each policy consists of a set ofrules. You can create multiple policies for each policy type, but only one active policy of each type can be applied toa specific device.
Refer to Getting Started with MobileIron Core for information on the most commonly used policy topics, such as:lDefault policieslSecurity policieslPrivacy policieslLockdown policieslSync policies

The topics in this chapter include the following advanced topics:lWorking with default policieslImporting and exporting policieslViewing policy status and platform supportlEdge Browser settingslSync policies and battery uselCountry changes and alertslWorking with Windows Update policieslNotifications of changes to the privacy policylExporting the devices in the WatchList

Related topics
For information on MobileIron Threat Defense, including the MTD Local Actions policy, see the MobileIron Threat
Defense Solution Guide for Core.

Working with default policies
Default policies are the policies applied to a device automatically when it is registered. Default policy values arealso used as a starting point when you create a custom policy. MobileIron provides the values for each default
policy specification. It is recommended that you create your own policies. You can use the settings in the default
policies as a starting point. If you do edit a default policy’s values (not recommended), those new values become
the starting point when you create a new custom policy.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 86

Importing and exporting policies

Unlike configurations, a device can have only one policy of each type.
MobileIron Core provides defaults for the following policy types:lSecurity (Refer to Getting Started with MobileIron Core for details.)lPrivacy (Refer to Getting Started with MobileIron Core for details.)lLockdown (Refer to Getting Started with MobileIron Core for details.)lSync (Refer to Getting Started with MobileIron Core for details.)lActiveSync (See “Working with ActiveSync policies” in the .)l

AppConnect global policy (Refer to the MobileIron Core AppConnect and AppTunnel Guide for MobileIron
Core.)

NOTE: You cannot delete default policies.
The default settings for each policy type are listed in the section for each type.

Importing and exporting policies
You can import and export policies from one deployment of MobileIron Core to another. Topics in this section
include:lExporting policies or configurationslImporting policies or configurations

NOTE: This feature is supported when importing or exporting policies or configurations between Coreinstances that are running the same version.

Exporting policies or configurations
Exporting policies and configurations help reduce errors when you have multiple instances of MobileIron. You canexport a configuration .json file for an existing policy, modify it, then import it to another policy. The export/importfeatures allow you to do this.
Procedure
1. Select Policies & Configs > Policies or Policies & Configs > Configurations.
All available policies are listed in the policies table.
All available configurations are listed in the configurations table.
2. Select a single policy or configuration to export.
You can sort, as necessary, to find the one you want to export.
3. Click Export to create an export .json file.
No application-related information is captured when exporting a policy or configuration.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 87

Importing policies or configurations

4. Enter an export password and confirm it in the two password fields.
This password encrypts sensitive configuration data during export (including passwords and certificates).
The same password is required to import the exported data to another MobileIron Core server.
5. Check Remember password for this session if you want to re-use the password during a session.
A session is defined as the length of a single login. The session ends when you log out or when you havebeen logged out by the system.
6. Locate the .json file, open, modify, and save it, as necessary.
NOTE: Review this file before reusing it as values are not verified before importing them. For
instance, If a security policy .json file has a minimum password length of 2000, theimported profile will have a minimum password length of 2000 and, when pushed todevices, it will enforce all the devices to have such a big password. The encrypted hashof the sensitive data is displayed in the .json file, but the sensitive data is not displayed inplain text format in the .json file.

Importing policies or configurations
Importing policies and configurations help reduce errors when you have multiple instances of MobileIron. You canexport a configuration .json file for an existing policy, modify it, then import it to another policy. The export/importfeatures allow you to do this.
Procedure
1. Select Policies & Configs > Policies or Policies & Configs > Configurations.
2. Click Import to locate a saved exported .json file.
3. Enter the name of the file or click Browse to locate it.
4. Enter the password created when the file was exported.
See Step in Exporting policies or configurations on page 87.
5. Check Remember password for this session if you want to re-use the password during a session.
A session is defined as the length of a single log-in. The session ends when you log out or when you havebeen logged out by the system.
6. Read the warning message and click the I Agree check box.
7. Click Import to add the new policy to the policy table.
If you import a policy that already exists, you can override the policy or cancel the import. If an exported
policy has child object/s (such as app control rules and compliance actions), MobileIron creates themduring import. If the child objects already exist, they are overridden.

Viewing policy status and platform support
For any given device, you can view the status of a policy you have applied to that device, such as Pending, Sent,
or Applied. For any given policy, you can view a list of supported platforms, such as Android, iOS, and Windows.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 88Displaying policy status

Topics in this section include:lDisplaying policy statusl

Displaying supported platforms for policies

Displaying policy status
The Device Details pane on the Device & Users > Devices page displays status for the following tasks:lapply lockdown policieslapply security policies

The categories of status you will see in the Policies tab are:l

Pending: The process of applying the policy has been started.

l

Sent: The policy has been successfully sent to the device.

llApplied: MobileIron Core has confirmed that the verifiable settings appear to have been applied to thedevice.
Partially Applied: One or more settings may have been rejected by the device. This can mean that thefeature is not supported by the device.

Displaying supported platforms for policies
To clarify which policies are supported on specific platforms, “Platforms Supported” links are included in the policy
dialogs. For example:

FIGURE 7. PLATFORMS SUPPORTED LINK

Each link displays a table outlining the platform support for each policy feature.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 89

Edge Browser settings

Edge Browser settings
Edge Browser was introduced with Windows 10 and therefore, this feature is not supported on Windows Phone 8.1
devices. Disabling pop-ups and saved passwords for Edge browsers helps administrators prevent hackers fromcreating pop ups on end user desktop and mobile devices.
In previous releases, administrators could not disable these features. Starting with MobileIron Core 9.0, thesefeatures are allowed by default. If administrators make no changes, device users will not see any changes, buthacker risks continue. However, if you disable these actions, end users might notice the features no longer work
the same and request help.
MobileIron Core 9.0 adds the capability for administrators to disable the following actions for Edge browsers onmobile devices:l

pop-ups (Windows 10 Desktop devices only)lsaved passwords

How to disable Edge browser settings
To disable pop-ups and password manager for Edge browsers on mobile devices:
1. In MobileIron Core, go to Policies & Configs > Policies.
2. Select the Default Lockdown Policy and click Edit.
3. Scroll down to the Windows group.
4. Click Disable for one or both Edge browser settings:l

Block Browser PopupslBrowser Password Manager

5. Click Save.

Sync policies and battery use
If users note significant battery impact on their devices after installing the MobileIron client (Apps@Work),
consider reviewing and optimizing your sync policies.

Country changes and alerts
Country changes are monitored by the MobileIron client. Assuming that the Sync While Roaming option is not set
to No Sync, each country change causes Apps@Work to send the change to MobileIron Core. If Apps@Work
can connect, then the Event Center generates the configured alerts, regardless of the sync interval. If connectivity
is not established, then Apps@Work generates a local alert, if configured.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 90

Working with Windows Update policies

Working with Windows Update policies
To set up the Windows update policies:
1. Go to the Admin Portal.
2. Select Policies & Configs > Policies > Add New > Windows > Windows Update.
3. Use the following guidelines to complete this form:
Use the following guidelines to create or edit Windows update policies for Windows 10 devices:
Item

Description

Name

Required. Enter a descriptive name for this policy. This is the text that will be
displayed to identify this policy throughout the Admin Portal. This name must be
unique within this policy type.
Tip: Though using the same name for different policy types is allowed (e.g.,
Executive), consider keeping the names unique to ensure clearer log entries.

Description

Enter an explanation of the purpose of this policy.

Auto Update Strategy

The options are:• Notify user before downloading• Auto install and notify for restart• Auto install and restart (default)• Auto install at scheduled time
• Auto install at scheduled time without notifying user.

Scheduled Install Day

The options are:• Everyday (default)• Monday-Sunday

Scheduled Install Time

Every hour on the hour. The default is 3:00 AM

Update Sources

The options are:
• Enterprise WSUS
• Enterprise WSUS and Microsoft Update

URL to Enterprise
WSUS Server

The URL for the instance of your enterprise Windows Server Update Services
server.

Defer non-security
UpgradesIn order to defer non-security upgrades, pause updates or upgrades, defer updates,or upgrades, administrators must:• Make sure that the URL to Enterprise WSUS Server is left blank (in Policies &Configs > Policies > Windows > Windows Update).
• MS Error Reporting is Enabled (in Policies & Configs > Policies >Lockdown).

Pause
Updates/Upgrades

Check this box to pause the update or upgrades based on the time period specified
in the following options.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 91

Notifications of changes to the privacy policy

Item

Description

Defer Updates

The options are 0-4 weeks. The default is 0 weeks.

Defer Upgrades

The options are 0-8 months. The default is 0 months.

NOTE: Use the Windows update policy to defer Microsoft upgrades and updates on Windows 10
devices using TH2 builds and above. Once the time frame of the deferment is up you cannot
defer that update again on that device.

Notifications of changes to the privacy policy
This feature is not available on Windows devices.

Exporting the devices in the WatchList
The number in the WatchList field indicates the number of devices for which the configuration is still in queue.
To export the WatchList:
1. In the MobileIron Core Admin Portal, go to Policies & Configs > Configurations.
2. Click the number in the WatchList field for the configuration for which you want to export the WatchList.
The Pending Devices window appears. The window displays a list of devices for which the configuration isqueued.
3. Click Export to export the list of devices.
4. The list is downloaded as .CSV file.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 92

7Managing Compliance
MobileIron Core uses compliance policies to ensure that managed devices comply with security and administratordefined compliance policies. Actions you define in policies, such as placing a device in quarantine, take effectwhen a device is non-compliant.
Refer to the following technical note for more information on compliance:
https://help.mobileiron.com/s/article-detail-page?Id=kA134000000QyFvCAK
The topics in this chapter include the following advanced topics:lManaging device compliance checkslTiered compliancelCompliance actions policy violationslViewing quarantine informationlViewing configurations removed due to quarantinelCustom compliance policies

Managing device compliance checks
Devices are checked for compliance with assigned policies each time they check in with MobileIron Core. In
addition, Core checks all devices for compliance at regular intervals to detect out-of-compliance devices that havenot checked in with Core.
Using MobileIron Core, you can:lupdate device compliance status at any timelset the timing for device compliance checkslupdate the device last check-in and policy update time

NOTE: Core receives information regarding device compliance status and last check-in only after
devices actually check-in with Core. While you can request a device check-in using the Admin
Portal, many factors can affect whether a device actually checks in, such as network
connectivity, or whether a device is switched on or off.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 93

Setting the device compliance check interval

Setting the device compliance check interval
By default, all devices are checked for policy compliance every 24 hours. You can change the time between
compliance checks. The Compliance Check Interval setting applies to compliance checks by the server only. Outof compliance conditions include:lDevice is out of contact for the time limit you set.

lDevice’s root detection logic has found an issue.

lDevice Admin privileges have been lost.

lDevice has been decrypted.

lDevice OS version is below the expected version.

NOTE: It is best to run LDAP Sync and the compliance check at different times to avoid any potential
Core performance problems.
Procedure
1. In the Admin Portal, go to Policies & Configs > Compliance Actions.
2. Click Preferences.
3. In Edit Compliance Preferences, select one of the timings for Compliance Check Interval (2, 4, 8, 12
or 24 hours).
NOTE: Checking the compliance status of all devices every two or four hours may impact Core
performance.
4. Click Save.

Updating device compliance status
You can manually request a device check-in to update device compliance status for one device, several devices,or all the devices registered to Core. Updating device compliance status enables:llladministrators to update the compliance status of any device without waiting for the scheduled compliancecheck to run
users to return to productive work when a compliance check is resolved, rather than wait for the nextscheduled compliance checkadministrators to update the following information about a device:o

Last check-in, updated when the device checks inoPolicy update time

Without the ability to update device status, the device in the following example could be locked for almost 24 hours
after complying with the defined security policy:la device status is jailbreak when Monday’s daily compliance check is done (the compliance check is set
for 24 hours)

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 94

Compliance triggers and actionslthe device is blocked when this status is detected, due to the defined security policylthe device is brought back into compliance two hours after Monday’s compliance checklthe user cannot use the device until the Tuesday daily compliance check is run 22 hours from the time thedevice is back in compliance

Procedure
1. In the Admin Portal, go to Device & Users > Devices.
2. Select one or more devices to update.
3. Select Actions > Check Compliance.
4. A message is displayed, letting you know that the compliance check has begun.
NOTE: The compliance status of the chosen devices may not change for one to two minutes after
selecting Check Compliance.
To update device compliance information for all devices:
1. In the Admin Portal, go to Policies & Configs > Compliance Actions.
2. Click Check Compliance to display a message asking if you want to update compliance status for all
devices.
3. Click Yes to check compliance status for all devices or click No to cancel the action.
NOTE: The compliance status of the devices may not change for one to two minutes after selecting
Check Compliance.

Compliance triggers and actions
Compliance actions, configured by the administrator, may be implemented locally on the device by Mobile@Work
when certain system events have occurred that cause a compliance verification check, and only when the Enforce
Compliance Actions Locally on Devices check box is selected for compliance action. Compliance verification
checks also occur at the device check-in interval. Out of compliance conditions include:lOut of Contact: the device has had no communication with the MobileIron Core server for greater than thetime period selected which is specified in days.

lCompromised: the device is suspected to be rooted or an app has been installed for rooted devices.

l

Device Admin lost: the device administration privileges have been revoked.

lDecrypted: it has been detected that the device is no longer encryptedl

OS Version: the version of the operating system on the device is below the expected version

Server compliance conditions and actions
Server compliance actions resulting from compliance conditions are listed in the table below.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 95

Server compliance conditions and actions

TABLE 10. SERVER COMPLIANCE CONDITIONS AND ACTIONS
Action and OS

Out ofContact

Compromised

Device Admin
lost

Decrypted

OS Version

Wipe

Wipe theWipe the device

The device

Wipe theWipe the(Android only,
when enabling
Android custom
ROM)

device when it

when the device

cannot be

device when it

device whenhas been out ofhas been

wiped when thehas been

the OS version

contact.

compromised.

administrator

detected thatis less thanprivileges havethe device has

expected.

been removed.

been
decrypted.

Alert• Android• iOS

Send an alert

Send an alert

Send an alert

Send an alert

Send an alert

when thewhen the device

when

when it has

when the OS

device is out ofhas been

administrator

been detectedversion is lesscontact.

compromised.

privileges havethat the device

than expected.

been removed.

as beenYou can send

You can sendalerts to device

alerts to device

You can send

users, admins,

users, admins,

alerts to device

You can send

users, admins,

or both users

or both users

users, admins,

alerts to device

or both users

and admins,

and admins,

or both users

users, admins,

and admins,

using SMS,

using SMS,

and admins,

or both users

using SMS,

push

push

using SMS,

and admins,push

notifications, ornotifications, or

push

using SMS,

notifications, oremail.

email.

notifications, or

push

email.

email.

notifications, ordecrypted.

You can sendalerts to device

email.
Remove Apps
• Android• iOS
Removal ofapps is only possible if the MDM
profile is sent byCore and ispresent on thedevice OR if theapp settings
have the"Remove app
when device isquarantined ofsigned-out"
check box selec-

RemoveRemoveManaged apps

RemoveRemovemanaged apps

managed appscannot be

managed apps

managed apps

when thewhen the device

removed when

when thewhen the OS

device is out ofhas been

administrator

device hasversion is lesscontact.

compromised.

privileges havebeen

than expected.

been removed.

decrypted.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 96Server compliance conditions and actions

Action and OS

Out ofContact

Compromised

Device Admin
lost

Decrypted

OS Version

Quarantine All• Android• iOS

Remove all

Remove All

Remove All

Remove All

Remove All

configurations

configurations

configurations

configurations

configurations

when thewhen the device

when

when thewhen the OS

All Android
enterprise apps
and functionality
are hidden,
exceptDownloads,
Google PlayStore, andMobile@Work.

device is out ofhas been

administrator

device hasversion is lesscontact.

compromised.

privileges havebeen

than expected.

been removed.

decrypted.

ted.

(Applicable only
if the"Quarantine app
when device isquarantined"
check box isselected.)
Quarantine All
Except Wi-Fi• Android• iOS• macOS

Remove all

Remove all

Remove all

Remove all

Remove allconfigurations

configurations

configurations

configurations

configurations

except for Wi-

except for Wi-Fi

except for Wi-

except for Wi-

except for Wi-

Fi.

when

Fi whenFi when theFi when the OS

compromised.

administrator

device hasversion is lessprivileges havebeen

than expected.

been removed.

decrypted.

(For Android
enterprise apps,
this isapplicable only
if the"Quarantine app
when device isquarantined"
check box isselected.)
Quarantine All
Except Wi-Fi
on Wi-Fi Only
• Android• iOS• macOS(Applicable only

Remove all

Remove all

Remove all

Remove all

Remove allconfigurations

configurations

configurations

configurations

configurations

except for Wi-

except for Wi-Fi

except for Wi-

except for Wi-

except for Wi-

Fi on Wi-Fi only

on Wi-Fi only

Fi on Wi-Fi only

Fi on Wi-Fi only

Fi on Wi-Fi only

devices.

devices whendevices whendevices whendevices whencompromised.

administrator

the device has

the OS version

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 97

Local compliance conditions and actions

Action and OS

Out ofContact

Compromised

if the"Quarantine app
when device isquarantined"
check box isselected.)
Block or retire
AppConnect
apps
• iOS
"Block" means
blocking accessto AppConnect
apps.

not applicable

Block(unauthorized) or
retire(unauthorize andwipe)
AppConnect
apps

Device Admin
lost

Decrypted

OS Version

privileges havebeen

is less thanbeen removed.

decrypted.

expected.

not applicable

not applicable

not applicable

Local compliance conditions and actions
Local compliance actions do not apply to MobileIron Threat Defense functionality included with Mobile@Work
clients. There are also no local compliance actions for Mobile@Work for macOS devices.
Local compliance enforcement actions resulting from compliance conditions are listed in the table below.

TABLE 11. LOCAL COMPLIANCE CONDITIONS AND ACTIONS
Situation

OS

ActionWhen the device cancommunicate with
Core to perform aCompliance Check

Alert• Android• iOS

Send an alert when the device is out ofcontact.

Block AppConnect apps
• Android• iOS

Blocks access to AppConnect apps.

Quarantine• iOS

When the device is out of contact, allconfigurations, managed apps and iBooks
content are removed. New app downloads are
disallowed.

(Applicable only if the"Quarantine app when device isquarantined" check box isselected.)
Quarantine• Android

Alerts are sent to device users, admins, orboth users and admins, using SMS, push
notifications, or email.

When the device is out of contact, allconfigurations and managed apps are
removed. New app downloads are disallowed.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 98

Local compliance conditions and actions

Situation

OS

Action(Applicable only if the"Quarantine app when device isquarantined" check box isselected.)

When the device canNOT communicate
with Core to perform aCompliance check

Quarantine• Android Enterprise

All Android enterprise apps and functionality
are hidden, except Downloads, Google PlayStore, and Mobile@Work.

Alert• Android• iOS

Send an alert when the device is out ofcontact.

Block AppConnect apps
• Android• iOS

Blocks access to AppConnect apps.

Quarantine• iOS

When the device is out of contact, allconfigurations, managed apps and iBooks
content are removed. New app downloads are
disallowed.

(Applicable only if the"Quarantine app when device isquarantined" check box isselected.)
Quarantine• Android(Applicable only if the"Quarantine app when device isquarantined" check box isselected.)

Alerts are sent to device users, admins, orboth users and admins, using SMS, push
notifications, or email.

Quarantine action requires all appConnect
apps to be re-installed after the device is backin compliance.
When the device is out of contact, allconfigurations and managed apps are
removed. New app downloads are disallowed.

Quarantine• Android Enterprise

All Android enterprise apps and functionality
are hidden, except Downloads, Google
settings, Google Play Store, andMobile@Work.

Retire• Android Enterprise

The work profile is deleted or the managed
device will be factory reset.
NOTE: This action is not reversible.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 99

Tiered compliance

Tiered compliance
Administrators can apply multiple compliance actions over time on violating devices using tiered compliance. The
following example describes a possible 3-tiered compliance action:
1. Send device users a warning message that their device is out of compliance, and give them time to fix theviolation.
2. If the device is violating the same policy 24 hours later, Core sends users a second message and blocks
the device.
3. If the device continues to violate the same policy another 24 hours later, Core sends users a third message
and quarantines the device.
The increasing penalties over time allow a user that is unintentionally violating a policy to get back undercompliance before punitive measures are taken, rather than immediately pulling email configurations, for example,
off the device and interrupting normal work flow.
NOTE: Tiers beyond the first one are only used by compliance policy rules, and are not used for security
policies.
Tiered compliance behaviorlllTiered compliance checks do not run based on delay times. For example, if the delay time is 4 hours, Core
does not automatically run a tiered compliance check after 4 hours. Instead, the next compliance check
will occur in one of the following cases:oDevice Check-inoCompliance check from the Devices pageo

Periodic compliance check (if the device has not checked in since the last periodic compliance check)

If a device check-in or compliance check occurs during the interval between two tiers, Core will not takeaction based on the next tier. Core will only take action for the next tier after the delay time between tiers
has elapsed.
Delays between tiers are cumulative. For example, if the delay for tier 2 is 4 hours, and 8 hours for tier 3,then Core takes tier 3 action after 12 hours.

Compliance actions policy violations
You can assign compliance actions for security policy violations and for compliance policy violations. When you
configure access control in either type of policy, you can select default compliance actions that are provided with
MobileIron Core. You can also select custom compliance actions that you create.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 100

Default compliance actions

FIGURE 8. COMPLIANCE ACTIONS POLICY VIOLATIONSNOTE: To create the custom compliance actions, see Custom compliance actions.

Default compliance actions
The following table describes the default compliance actions:

TABLE 12. DEFAULT COMPLIANCE ACTIONS TABLE
Default compliance action

Description

Send Alert

Sends alert that you configured for the policy violation.
To configure the alert, see Policy violations event settings on page 303.

Block Email, AppConnect
Apps And Send Alert

This feature is not supported on Windows devices.

Customized complianceactions

These actions can contain 4 tiers of actions. Tiers 2-4 are only used incompliance policies; they are not used by legacy security policies. Security
policies only perform the action defined in tier 1.

Custom compliance actions
You can customize the compliance actions that you want to take for the settings on the Compliance Actions pageunder Policies & Configs. After you create your customized compliance actions, the actions you created appear ina drop-down list in the Access Control section of your security policies.
Custom compliance actions enable you to specify combinations of the following actions:lSend alertl

Block email access and AppConnect apps (includes blocking app tunnels)lQuarantine: block email access, block app tunnels, block AppConnect apps, and wipe AppConnect app
datal

Remove configurations (i.e., profiles)lSpecify exceptions for Wi-Fi-only devices

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 101

Creating a compliance action

Once you create a set of these actions, you can select that set from the drop downs in the Access Control sectionof security policies.

Creating a compliance action
With custom compliance actions, you can create actions to better manage access control. With tiered complianceactions, you can customize them to include up to 4 levels of action to better manage compliance actions.
Procedure
1. Log into the Admin Portal.
2. Go to Policies & Configs > Compliance Actions.
3. Click Add+ to open the Add Compliance Action dialog box.
4. Select the appropriate fields as described in the Add Compliance Action table.
5. If you want to add another set of actions, click the plus (+) button and select the fields, as necessary, tocomplete the second compliance action.
6. If you want to add another set of actions, click the plus (+) button and select the fields, as necessary, tocomplete the third compliance action.
7. Click Save to add the new compliance action for access control and compliance actions.
8. You can select them by going to:ll

Policies & Configs > Policies > policy > Edit > Access Control section (1 tier only).
Policies & Configs > Compliance Policies > Add+ > Compliance Policy Rule > Compliance
Actions drop-down (1-4 tiers).

Add Compliance Action table
The following table describes the Add Compliance Actions options:

TABLE 13. ADD COMPLIANCE ACTION FIELDS
Item

Description

Name

Enter an identifier for this set of compliance actions. Consider specifying theresulting action so that the action will be apparent when you are editing asecurity policy.

Enforce Compliance
Actions Locally on
DevicesThis feature is not supported on Windows devices.

ALERT: Send acompliance notification oralert to the user

Select if you want to trigger a message indicating that the violation has occurred.
Core sends alerts to users, administrators, or both.

BLOCK ACCESS: BlockThis feature is not supported on Windows devices.

To configure the alert, see Policy violations event settings.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 102

When the compliance action takes effectItem

Description

email access andAppConnect apps
QUARANTINE:
Quarantine the device

This feature is not supported on Windows devices.

(Select this check box todisplay the other
Quarantine options.)
QUARANTINE:
Remove All
Configurations and SaaS
Sign-on Policy

This feature is not supported on Windows devices.

QUARANTINE:
Do not remove Wi-Fi
settings for Wi-Fi only
devicesThis feature is not supported on Windows devices.

QUARANTINE:
Do not remove Wi-Fi
settings for all devices(iOS and Android only)This feature is not supported on Windows devices.

QUARANTINE:
Remove iBooks content,
managed apps, and block
new app downloads

This feature is not supported on Windows devices.

Retire:Retire the Work profile orfactory reset the managed
deviceThis feature is not supported on Windows devices.

When the compliance action takes effect
When you first apply a security policy, several factors affect the amount of time required to communicate thechanges to targeted devices:lsync intervalltime the device last checked inlbattery levellnumber of changes already queuedlwhether Enforce Compliance Actions Locally on Devices is selected.

Once the change reaches the device, MobileIron Core checks the device for compliance. If the device is out ofcompliance, then the action is performed.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 103

Viewing quarantine information

If the action for a security violation can be enforced locally on the device, and that option is selected in the
Compliance Action dialog, then Apps@Work initiates the compliance action without requiring contact with
MobileIron Core.

Viewing quarantine information
Devices that have had configurations removed due to policy violations are considered quarantined. You can view
quarantine information in the following places:lDevice & Users > Devices pagel

Policies & Configs > Configurations pagel

Dashboard page

Procedure
1. Go to Device & Users > Devices.
2. Click Advanced Search
3. Enter the search phrase: “common.quarantined” = true
4. Click Search.
To view information about an individual quarantined device:
1. Go to Device & Users > Devices.
2. Note devices that have been highlighted and appear with a quarantine icon.
3. Expand the device details for a quarantined device.
4. Click the Configurations tab in the device details panel to see which configurations have been removed
due to quarantine.

Viewing configurations removed due to quarantine
You can view the configurations that MobileIron Core has removed due to quarantine on the Configurations page.
1. Go to Policies & Configs > Configurations.
2. Click a number link in the Quarantined column to display a list of devices that have had the configuration
removed.

Dashboard page: Device by Compliance chart
To see how many devices are quarantined:
1. Go to Dashboard.
2. View the Device by Compliance chart. (If the chart is not visible, click Add to add it.)

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 104

Custom compliance policies

3. To see a list of all quarantined devices, click the quarantined category.

Custom compliance policies
Core provides security policies for 10 static definitions to mark a device as non-compliant. These policies have
limited customization options, but are a quick and easy way to begin to set up compliance policy rules. The
Compliance Policies feature allows administrators to define their own criteria for marking devices non-compliant.
They can combine dozens of device and user fields to create non-compliant matching criteria.
Compliance policy rules use the Advanced Search filter criteria to define non-compliant devices. Eachcompliance policy rule has a filter criteria and an associated compliance action object. Access compliance policies
by selecting Policies & Configs > Compliance Policies from the Admin Portal.
Core uses custom device and user attributes to set up compliance policy rule conditions. These settings, listed
under Devices & Users > Devices > Advanced Search > User Fields > LDAP > User Account Control in
the Admin Portal, are:l

Account DisabledlLocked OutlPassword Expired

Compliance policies are enforced by Core during device check-in.
The work flow to set up and use compliance policies is:lAssigning compliance roleslManaging compliance policy ruleslManaging compliance policy groupslDevice search fields for compliance rules

Assigning compliance roles
The following describes how to assign compliance roles.
Procedure
1. Log into the Admin Portal.
2. Go to Admin > Admins.
3. Select a user then click Actions > Edit Roles.
4. Select an Admin Space.
5. Scroll down the window to the Compliance Policy Management section.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 105

Managing compliance policy rules

6. Select one or more of the roles:lView compliance policy: Allows the selected user to view rules, groups, lists, and configuration.

lModify compliance policy: Allows the selected user to create, edit, and delete rules and groups.

lApply and remove compliance policy labels: Allows the selected user to add or remove groups
from labels.

7. Scroll to the Settings and Services Management section.
8. Select View settings and services.
9. Click Save.

Managing compliance policy rules
Compliance policy rules are the building blocks in compliance policy groups used to manage device compliance.
Administrators create compliance policy groups, add compliance policy rules to the groups, apply the groups tolabels pushed to devices. Administrators can create a group with no rules or add compliance policy rules while
creating the compliance policy group, if rules have already been created. They can also modify the group, including
the name, description, and selected rules. This section describes:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 106

Managing compliance policy ruleslCreating compliance policy ruleslSubstitution variables for compliance policy ruleslViewing and modifying compliance policy ruleslDeleting compliance policy ruleslSearching for compliance policy rules

Creating compliance policy rules
A single rule can be in multiple compliance policy groups.
Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies.
3. Click Compliance Policy Rule tab and then click Add+.
4. Add a unique name in the Rule Name field.
5. Select the Status to Enabled or Disable.
6. Enter a description of the rule if desired.
7. Build a Condition using Advance Search to define non-compliance.
NOTE: It is recommended to have one Condition set to include when Mobile@Work lastchecked in within the last 30 days. See the TIP below.
8. In the Compliance Actions field, select from the drop-down to use on devices matching the condition.
9. (Optional) In the Message field, enter text for alerts generated by violations of the policy rule.
When configuring the message accompanying the compliance action, custom attributes (see Adding
custom attributes to users and/or devices) and substitution variables can be inserted into the text. To dothis, copy the appropriate variable (see the Substitution variable table) located to the right of the Message
field and paste it into the text box. Before sending the message to the device, Core will replace thesubstitution variable to the actual value of the custom attribute for that device. For example, $FIRST_
NAME$ would insert the first name of the target user into the message.
10. If you don't want the search results to include retired devices, select the Exclude retired devices fromsearch results check box.
11. Click Save.
TIP: It is recommended to have a Compliance Policy Rule with one condition set to include when
Mobile@Work last checked in with Core. This is helpful if you need assurance that Mobile@Work is
running on devices (for example, for use in MobileIron Threat Defense).
Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 107

Managing compliance policy rules

3. Click Compliance Policy Rule tab and then click Add+.
4. Enter ClientLastCheckIn in the Rule Name field.
5. Enter Condition > All.
6. Go to Field and type in "Client Last Check-In" or select Common Fields > Client Last Check-In.
The regular expression is listed below; green check mark indicates regular expression is accepted.
7. Select within the last in the Value field; enter 30 days in the remaining two fields.
8. Keep the default setting of Exclude retired devices from search results.
9. In the Compliance Actions field, select Send Alert from the drop-down.
10. Click Save.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 108

Substitution variables for compliance policy rules

Substitution variables for compliance policy rules
TABLE 14. SUBSTITUTION VARIABLES FOR COMPLIANCE POLICY RULES
Category

Substitution variable

Compliancepolicy rulecustomized
message

The substitution variables are available for use in compliance policy rules for all devices. To
use in a compliance action message, copy/paste the variable into the Message field.
• $CN$• $CONFIG_UUID$• $DEVICE_CLIENT_ID$• $DEVICE_ID$• $DEVICE_IMEI$• $DEVICE_IMSI$• $DEVICE_MAC$• $DEVICE_PIVD_ACTIVATION_LINK$• $DEVICE_SN$• $DEVICE_UDID$• $DEVICE_UUID$• $DEVICE_UUID_NO_DASHES$• $DISPLAY_NAME$• $EMAIL$• $EMAIL_DOMAIN$• $EMAIL_LOCAL$• $FIRST_NAME$• $GOOGLE_AUTOGEN_PASSWORD$• $ICCID$• $LAST_NAME$• $MI_APPSTORE_URL$• $MODEL$• $NULL$• $OU$• $PASSWORD$• $PHONE_NUMBER$• $RANDOM_16$• $RANDOM_32$• $RANDOM_64$• $REALM$• $SAM_ACCOUNT_NAME$• $TIMESTAMP_MS$• $USERID$• $USER_CUSTOM1$• $USER_CUSTOM2$• $USER_CUSTOM3$• $USER_CUSTOM4$• $USER_DN$• $USER_LOCALE$• $USER_UPN$

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 109

Managing compliance policy groups

Viewing and modifying compliance policy rules
You can view or modify a compliance policy rule. Viewing a rule requires the View role and modifying a rule requires
the Modify role.
You can modify a rule without removing it from an assigned group. For instance, you can change its status from
Enabled to Disabled to troubleshoot it. When you modify a rule, the change is applied to all the groups that use therule.
To view or modify a compliance policy rule:
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Rule.
3. Select the name of the rule you want to modify and click Edit.
4. Modify details, as necessary, including disabling the rule.
5. Click Save.
Deleting compliance policy rules
To delete one or more compliance policy rules:
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Rule.
3. Select the name of one or more rules to delete.
4. Click Actions > Delete.
Searching for compliance policy rules
To search for compliance policy rules:
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Rule.
3. Enter a name in the search field.
4. Use one of the following filters:
l

All

l

EnabledlDisabled

5. Click Search.

Managing compliance policy groups
Compliance policy groups are applied to devices to manage device compliance. Administrators create compliancepolicy groups, add compliance policy rules to the groups, apply the group's rules to devices matching the label

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 110

Managing compliance policy groups

criteria.
Administrators can create a group with no rules or add compliance policy rules while creating the compliance policy
group, if rules have already been created. They can also modify the group, including the name, description, andselected rules. This section describes:lCreating compliance policy groupslModifying compliance policy groupslAdding compliance policy rules to a grouplApplying compliance policy groups to labelslRemoving compliance policy groups from labelslDeleting compliance policy groupslSearching for compliance policy groups

Creating compliance policy groups
You can create a group without adding rules, which can be added later. One rule can be member of multiple
groups.The following provides the steps to add one or more compliance policy rules to a compliance policy group.
Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies.
3. Click Compliance Policy Group tab.
4. Click Add+. The Add Compliance Policy Group page displays.
5. Enter a unique name in the Group Name field.
6. Select Enabled in the Status field.
7. Move one or more rules from Available Rules to the Selected Rules list.
8. Click Save.
Modifying compliance policy groups
The following provides the steps to modify compliance policy groups.
Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Select the name of the group you want to modify.
4. Modify details, as necessary, including the name, description, or to enable or disable the group.
5. Click Save in the Details section.
6. Click Edit in the Rules section.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 111

Managing compliance policy groups

7. Modify rules, as necessary, by adding or removing rules.
8. Click Save in the Rules section.
Adding compliance policy rules to a group
One rule can be a member of multiple groups. This procedure requires that you have already created one or morerule. See Creating compliance policy rules for details.
To apply a compliance policy rule to a compliance policy group:
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Double-click the name of the group to which you want to add one or more rules.
4. Go to the Rules section and click Edit.
5. Move one or more rules from the Available Rules list to the Selected Rules list.
6. Click Save in the Rules section.
Applying compliance policy groups to labels
Once a group (and its underlying rules) is assigned to devices, status of the devices are evaluated based on theconditions in the rules for compliance. Compliance Policy rules are evaluated against each device in the following
ways:
l

l

l

During device check-in
Periodically, during the compliance policy check interval. This is set at Policies & Configs >Compliance Actions > Preferences.
When a manual Check Compliance is initiated by the administrator. This can be set at Policies &Configs > Compliance Actions > Check Compliance or on the Devices page under Actions.

Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Select the name of the compliance policy group you want to apply to label.
4. Click Actions > Apply to Labels.
5. Select one or more of the labels.
6. Click Apply.
Removing compliance policy groups from labels
Once a group (and its underlying rules) is assigned to devices, status of the devices are evaluated based on theconditions in the rules for compliance. The following describes the steps to apply a compliance policy groups to one
or more labels.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 112

Device search fields for compliance rules

Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Select the name of the compliance policy group you want to remove from a label.
4. Click Actions > Remove from Labels.
5. De-select one or more of the labels.
6. Click Apply.
After the next device check in, these changes will apply.
Deleting compliance policy groups
The following provides the steps to delete one or more compliance policy groups.
Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Select the name of one or more groups to delete.
4. Click Actions > Delete.
Searching for compliance policy groups
The following provides the steps to search for compliance policy group.
Procedure
1. Go to the Admin Portal.
2. Select Policies & Configs > Compliance Policies > Compliance Policy Group.
3. Enter a name in the search field.
4. Use one of the following filters:
l

All

l

EnabledlDisabled

5. Click Search.

Device search fields for compliance rules
This section includes the compliance action objects the compliance policy rules use for device search fields. In
addition to the fields listed in the below table, any Custom Device Attributes or Custom User Attributes that wereadded in Settings > System Settings > Users & Devices > Custom Attributes will also be available forsearching.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 113

Device search fields for compliance rules

The following table lists the available objects, including:lCommon fieldslCustom fieldslAndroid devicesl

iOS deviceslWindows deviceslUser fields (including LDAP fields)

TABLE 15. DEVICE SEARCH FIELDS FOR COMPLIANCE RULES
Category

Compliance policy objects

CommonThe following search fields are available for use in compliance rules for all devices:cellular_technology, client_name, client_build_date, client_version, creation_date, current_
country_code, current_country_name, country_name, current_operator_name, carrier_short_
name, current_phone_number, current_phone_number, data_protection_enabled, data_protection_reasons, device_admin_enabled, device_encrypted, device_is_compromised, eas_
last_sync_time, ethernet_mac, home_country_code, home_country_name, home_operatory_
name, home_phone_number, imei, imsi, language, last_connected _at, locale, location_last_captured_at, manufacturer, mdm_managed, mdm_tos_accepted, mdm_tos_accepted_date,model, model_name, os_version, owner, pending_device_passcode, pending_device_passcode_expiration_time, platform_name, platform, registration_date, registration_imsi,
retired, roaming, security_state, status, uuid, wifi_mac_address

Android

The following search fields are available for use in compliance rules for all Android devices:admin_activated, attestation, afw_capable, brand, Client_version_code, device_roaming_flag,knox_version, manufacturer_os_version, mdm_enabled, multi-mdm, os_build_number, os_
update_status, registration_status, samsung_dm, secure_apps_encryption_enabled, secure_apps_encryption_mode, security_detail, security_patch, usb_debugging, dpm_encryption_
statusiOS

The following search fields are available for use in compliance rules for all iOS devices:BluetoothMAC, BuildVersion, CarrierSettingsVersion, Current MCC, Current MNC,
DataRoamingEnabled, data_protection, forceEncryptedBackup, iCloud Backup Is Enabled,
iOSBackgroundStatus, iPhone PRODUCT, iPhone VERSION,
IsDeviceLocatorServiceEnabled, IsDEPEnrolledDevice, IsDoNotDisturbInEffect,
IsMDMLostModeEnabled, IsMDMServiceEnrolledDevice, iTunesStoreAccountIsActive,
ProductName, PasscodePresent, PasscodeIsCompliantWithProfiles, PasscodeIsCompliant,Personal Hotspot Enabled, SerialNumber, Supervised, SIM MCC, SIM MNC, Subscriber
Carrier Network, Voice Roaming Enabled, osUpdateStatus,

Windows

The following search fields are available for use in compliance rules for all Windows devices:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 114

Device search fields for compliance rules

TABLE 15. DEVICE SEARCH FIELDS FOR COMPLIANCE RULES (CONT.)
Category

Compliance policy objects
dm_client_version, wp_firmware_version, wp_hardware_version, wp_os_edition, health_data_
issued, health_data_aik_present, health_data_dep_policy, health_data_bit_locker_status,
health_data_boot_manager_rev_list_version, health_data_code_integrity_rev_list_version,
health_data_secure_boot_enabled, health_data_boot_debugging_enabled, health_data_os_
kernel_debugging_enabled, health_data_code_integrity_enabled, health_data_test_signing_enabled, health_data_safe_mode, health_data_win_pe, health_data_elam_driver_loaded,health_data_vsm_enabled, health_data_pcr0, health_data_sbcp_hash,User

The following search fields are available for use in compliance rules user-related fields, including
LDAP:email_address, user_id, attr_dn, dn, name, locale, principal, upn, account-disabled, locked_out,
password_expired, custom1, custom2, custom3, custom4, <dynamically created custom userattribute field name #1>, <dynamically created custom user-attribute field name #2>,
<dynamically created custom user-attribute field name #3>, <dynamically created custom userattribute field name #4>, <dynamically created user-attribute field names>

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 115

8Managing Device Settings with Configurations
This section addresses the automation of major settings via configurations that can then be applied to a large
inventory of different devices.
lManagement of device settings with configurationslConfigurations pagelDefault configurationslDisplaying configurations statusl

Adding new configurationslEditing configurationslDeleting configurationslExporting configurationslImporting configurationslApplying configurations to labelsl

Exporting the devices in the WatchListlImpact of changing LDAP server variables

Management of device settings with configurations
Configuring major settings across a large inventory of different devices can mean a major daily time investment for
IT personnel. You can automate this process by specifying and distributing configurations, previously called app
settings. A configuration is a group of settings to be applied to devices.
The following table summarizes the device settings managed by MobileIron Core. Configurations are found on the
Policies & Configs > Configurations page.

TABLE 16. DEVICE SETTINGS
Category

Configuration TypeInfrastructure

•
•
•
•
•
•

Exchange
Email
Wi-Fi
VPN
Certificates
Certificate Enrollment

MobileIron AppConnect•

App Configuration

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 116

Configurations page

TABLE 16. DEVICE SETTINGS (CONT.)
Configuration Type

Category•

Container Policy

MobileIron Features••

Docs@Work
Web@Work

Windows••

Enrollment Token (AET) (Windows Phone only)
Sideloading Key (Windows 8.1 only)

Configurations page
A configuration (previously called app settings) is a group of settings that are applied to devices. Go to the Policies& Configs > Configurations page to create and manage configurations. It displays the following information foreach configuration.

TABLE 17. CONFIGURATIONS PAGE OPTIONS
Field

Description

Name

Indicates a name for this group of settings.

Configuration Type

Indicates the kind of configuration.

Bundle/Package ID

If this configuration is links to a App Catalog entry, the Bundle/Package ID will
display here.

Description

Displays additional information about this group of settings.

# Phones

Indicates the number of phones to which this group of settings has been
applied. Click the link to display a list of the devices.

LabelsLists the labels to which this group of settings has been applied.

WatchList

Displays the number of devices for which this group of settings is queued.
Click the link to display a list of the devices.

Quarantined

Displays the number of devices that have had configurations removed due topolicy violations. Click the link to display a list of the devices. See Creating acompliance action on page 102 for information on quarantining devices.

Required role: Administrator must have the View configuration role to access the Configurations page.

Default configurations
MobileIron Core provides the following default configurations. The names of these default configurations start with
“System - “.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 117

Displaying configurations status

TABLE 18. DEFAULT CONFIGURATIONS
Configuration NameType

Description

Windows Cert Auth RootCA Certificate

CERTIFICATEThis setting is used for (non-enrollment) server
authentication by Windows devices.

Windows Computer-level
Cert Auth CE Setting

CERTIFICATEThis setting is used for computer-level certificate
authentication by Windows clients.

Windows Phone EnrollmentSCEP

CERTIFICATEThis setting is an auto-created SCEP setting for the
Windows Phone Enrollment CA.

Windows User-level Cert
Auth CE Setting

CERTIFICATEThis setting is used for user-level certificate
authentication by Windows clients.

Displaying configurations status
To see the status of configurations for each device:
1. Go to Device & Users > Devices
2. Select a device, and click the caret to open the device details
3. Click the Configurations tab.
The statuses you will see are:l

Pending: The process of applying the settings has been started.

l

Sent: The settings have been successfully sent to the device.

l

l

l

Applied: MobileIron Core has confirmed that the verifiable settings appear to have been applied to thedevice.
Partially Applied: One or more settings may have been rejected by the device. This can mean that thefeature is not supported by the device.
Update Pending: The administrator has edited the setting in the Admin Portal. The process of applying
the updated setting has begun.

Adding new configurations
NOTE: Add new configurations for Windows devices through Exchange and Certificates only. Add new
configurations for Windows 8.1 devices through Wi-Fi and VPN only.
To add new configurations:
1. Go to Policies & Configs > Configurations.
2. Click Add New.
3. Select the type of configuration you want to create.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 118

Editing configurations

4. Complete the displayed form for the configuration.
5. Click Save.
6. To push the configuration to devices, apply it to the appropriate labels. Select Actions > Apply to Label.

Editing configurations
NOTE: Add new configurations for Windows devices through Exchange and Certificates only. Add new
configurations for Windows 8.1 devices through Wi-Fi and VPN only.
To edit configurations:
1. In the Configurations screen, select the configuration you want to edit.
2. Click Edit.
3. Make your changes.
4. Click Save.
A pop-up displays.
5. Click Yes to continue.
The configuration will be re-pushed to matching devices even you made no changes. However, if the onlychange made is to the description, the configuration will not be re-pushed to the devices.

Deleting configurations
NOTE: Add new configurations for Windows devices through Exchange and Certificates only. Add new
configurations for Windows 8.1 devices through Wi-Fi and VPN only.
To delete configurations:
1. In the Configurations screen, select the settings you want to delete.
2. Click Delete.

Exporting configurations
Export and importing setting configurations helps reduce errors when you have multiple instances of MobileIron.
You can export a configuration .json file for an existing setting, modify it, then import it to another configuration.
To export a configuration:
1. Select Policies & Configs > Configurations.
All available configurations are listed in the table.
2. Select a single configuration to export.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 119

Importing configurations

You can sort, as necessary, to find the configuration you want to export.
3. Click Export to create an export configuration .json file.
No application-related information is captured when exporting a configuration.
4. Locate the .json file, open, modify, and save it, as necessary.
NOTE: Review this file before reusing it as values are not verified before importing them.

Importing configurations
To import a configuration:
1. Log into MobileIron Core.
2. Select Policies & Configs > Configurations.
3. Click Import to locate a saved exported configuration .json file.
4. Enter the name of the file or click Browse to locate it.
5. Read the warning message and click in the I Agree check box.
6. Click Import to add the new configuration to the configuration table.
If you import a configuration that already exists, you can override the file or cancel the import.

Applying configurations to labels
Use labels to apply configurations to devices. Refer to the “Using labels to establish groups” section in the Getting
Started with MobileIron Core for more information.
To apply a configuration to a label:
1. Select Policies & Configs > Configurations to display the configurations table with all available
settings configurations.
2. Select the check box next to a configuration you want to apply to a label.
Search for a configuration by entering the configuration name or description in the search box.
3. Click Actions > Apply To Label.
Select the label.
4. You can search by label name or description to help find the label.
5. Click Apply.

Exporting the devices in the WatchList
The number in the WatchList field indicates the number of devices for which the configuration is still in queue.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 120

Impact of changing LDAP server variables

To export the WatchList:
1. In the MobileIron Core Admin Portal, go to Policies & Configs > Configurations.
2. Click the number in the WatchList field for the configuration for which you want to export the WatchList.
The Pending Devices window appears. The window displays a list of devices for which the configuration isqueued.
3. Click Export to export the list of devices.
4. The list is downloaded as .CSV file.

Impact of changing LDAP server variables
A change to a LDAP server variable (such as $EMAIL$, $FIRST_NAME$, $LAST_NAME$, $DISPLAY_NAME$,$USER_UPN$, $USER_CUSTOM1, $USER_CUSTOM2, $USER_CUSTOM3$, or $USER_CUSTOM4$) now
causes a setting that uses the variable to be re-pushed to the device. The impacted settings are:l

Exchange settinglEmail settingl

Wi-Fi settingl

VPN settingl

CalDAV settingl

CardDAV settinglSubscribed calendar settinglAppConnect app configurationlDocs@Work setting

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 121

9Configuring EmailThis section addresses email account configuration, enabling S/MIME encryption and synchronizing account data.
l

Exchange settingslSynchronizing Google account data

Exchange settings
To specify the settings for the ActiveSync server that devices use, go to Policies & Configs > Configurations,then click Add New > Exchange. The ActiveSync server can be a Microsoft Exchange server, an IBM® Lotus®
Notes Traveler server, Microsoft Office 365, or another server.
The following table describes the Exchange settings you can specify.

TABLE 19. EXCHANGE SETTINGS
SectionField Name

Description

GeneralName

Enter brief text that identifies this group of Exchange
settings.

Description

Enter additional text that clarifies the purpose of thisgroup of Exchange settings.

Server AddressEnter the address of the ActiveSync server.
If you are using Standalone Sentry, do the following:
•
•

•

•

Enter the Standalone Sentry’s address.
If you are using Lotus Domino server 8.5.3.1 Upgrade
Pack 1 for your ActiveSync server, set the server
address to <Standalone Sentry’s fully qualified
domain name>/traveler.
If you are using a Lotus Domino server earlier than
8.5.3.1 Upgrade Pack 1, set the address to<Standalone Sentry fully qualified domainname>/servlet/traveler.
If you are using load balancers, contact MobileIron
Professional Services.

When using Integrated Sentry, set the server address to
Microsoft Exchange Server’s address.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 122

Exchange settings

TABLE 19. EXCHANGE SETTINGS (CONT.)
SectionField Name

Description
NOTE: When using Sentry, you can do preliminary
verification of your Exchange configuration
choices for the ActiveSync User Name,
ActiveSync User Email, and ActiveSync
Password fields. To do so, first set the server
address to the ActiveSync server. After you
have verified that users can access theiremail using this Exchange configuration,change the server address to theappropriate Sentry address.
For more information about configuring Sentry, see the
MobileIron Sentry Guide.

Use SSL

Select to use secure connections.

Use alternate device
handling

Replaces the Use Standalone Sentry option. Use thisoption only under the direction of MobileIron Support.

DomainSpecify the domain configured for the server.

Google Apps Password

This check box only appears if you have configured a
Google account with MobileIron Core, as described in
Exchange settings on page 122.
When linking to Google Apps, select this option to use theGoogle Apps password to log in to the Google account
you have configured to work with MobileIron Core. This
password allows device users to access their Email,Contacts, and Calendar data on their managed devices.
When selected, Core grays out the ActiveSync User
Name and ActiveSync User Password.
This check box only appears if you have configured a
Google account with MobileIron Core, as described inSynchronizing Google account data on page 127.

ActiveSync User Name

Specify the variable for the user name to be used with thisExchange configuration. You can specify any or all of thefollowing variables $EMAIL$, $USERID$,$PASSWORD$. You can also specify custom formats,such as $USERID$_US. Custom attribute variable
substitutions are supported.
Typically, you use $USERID$ if your ActiveSync serveris a Microsoft Exchange Server, and you use $EMAIL$ if
your ActiveSync server is an IBM Lotus Notes Traveler
server. You cannot use $NULL$ for this field.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 123

Exchange settings

TABLE 19. EXCHANGE SETTINGS (CONT.)
SectionField Name

Description

ActiveSync User EmailSpecify the variable for the email address to be used withthis Exchange configuration. You can specify any or all of
the following variables $USERID$, $EMAIL$,$SAM_
ACCOUNT_NAME$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_DEVICE_Attributename$,
CUSTOM_USER_Attributename$, or $NULL$. You canalso specify custom formats, such as $USERID$_US.
Custom attribute variable substitutions are supported.
Typically, you use $EMAIL$ in this field; you cannot use$NULL$.
For Windows 10 devices: Use only $EMAIL$.

ActiveSync User
Password

Specify the variable for the password to be used with thisExchange configuration. You can specify any or all of thefollowing variables: $USERID$, $EMAIL$,$PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_DEVICE_Attributename$,
CUSTOM_USER_Attributename$, or $NULL$. You canalso specify custom formats, such as $USERID$_US.
Custom attribute variable substitutions are supported.
Enter additional variables or text in the text box adjacentto the Password field. Entries in this text box are kept
hidden and will not be visible to any MobileIron Coreadministrator.
NOTE: All variables and text up to the last valid
variable will be visible. Anything after the lastvalid variable will not be visible. The valid
variable may appear in either of thepassword fields. Valid variables are variablesin the drop-down list.

Identity Certificate

Select the Certificate Enrollment entry you created forsupporting Exchange ActiveSync, if you are
implementing certificate-based authentication.
NOTE: When setting up email for devices with multiuser sign-in, the exchange profile must
always use a user-based certificate. The
user-based certificate will ensure secureaccess to email for all users. Using a device-

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 124

Exchange settings

TABLE 19. EXCHANGE SETTINGS (CONT.)
SectionField Name

Description
based certificate can result in one user
sending or receiving emails for another user.
When configuring the user-based
certificate, select the Proxy enabled andStore certificate keys on MobileIron Core
options. This allows the user certificate andprivate key to be delivered each time theylog in on the shared device.

Password is also
requiredSpecify whether to prompt device users for a password
when certificate authentication is implemented. The
password prompt is turned off by default. Once you
specify an Identify Certificate, this option is enabled.
Select the option if you want to retain the password
prompt.

Items to Synchronize

Select the Outlook items to be synchronized (Contacts,
Calendar, Email, Tasks).

(Android, Windows)
Items to Synchronize(iOS)

This feature is not supported on Windows devices.

Past Days of Email to
Sync

Specify the maximum amount of email to synchronize
each time by selecting an option from the drop-down list.
The 1 Day option maps to the All option.

S/MIME

Move/Forward
Messages to Other
Email Accounts

This feature is not supported for Windows devices.

Enable for Android andiOS 9.3.3 (or earlier)

Select to enable S/MIME signing and encryption on
devices running Android or iOS 9.3.3 or earlier.

S/MIME Signing:
EnableThis feature is not supported for Windows devices.

S/MIME Signing
identityThis feature is not supported for Windows devices.

Signing Identity: User
Overrideable

This feature is not supported for Windows devices.

S/MIME Signing: User
Overrideable

This feature is not supported for Windows devices.

S/MIME Signing

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 125

Exchange settings

TABLE 19. EXCHANGE SETTINGS (CONT.)
SectionField Name

Description

Encryption by Default

This feature is not supported for Windows devices.

Encryption Identity

This feature is not supported for Windows devices.

Encryption Identity:
User Overrideable

This feature is not supported for Windows devices.

Encryption by Default:
User Overrideable

This feature is not supported for Windows devices.

Per-Message
Encryption Switch

This feature is not supported for Windows devices.

S/MIME
Encryption

ActiveSync
Sync during
Peak Time

Select the preferred synchronization approach for peaktimes.

Off-peak Time

Select the preferred synchronization approach for offpeak times.

Use above settings
when roaming

Specify whether to apply synchronization preferences
while roaming.

Send/receive when
sendSpecify whether queued messages should be sent andreceived whenever the user sends a message.

Peak TimeiOS 5 and Later Settings

Peak Days

Specify which days should be considered peak days.

Start Time

Specify the beginning of the peak period for all peak days.

End Time

Specify the end of the peak period for all peak days.
These features are not supported for Windows devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 126

Configuring POP and IMAP email settings

TABLE 19. EXCHANGE SETTINGS (CONT.)
SectionField Name

Android

Windows 10 Desktop

Description
These features are not supported for Windows devices.

Windows 10 Desktop

This feature is only supported for Windows 10 Desktop
devices.

Configure Outlook

Select this option to configure an email profile with theuse of Microsoft’s Outlook client, versions of 2010 or
2013. Outlook uses the Name, Server Address, Domain,
ActiveSync User Name, ActiveSync User Email, andActiveSync Password. All other settings are ignored.
This is supported only on Outlook 2010 and 2013. Outlook
2016 and future versions require that Auto Discovery is
configured on the Exchange server and does not needthis configuration.
NOTE: This feature requires MobileIron Bridge. See
Setting up MobileIron Bridge for details.

Configuring POP and IMAP email settings
This feature is not supported for Windows devices.

Synchronizing Google account data
You can synchronize email, contacts, calendar, and tasks with mail apps on devices managed by MobileIron Core.
To enable synchronization, you need to authorize apps to use Google APIs for communication between servers
without accessing user information. This requires a service account that makes API calls on behalf of an app, as
well as credentials that authenticate the identity of the app.
You create these credentials in the Google Developers Console, and then upload the credentials both to the Google
Admin Console and MobileIron Core. You can then configure an Exchange setting to synchronize Google email
data (including email, contacts, calendar, and tasks) with managed devices. You can alternatively choose tosynchronize only some email data, such as calendar and contacts only, or email alone.
The Exchange setting also allows you to control the Google Apps password through MobileIron Core.
Main steps
Synchronizing Google Apps data involves the following main steps:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 127

Using OAuth to enable access to Google APIsl

Using OAuth to enable access to Google APIsl

Uploading OAuth credentials to the Google Admin ConsolelLinking Google Apps credentials with MobileIron Corel

Setting up your Exchange setting for access to Google Apps datal

Renewing the Google Apps password for a given set of users (optional)

Before you begin
You need a Google administrator account.
Review the following Google documentation:lhttps://developers.google.com/admin-sdk/?hl=en_USlhttps://support.google.com/googleapi/answer/6158857?hl=enlhttps://support.google.com/googleapi/answer/6158849?hl=en#serviceaccounts

Using OAuth to enable access to Google APIs
You must login to the Google Developers Console to enable access to Google APIs from clients using OAuth.
For detailed information, see the Google documentation here:lhttps://developers.google.com/identity/protocols/OAuth2lhttps://developers.google.com/identity/protocols/OAuth2ServiceAccountFollowing are the main steps of this procedure.
Main steps
1. Login to https://console.developers.google.com
2. In the Google Developers Console, create a new project.
3. Enable the Admin SDK and/or APIs.
4. Create credentials for the OAuth 2.0 client.
5. Create a consent form.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 128

Uploading OAuth credentials to the Google Admin Console

6. Enter the relevant information, as shown in the following table.
Item

Description

Application type

Select web application.

Name

Enter the name of the iOS app.

Authorized JavaScript origins

Enter JavaScript origins here or redirect URIs below (or both).
Cannot contain a wildcard (http://*.example.com) or a path
(http://example.com/subdir).

Authorized redirect URIs

Must have a protocol. Cannot contain URL fragments or relative
paths. Cannot be a public IP address.

7. Download the credentials in the form of a JSON file for the web client.

Uploading OAuth credentials to the Google Admin Console
You must now upload to the Google Admin Console the JSON file you created in Using OAuth to enable access toGoogle APIs on page 128. The JSON files contains the credentials you created for client access.
For detailed information, see the Google documentation here:••

https://developers.google.com/identity/protocols/OAuth2
https://developers.google.com/identity/protocols/OAuth2ServiceAccountFollowing are the main steps of this procedure.
Main steps
1. Go to https://admin.google.com and login with your administrator ID.
2. Enable API access.
3. Enter the client name and API scope.
4. Authorize the JSON file so that clients may access it.

Linking Google Apps credentials with MobileIron Core
You must upload the JSON credentials file you downloaded from the Google Developers console to link your
Google credentials with MobileIron Core. For more information, see Using OAuth to enable access to Google APIs
on page 128.
Procedure
1. In the Admin Portal, go to Services > Google.
2. In the Google Admin Username field, enter your Google administrator email address.
3. Next to the JSON File field, click Browse.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 129

Linking Google Apps credentials with MobileIron Core

4. Select the JSON file you downloaded from the Google Developers Console.
5. Click Save.
The results are displayed on the lower left.

6. Go to Settings > Preferences.
7. Scroll down to the Google Apps API section.
8. Click Password Settings.
9. Configure password settings as follows:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 130

Setting up your Exchange setting for access to Google Apps datalPassword length must be: Enter the minimum password length.

lRequire a password change every: Check the box and enter the number of days after which device
users must change their password.
NOTE: Password expiration and password length values should match whatever isconfigured in Google. For example, if you configured a 90 day expiration period in
Google with a password length of 8 to 90, then you would configure the same
expiration and password length values in MobileIron Core.

10. Click Save.
11. Optionally, view the Google Apps account status by clicking View Account.

Setting up your Exchange setting for access to Google Apps data
Create an Exchange setting to connect MobileIron Core to Google servers, such that device users will be able toaccess their email, calendar, and contacts. Apply the Exchange setting to the relevant labels, such that Core
pushes the new setting to the correct devices. The Exchange setting must include the Google Apps Password flag,
which tells Core to generate a Google Apps password and send it to Google servers.
When sending an event to a device, MobileIron Core checks whether the Google Apps Password flag is toggled on
or off. If a Google Apps password is required, but the password has not yet been generated and sent to Google,
then Core sends the password to Google first before sending the Exchange setting to the device.
If MobileIron Core cannot find a user on Google, Core logs an error, and does not push the Exchange setting again.
Under some circumstances, you may need to renew the Google Apps password. For more information, see
Renewing the Google Apps password for a given set of users on page 133.
Note The Following:ll

If you intend to distribute an AppConnect email app to devices, such as MobileIron Email+ for iOS, youmust add the key email_password with a value of $GOOGLE_AUTOGEN_PASSWORD$ to the
AppConnect app configuration for the email app. For more information, see “Configuring an AppConnect
app configuration” in the MobileIron Core AppConnect and AppTunnel Guide for MobileIron Core.
Set the Exchange Username field to $EMAIL$ when using $GOOGLE_AUTOGEN_PASSWORD$ in the
Password field and when using Android enterprise managed configurations or AppConnect KVPs.

Procedure
1. In the Admin Portal go to Policies & Configs > Configurations.
2. Click Add New > Exchange.
3. In the Exchange Setting dialog box, enter the following:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 131

Setting up your Exchange setting for access to Google Apps data

Item

Description

GeneralName

Enter brief text that identifies this group of Exchange settings.

Description

Enter additional text that clarifies the purpose of this group of Exchange
settings.

Server AddressEnter the address of the mail server, such as m.google.com.
If you are using Standalone Sentry, do the following:•••Enter the address of Standalone Sentry.
Go to Services > Sentry and edit your Standalone Sentry. In the
ActiveSync Server field, enter m.google.com.
If you are using load balancers, contact MobileIron Professional
Services.

For more information about configuring Sentry, see the MobileIron
Sentry Guide.
Use SSL

Select to use secure connections.
NOTE: You must use SSL to link to Google Apps.

Google Apps Password

When linking to Google Apps, select this option to use the Google Apps
password to log in to the Google account you have configured to workwith MobileIron Core. This password allows device users to accesstheir mail, contacts, and calendar data on their managed devices.
When selected, Core grays out the ActiveSync User Name andActiveSync User Password.
This check box only appears if you have configured a Google accountwith MobileIron Core, as described in Synchronizing Google accountdata on page 127.

ActiveSync User EmailSpecify the variable for the email address to be used with this Exchange
configuration. You can specify any or all of the following variables$EMAIL$, $USERID$, $PASSWORD$. You can also specify custom
formats, such as $USERID$_US. Custom attribute variable
substitutions are supported.
Typically, you use $EMAIL$ in this field.

Items to Synchronize

Select the items you want to synchronize with Google Apps: Contacts,
Calendar, Email, Tasks.

4. Click Save.
5. Check the box next to the Exchange setting you created, and select Actions > Apply To Label.
6. Select the labels to which you want to apply the Exchange setting and click Apply.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 132

Renewing the Google Apps password for a given set of users

Renewing the Google Apps password for a given set of users
If there is a communication error when sending a Google Apps password to Google, MobileIron Core. Core tracks
the number of attempts to send updated passwords to Google. If it reaches the preset maximum number ofattempts to contact Google servers, Core stops trying and the password is set to failure state. At this point, youmust manually renew the Google Apps password.
You can renew the Google password for an individual user or a set of users on the Users page in the MobileIron
Core Admin Portal. After you generate it, Core pushes the new password to Google when the device checks in.
Procedure
1. Go to Devices & Users > Users.
2. Select the user or users whose Google password you want to renew.
3. Select Actions > Renew Google Apps Password.
The Admin Portal shows a dialog that lists the users whose Google Apps password you want to renew.
4. Click Renew Google Apps Password.
The Admin Portal sends the request to renew the Google Apps password for the selected users.
5. Click Close.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 133

10Managing Wi-Fi Settings
This section addresses the Wi-Fi settings.
l

Wi-Fi settingsl

Wi-Fi profiles and password cachingl

Wi-Fi authentication types

Wi-Fi settings
To configure wireless network access, in the Admin Console, go to Policies & Configs > Configurations. Click
Add New > Wi-Fi to create a new configuration.
NOTE: Do not assign multiple Wi-Fi profiles to a device if the Network Name SSID (Service Set Identifier)differs only by case. For example, if one profile has an SSID value of "yourco" and another has an
SSID of "YourCo," those two must not be assigned to the same device. Doing so will cause checkin problems, and full device details will not be properly recorded.

Wi-Fi profiles and password caching
To make deployments easier, MobileIron offers the option of caching a user’s Wi-Fi password. This option is turned
off by default. Cached passwords are encrypted, stored on MobileIron Core, and used only for authentication. Notethat the password must match the LDAP password in order for this feature to be of use.

Wi-Fi authentication types
The fields that appear in the New Wi-Fi Setting dialog change based on values selected. The following tables
describe the fields required for each selection in the Authentication field:

Open authentication
Use the following guidelines to set up Open authentication.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 134

Open authentication

TABLE 20. WI-FI OPEN AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.
If the profile name and SSID are different, Windows devices will not connect to
Wi-Fi.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select Open.

Data Encryption

Select the data encryption method associated with the selected authentication
type. The selection affects which of the following fields are displayed. For Openauthentication, the following encryption options are available:• Disabled• WEP• WEP Enterprise

Network Key

WEP encryption
Enter the network key necessary for accessing this network. The network key
should be 5 or 13 ASCII characters or 10 or 26 hexadecimal digits.

Key Index

WEP encryption
If using multiple network keys, select a number indicating the memory positionof the correct encryption key.

Confirm Network Key

Re-enter the network key to confirm.

User NameWEP Enterprise encryption
Specify the variable to use as the user name when establishing the Wi-Fi
connection. See Open authentication on page 134.

Password

WEP Enterprise encryption
Specify the variable to use and any necessary custom formatting for the Wi-Fi
password. The default variable selected is $PASSWORD$.
Enter additional variables or text in the text box adjacent to the Password field.
Entries in this text box are kept hidden and will not be visible to any MobileIron
Core administrator.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 135

Open authentication

TABLE 20. WI-FI OPEN AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description
Note The Following:• If you specify $PASSWORD$, also enable Save User Password under
Settings > System Settings > Users & Devices > Registration.
• All variables and text up to the last valid variable will be visible. Anything
after the last valid variable will not be visible. The valid variable may appear
in either of the password fields.
See Open authentication on page 134.

Apply to Certificates

WEP Enterprise encryption
Configure this field with the CA certificate needed to validate the Identity
Certificate presented by the Wi-Fi Access Point. It is not the CA certificate

needed to validate the Identity Certificate sent to the device in the Wi-Fi
config.
Trusted Certificate Names

WEP Enterprise encryption.
If you did not specify trusted certificates in the Apply to Certificates list, thenenter the names of the authentication servers to be trusted. You can specify aparticular server, such as server.mycompany.com or a partial name such as*.mycompany.com.

Allow Trust Exceptions

WEP Enterprise encryption.
Select this option to let users decide to trust a server when the chain of trust
can’t be established. To avoid these prompts, and to permit connections only totrusted services, turn off this option and upload all necessary certificates.

Use Per-connection
Password

WEP Enterprise encryption.

EAP Type

Select the authentication protocol used:• EAP-FAST• EAP-SIM• LEAP• PEAP• TLS• TTLS

Select this option to prompt the user to enter a password each time the device
connects to the Wi-Fi network.

If you select EAP-FAST, then you also need to specify the Protected Access
Credential (PAC).
If you select TLS, then you must specify an Identity Certificate.
If you select TTLS, then you must also specify the Inner Identity
Authentication Protocol. You may optionally specify an Outer Identity

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 136

Shared authentication

TABLE 20. WI-FI OPEN AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

Connects To

Select Internet or Work.

Apple Settings

These features are not supported on Windows devices.

Windows Settings

These features are not supported on Windows devices.

Proxy TypeSpecifies whether a proxy is configured and which type is configured. Available
types are Manual and Auto.
NOTE: The Auto type is only available for Windows 10 Mobile devices.

PAC URL

Specifies the URL for the proxy auto-configuration (PAC) file. This option is only
available after selecting Auto.

Proxy Host

Specifies the proxy host. This option is only available after selecting Manual.

Proxy Port

Specifies the proxy port. This option is only available after selecting Manual.

Related topicslShared authenticationl

WPA Enterprise authenticationl

WPA2 / WPA3 Enterprise authenticationl

WPA Personal authenticationl

WPA2 / WPA3 Personal authenticationlSupported variables for Wi-Fi authentication

Shared authentication
Use the following guidelines to set up shared authentication:

TABLE 21. WI-FI SHARED AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.
If the profile name and SSID are different, Windows devices will not connect to
Wi-Fi.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 137

Shared authentication

TABLE 21. WI-FI SHARED AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select Shared.

Data Encryption

Select the data encryption method associated with the selected authentication
type. The selection affects which of the following fields are displayed. For
Shared authentication, the following encryption options are available:• Disabled• WEP• WEP Enterprise

Network Key

WEP encryption
Enter the network key necessary for accessing this network. The network key
should be 5 or 13 ASCII characters or 10 or 26 hexadecimal digits.

Key Index

WEP encryption
If using multiple network keys, select a number indicating the memory positionof the correct encryption key.

Confirm Network Key

Re-enter the network key to confirm.

User NameWEP Enterprise encryption
Specify the variable to use as the user name when establishing the Wi-Fi
connection. See Shared authentication on page 137.

Password

WEP Enterprise encryption
Specify the variable to use and any necessary custom formatting for the Wi-Fi
password. The default variable selected is $PASSWORD$.
Enter additional variables or text in the text box adjacent to the Password field.
Entries in this text box are kept hidden and will not be visible to any MobileIron
Core administrator.
Note The Following:• If you specify $PASSWORD$, also enable Save User Password under
Settings > System Settings > Users & Devices > Registration.
• All variables and text up to the last valid variable will be visible. Anything
after the last valid variable will not be visible. The valid variable may appear
in either of the password fields.
See Shared authentication on page 137.

Apply to Certificates

WEP Enterprise encryption

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 138

Shared authentication

TABLE 21. WI-FI SHARED AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description
Configure this field with the CA certificate needed to validate the Identity
Certificate presented by the Wi-Fi Access Point. It is not the CA certificate
needed to validate the Identity Certificate sent to the device in the Wi-Fi config.

Trusted Certificate Names

WEP Enterprise encryption.
If you did not specify trusted certificates in the Apply to Certificates list, thenenter the names of the authentication servers to be trusted. You can specify aparticular server, such as server.mycompany.com or a partial name such as*.mycompany.com.

Allow Trust Exceptions

WEP Enterprise encryption.
Select this option to let users decide to trust a server when the chain of trust
can’t be established. To avoid these prompts, and to permit connections only totrusted services, turn off this option and upload all necessary certificates.

Use Per-connection
Password

WEP Enterprise encryption.

EAP Type

Select the authentication protocol used:• EAP-FAST• EAP-SIM• LEAP• PEAP• TLS• TTLS

Select this option to prompt the user to enter a password each time the device
connects to the Wi-Fi network.

If you select EAP-FAST, then you also need to specify the Protected Access
Credential (PAC).
If you select TLS, then you must specify an Identity Certificate.
If you select TTLS, then you must also specify the Inner Identity
Authentication Protocol. You may optionally specify an Outer Identity.
Connects To

Select Internet or Work.

Apple Settings

These features are not supported on Windows devices.

Related topicslOpen authenticationl

WPA Enterprise authenticationl

WPA2 / WPA3 Enterprise authenticationl

WPA Personal authentication

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 139

WPA Enterprise authenticationl

WPA2 / WPA3 Personal authenticationlSupported variables for Wi-Fi authentication

WPA Enterprise authentication
Use the following guidelines to set up WPA Enterprise authentication:

TABLE 22. WI-FI WPA ENTERPRISE AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.
If the profile name and SSID are different, Windows devices will not connect to
Wi-Fi.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select WPA Enterprise.

Data Encryption

Select the data encryption method associated with the selected authentication
type. For WPA Enterprise authentication, the following encryption options areavailable:• AES• TKIP

User Name

Specify the variable to use as the user name when establishing the Wi-Fi
connection. See WPA Enterprise authentication on page 140.

Password

Specify the variable to use and any necessary custom formatting for the Wi-Fi
password. The default variable selected is $PASSWORD$.
Enter additional variables or text in the text box adjacent to the Password field.
Entries in this text box are kept hidden and will not be visible to any MobileIron
Core administrator.
Note The Following:• If you specify $PASSWORD$, also enable Save User Password under
Settings > System Settings > Users & Devices > Registration.
• All variables and text up to the last valid variable will be visible. Anything
after the last valid variable will not be visible. The valid variable may appear
in either of the password fields.
See WPA Enterprise authentication on page 140.

Apply to Certificates

Configure this field with the CA certificate needed to validate the Identity

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 140

WPA Enterprise authentication

TABLE 22. WI-FI WPA ENTERPRISE AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description
Certificate presented by the Wi-Fi Access Point. It is not the CA certificate
needed to validate the Identity Certificate sent to the device in the Wi-Fi
configuration.

Trusted Certificate Names

If you did not specify trusted certificates in the Apply to Certificates list, thenenter the names of the authentication servers to be trusted. You can specify aparticular server, such as server.mycompany.com or a partial name such as*.mycompany.com.

Allow Trust Exceptions

Select this option to let users decide to trust a server when the chain of trust
can’t be established. To avoid these prompts, and to permit connections only totrusted services, turn off this option and upload all necessary certificates.

Use Per-connection
Password

Select this option to prompt the user to enter a password each time the device
connects to the Wi-Fi network.

EAP Type

Select the authentication protocol used:• EAP-FAST• EAP-SIM• LEAP• PEAP• TLS• TTLS
If you select EAP-FAST, then you also need to specify the Protected Access
Credential (PAC).
If you select TLS, then you must specify an Identity Certificate.
If you select TTLS, then you must also specify the Inner Identity
Authentication Protocol. You may optionally specify an Outer Identity.

Connects To

Select Internet or Work.

Apple Settings

These features are not supported on Windows devices.

Related topicslOpen authenticationlShared authenticationl

WPA2 / WPA3 Enterprise authenticationl

WPA Personal authenticationl

WPA2 / WPA3 Personal authenticationlSupported variables for Wi-Fi authentication

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 141

WPA2 / WPA3 Enterprise authentication

WPA2 / WPA3 Enterprise authentication
Use the following guidelines to configure WPA2 or WPA3 Enterprise authentication.
Except for Apple TV, WPA2 Enterprise is applicable to iOS 8.0 through the latest version as supported by
MobileIron.
WPA3 Enterprise is applicable to iOS 13.0 through the latest version as supported by MobileIron.

TABLE 23. WI-FI WPA2 / WPA3 ENTERPRISE AUTHENTICATION FIELD DESCRIPTION
Item

Description

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.
If the profile name and SSID are different, Windows devices will not connect to
Wi-Fi.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select one:
• WPA2 Enterprise• WPA2 Enterprise (iOS 8 or later except Apple TV)• WPA3 Enterprise (iOS 13 or later)

Data Encryption

Select the data encryption method associated with the selected authentication
type. For WPA2 Enterprise authentication, the following encryption options areavailable:
l

AES

l

TKIP

User Name

Specify the variable to use as the user name when establishing the Wi-Fi
connection. See WPA2 / WPA3 Enterprise authentication on page 142.

Password

Specify the variable to use and any necessary custom formatting for the Wi-Fi
password. The default variable selected is $PASSWORD$.
Enter additional variables or text in the text box adjacent to the Password field.
Entries in this text box are kept hidden and will not be visible to any MobileIron
Core administrator.
Note The Following:• If you specify $PASSWORD$, also enable Save User Password under
Settings > System Settings > Users & Devices > Registration.
• All variables and text up to the last valid variable will be visible. Anything
after the last valid variable will not be visible. The valid variable may appear

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 142

WPA2 / WPA3 Enterprise authentication

TABLE 23. WI-FI WPA2 / WPA3 ENTERPRISE AUTHENTICATION FIELD DESCRIPTION (CONT.)
Item

Descriptionin either of the password fields. Valid variables are variables in the dropdown list.

Apply to Certificates

Configure this field with the CA certificate needed to validate the Identity
Certificate presented by the Wi-Fi Access Point. It is not the CA certificate
needed to validate the Identity Certificate sent to the device in the Wi-Fi
configuration.

Trusted Certificate Names

If you did not specify trusted certificates in the Apply to Certificates list, thenenter the names of the authentication servers to be trusted. You can specify aparticular server, such as server.mycompany.com or a partial name such as*.mycompany.com.

Allow Trust Exceptions

Select this option to let users decide to trust a server when the chain of trust
can’t be established. To avoid these prompts, and to permit connections only totrusted services, turn off this option and upload all necessary certificates.

Use Per-connection
Password

Select this option to prompt the user to enter a password each time the device
connects to the Wi-Fi network.

EAP Type

Select the authentication protocol used:l

EAP-FASTl

EAP-SIM

l

LEAP

l

PEAP

l

TLS

l

TTLS

If you select EAP-FAST, then you also need to specify the Protected Access
Credential (PAC).
If you select TLS, then you must specify an Identity Certificate.
If you select TTLS, then you must also specify the Inner Identity
Authentication Protocol. You may optionally specify an Outer Identity.
Connects To

Select Internet or Work.

Apple Settings

These features are not supported on Windows devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 143

WPA Personal authentication

Related topicslOpen authenticationlShared authenticationl

WPA Enterprise authenticationl

WPA Personal authenticationl

WPA2 / WPA3 Personal authenticationlSupported variables for Wi-Fi authentication

WPA Personal authentication
Use the following guidelines to configure WPA Personal authentication.

TABLE 24. WI-FI WPA PERSONAL AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.
If the profile name and SSID are different, Windows devices will not connect to
Wi-Fi.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select WPA Personal.

Data Encryption

Select the data encryption method associated with the selected authentication
type. For WPA Personal authentication, the following encryption options areavailable:• AES• TKIP

Network Key

Enter the network key necessary for accessing this network. The key should be
at least 8 characters long.

Confirm Network Key

Re-enter the network key to confirm.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 144

WPA2 Personal authentication

TABLE 24. WI-FI WPA PERSONAL AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

EAP Type

Not applicable.

Connects To

Select Internet or Work.

Apple Settings

These features are not supported on Windows devices.

WPA2 Personal authentication
Use the following guidelines to configure WPA2 Personal authentication.

TABLE 25. WI-FI WPA2 PERSONAL AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.
If the profile name and SSID are different, Windows devices will not connect to
Wi-Fi.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select WPA2 Personal.

Data Encryption

Select the data encryption method associated with the selected authentication
type. For WPA Personal authentication, the following encryption options areavailable:• AES• TKIP

Network Key

Enter the network key necessary for accessing this network. The key should be
at least 8 characters long.

Confirm Network Key

Re-enter the network key to confirm.

EAP Type

Not applicable.

Connects To

Select Internet or Work.

iOS Settings

These features are not supported on Windows devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 145

WPA2 / WPA3 Personal authentication

Related topicslOpen authenticationlShared authenticationl

WPA Enterprise authenticationl

WPA2 / WPA3 Enterprise authenticationl

WPA2 / WPA3 Personal authenticationlSupported variables for Wi-Fi authentication

WPA2 / WPA3 Personal authentication
Use the following guidelines to configure WPA2 or WPA3 Personal authentication.
WPA3 Personal is applicable to iOS 13.0 through the latest version as supported by MobileIron.

TABLE 26. WI-FI WPA2 / WPA3 PERSONAL AUTHENTICATION FIELD DESCRIPTIONS
Item

Description

Name

Enter the name to use to reference this configuration in MobileIron.

Network Name (SSID)Enter the name (i.e., service set identifier) of the Wi-Fi network these settings
apply to. This field is case sensitive.
If the profile name and SSID are different, Windows devices will not connect to
Wi-Fi.

Description

Enter additional text to clarify the purpose of this group of Wi-Fi settings.

Hidden Network

Select this option if the SSID is not broadcast.

Authentication

Select one:
• WPA2 Personal• WPA3 Personal (iOS 13 or later)

Data Encryption

Select the data encryption method associated with the selected authentication
type. For WPA Personal authentication, the following encryption options areavailable:• AES• TKIP

Network Key

Enter the network key necessary for accessing this network. The key should be
at least 8 characters long.

Confirm Network Key

Re-enter the network key to confirm.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 146

Supported variables for Wi-Fi authentication

TABLE 26. WI-FI WPA2 / WPA3 PERSONAL AUTHENTICATION FIELD DESCRIPTIONS (CONT.)
Item

Description

EAP Type

Not applicable.

Connects To

Select Internet or Work.

Apple Settings

These features are not supported on Windows devices.

Related topicslOpen authenticationlShared authenticationl

WPA Enterprise authenticationl

WPA2 / WPA3 Enterprise authenticationl

WPA Personal authenticationlSupported variables for Wi-Fi authentication

Supported variables for Wi-Fi authentication
You can use the following variables in fields that support variables.
l$PASSWORD$ (only supported in the password field)l$EMAIL$l$USERID$l$DEVICE_MAC$l$NULL$l$USER_CUSTOM1$... $USER_CUSTOM4$ (custom fields defined for LDAP)

Custom attribute variable substitutions are supported.
Related topicslOpen authenticationlShared authenticationl

WPA Personal authenticationl

WPA2 / WPA3 Personal authenticationl

WPA Enterprise authenticationl

WPA2 / WPA3 Enterprise authentication

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 147

11Managing VPN Settings
This section addresses the VPN settings. If you do not see information for the relevant VPN setting, check the
MobileIron Core Device Management Guide of the relevant OS.
l

VPN settings overviewlConfiguring new VPN settingsl

Check Point Capsulel

Cisco AnyConnect (iOS only)l

Cisco Legacy AnyConnectl

F5 SSLl

IKEv2 (iOS Only)l

IKEv2 (Windows)l

IPSec (Blue Coat)l

IPSec (Cisco)lJuniper SSL

l

L2TP

l

MobileIron Tunnel (iOS and macOS)l

MobileIron Tunnel (Android)lMobileIron Tunnel (Samsung Knox Workspace)l

MobileIron Tunnel (Windows)l

NetMotion Mobility VPN (iOS)l

OpenVPN

l

Palo Alto Networks GlobalProtectlPulse Secure SSLlSamsung Knox IPsecl

SonicWall Mobile ConnectlCustom SSLlApplication-triggered VPN for Windows devices

VPN settings overview
NOTE: This feature is supported for Cisco’s AnyConnect VPN client on Windows devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 148

Configuring new VPN settings

VPN is a technology that creates a secure network connection over a public network. A mobile device uses a VPN
client to securely access protected corporate networks.
To use VPN:l

On the device, the user installs a VPN client app.

lDefine a VPN setting in MobileIron Core.

l

Apply labels to the VPN setting so that the VPN setting is sent to the appropriate devices.

l

Depending on the type of VPN, additional set up steps may be required to complete the VPN configuration.

Apps@Work uses the VPN client and the VPN setting, based on defined VPN rules, to enable access to corporate
networks.

Configuring new VPN settings
In the Admin Portal, go to Policies & Configs > Configurations and click Add New > VPN to configure VPN
access.
For macOS only, select one of the following Channel options:lDevice channel - the configuration is effective for all users on a device. This is the typical option.

lUser channel - the configuration is effective only for the currently registered user on a device.

The following sections describe the fields required for each selection in the Connect Type field. For MobileIron
Tunnel support for Android, select MobileIron Tunnel (Android) in the Connection Type field.

About VPN settings for Windows deviceslll

The following VPN settings are supported for Windows devices:o

Cisco Legacy AnyConnect

o

IKEv2

o

Juniper SSL

o

PPTP

o

Pulse Secure SSL

The following VPN settings are expected to work, but are not included in product warranty as they havebeen tested for provisioning only, but not tested for connectivity with Windows devices:o

F5 SSLo

SonicWALL

If you change the name of a VPN profile, it is pushed as a new profile to the device.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 149

Check Point Capsulel

Identity certificates with Microsoft SCEP are supported. A root or intermediate certificate from a trusted
certificate authority (CA) is required, and you must set up MobileIron Core to act as a SCEP reverse proxy.

Check Point Capsule
This VPN connection type is supported on iOS, macOS, and Windows devices only. It is not supported on Android
devices
Use the following guidelines to configure the Check Point Capsule VPN connection type:l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:lWindows ConfigurationlCustom Data

Proxy - None (default)
Use the following guidelines to configure a Check Point Capsule VPN without a proxy.

TABLE 27. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Check Point Capsule.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 150

Proxy - Manual

TABLE 27. PROXY - NONE SETTINGS (CONT.)
Item

Description$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Send All Traffic

Select to send all traffic from the Windows device through the VPN gateway.
When Send All Traffic is checked, all traffic is sent through the VPN gateway
with the exception of traffic from the resources you enter in this table.
When Send All Traffic is unchecked, only traffic from the resources you enterin this table is sent through the VPN gateway.

Continue to Windows Configuration.
Continue to Custom Data.

Proxy - Manual
If you select Manual, you must specify the proxy server, port number. and proxy domain information.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 151

Proxy - Manual

TABLE 28. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Check Point Capsule.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. For an Automatic proxy, see Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.
Type - Select Static or Variable for the type of authentication to be used for theproxy server.

Type

Select Manual proxy to see this option. Select Static or Variable.

Proxy Server User Name

If the authentication type is Static, enter the user name for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)This setting applies to iOS and macOS devices only.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users will

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 152

Proxy - Automatic

TABLE 28. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
need to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Send All Traffic

Select to send all traffic from the Windows device through the VPN gateway.
When Send All Traffic is checked, all traffic is sent through the VPN gateway
with the exception of traffic from the resources you enter in this table.
When Send All Traffic is unchecked, only traffic from the resources you enterin this table is sent through the VPN gateway.

Continue to Windows Configuration.
Continue to Custom Data.

Proxy - Automatic
If you selected an Automatic proxy, you must specify the proxy server URL and proxy domain(s).
WARNING: For Windows 10 devices, please add the configuration and value for automatic proxy in the
Custom Data Grid. Automatic proxy is not supported in Windows 8.1.
TABLE 29. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 153

Proxy - Automatic

TABLE 29. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Check Point Capsule.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. For a manual proxy, see Proxy - Manual

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)This setting applies to iOS and macOS devices only.

Username

Specify the user name to use (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$

Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 154

Windows Configuration

TABLE 29. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Send All Traffic

Select to send all traffic from the Windows device through the VPN gateway.
When Send All Traffic is checked, all traffic is sent through the VPN gateway
with the exception of traffic from the resources you enter in this table.
When Send All Traffic is unchecked, only traffic from the resources you enterin this table is sent through the VPN gateway.

Continue to Windows Configuration.
Continue to Custom Data.

Windows Configuration
Allowed Secured Resources (Windows Phone only)
Excluded Secured Resources (Windows Phone only)
See Application-triggered VPN for Windows devices for information on how to configure these settings to set up
application-triggered VPN for 8.0.1 devices.

TABLE 30. WINDOWS CONFIGURATIONS
Item

Description

Windows Configuration

Enter the secured resources (domains, IP ranges, or apps) used by the Send
All Traffic option.

Always On

Select this option to keep the VPN on. Lock Down supersedes this option for
Windows devices.

Lock Down

You cannot change the assigned settings unless 1) the Lock Down setting isremoved from the profile and the new profile is pushed to the device or 2) the
device is un-enrolled from Core.
This option supersedes the Always On option.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 155

Cisco AnyConnect (iOS only)

Cisco AnyConnect (iOS only)This VPN connection type is supported on iOS devices only. It is not supported on Android, macOS, and Windows
devices.

Cisco Legacy AnyConnect
This VPN connection type is supported on iOS devices (up to version 12.0), macOS, Android, and Windows
devices.
Cisco Legacy AnyConnect is a universal app that can be used with Samsung Knox or with any Android device.
This app can be used for all VPN modes:lper-app inside the Knox containerlper-app outside the Knox containerlper-container (Knox)lper-device (Knox)lper-device (Android)

Use the following guidelines to configure Cisco Legacy AnyConnect VPN.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:lWindows ConfigurationlCustom Data (does not apply to Android devices)

Proxy - None (default)
Use the following guidelines to configure a Cisco Legacy AnyConnect VPN without a proxy.

TABLE 31. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:lDevice channel - the configuration is effective for all users on a device.
This is the typical option.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 156

Proxy - None (default)

TABLE 31. PROXY - NONE SETTINGS (CONT.)
Item

DescriptionlUser channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Cisco Legacy AnyConnect.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users will

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 157

Proxy - Manual

TABLE 31. PROXY - NONE SETTINGS (CONT.)
Item

Description
need to fill in the relevant password.

Group Name

Specify the name of the group to use.

VPN On DemandThis setting does not apply to Windows devices.

Per-App VPNThis setting applies to iOS and macOS devices only.

Provider Type

This setting applies to iOS and macOS devices only.

Continue to Windows Configuration.
Continue to Custom Data.

Proxy - Manual
If you select Manual, you must specify the proxy server, port number, and proxy domain information.

TABLE 32. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a
device. This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Cisco Legacy AnyConnect.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.
Type - Select Static or Variable for the type of authentication to be used forthe proxy server.

Proxy Server User Name

If the authentication type is Static, enter the user name for the proxy server.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 158

Proxy - Manual

TABLE 32. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)This setting applies to iOS and macOS devices only.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Group Name

Specify the name of the group to use.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 159

Proxy - Automatic

TABLE 32. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

VPN on DemandThis setting does not apply to Windows devices.

Per-App VPNThis setting applies to iOS and macOS devices only.

Provider Type

This setting applies to iOS and macOS devices only.

Continue to Windows Configuration.
Continue to Custom Data.

Proxy - Automatic
If you selected an Automatic proxy, you must specify the proxy server URL and proxy domain(s).

TABLE 33. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Cisco Legacy AnyConnect.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)This setting applies to iOS and macOS devices only.

Username

Specify the user name to use (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 160

Windows Configuration

TABLE 33. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Group Name

Specify the name of the group to use.

VPN On DemandThis setting does not apply to Windows devices.

Per-App VPNThis setting applies to iOS and macOS devices only.

Provider Type

This setting applies to iOS and macOS devices only.

Continue to Windows Configuration.
Continue to Custom Data.

Windows Configuration
Allowed Secured Resources (Windows Phone only)
Excluded Secured Resources (Windows Phone only)
See Application-triggered VPN for Windows devices for information on how to configure these settings to set up
application-triggered VPN for 8.0.1 devices.

TABLE 34. WINDOWS CONFIGURATIONS
Item

Description

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 161

Custom Data

TABLE 34. WINDOWS CONFIGURATIONS (CONT.)
Windows Configuration

Enter the secured resources (domains, IP ranges, or apps) used by the Send
All Traffic option.

Always On

Select this option to keep the VPN on. Lock Down supersedes this option for
Windows devices.

Lock Down

You cannot change the assigned settings unless 1) the Lock Down setting isremoved from the profile and the new profile is pushed to the device or 2) the
device is un-enrolled from Core.
This option supersedes the Always On option.

Custom Data
Custom Data does not apply to Android devices.
ll

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

F5 SSL
This VPN connection type is supported on iOS, macOS, Windows devices. F5 SSL supports Android devices thathave Samsung Knox enabled and on Android devices without Samsung Knox.
Use the following guidelines to configure the F5 SSL VPN connection type:l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:lWindows ConfigurationlCustom Data

Proxy - None (default)
Use the following guidelines to configure a F5 SSL VPN without a proxy.

TABLE 35. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 162

Proxy - None (default)

TABLE 35. PROXY - NONE SETTINGS (CONT.)
Item

Description

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

This setting is not supported on Windows devices.Select F5 SSL.

Samsung Knox

This setting is only supported on Android devices.

Deploy inside Knox
Workspace

This setting is only supported on Android devices.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 163

Proxy - Manual

TABLE 35. PROXY - NONE SETTINGS (CONT.)
Item

Description$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN On DemandThis setting applies to Windows devices only.

Per-App VPNThis setting does not apply to Windows devices.

Provider Type

This setting applies to iOS and macOS devices only.

Continue to Windows Configuration.
Continue to Custom Data.

Proxy - Manual
If you select Manual, you must specify the proxy server, port number. and proxy domain information.

TABLE 36. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

This setting is not supported on Windows devices.Select F5 SSL.

Samsung Knox

This setting is only supported on Android devices.

Deploy inside Knox
Workspace

This setting is only supported on Android devices.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. For an Automatic proxy, see Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 164

Proxy - Manual

TABLE 36. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

Proxy Server PortEnter the port number for the proxy server.
Type - Select Static or Variable for the type of authentication to be used for theproxy server.

Proxy Server User Name

If the authentication type is Static, enter the user name for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)This setting applies to iOS and macOS devices only.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 165

Proxy - Automatic

TABLE 36. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Per-App VPNThis setting does not apply to Windows devices.

Provider Type

This setting applies to iOS and macOS devices only.

Continue to Windows Configuration.
Continue to Custom Data.

Proxy - Automatic
If you selected an Automatic proxy, you must specify the proxy server URL and proxy domain(s).
WARNING: For Windows 10 devices, please add the configuration and value for automatic proxy in the
Custom Data Grid. Automatic proxy is not supported in Windows 8.1.
TABLE 37. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

This setting is not supported on Windows devices.Select F5 SSL.

Samsung Knox

This setting is only supported on Android devices.

Deploy inside Knox
Workspace

This setting is only supported on Android devices.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. For a manual proxy, see Proxy - Manual

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)This setting applies to iOS and macOS devices only.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 166

Windows Configuration

TABLE 37. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description

Username

Specify the user name to use (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$

Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

VPN On DemandThis setting does not apply to Windows devices.

Per-App VPNThis setting does not apply to Windows devices.

Provider Type

This setting applies to iOS and macOS devices only.

Continue to Windows Configuration.
Continue to Custom Data.

Windows Configuration
Allowed Secured Resources (Windows Phone only)
Excluded Secured Resources (Windows Phone only)

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 167

Custom Data

See Application-triggered VPN for Windows devices for information on how to configure these settings to set up
application-triggered VPN for 8.0.1 devices.

TABLE 38. WINDOWS CONFIGURATIONS
Item

Description

Windows Configuration

Enter the secured resources (domains, IP ranges, or apps) used by the Send
All Traffic option.

Always On

Select this option to keep the VPN on. Lock Down supersedes this option for
Windows devices.

Lock Down

You cannot change the assigned settings unless 1) the Lock Down setting isremoved from the profile and the new profile is pushed to the device or 2) the
device is un-enrolled from Core.
This option supersedes the Always On option.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

IKEv2 (iOS Only)
This VPN connection type is supported on iOS devices. It is not supported on Android, macOS, and Windows
devices.

IKEv2 (Windows)
This VPN connection type is supported on Windows devices. It is not supported on Android, iOS, and macOS
devices.
NOTE: For Windows 10 devices, please add the configuration and value for auto proxy in the Custom
Data Grid. Please note that the Automatic proxy is not supported in Windows 8.1.
Note The Following:llWindows devices do not support pushing $USERID$ and $PASSWORD$ to the device in VPN settings.
The device user must enter user name and password to connect to VPN.
For certificate authentication, Windows devices only support identity certificates using SCEP reverse
proxy.

Use the following guidelines to configure a IKEv2 (Windows) VPN.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 168

Proxy - None (default)lProxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:lWindows ConfigurationlCustom Data

Proxy - None (default)
Use the following guidelines to configure a IKEv2 (Windows) VPN connection without a proxy.

TABLE 39. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select IKEv2 (Windows).

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.
NOTE: Windows 8.1 devices do not currently support Automatic Proxy.

Proxy Server

Select Manual proxy to see this option. Enter the name for the proxy server.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users will

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 169

Proxy - Manual

TABLE 39. PROXY - NONE SETTINGS (CONT.)
Item

Description
need to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Send All Traffic

Select to send all traffic from the Windows device through the VPN gateway.
When Send All Traffic is checked, all traffic is sent through the VPN gateway
with the exception of traffic from the resources you enter in this table.
When Send All Traffic is unchecked, only traffic from the resources you enter inthis table is sent through the VPN gateway.

Continue to Windows Configuration.
Continue to Custom Data.

Proxy - Manual
Use the following guidelines to configure a IKEv2 (Windows) VPN connection with a manual proxy.

TABLE 40. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 170

Proxy - Manual

TABLE 40. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
registered user on a device.

Connection Type

Select IKEv2 (Windows).

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an Automatic proxy, go to Proxy - Automatic.
NOTE: Windows 8.1 devices do not currently support Automatic Proxy.

Proxy Server

Select Manual proxy to see this option. Enter the name for the proxy server.

Proxy Server Port

Select Manual proxy to see this option. Enter the port for the proxy server.

Type

Select Manual proxy to see this option. Select Static or Variable.

Proxy Server User Name

Select Manual proxy to see this option. If the type is Static, enter the username
for the proxy server
If the type is Variable, the default variable selected is $USERID$.
NOTE: Windows devices do not support Proxy Server User Name.

Proxy Server Password

Select Manual proxy to see this option. If the type is Static, enter the password
for the proxy server
If the type is Variable, the default variable selected is $PASSWORD$.
NOTE: Windows devices do not support Proxy Server Password.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 171

Proxy - Automatic

TABLE 40. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Send All Traffic

Select to send all traffic from the Windows device through the VPN gateway.
When Send All Traffic is checked, all traffic is sent through the VPN gateway
with the exception of traffic from the resources you enter in this table.
When Send All Traffic is unchecked, only traffic from the resources you enter inthis table is sent through the VPN gateway.

Continue to Windows Configuration.
Continue to Custom Data.

Proxy - Automatic
Use the following guidelines to configure a IKEv2 (Windows) VPN connection with an automatic proxy.
NOTE: For Windows 10 devices, please add the configuration and value for auto proxy in the Custom
Data Grid. Please note that the Automatic proxy is not supported in Windows 8.1.
TABLE 41. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select IKEv2 (Windows).

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure an Manual proxy, go to Proxy - Manual .

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 172

Windows Configuration

TABLE 41. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
NOTE: Windows 8.1 devices do not currently support Automatic Proxy.

Proxy Server URL

Select Automatic proxy to see this option. Enter the URL for the proxy server.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Send All Traffic

Select to send all traffic from the Windows device through the VPN gateway.
When Send All Traffic is checked, all traffic is sent through the VPN gateway
with the exception of traffic from the resources you enter in this table.
When Send All Traffic is unchecked, only traffic from the resources you enter inthis table is sent through the VPN gateway.

Continue to Windows Configuration.
Continue to Custom Data.

Windows Configuration
Allowed Secured Resources (Windows Phone only)
MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 173

Custom Data

Excluded Secured Resources (Windows Phone only)
See Application-triggered VPN for Windows devices for information on how to configure these settings to set up
application-triggered VPN for 8.0.1 devices.

TABLE 42. WINDOWS CONFIGURATIONS
Item

Description

Windows Configuration

Enter the secured resources (domains, IP ranges, or apps) used by the Send
All Traffic option.

Always On

Select this option to keep the VPN on. Lock Down supersedes this option for
Windows devices.

Lock Down

You cannot change the assigned settings unless 1) the Lock Down setting isremoved from the profile and the new profile is pushed to the device or 2) the
device is un-enrolled from Core.
This option supersedes the Always On option.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

IPSec (Blue Coat)This VPN connection type is supported on iOS devices. It is not supported on Android, macOS, and Windows
devices.

IPSec (Cisco)This VPN connection type is supported on iOS and macOS devices. It is not supported on Android and Windows
devices.

Juniper SSL
This VPN connection type is supported on iOS, macOS, Android and Windows devices.
NOTE: MobileIron recommends that you use Pulse Secure SSL instead of Juniper SSL.
Use the following guidelines to configure Juniper SSL VPN.
l

Proxy - None (default)lProxy - Manual

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 174

Proxy - None (default)lProxy - AutomaticWithin these selections, you may make settings for:lWindows ConfigurationlCustom Data

Proxy - None (default)
Use the following guidelines to configure a Juniper SSL VPN without a proxy.

TABLE 43. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Juniper SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 175

Proxy - Manual

TABLE 43. PROXY - NONE SETTINGS (CONT.)
Item

Description
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Role

Specify the Juniper user role to use as a restriction.

Realm

Specify the Juniper realm to use as a restriction.

VPN On DemandThis setting does not apply to Windows devices.

Per-app VPNThis setting does not apply to Windows devices.

Provider Type

This setting applies to iOS and macOS devices only.

Continue to Windows Configuration.
Continue to Custom Data.

Proxy - Manual
Use the following guidelines to configure a Juniper SSL VPN with a manual proxy.

TABLE 44. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:lDevice channel - the configuration is effective for all users on a device.
This is the typical option.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 176

Proxy - Manual

TABLE 44. PROXY - MANUAL SETTINGS (CONT.)
Item

DescriptionlUser channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Juniper SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an Automatic proxy, go to Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)This setting applies to iOS and macOS devices only.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 177

Proxy - Automatic

TABLE 44. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Role

Specify the Juniper user role to use as a restriction.

Realm

Specify the Juniper realm to use as a restriction.

VPN On DemandThis setting does not apply to Windows devices.

Per-app VPNThis setting does not apply to Windows devices.

Provider Type

This setting applies to iOS and macOS devices only.

Continue to Windows Configuration
Continue to Custom Data.

Proxy - Automatic
Use the following guidelines to configure a Juniper SSL VPN with an automatic proxy.

TABLE 45. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 178

Proxy - Automatic

TABLE 45. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description

Connection Type

Select Juniper SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a manual proxy, go to Proxy - Manual .

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)This setting applies to iOS and macOS devices only.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 179

Windows Configuration

TABLE 45. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description

Role

Specify the Juniper user role to use as a restriction.

Realm

Specify the Juniper realm to use as a restriction.

VPN On DemandThis setting does not apply to Windows devices.

Per-app VPNThis setting does not apply to Windows devices.

Provider Type

This setting applies to iOS and macOS devices only.

Continue to Windows Configuration.
Continue to Custom Data.

Windows Configuration
Allowed Secured Resources (Windows Phone only)
Excluded Secured Resources (Windows Phone only)
See Application-triggered VPN for Windows devices for information on how to configure these settings to set up
application-triggered VPN for 8.0.1 devices.

TABLE 46. WINDOWS CONFIGURATIONS
Item

Description

Windows Configuration

Enter the secured resources (domains, IP ranges, or apps) used by the Send
All Traffic option.

Always On

Select this option to keep the VPN on. Lock Down supersedes this option for
Windows devices.

Lock Down

You cannot change the assigned settings unless 1) the Lock Down setting isremoved from the profile and the new profile is pushed to the device or 2) the
device is un-enrolled from Core.
This option supersedes the Always On option.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

L2TP
This VPN connection type is supported on iOS, macOS, and Windows devices. It is not supported on Android
devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 180

Proxy - None (default)This section covers how to configure L2TP VPN.
l

Proxy - None (default)lProxy - Manuall

Proxy - Automatic

Proxy - None (default)
Use the following guidelines to configure a L2TP VPN without a proxy.

TABLE 47. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select L2TP.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

Shared Secret

The shared secret passcode. This is not the user’s password; the sharedsecret must be specified to initiate a connection.

Confirm Shared Secret

Re-enter the shared secret to confirm.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users will

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 181

Proxy - Manual

TABLE 47. PROXY - NONE SETTINGS (CONT.)
Item

Description
need to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the authentication method to use: Password or RSA SecureID.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Proxy - Manual
Use the following guidelines to configure a L2TP VPN with a manual proxy.

TABLE 48. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select L2TP.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an automatic proxy, go to Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 182

Proxy - Manual

TABLE 48. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)This setting applies to iOS and macOS devices only.
The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.
Click Add+ to add a domain.

Shared Secret

The shared secret passcode. This is not the user’s password; the sharedsecret must be specified to initiate a connection.

Confirm Shared Secret

Re-enter the shared secret to confirm.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the authentication method to use:Password or RSA SecureID.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 183

Proxy - Automatic

TABLE 48. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Proxy - Automatic
Use the following guidelines to configure a L2TP VPN with an automatic proxy.

TABLE 49. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select L2TP.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a Manual proxy, go to Proxy - Manual.

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)This setting applies to iOS and macOS devices only.
The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes
can be used to match multiple domains. For example, .com would include all.com domains, and example.com would include all domains ending inexample.com, such as pages.example.com and mysite.example.com .
Wildcards are not supported.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 184

MobileIron Tunnel (iOS and macOS)

TABLE 49. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
Click Add+ to add a domain.

Shared Secret

The shared secret passcode. This is not the user’s password; the sharedsecret must be specified to initiate a connection.

Confirm Shared Secret

Re-enter the shared secret to confirm.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

Username

Specify the user name to use. The default value is $USERID$. Use this field
to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the authentication method to use:Password or RSA SecureID.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

MobileIron Tunnel (iOS and macOS)
This VPN connection type is supported on iOS and macOS devices only. It is not supported on Windows orAndroid devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 185

MobileIron Tunnel (Android)

MobileIron Tunnel (Android)
This VPN connection type is supported on Android devices only. It is not supported on iOS, macOS and Windows
devices.

MobileIron Tunnel (Samsung Knox Workspace)
This VPN connection type is supported on Android devices only. It is not supported on iOS, macOS and Windows
devices.

MobileIron Tunnel (Windows)
This VPN connection type is supported on Windows devices only. It is not supported on iOS, macOS and Android
devices.
Use this setting to configure Tunnel VPN for Windows 10. For information on how to set up and configure Tunnel
VPN for MobileIron Tunnel for Windows 10, see the MobileIron Tunnel for Windows 10 Guide for Administrators on
the MobileIron Tunnel for Windows Documentation Home Page.

NetMotion Mobility VPN (iOS)This VPN connection type is supported on iOS devices. It is not supported on macOS, Android and Windows
devices.

OpenVPN
This VPN connection type is supported on Android devices. It is not supported on iOS, macOS, and Windows
devices.

Palo Alto Networks GlobalProtect
This VPN connection type is supported on iOS, macOS, and Android devices. It is not supported on Windows
devices.

PPTP
This VPN connection type is supported on iOS, macOS, Android, and Windows devices.
Use the following guidelines to configure the PPTP VPN connection type.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 186

Proxy - None (default)lProxy - None (default)lProxy - Manuall

Proxy - Automatic

Proxy - None (default)
Use the following guidelines to configure a PPTP VPN without a proxy.

TABLE 50. PROXY - NONE (DEFAULT) SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select PPTP.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic

Encryption Level

Select None, Automatic or Maximum (128 bit).

DomainSpecify the network domain.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

User Name

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 187

Proxy - Manual

TABLE 50. PROXY - NONE (DEFAULT) SETTINGS (CONT.)
Item

Description
identifier is exposed.

User Authentication

Select the authentication method to use: Password or RSA SecureID.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Proxy - Manual
Use the following guidelines to configure a PPTP VPN with a manual proxy.

TABLE 51. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select PPTP.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an automatic proxy, go to Proxy - Automatic

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 188

Proxy - Automatic

TABLE 51. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)This setting does not apply to Windows devices.

Encryption Level

Select None, Automatic or Maximum (128 bit).

DomainSpecify the network domain.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the authentication method to use: Password or RSA SecureID.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Proxy - Automatic
Use the following guidelines to configure a PPTP VPN with an automatic proxy.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 189

Proxy - Automatic

TABLE 52. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select PPTP.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a manual proxy, go to Proxy - Manual.

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)This setting does not apply to Windows devices.

Encryption Level

Select None, Automatic or Maximum (128 bit).

DomainSpecify the network domain.

Send all Traffic

Selecting this option protects data from being compromised, particularly on
public networks.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the authentication method to use: Password or RSA SecureID.

Password

Specify the password to use (required.) The default value is $PASSWORD$.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 190

Pulse Secure SSL

TABLE 52. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Pulse Secure SSLThis VPN connection type is supported on iOS, macOS, Android, and Windows devices.
NOTE: MobileIron recommends using the Pulse Secure SSL connection type instead of Juniper SSL.
Use the following guidelines to configure Pulse Secure SSL VPN.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:lWindows ConfigurationlCustom Data

Proxy - None (default)
Use the following guidelines to configure a Pulse Secure SSL VPN without a proxy.

TABLE 53. PROXY - NONE (DEFAULT) SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 191

Proxy - None (default)

TABLE 53. PROXY - NONE (DEFAULT) SETTINGS (CONT.)
Item

Description

Connection Type

Select Pulse Secure SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic.

UsernameEnter a value for the username (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Use this field to specify a custom format, such as $PASSWORD$_$USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Role

Specify the Pulse user role to use as a restriction.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 192

Proxy - Manual

TABLE 53. PROXY - NONE (DEFAULT) SETTINGS (CONT.)
Item

Description

Realm

Specify the Pulse realm to use as a restriction.

VPN On DemandThis setting does not apply to Windows devices.

Per-app VPNThis setting does not apply to Windows devices.

Provider Type

This setting applies to iOS and macOS devices only.

Continue with Windows Configuration.
Continue with Custom Data.

Proxy - Manual
Use the following guidelines to configure a Pulse Secure SSL VPN with a manual proxy.

TABLE 54. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Pulse Secure SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an automatic proxy, go to Proxy - Automatic.

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 193

Proxy - Manual

TABLE 54. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is$PASSWORD$.

Proxy Domains (iOS only)This field applies to iOS and macOS devices only.

UsernameEnter a value for the username (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Use this field to specify a custom format, such as $PASSWORD$_$USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Role

Specify the Pulse user role to use as a restriction.

Realm

Specify the Pulse realm to use as a restriction.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 194

Proxy - Automatic

TABLE 54. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

VPN On DemandThis setting does not apply to Windows devices.

Per-app VPNThis setting does not apply to Windows devices.

Provider Type

This setting applies to iOS and macOS devices only.

Continue with Windows Configuration.
Continue with Custom Data.

Proxy - Automatic
Use the following guidelines to configure a Pulse Secure SSL VPN with an automatic proxy.

TABLE 55. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select Pulse Secure SSL.

Samsung Knox

This setting applies to Android devices only.

Deploy inside Knox
Workspace

This setting applies to Android devices only.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a manual proxy, go to Proxy - Manual

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)This setting applies to iOS and macOS devices only.

UsernameEnter a value for the username (required.) The default value is $USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 195

Windows Configuration

TABLE 55. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be
used as the account credential.
If you select Certificate, and extended authentication (EAP) is not used, thiscertificate will be sent out for IKE client authentication. If extended
authentication is used, this certificate can be used for EAP-TLS.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Use this field to specify a custom format, such as $PASSWORD$_$USERID$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Role

Specify the Pulse user role to use as a restriction.

Realm

Specify the Pulse realm to use as a restriction.

VPN On DemandThis setting does not apply to Windows devices.

Per-app VPNThis setting does not apply to Windows devices.

Provider Type

This setting applies to iOS and macOS devices only.

Continue with Windows Configuration.
Continue with Custom Data.

Windows Configuration
Allowed Secured Resources (Windows Phone only)
Excluded Secured Resources (Windows Phone only)

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 196

Custom Data

See Application-triggered VPN for Windows devices on page 205 for information on how to configure these settings
to set up application-triggered VPN for 8.0.1 devices.

TABLE 56. WINDOWS CONFIGURATIONS
Item

Description

Windows Configuration

Enter the secured resources (domains, IP ranges, or apps) used by the Send
All Traffic option.

Always On

Select this option to keep the VPN on. Lock Down supersedes this option for
Windows devices.

Lock Down

You cannot change the assigned settings unless 1) the Lock Down setting isremoved from the profile and the new profile is pushed to the device or 2) the
device is un-enrolled from Core.
This option supersedes the Always On option.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

Samsung Knox IPsec
This VPN connection type is supported on Android devices. It is not supported on iOS, macOS, and Windows
devices.

SonicWall Mobile Connect
This VPN connection type is supported on iOS, macOS, and Windows devices. It is not supported on Android
devices.
Use the following guidelines to configure a SonicWall Mobile Connect VPN.
l

Proxy - None (default)lProxy - Manuall

Proxy - AutomaticWithin these selections, you may make settings for:lWindows ConfigurationlCustom Data

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 197

Proxy - None (default)

Proxy - None (default)
Use the following guidelines to configure a SonicWall Mobile VPN connection without a proxy.

TABLE 57. PROXY - NONE SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select SonicWall Mobile Connect.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

None is the default setting. To configure a Manual or Automatic proxy, go to
Proxy - Manual or Proxy - Automatic

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 198

Proxy - Manual

TABLE 57. PROXY - NONE SETTINGS (CONT.)
Item

Description
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Continue to Windows Configuration
Continue to Custom Data.

Proxy - Manual
Use the following guidelines to configure a SonicWall Mobile VPN connection with a manual proxy.

TABLE 58. PROXY - MANUAL SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select SonicWall Mobile Connect.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Manual. To configure an Automatic proxy, go to Proxy - Automatic

Proxy ServerEnter the name for the proxy server.

Proxy Server PortEnter the port number for the proxy server.

Type

Select Static or Variable for the type of authentication to be used for the proxy
server.

Proxy Server User Name

If the authentication type is Static, enter the username for the proxy server.
If the authentication type is Variable, the default variable selected is$USERID$.

Proxy Server Password

If the authentication type is Static, enter the password for the proxy server.
Confirm the password in the field below.
If the authentication type is Variable, the default variable selected is

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 199

Proxy - Manual

TABLE 58. PROXY - MANUAL SETTINGS (CONT.)
Item

Description$PASSWORD$.

Proxy Domains (iOS only)This field is applicable to iOS only.
The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes canbe used to match multiple domains. For example, .com would include all .com
domains, and example.com would include all domains ending in example.com,
such as pages.example.com and mysite.example.com . Wildcards are notsupported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$. Use
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Login Group or Domain

The LDAP group or domain associated with users.

VPN on DemandThis setting applies to iOS and macOS devices only.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 200

Proxy - Manual

TABLE 58. PROXY - MANUAL SETTINGS (CONT.)
Item

Description
Select to enable VPN On Demand.
The SonicWall Mobile Connect field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles theconnection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection evaluationarray, VPN On Demand compares the requested domain against thedomains listed in the Domains array.
• If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network interfacechanges, for example when the device switches to a different Wi-Fi network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matching rule
is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
Per-app VPN is supported on iOS devices version 9.0 through the most recently
released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected VPN
configurations in the Per-App VPN section, then VPN prioritization
will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 201

Proxy - Automatic

TABLE 58. PROXY - MANUAL SETTINGS (CONT.)
Item

Description

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packet-tunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Windows Configuration
Continue to Custom Data.

Proxy - Automatic
Use the following guidelines to configure a SonicWall Mobile VPN connection with an automatic proxy.

TABLE 59. PROXY - AUTOMATIC SETTINGS
Item

Description

Name

Enter a short phrase that identifies this VPN setting.

Description

Provide a description that clarifies the purpose of these settings.

ChannelFor macOS only. Select one of the following distribution options:ll

Device channel - the configuration is effective for all users on a device.
This is the typical option.
User channel - the configuration is effective only for the currently
registered user on a device.

Connection Type

Select SonicWall Mobile Connect.

ServerEnter the IP address, hostname, or URL for the VPN server.

Proxy

Select Automatic. To configure a manual proxy, go to Proxy - Manual

Proxy Server URL

Enter the URL for the proxy server.
Enter the URL of the location of the proxy auto-configuration file.

Proxy Domains (iOS only)This field is applicable to iOS only.
The VPN will only proxy for the domain and domain suffixes specified here(.com and .org are examples of top-level domain suffixes). Domain suffixes canbe used to match multiple domains. For example, .com would include all .com
domains, and example.com would include all domains ending in example.com,
such as pages.example.com and mysite.example.com . Wildcards are notsupported.
Click Add+ to add a domain.

Username

Specify the user name to use (required.) The default value is $USERID$. Use

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 202

Proxy - Automatic

TABLE 59. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description
this field to specify an alternate format, such as:$USERID$, $EMAIL$, $SAM_ACCOUNT_NAME$, $USER_CUSTOM1$,$USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$,$CUSTOM_DEVICE_Attributename$, $CUSTOM_USER_Attributename$,$NULL$
You can use combinations such as the following:• $USERID$:$EMAIL$• $USERID$_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant username.
NOTE: Some enterprises have a strong preference concerning which
identifier is exposed.

User Authentication

Select the user authentication to use:
• Password - see next row for information.
• Certificate - If you select Certificate, select the identity certificate to be usedas the account credential.

Password

Specify the password to use (required.) The default value is $PASSWORD$.
Include at least one of the following variables:$USERID$, $EMAIL$, $PASSWORD$, $USER_CUSTOM1$, $USER_CUSTOM2$, $USER_CUSTOM3$, $USER_CUSTOM4$, $CUSTOM_
DEVICE_Attributename$, $CUSTOM_USER_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users willneed to fill in the relevant password.

Login Group or Domain

The LDAP group or domain associated with users.

VPN on DemandThis setting applies to iOS and macOS devices only.
Select to enable VPN On Demand.
The SonicWall Mobile Connect field displays.
On Demand rules are associated with an array of dictionaries that define the
network match criteria identifying a particular network location.
VPN On Demand matches the dictionaries in the On Demand Rules against
properties of your current network connection to determine whether domainbased rules should be used in determining whether to connect, then handles theconnection as follows:• If domain-based matching is enabled for a matching On Demand Ruledictionary, then for each dictionary in that dictionary’s connection evaluationarray, VPN On Demand compares the requested domain against the

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 203

Windows Configuration

TABLE 59. PROXY - AUTOMATIC SETTINGS (CONT.)
Item

Description•

domains listed in the Domains array.
If domain-based matching is not enabled, the specified behavior (Connect,
Disconnect, Allow, or Ignore) is used if the dictionary otherwise matches.

VPN On Demand rules are applied when the device's primary network interfacechanges, for example when the device switches to a different Wi-Fi network.
Note the following:• A matching rule is not required. The Default Rule is applied if a matching rule
is not defined.
• If you select Evaluate Connection, a matching rule is not required.
• You can create up to 10 On Demand matching rules.
• For each matching rule you can create up to 50 Type and Value pairs.
Per-app VPN

Select Yes to create a per-app VPN setting. An additional license may berequired for this feature.
The Provider Type field displays.
Per-app VPN is supported on iOS devices version 9.0 through the most recently
released version of iOS as supported by MobileIron.
You cannot delete a per-app VPN setting that is being used by an app. Remove
the per-app VPN setting from the app before you delete the setting.
You can enable per-app VPN for an app when you:• add the app in the App Catalog.
• edit an in-house app or an App Store app in the App Catalog.
NOTE: When multiple labels are assigned to associate the selected VPN
configurations in the Per-App VPN section, then VPN prioritization
will happen in the order of the selected list.
See the MobileIron Apps@Work Guide for information about how to add or edit
apps.

Provider TypeIf Per-App VPN is set to Yes, define whether the per-app VPN service willtunnel traffic at the application layer (app-proxy) or the IP layer (packet-tunnel).
Select app-proxy (default) or packet-tunnel.

Continue to Windows Configuration
Continue to Custom Data.

Windows Configuration
Allowed Secured Resources (Windows Phone only)
Excluded Secured Resources (Windows Phone only)

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 204

Custom Data

See Application-triggered VPN for Windows devices for information on how to configure these settings to set up
application-triggered VPN for 8.0.1 devices.

TABLE 60. WINDOWS CONFIGURATIONS
Item

Description

Windows Configuration

Enter the secured resources (domains, IP ranges, or apps) used by the Send
All Traffic option.

Always On

Select this option to keep the VPN on. Lock Down supersedes this option for
Windows devices.

Lock Down

You cannot change the assigned settings unless 1) the Lock Down setting isremoved from the profile and the new profile is pushed to the device or 2) the
device is un-enrolled from Core.
This option supersedes the Always On option.

Custom Datall

Add+ - Click to add a new key / value pair.
Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should
provide the necessary key / value pairs.

Custom SSL
This VPN connection type is supported on iOS devices. It is not supported on macOS, Android, and Windows
devices.

Application-triggered VPN for Windows devices
Administrators can choose to specify what applications trigger a VPN connection and what applications do not.
Core exposes all key-value pairs for app triggers and app filters rules to provide administrators with the ability to
manually add AppTrigger rules separately from rather than TrafficFilter rules, rather than automatically being added
whenever a TrafficFilter rule was applied to an application.
Previous to the Core 9.2.0.0 release, Core automatically added an AppTrigger rule whenever adding theTrafficFilter rule, without also including the AppTrigger in the Admin Portal. As of 9.2.0.0, if you set up VPN profiles
in previous releases these profiles will not change, but Core automatically adds the AppTrigger rule that it added in
the background with the TrafficFilter rule. Both are included in the Policies & Configs > Configurations > Add
New > VPN > Custom Data table.
With this separation between AppTrigger and TrafficFilter rules, you can remove a rule if you do not want to trigger
the VPN on an application. While existing profiles will not change, you can modify existing rules or configure themto separate between trigger and filter.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 205

Configuring VPNs triggers

Configuring VPNs triggers
Use these steps to set up VPN triggers by connecting AppTrigger with TrafficFilter rules.
To configure VPN triggers:
1. Log into the Admin Portal.
2. Go to Policies and Configs > Configurations.
3. Click Add New > VPN.
4. Scroll to the Custom Data section.
5. Enter a TrafficFilter rule in the KEY column.
6. Enter the application to trigger the VPN in the VALUE column.
7. Enter an AppTrigger to pair with the TrafficFilter.
8. Enter the same application in the VALUE column.
9. Click Save.

How to set up exclusions for VPN traffic
If the VPN configuration is set up to send all traffic through VPN, you can configure exclusions.
To exclude traffic from using VPN:
1. In the Admin Portal, go to Policies and Configs > Configurations.
2. Click Add New > VPN, or select an existing VPN setting to Edit.
3. Ensure that Send All Traffic is checked.
4. In the Excluded Secured Resources (Windows Phone only) section, click Add +.
Create a separate entry for each domain name, IP range, or app.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 206

How to get the app GUID for a Windows Phone 8.1 device app

5. Enter the following information:
Item

Description

Secured ResourcesEnter one of the following:• Domain name: Apps connecting to the domain name will be excluded
from using the VPN connection. Wildcard '*' prefix is required.
Example: *.corp.example.com
We also strongly suggest to add *.yourcoredomain.com to the
exclusion list. This excludes the use of VPN when the device
connects to Core. If your Core domain is not in the exclusion list, andthe device fails to establish a VPN connection, the device will not beable to connect to Core.
• Valid IP range: Enter IP range. Apps connecting to an IP address in
the range will be excluded from using the VPN connection. You mustenter a valid IP range.
Example: 192.0.2.0/24• App GUI ID: Enter the GUID for the app. Traffic from the app will be
excluded from using the VPN connection.

Description

Enter a description for the secure resource.

6. Click Save.

How to get the app GUID for a Windows Phone 8.1 device app
To get the app GUID for a 8.1 app:
1. Go to the Windows Phone 8.1 app store.
2. Search and click on the app for which you want the app GUID.
The app GUID is the numbers and letters in the tail end of the URL, in the address bar of the app details
page.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 207

12Managing Certificates and Configuring
Certificate Authorities
This section addresses components related to managing certificates and certificate authorities.
Certificates overview
Managing certificates issued by certificate enrollment configurations
Supported certificate scenarios
MobileIron Core as a certificate authority
Configuring MobileIron Core as an independent root CA (Self-Signed)
Configuring MobileIron Core as an intermediate CA
Mutual authentication between devices and MobileIron Core
Certificates settings
Certificate Enrollment settings
Configuring a client-provided certificate enrollment setting
Configuring an Entrust CA
Configuring a GlobalSign CA
Configuring MobileIron Core as the CA
Configuring OpenTrust CA
Configuring a single file identity certificate enrollment setting
Configuring SCEP
Configuring Symantec Managed PKI
Configuring Symantec Web Services Managed PKI
Configuring a user-provided certificate enrollment setting

Certificates overview
MobileIron is capable of distributing and managing certificates.
Certificates are mainly used for the following purposes:lEstablishing secure communicationslEncrypting payloads

lAuthenticating users and devices

Certificates establish user identity while eliminating the need for users to enter user names and passwords on theirmobile devices. Certificates streamline authentication to key enterprise resources, such as email, Wi-Fi, and VPN.
Some applications require the use of certificates for authentication.
The following diagram compares a certificate to a passport:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 208

Types of certificates

FIGURE 9. COMPARING CERTIFICATES TO A PASSPORTThe certificate includes information that identifies the following information:lthe issuing certificate authoritylacceptable uses for the certificatelinformation that enables the certificate to be validated.

The MobileIron solution provides the flexibility to use MobileIron Core as a local certificate authority, anintermediate certificate authority, or as a proxy for a trusted certificate authority.

Types of certificates
MobileIron uses the following types of certificates:

TABLE 61. CERTIFICATE TYPES
Certificate type

Description

Portal HTTPSThe identify certificate and its certificate chain, including the private key, that
identifies MobileIron Core, allowing a client (such as a browser or app) to trust
MobileIron Core. Typically, this certificate is the same certificate as the Client TLS
and iOS Enrollment certificates.
Core sends this certificate to the client as part of the TLS handshake over port 443 or
8443 when the client initiates a request to Core.
NOTE: This certificate must be a publicly trusted certificate from a wellknown Certificate Authority if you are using mutual authentication.
Related topics“Certificates you configure on the System Manager” in the MobileIron Core System

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 209Managing certificates issued by certificate enrollment configurations

TABLE 61. CERTIFICATE TYPES (CONT.)
Certificate type

Description
Manager Guide

Client TLS

The identify certificate and its certificate chain, including the private key, that
identifies MobileIron Core, allowing Mobile@Work for iOS and Android to trust
MobileIron Core. Typically, this certificate is the same certificate as the Portal
HTTPS and iOS Enrollment certificates.
Core sends this certificate to Mobile@Work for iOS or Android as part of the TLS
handshake over port 9997 when Mobile@Work initiates a request to Core.
Related topics“Certificates you configure on the System Manager” in the MobileIron Core System
Manager Guide

MobileIron Core
server SSL

Can be either self-signed or third-party certificates. By default, Core generates selfsigned certificates. You can use trusted certificates from third-party certificate
providers such as Verisign, Thawte, or Go Daddy. Kerberos and Entrust certificatesare also supported.

Sentry server SSL

Identifies the Sentry to the client and secures communication, over port 443,
between devices and the Sentry.

Windows Phone
Enrollment

Issued by Core to authenticate the device. This is the local CA certificate.

Client identity

Verifies the identity of users and devices and can be distributed through Certificate
Enrollment.

NOTE: Windows devices require a root or intermediate certificate from a trusted certificate authority(CA) for registering with MobileIron.

Managing certificates issued by certificate enrollment
configurations
MobileIron Core runs a process each day at 3:45 am that manages all certificates issued using certificate
enrollment configurations.
Certificates have a limited lifetime that is defined when certificates are issued. When the certificate lifetime iswithin the expiry window (60 days, by default), MobileIron Core does not automatically renew the certificates. Onlya forced manual renewal/creation is possible.
Re-issued certificates are sent to the managed device configuration and the expiring certificates become inactive.
The inactive certificates are purged from the system once the certificates are expired or confirmed to be revoked.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 210

Supported certificate scenarios

Supported certificate scenarios
MobileIron supports the following certificate scenarios:lMobileIron Core as a certificate authoritylUsing MobileIron Core as a certificate proxyl

Using MobileIron Core as a certificate enrollment reverse proxylSupported certificate scenarios

MobileIron Core as a certificate authority
You can configure MobileIron Core as a local certificate authority (CA) for the following scenarios:llCore as an Independent Root CA (self-signed)—Configure Core as an independent root certificate
authority if you are using a self-signed certificate. Use this option if your company does not have its own
certificate authority and you are using Core as the certificate authority.
Core as an Intermediate CA—Use this option when your company already has its own certificate authority.
Using Core as an Intermediate CA gives your mobile device users the advantage of being able toauthenticate to servers within your company intranet.

Using MobileIron Core as a certificate proxy
MobileIron Core can act as a proxy to a 3rd party CA by using APIs exposed by the 3rd party CA or the SCEP
protocol to obtain certificates required by a Certificate Enrollment. This enables you to configure certificate-based
authentication for devices.
Using Core as a certificate proxy has the following benefits:
l

l

l

l

Certificate verifies Exchange ActiveSync, Wi-Fi and/or VPN connections, eliminating the need forpasswords that are complex to manage
MobileIron can manage certificates by checking status against a CA's CRL, deactivating revokedcertificates and requesting replacement when certificates are about to expire
MobileIron can detect and address certificate renewal and ensure that devices cannot reconnect toenterprise resources if they are out of compliance with company policies.
Simplified enrollment with the following:o

MS Certificate Enrollmento

Entrusto

Local CAo

Symantec Managed PKIoUser provided certificatesoOpen TrustoSymantec Web Services Managed PKI

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 211

Using MobileIron Core as a certificate enrollment reverse proxy

The following applications are supported.
l

Wi-Fi.

For information about how to create certificate enrollment settings in MobileIron Core, see Certificate Enrollment
settings on page 227.

Using MobileIron Core as a certificate enrollment reverse proxy
Identity certificates with Microsoft Certificate Enrollment are supported. A root or intermediate certificate from atrusted certificate authority (CA) is required, and you must set up MobileIron Core to act as a SCEP reverse proxy.
Windows devices originate the certificate request. When the Windows device requests a certificate, the MobileIron
Core acts as a Certificate Enrollment reverse proxy and communicates with the Certificate Enrollment server todeliver the certificate to the device.

Certificate scenarios supported for Windows 8.1 Phone
TABLE 62. CERTIFICATE SCENARIOS SUPPORTED FOR WINDOWS 8.1 PHONE
Windows Phone 8.1
PortalPublic trusted1

Core as certificate authority-

Certificate Enrollment proxy-

Reverse Certificate Enrollment

Yes2

KerberosYes

1. The portal certificate must be issued by a trusted third-party certificate authority for successful device
registration.
2. Supported for email, Wi-Fi, VPN configurations and in-house apps.

MobileIron Core as a certificate authority
You can configure MobileIron Core as a local certificate authority for the following scenarios:lMobileIron Core as an Independent Root CA (self-signed)—Configure MobileIron Core as anindependent root certificate authority if you are using a self-signed certificate. Use this option if yourcompany does not have its own certificate authority and you are using MobileIron Core as the certificate
authority.
See Configuring MobileIron Core as an independent root CA (Self-Signed) on page 213.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 212

Configuring MobileIron Core as an independent root CA (Self-Signed)lMobileIron Core as an Intermediate CA—Use this option when your company already has its own
certificate authority. Using MobileIron Core as an Intermediate CA gives your mobile device users theadvantage of being able to authenticate to servers within your company intranet.
See Configuring MobileIron Core as an intermediate CA on page 216.

Configuring MobileIron Core as an independent root CA (SelfSigned)
Configuring MobileIron Core as an independent root CA requires configuring your infrastructure to trust Core as anindependent root CA.
To configure MobileIron Core as an independent root CA, you must follow these basic steps:
1. Generate a self-signed certificate
See Generating a self-signed certificate on page 213.
2. Create a local CA certificate enrollment setting for the self-signed certificate
See Creating a local certificate enrollment setting on page 215.

Generating a self-signed certificate
To generate the self-signed certificate:
1. Log into the Admin Portal.
2. Go to Services > Local CA.
3. Select Add > Generate Self-Signed Cert.

4. Enter the following information.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 213

Generating a self-signed certificate

l

l

l

l

Local CA Name: Enter a recognizable name to identify the self-signed certificate. This name willappear in the list of local certificate authorities in Services > Local CA.
Key Type: Specify the key type. The options are RSA (default) or Elliptical Curve.
Key Length: Specify the key length. The values are 2048, 3072 (the default), and 4096. The longer the
key length, the more secure the certificate.
CSR Signature Algorithm: The values are SHA1, SHA256, SHA384 (default), and SHA512.
o

Key Lifetime (in days): Enter number of days. The key will expire after the entered number ofdays.
The default is 10,950 days. MobileIron recommends 5 years or longer; 61 days is the minimum.

oIssuer Name: Requires an X.509 name. For example, CN=www.yourcompany.com,
DC=yourcompany, DC=com.
The Issuer Name field uses an X.509 distinguished name. You can use one or more X.509 codes,
separated by commas. The following table describes the valid codes for the Issuer Name field:
Code

Name

Type

Max
Size

ExampleC

Country/Region

ASCII

2

C=US

DC

Domain Component

ASCII

255

DC=company, DC=com

S

State or Province

Unicode128

S=California

L

Locality

Unicode128

L=Mountain View

O

Organization

Unicode64

O=Company Name, Inc.

OU

Organizational Unit

Unicode64

OU=Support

CN

Common NameUnicode64

CN=www.company.com

If you have a registered DNS name that you use to send SMTP mail, a best practice is to use thedomain component convention and the DNS name for the certificate name.
5. Click Generate.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 214

Creating a local certificate enrollment setting

6. Configure the Client Certificate Template.
Values depend on the purpose for the certificate and the requirements of your environment.
lHash Algorithm: The larger the hash number, the more secure. The options are SHA256, SHA384(default), SHA512—part of the SHA2 secure hash algorithm family required for U.S. government
applications. The number signifies the output bits.

l

Minimum Key Size Allowed: The longer the key length is, the more secure the certificate.

l

Key Lifetime (days): 365 days or longer is recommended; 61 days is the minimum.

l

Key Lifetime limited by CA: Select to use the key lifetime specified for the self-signed CA.
MobileIron recommends enabling this option. Enabling this option ensures that client certificate
validity periods do not exceed the life time of the issuing CA certificate.

llEnhanced Key Usage: When a certificate is presented to an application, the application can require
the presence of an Enhanced Key Usage OID specific to that application. Leave these deselected if
you do not have any applications that require additional OIDs.
Custom OIDs: If you are using this certificate for SSL authentication, enter the OID in this field.

7. Click Save.
The newly created self-signed certificate will be listed in Services > Local CA.

Creating a local certificate enrollment setting
After you have generated the self-signed certificate, you need to create a local CA certificate enrollment setting forthe self-signed certificate. Creating a local CA certificate enrollment setting enables proxy functionality so that
MobileIron Core generates the certificates and caches the generated keys.
1. Log into the Admin Portal.
2. Go to Policies & Configs > Configurations.
3. Click Add New > Certificate Enrollment > Local.
For more information on configuring the settings, see Certificate Enrollment settings.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 215

Configuring MobileIron Core as an intermediate CA

Configuring MobileIron Core as an intermediate CA
When you configure Core as an intermediate certificate authority, the managed device users can authenticate toservers within your company intranet; not just the MobileIron system.
After you get the certificate from your certificate vendor, you can add the certificates to MobileIron Core to create
the intermediate certificate authority (CA).
Procedure
1. In the MobileIron Core Admin Portal go to Services > Local CA.
2. Click on Add > Intermediate Enterprise CA.

3. Click Browse and navigate to the combined file.
4. Click Open.
5. Enter a recognizable name in the Local CA Name field.
6. Click Upload Certificate.
Your local certificate authority is now available to use. The local CA will be listed in Services > Local CA.

Mutual authentication between devices and MobileIron Core
MobileIron Core supports mutual authentication, which means that not only must the device trust MobileIron Core,
but MobileIron Core must trust the device. Therefore, with mutual authentication, a registered device can continue
to communicate with Core only if the device provides the right certificate to Core. Mutually authenticatedcommunication between the device and MobileIron Core enhances security.
NOTE: A device authenticating to Core with a certificate is also known as certificate-based
authentication to Core.
l

Scenarios that can use mutual authenticationlCore port usage with devices, with and without mutual authenticationl

The mutual authentication setting on MobileIron Core

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 216

Scenarios that can use mutual authenticationlWhen devices use mutual authenticationlMutual authentication identity certificate for MobileIron Corel

Mutual authentication client identity certificatelSupported custom attributes for mutual authentication certificateslHandling client identity certificate expiration for Android deviceslHandling client identity certificate expiration for iOS deviceslMutual authentication and Apps@Workl

Enabling mutual authentication for Apple and Android deviceslEnabling TLS inspecting proxy support when using mutual authenticationlEnabling mutual authentication for Apple and Android deviceslEnabling mutual authentication for Apple and Android devices

Scenarios that can use mutual authentication
The device can present a client identity certificate to MobileIron Core in the following cases:

TABLE 63. MUTUAL AUTHENTICATION USAGE BY PLATFORM
Platform

Mutual Authentication usage

iOS

•
•
•
•

Mobile@Work for iOS device check-in
AppConnect for iOS check-in
iOS MDM device check-in
Apps@Work for iOS communication

macOS

•
•

Mobile@Work for macOS device check-in
macOS MDM device check-in

Android••

Mobile@Work for Android device check-in, which includes AppConnect checkinApps@Work for Android communication•

Device check-in

Windows 10

NOTE: Mutual authentication is not possible at the time Mobile@Work registers with Core, because thedevice receives its identity certificate during the registration process.

Core port usage with devices, with and without mutual authentication
The following table summarizes MobileIron Core port usage for registration and further communication with
devices. The port usage for some cases is different depending on whether mutual authentication is enabled.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 217

The mutual authentication setting on MobileIron CoreTABLE 64. CORE PORT USAGE WITH DEVICES WITH AND WITHOUT MUTUAL AUTHENTICATION
Without mutual authentication

With mutual authentication

Mobile@Work for iOS

9997

443

Mobile@Work for Android

9997

443

Mobile@Work for macOSNot applicable.

443

Mobile@Work for macOS always
uses mutual authentication withCore.
iOS and macOS MDM agent
provisioning and agent
check-in443

443

Windows 10

Not applicable.

443

Windows 10 always uses mutual
authentication with Core.
NOTE: Port 9997 is configurable in the System Manager in Settings > Port Settings > Sync TLS Port.
However, changing the port is rare.

The mutual authentication setting on MobileIron Core
The setting on MobileIron Core to enable mutual authentication is in the Admin Portal in Settings > System
Settings > Security > Certificate Authentication. Whether the setting is automatically selected on new
installations and upgrades is described by the following table.

TABLE 65. SETTING FOR MUTUAL AUTHENTICATION ON NEW INSTALLS AND UPGRADES
Setting to enable mutual authentication
New installations

Not selected. Mutual authentication is not enabled.

Upgrade from a previous version of Core in which
mutual authentication was not enabled.

Not selected. Mutual authentication is not enabled.

Or
Upgrade from a version of Core prior to Core 9.7.0.0
in which the Android mutual authentication setting
was not enabled.
Upgrade from a previous version of Core in which
mutual authentication was enabled.

Selected. Mutual authentication is enabled.

Or
Upgrade from a version of Core prior to Core 9.7.0.0
in which the Android mutual authentication setting
was enabled.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 218

When devices use mutual authentication

IMPORTANT: Once mutual authentication is enabled on Core, it cannot be disabled.
The mutual authentication setting impacts mutual authentication usage only on:l

Mobile@Work for Androidl

Apps@Work for Androidl

However, to enable mutual authentication for Apps@Work for Android:o

You must also select Certificate Authentication for Apps@Work at Apps > Apps@Work Settings> App Storefront Authentication.

o

The device must be using Mobile@Work 10.2.0.0 for Android through the most recently released
version as supported by MobileIron.

l

Mobile@Work 9.8 for iOS through the most recently released version as supported by MobileIronl

iOS MDMlmacOS MDM

The mutual authentication setting has no impact on mutual authentication usage on:lVersions of Mobile@Work for iOS prior to Mobile@Work 9.8
These versions of Mobile@Work for iOS never use mutual authentication.

lApps@Work for iOS
Apps@Work for iOS uses mutual authentication if you select Certificate Authentication for
Apps@Work at Apps > Apps@Work Settings > App Storefront Authentication.

l

Mobile@Work for macOS
Mobile@Work for macOS always uses mutual authentication.

lWindows 10 devices
Windows 10 devices always uses mutual authentication.

When devices use mutual authentication
Whether devices use mutual authentication depends on:l

The device platformlWhether mutual authentication was enabled before upgradelWhether mutual authentication is enabled after upgradelWhether mutual authentication is enabled after a new installationl

For Mobile@Work for iOS, the version of Mobile@Work

The following table summarizes when devices use mutual authentication and the port they use in communication
with MobileIron Core.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 219

When devices use mutual authentication

TABLE 66. CORE MUTUAL AUTHENTICATION (MA) SETTING IMPACT TO DEVICE COMMUNICATIONNew Core
installation

New Core installation inwhich you enable MA
setting after installation.

orCore upgrade in which:
MA setting WAS enabled
before upgradeorCore upgradein which:
MA setting was
NOT enabled
before upgrade
Mutualauthentication
settingCore upgrade in which:
MA setting was NOT
enabled before upgrade but
you enable it after the
upgrade.

Not enabled

EnabledEnabledAndroid:

Port: 9997

Port: 443

Mobile@Work

MA: not used

Devices that register after
enabling MA:• Port: 443• MA: used

Device client(all Mobile@Workversions that Core
supports)

MA: used

Devices that were alreadyregistered:• Port: 9997
• MA: not used.

iOS:

Port: 9997

Devices that register after
enabling MA:• Port: 443• MA: used

Devices that register after
enabling MA:• Port: 443• MA: used

Mobile@Work 9.8
through the mostrecently released
version as
supported by
MobileIron

MA: not used

Devices that were alreadyregistered:• Port: 9997
• MA: not used.

Devices that were alreadyregistered:• Port: 9997
• MA: not used.

iOS:

Port: 9997

Port: 9997

Port: 9997

Mobile@Workversions prior to
9.8

MA: not used

MA: not used

MA: not usediOS:

Port: 443

Port: 443

Port: 443

iOS MDM check-in

MA: not used

MA: used

MA: used.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 220

Mutual authentication identity certificate for MobileIron CoreTABLE 66. CORE MUTUAL AUTHENTICATION (MA) SETTING IMPACT TO DEVICE COMMUNICATION (CONT.)New Core
installation

New Core installation inwhich you enable MA
setting after installation.

orCore upgrade in which:
MA setting WAS enabled
before upgradeorCore upgradein which:
MA setting was
NOT enabled
before upgradeCore upgrade in which:
MA setting was NOT
enabled before upgrade but
you enable it after the
upgrade.

macOS:

Port: 443

Port: 443

Port: 443

Mobile@Work

MA: used

MA: used

MA: usedmacOS

Port: 443

Port: 443

Port: 443

macOS MDM
agent check-in

MA: not used

MA: used

MA: used

Windows 10

Port: 443

Port: 443

Port: 443

MA: used

MA: used

MA: used

NOTE: On new MobileIron Core installations (not upgrades), if you enable mutual authentication
before any devices register, you can disable port 9997 (in the System Manager in Settings > Port
Settings > Sync TLS Port) because it is not used. If devices were registered before enabling mutual
authentication, disabling the port causes those devices to not be able to check-in.

Mutual authentication identity certificate for MobileIron Core
You provide an identity certificate for MobileIron Core to use in mutual authentication in the Portal HTTPS
certificate. You configure this certificate on the System Manager at Security > Certificate Mgmt. The certificate
is the identify certificate and its certificate chain, including the private key, that identifies MobileIron Core, allowing
the devices to trust MobileIron Core. This certificate must be a publicly trusted certificate from a well-known
Certificate Authority when using mutual authentication.

Mutual authentication client identity certificate
You enable mutual authentication for iOS and Android devices in the Admin Portal in Settings > System Settings> Security > Certificate Authentication. When enabling that setting, you specify a certificate enrollment setting.
The certificate enrollment setting specifies how the identity certificate that the device will present to Core is
generated.
By default, the certificate enrollment setting for mutual authentication is generated with Core as a local Certificate
Authority (CA). Most customers use the default selection. However, if necessary due to your security
requirements, you can instead specify a SCEP certificate enrollment setting that you create.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 221

Supported custom attributes for mutual authentication certificates

IMPORTANT:lll

If you use a SCEP certificate enrollment setting for mutual authentication, you cannot use it for any otherpurpose. For example, you cannot use it in VPN or wi-fi configurations.
If you use a SCEP certificate enrollment setting that uses an intermediate CA, make sure that all theintermediate CA certificates and the root CA certificate are included in MobileIron Core's trusted root
certificates. See "Managing trusted certificates" in the Getting Started with MobileIron CoreSee:oHandling client identity certificate expiration for Android devicesoHandling client identity certificate expiration for iOS devices

Supported custom attributes for mutual authentication certificates
From Core release 10.8.0.0 through the latest release supported by MobileIron, Core supports only the following listof custom attributes in the Subject field for mutual authentication enrollment certificates:l$RANDOM_16$l$RANDOM_32$l$RANDOM_64$l$CONFIG_UUID$l$TIMESTAMP_MS$

If, after upgrading to release 10.8.0.0, the existing selected mutual authentication certificate includes unsupported
attributes, Core will replace them with the value $RANDOM_32$ for new device registrations and for existing
device certificate renewals.
The Admin portal > Settings > System Settings > Client Mutual Certificate Authentication > Certificate
Enrollment setting drop-down menu displays only the Simple Certificate Enrollment Protocol (SCEP)
configurations with the five supported custom attributes in the Subject field. Configurations with other custom
attributes do not display.

Handling client identity certificate expiration for Android devices
Mobile@Work 10.1 for Android handles the expiration of the client identity certificate used for mutual authentication
between Mobile@Work for Android and MobileIron Core. In the Admin Portal, on the sync policy for the device,specify a renewal window for the certificate. The renewal window is a number of days prior to the certificate
expiration. When Mobile@Work determines the renewal window has begun, it requests a new certificate fromCore.
If Mobile@Work is out of contact with Core during the renewal window, but is in contact again within 30 days after
the expiration, Mobile@Work requests a new certificate from Core.
If Mobile@Work is not in contact with Core either during the renewal window or within 30 days after the expiration,
the device will be retired and will need to re-register with Core.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 222

Handling client identity certificate expiration for iOS devices

Mobile@Work versions prior to 10.1 do not support certificate expiration. When the certificate expires, the deviceuser must re-register Mobile@Work.
Procedure
1. In the Admin Portal, go tos Policies & Configs > Policies.
2. Select the appropriate sync policy.
3. For Mutual Certificate Authentication Renewal Window, enter the number of days prior to the
expiration date that you want to allow devices to renew their identity certificate. Enter a value between 1
and 60.
NOTE: A blank value defaults to 60 days.
4. Click Save.
5. Click OK.

Handling client identity certificate expiration for iOS devices
Mobile@Work 11.1.0 for iOS handles the expiration of the client identity certificate used for mutual authentication
between Mobile@Work for iOS and MobileIron Core version 10.3.0.0 through the most recently released version as
supported by MobileIron. In the Admin Portal, on the sync policy for the device, specify a renewal window for thecertificate. The renewal window is a number of days prior to the certificate expiration. When Mobile@Work
determines the renewal window has begun, it requests a new certificate from Core.
If Mobile@Work is out of contact with Core during the renewal window, but is in contact again within 30 days after
the expiration, Mobile@Work requests a new certificate from Core.
If Mobile@Work is not in contact with Core either during the renewal window or within 30 days after the expiration,
the device will be retired and will need to re-register with Core.
Mobile@Work versions prior to 11.1.0 do not support certificate expiration. When the certificate expires, the deviceuser must re-register Mobile@Work.
Procedure
1. In the Admin Portal, go to Policies & Configs > Policies.
2. Select the appropriate sync policy.
3. For Mutual Certificate Authentication Renewal Window, enter the number of days prior to the
expiration date that you want to allow devices to renew their identity certificate. Enter a value between 1
and 60.
NOTE: A blank value defaults to 60 days.
4. Click Save.
5. Click OK.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 223

Mutual authentication and Apps@Work

Mutual authentication and Apps@Work
Both Apps@Work for Android and Apps@Work for iOS can use mutual authentication.
Apps@Work for iOS uses mutual authentication if you select Certificate Authentication at Apps > Apps@Work
Settings > App Storefront Authentication. It does not depend on the mutual authentication setting at Settings >System Settings > Security > Certificate Authentication.
However, Apps@Work for Android uses mutual authentication only if you do both of the following:ll

Select Certificate Authentication at Apps > Apps@Work Settings > App Storefront Authentication.
Enable the mutual authentication setting at Settings > System Settings > Security > Certificate
Authentication.

Related topicsl"Setting up Apps@Work for iOS and macOS" in the MobileIron Apps@Work Guidel"Apps@Work in Mobile@Work for Android in the MobileIron Apps@Work Guide

Enabling mutual authentication for Apple and Android devices
The MobileIron Core mutual authentication setting enables mutual authentication for:l

Mobile@Work for Androidl

Apps@Work for Androido

You must also select Certificate Authentication for Apps@Work at Apps > Apps@Work Settings> App Storefront Authentication.

o

The device must be using Mobile@Work 10.2.0.0 for Android through the most recently released
version as supported by MobileIron.

l

Mobile@Work 9.8 for iOS through the most recently released version as supported by MobileIronl

iOS MDMlmacOS MDM

Note The Following:ll

The setting is automatically enabled in the cases described in The mutual authentication setting on
MobileIron Core.
After you enable mutual authentication, you cannot disable it.

Before you begin
1. As discussed in in Mutual authentication client identity certificate, create a SCEP certificate enrollment
setting if you do not want to use the default local certificate enrollment setting for mutual authentication.
The SCEP setting must select the Decentralized option. For details, see Certificate Enrollment settings.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 224

Enabling TLS inspecting proxy support when using mutual authentication

NOTE: When you enable mutual authentication, change the certificate enrollment selection
for mutual authentication before any more devices register. Any devices alreadyregistered and using mutual authentication will not be able to check-in with Core. Those
devices will need to re-register with Core. Note that devices already registered but notusing mutual authentication can continue to check-in.
2. If you are using iOS devices with the Apps@Work web clip using certificate authentication, change theApps@Work Port field in the System Manager in Settings > Port Settings. MobileIron recommends port
7443. However, you can use any port except the port that the Admin Portal uses, which is either 443 or
8443, which you specify in the MIFS Admin Port field in the System Manager in Settings > Port
Settings.
Procedure
1. In the Admin Portal, go to Settings > System Settings > Security > Certificate Authentication.
2. Select Enable client mutual certification on Android client, iOS client and Apple MDM
communication.
3. In the Certificate Enrollment Configuration field, most customers use the default selection. Otherwise,
select a SCEP certificate enrollment setting.
4. Click Save.
Related topicsl“Setting up Apps@Work for iOS and macOS” in the MobileIron Apps@Work Guidel"Port settings" in the MobileIron Core System Manager Guidel“Apps@Work for Android authentication to MobileIron Core” in the MobileIron Apps@Work Guide

Enabling TLS inspecting proxy support when using mutual authentication
Contact MobileIron Professional Services or a MobileIron certified partner to set up this deployment.
MobileIron Core can support a TLS inspecting proxy to handle HTTPS requests from your devices to MobileIron
Core when using mutual authentication. For example, you can use a TLS offload proxy such as an Apache or F5
server. This proxy is also known as a Trusted Front End. It intercepts and decrypts HTTPS network traffic andwhen it determines that the final destination is MobileIron Core, it re-encrypts and forwards the traffic to Core. The
devices that register to Core (using port 443) must send HTTPS requests to the TFE rather than to MobileIron
Core. Also, the TFE must be provisioned with digital certificates that establish an identity chain of trust with alegitimate server verified by a trusted third-party certificate authority.
Related topics"Advanced: Trusted Front End" in the MobileIron Core System Manager Guide.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 225

Migrating Mobile@Work for Android to use mutual authentication

Migrating Mobile@Work for Android to use mutual authentication
For devices that register after enabling mutual authentication, Mobile@Work uses port 443 for device check-ins.
However, devices that were already registered continue to use port 9997. You can migrate Mobile@Work forAndroid from using port 9997 without mutual authentication to using port 443 with mutual authentication. The
device users do not need to re-register with MobileIron Core.
Before you begin
Instruct Android device users to upgrade to Mobile@Work 10.1 for Android through the most recently released
version as supported by MobileIron. Prior Mobile@Work releases do not support migration.
Procedure
1. In the Admin Portal, go to Policies & Configs > Policies.
2. Select the sync policy for the devices that you want to migrate. Select Edit.
3. In the Modify Sync Policy dialog box, select Migrate Mobile@Work Client.
4. Click Save.
5. Click OK.
On the next device check-in, MobileIron Core will send the mutual authentication client identity certificate to thedevice. In all subsequent device check-ins, the device will use mutual authentication on port 443.
On that first device check-in, the device's client migration status changes to Pending. After Core has sent themutual authentication client identity certificate to the device, the client migration status changes to Success.
You can search on this value in the Client Migration Status field in Advanced Search on Devices & Users> Devices.
Related topics
When devices use mutual authentication

Certificates settings
Use a certificate setting to upload a trusted public key root certificate or certificate chain. If it is a certificate chain,it can include the root certificate or only intermediate certificates.
IMPORTANT: You cannot upload an identity certificate -- a certificate that contains a private key -- intoa certificate setting. To upload an identity certificate to Core, use the certificate
enrollment setting called single file identity.
You configure MobileIron Core to deliver the uploaded certificate or certificate chain to devices so that the devices
can trust, for example, specific web services, email servers, or network components like VPN and Wi-Fi.
Two ways are available to deliver the certificate to a device:
MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 226

Adding a certificate settingll

You reference the certificate setting from another Core setting, and apply the appropriate labels to thereferencing setting. Only the following settings can reference a certificate setting:o

An AppConnect app configuration, Web@Work setting, or Docs@Work setting can reference a
certificate setting as the value of a key-value pair.

o

A Wi-Fi setting can reference a certificate setting in its Apply to Certificates field (used with specificauthentication and data encryption values on the Wi-Fi setting).

You want to deliver a trusted public key certificate directly to a set of devices, without referencing thecertificate setting from another setting. In this case, label the certificate setting. This case is less common.

Note The Following:llWhen upgrading from a MobileIron Core prior to Core 9.5.0.0, each certificate setting that contained an
identity certificate is automatically converted to a single file identity certificate enrollment setting. Any
settings that referenced the certificate setting refer to the new single file identity certificate enrollment
setting.
You cannot import a certificate setting from a MobileIron Core prior to Core 9.4.0.0 if the certificate setting
contained an identity certificate. You must manually create a single file identity certificate enrollment
setting.

Adding a certificate setting
Procedure
1. Log in to the Admin Portal.
2. Go to Policies & Configs > Configurations
3. Click Add New > Certificates.
4. Fill in the entries:lName: Enter brief text that identifies certificate setting.

lDescription: Enter additional text that clarifies the purpose of this certificate setting.

lFile Name: Click Browse to select the X.509 certificate file (.cer, .crt, .pem, or .der) to upload to
MobileIron Core. The certificate must be encoded as binary DER or ASCII PEM.

5. Click Save.
Label the certificate setting if you want to deliver the certificate directly to a set of devices, regardless whether it isreferenced from another setting. If you are referencing the certificate setting from another setting, label the othersetting.

Certificate Enrollment settings
NOTE: Identity certificates can be distributed via Apps@Work.
Certificate enrollment settings are used as follows:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 227

If Certificate Enrollment integration is not an option

l

l

l

As part of a larger process of setting up a certificate enrollment server to support authentication for VPN on
demand, Wi-Fi, Exchange ActiveSync, AppTunnel and so on.
To provide devices identity certificates that you uploaded to Core for the case when you want to provide
the same identity certificate to many users’ devices.
To provide user-provided certificates to devices when end users use the MobileIron Core user portal to
upload their identity certificates to Core.

The available options are:llBlue Coat: Select Blue Coat to create a Blue Coat certificate enrollment setting for integrating with theBlue Coat Mobile Device Security service.
Client-Provided: Select Client-Provided if you want AppConnect apps to use derived credentials forauthentication, digital signing, or encryption.

lEntrust: Select Entrust if you are using the Entrust Datacard certificate enrollment solution.

lGlobalSign: Select GlobalSign if you are using GlobalSign as the CA for certificate enrollment.

lLocal: Select Local if you are using MobileIron Core as the CA.

l

OpenTrust: Select OpenTrust if you are using the OpenTrust integration. See Configuring OpenTrust CA.

llSingle File Identity: Select Single File Identity to upload an identity certificate for distribution todevices.
SCEP: Select SCEP for standard certificate-based authentication using a separate CA.
NOTE: SCEP Configurations created before upgrading to Core 7.0.0.0 or later should be
replaced with a new SCEP Configuration. Failure to do so might result in cert renewal
failure from Core 9.4.0.0.

l

l

l

Symantec Managed PKI: Select Symantec Managed PKI if you are using Symantec’s Certificate
Enrollment solution. See Configuring Symantec Managed PKI for more information.
Symantec Web Services Managed PKI: Select Symantec Web Services Managed PKI if you areusing the Symantec Web Services Managed PKI solution. See Configuring Symantec Web Services
Managed PKI for more information.
User-Provided: Select User-Provided if device users will upload their personal certificates. The user
portal includes a certificate upload section for this purpose. A web services API is also available for you to
upload user-provided certificates.

If Certificate Enrollment integration is not an option
If Certificate Enrollment integration is not an option for your organization, consider configuring MobileIron Core as
an intermediate or root CA. See Certificate Enrollment settings for more information.

Supported variables for certificate enrollment
The following variables are supported for the required and optional fields when configuring integration withsupported Certificate Authorities (CA’s):

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 228

Configuring a client-provided certificate enrollment settingl$EMAIL$l$USERID$l$FIRST_NAME$l$LAST_NAME$l$DISPLAY_NAME$l$USER_DN$l$USER_UPN$l$USER_LOCALE$l$DEVICE_UUID$l$DEVICE_UUID_NO_DASHES$l$DEVICE_UDID$l$DEVICE_IMSI$l$DEVICE_IMEI$l$DEVICE_SN$l$DEVICE_ID$l$DEVICE_MAC$l$DEVICE_CLIENT_ID$l$USER_CUSTOM1$l$USER_CUSTOM2$l$USER_CUSTOM3$l$USER_CUSTOM4$l$REALM$l$TIMESTAMP_MS$l$RANDOM_16$l$RANDOM_32$l$RANDOM_64$l$CONFIG_UUID$** This substitution variable works only for the values under the Subject Alternative Names section for thefollowing configurations: Entrust, Local, SCEP, Symantec Managed KPI. It is used for Sentry certificate-basedtunneling (CBT).

Configuring a client-provided certificate enrollment settingThis section covers client-provided certificate enrollment settings.
Client-provided certificate enrollment settings are applicable only to iOS and Android devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 229

Overview of client-provided certificate enrollment settings

Overview of client-provided certificate enrollment settings
Derived credentials are identity certificates derived from the certificates on a smart card. The derived credentials
are stored on the device in Mobile@Work on iOS devices, and in Secure Apps Manager on Android devices.
AppConnect apps on mobile devices can use derived credentials for these purposes:lauthentication to backend servers, such as email servers, web servers, or app serversldigital signinglencryptionldecryption of older emails for which the original encryption certificate has expired (iOS only)lauthenticating the user to Standalone Sentry when using AppTunnel with Kerberos authentication to thebackend server

You create a client-provided certificate enrollment setting when you want an AppConnect app to use derived
credentials for one of these purposes. You then refer to the client-provided certificate enrollment in the appropriate
setting.
NOTE: The certificate enrollment setting is called client-provided because Mobile@Work for iOS or
Secure Apps Manager for Android, known as client apps, provide the identity certificate to the
AppConnect app.
Only the following settings can refer to a client-provided certificate enrollment setting:l

AppConnect app configuration
It can refer to a client-provided certificate enrollment setting in:lo

the value in a key-value pair in its App-specific Configurations sectionothe identity certificate in its AppTunnel Rules section

Web@Work setting
It can refer to a client-provided certificate enrollment setting in:lo

the value in a key-value pair in its Custom Configurations sectionothe identity certificate in its AppTunnel Rules section

Docs@Work setting
It can refer to a client-provided certificate enrollment setting in:othe value in a key-value pair in its Custom Configurations sectionothe identity certificate in its AppTunnel Rules section

Make sure the version of Mobile@Work for iOS or the Secure Apps Manager for Android on the device supports
client-provided certificate enrollment settings as shown in the following table:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 230

Specifying a client-provided certificate enrollment setting

Reference to theclient-provided
certificate
enrollment
setting

iOS:

iOS:

iOS:

Android:

Mobile@Workprior to 8.5

Mobile@Work
8.5 and 8.6

Mobile@Work 9.0
through the mostrecently released
version as
supported by
MobileIron

All versions ofSecure Apps
Manager supported
or compatible with
MobileIron Core

In key-value pairs

Not supported

Supported

Supported

Supported

In AppTunnel
rules

Not supported

Not supported

Supported

Not supported

Related topicslMobileIron Core Derived Credentials Guidel

MobileIron PIV-D Manager App for iOS Release Notesl

MobileIron PIV-D Entrust App for Android Release Notes

Specifying a client-provided certificate enrollment setting
To specify a client-provided certificate enrollment setting:
1. Go to Policies & Configs > Configurations.
2. Select Add New > Certificate Enrollment > Client-Provided.
In the New Client-Provided Certificate Enrollment Setting dialog box, use the following guidelines tospecify your settings.
Item

Description

Name

Enter brief text that identifies this certificate enrollment
setting.

Description

Enter additional text that clarifies the purpose of thiscertificate enrollment setting.

Select purpose

Select one of the following, depending on the intended
use of the client-provided identity certificate:• Authentication• Decryption• Encryption• Signing

ProviderSelect the derived credential provider.

3. Click Save.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 231

Configuring an Entrust CA

Configuring an Entrust CA
MobileIron Core supports integration with the Entrust Administration Services (EAS). This integration allows
MobileIron Core to work with Entrust to obtain certificates directly from the CA.
Entrust Prerequisites
The information in this section assumes the following:l

You have the URL for your Entrust server (received from Entrust).

l

You have the Admin ID and password.

Procedure
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment > Entrust.
2. Use the following guidelines to specify the settings.
lName: Enter brief text that identifies this group of settings.

lDescription: Enter additional text that clarifies the purpose of this group.

l

API URL: Enter the URL for your Entrust server (received from Entrust).

l

Admin ID: The administrator credentials to log into the Entrust server.

lAdmin Password: Enter the Admin Password.

lGroup: The Entrust group associated with users. Custom attribute variable substitutions aresupported.
NOTE: If the profile you selected contains an iggroup variable, then the you must configure
the same value here as welll

Key Usage: Use these options to filter out the certificates returned by Entrust, which may return
multiple certificates with different uses depending on the selected profile.
NOTE: When multiple certificates are returned by a DigitalID profile, the first one thatmatches the selected key usage flags is used. If none of the returned certificatesmatch the selected key usage flags, an error is raised. Use the Issue Test Certificate
feature to ensure the expected certificate is selected.

lProfile: Use these options to filter out the certificates returned by Entrust, which may return multiple
certificates with different uses depending on the selected profile.
Select a profile template from Entrust. Once you select this profile, more options (required and optionalvariables) are available to you based on the profile you select. Entrust refers to profiles as DigitalIDs.

lProfile Description: Pre-populated based on the profile you select.

lApplication Description: Pre-populated based on the profile you select.

lCentralized: Select to allow MobileIron Core to retrieve certificates on behalf of devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 232

Revoking the certificate

Decentralized: Select to let managed devices retrieve their own certificates.
lThis feature is supported on iOS devices only.
Store keys on Core: Specifies whether MobileIron Core stores the private key sent to each device.
When storing keys is enabled, private keys are encrypted and stored on the local Core.
o

If you select this option after devices have been provisioned, certificates will be re-provisioned for
all impacted devices.

l

User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.

l

Device Certificate: Specifies that the certificate is bound to the given device.

l

Entrust SCEP CA:o

URL: Enter the URL of the Entrust SCEP CA.

o

Key Type: Select RSA.

o

Key Length: Select 1024 or 2048.

l

Subject Alternative Names table: Select a type and value. At run-time, these variables are resolved
into user values. (See Certificate Enrollment settings for more information.) Custom attribute variable
substitutions are supported.

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values thatyou enter result in warnings, you can save the configuration after confirming the warning
messages. To see configuration errors, go to Services > Overview.

Revoking the certificate
You can revoke an Entrust API Version 9 certificate.
Revoking a certificate adds the certificate to the CRL (Certificate Revocation List). The certificate is also removed
from the Entrust manager. When a device authenticates with MobileIron Core, the system first checks the CRL toverify that the certificate is not on the list. If the certificate is on the list, authentication fails.
To revoke a certificate:
1. Navigate to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Select Actions > Revoke.

Configuring a GlobalSign CA
MobileIron Core supports integration with GlobalSign as a certificate authority (CA) for certificate enrollment. This
integration enables GlobalSign to perform the proxy tasks that would normally be performed by Core, allowing the

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 233

GlobalSign Prerequisites

device to obtain certificates from the GlobalSign CA.

GlobalSign Prerequisites
The information in this section assumes that you have set up the following information with GlobalSign:l

A user name and password for MobileIron Core to use to access the GlobalSign serverlGlobalSign profilesllWhether you want the generated certificates to have the enhanced key usage extension Encrypting File
System (EFS)
Whether you want the generated certificates to be the GlobalSign type “personal” or “department”

To specify GlobalSign settings:
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment >GlobalSign.
2. Use the following guidelines to specify the settings.
lName: Enter brief text that identifies this certificate enrollment setting.

lDescription: Enter additional text that clarifies the purpose of this certificate enrollment setting.

lStore keys on Core: Specifies whether MobileIron Core stores the private key sent to each device.
When storing keys is enabled, private keys are encrypted and stored on the local Core.
If you select this option after devices have been provisioned, certificates will be re-provisioned for all
impacted devices.

l

User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.

l

Device Certificate: Specifies that the certificate is bound to the given device.

l

URL: Enter the URL for the GlobalSign server. This field defaults to:https://system.globalsign.com/cr/ws/GasOrderService
Typically, you only change this if you are working with a GlobalSign test environment.

l

l

l

User Name: The user name for MobileIron Core to use to access the GlobalSign server. Custom
device and user attributes variable names are supported.
Password: Enter the password then re-enter to confirm. Custom device and user attributes variablenames are supported.
Profile: Click Refresh to populate the drop-down list of profiles from GlobalSign. Then, select a
profile.
NOTE: You must enter a valid User Name and Password before clicking Refresh.

lProfile Description: Pre-populated based on the profile you select.

lApplication Description: Pre-populated based on the profile you select.

l

Product Code: Select either EPKIPSPersonal or EPKIPSDept, depending on whether you want thegenerated certificates to be the GlobalSign type “personal” or “department”.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 234

Revoking the certificatelCertificate Expiration: Specify when the generated certificate will expire.

l

EFS option: Select this setting if you want the generated certificate to have the enhanced key usage
extension Encrypting File System (EFS).
Selecting this setting has no impact if the selected profile has disabled EFS.

lCommon Name: Specify the Common Name to use in the generated certificate.

l

Organization Unit: Specify the Organization Unit to use in the generated certificate.

l

E-Mail: Specify the email address to use in the generated certificate.

l

Subject Alternative Names Value: Enter a type and value. At run-time, these variables are resolved
into user values. Add multiple SAN entries with corresponding values. Click Add+, select the SAN
type (NT Principal Name) from the drop-down list, then select one of the available values. (SeeSupported variables for certificate enrollment for more information.)

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values thatyou enter result in warnings, you can save the configuration after confirming the warning
messages. To see configuration errors, go to Services > Overview.

Revoking the certificate
You can revoke a GlobalSign certificate.
Revoking a certificate adds the certificate to the CRL (Certificate Revocation List). The certificate is also removed
from the GlobalSign server. When a device authenticates with MobileIron Core, the system first checks the CRL toverify that the certificate is not on the list. If the certificate is on the list, authentication fails.
To revoke a certificate:
1. Navigate to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Select Actions > Revoke.

Configuring MobileIron Core as the CA
This section describes how to configure MobileIron Core as the CA.
To specify local settings:
1. Go to Policies & Configs > Configurations.
2. Click Add New > Certificate Enrollment > Local.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 235

Revoking the certificate

3. Use the following guidelines to specify the settings.
lName: Enter brief text that identifies this group of settings. Example: Local Certificate Settings for WiFil

Description: Enter additional text that clarifies the purpose of this group of settings.

lStore keys on Core: Specifies whether MobileIron Core stores the private key sent to each device.
When storing key is enabled, private keys are encrypted and stored on the local Core.
If you select this option after devices have been provisioned, certificates will be re-provisioned for all
impacted devices.
Select this option for certificates used for email on devices with multi-user sign-in.

lUser Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.
Select this option for certificates used for email on devices with multi-user sign-in.

lDevice Certificate: Specifies that the certificate is bound to the given device.

l

Local CAs: Select the name of the self-signed certificate you generated.

l

Key Type: Specifies the key exchange algorithm used (typically RSA or elliptic curve).

lSubject: Enter an X.509 name represented as an array of OIDs and values.
See Supported variables for certificate enrollment for more information.

l

Subject Common Name Type: Select the CN type specified in the certificate template. If you enter
the $USER_DN$ variable in the Subject field, select None from the drop-down list.

l

Key Usage: Specify acceptable use of the key (signing and/or encryption).

l

Key Length: Select a Key Length.
The values are 1024, 1536, 2048 (the default), 3072, and 4096.

l

CSR Signature Algorithm: Select the signature algorithm.
The values are SHA1, SHA256, SHA384 (default), and SHA512.

l

Subject Alternative Names table: Enter a type and value. At run-time these variables are resolved
into user values.
See Supported variables for certificate enrollment for more information.

4. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
5. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values thatyou enter result in warnings, you can save the configuration after confirming the warning
messages. To see configuration errors, go to Services > Overview.

Revoking the certificate
You can revoke a local certificate.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 236

Configuring OpenTrust CA

Revoking a certificate adds the certificate to the CRL (Certificate Revocation List). When a device authenticateswith MobileIron Core, the system first checks the CRL to verify that the certificate is not on the list. If the certificate
is on the list, authentication fails.
To revoke a certificate:
1. Navigate to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Click Actions > Revoke.

Configuring OpenTrust CA
MobileIron Core supports integration with the OpenTrust Mobile Provisioning Server (MPS). This integration
enables OpenTrust to perform the proxy tasks that would normally be performed by Core. The following describes
the configuration in Core.
Note The Following: Compatibility notesllThis integration does not support the pushing Certificate Authorities Bundles to devices, which is offeredby OpenTrust.
MobileIron Core supports one certificate per OpenTrust configuration. OpenTrust supports creating profiles
having multiple credentials (called application in the OpenTrust context).

Before you begin
The information in this section assumes the following:ll

You have the URL for your OpenTrust cloud instance.
You have the client-side JSON connector identity certificate MobileIron Core will use to authenticate to the
MPS.

l

You have implemented a centralized OpenTrust cloud.

l

You have created a Mobile Management Profile on MPS containing a single centralized credential.

Procedure
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment >OpenTrust.
2. Use the following guidelines to specify the settings:
NOTE: Although optional fields are not required by OpenTrust, they are still used if present.
Therefore, you must still specify the appropriate variable for each optional field. For
example, the phone number might be an optional field because the tablets in yourorganization do not have phone numbers. However MPS might still use this information torequest a certificate from the PKI server if it is present.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 237

Revoking the certificatelName: Enter brief text that identifies this group of settings.

lDescription: Enter additional text that clarifies the purpose of this group.

l

l

l

Store keys on Core: Specifies whether MobileIron Core stores the private key sent to each device.
When storing key is enabled, private keys are encrypted and stored on the local Core.
If you select this option after devices have been provisioned, certificates will be re-provisioned for all
impacted devices
User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.

l

Device Certificate: Specifies that the certificate is bound to the given device.

l

API URL: Enter the URL for the OpenTrust server.

lCertificate 1: This is the name of the uploaded certificate.

lPassword 1 (Optional): This password is optional.

l

Add Certificate: Click this link to add one or more certificates, as necessary.

l

l

l

Profile: This is the MPS Mobile Profile to use for the integration. If you do not see an expected profile,then it most likely contains multiple credentials, a configuration that MobileIron Core does not currently
support.
Profile Description: This is pre-populated based on the profile you select.
Application Description: This is populated automatically with the corresponding OpenTrust content
associated with the selected profile.

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values thatyou enter result in warnings, you can save the configuration after confirming the warning
messages. To see configuration errors, go to Services > Overview.

Revoking the certificate
You can revoke a OpenTrust certificate.
Revoking a certificate adds the certificate to the CRL (Certificate Revocation List). The certificate is also removed
from the OpenTrust manager. When a device authenticates with MobileIron Core, the system first checks the CRL
to verify that the certificate is not on the list. If the certificate is on the list, authentication fails.
Procedure
1. Navigate to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Click Actions > Revoke.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 238

Configuring a single file identity certificate enrollment setting

Configuring a single file identity certificate enrollment setting
Use a single file identity certificate enrollment setting to upload an identity certificate to MobileIron Core for
distribution to devices. A typical use case for a single file identity certificate is using the certificate to authenticate
devices to a network server, such as:lllStandalone Sentry
When device authentication on Standalone Sentry is configured as Group Certificate, you typically
distribute the same identity certificate to multiple devices.
a Wi-Fi network component
When you configure a Wi-Fi setting to use TLS or TTLS for its EAP type, you can distribute the same
identity certificate to multiple devices.
a VPN network component
When you configure a VPN setting, depending on the type of VPN setting, you can use certificate-based
authentication. For the authentication, you can distribute the same identity certificate to multiple devices.

You can upload either:lll

An identity certificate.
The certificate is a PKCS 12 certificate which contains exactly one private key. It is a .p12 or .pfx file. The
file can optionally include the certificate chain. The certificate chain can include only intermediate
certificates, or intermediate certificates through the root certificate. The root certificate is not necessary if it
is from a well known certificate authority.
You also provide the password for the identity certificate’s private key.
Multiple files, which include among them:othe private key and its password.

othe public certificate.

othe supporting certificates in the certificate chain. The root certificate is not necessary if it is from awell known certificate authority.

Examples of combinations you can upload are:oa .p12 or .pfx file containing a an identity certificate and its private key and password, plus additional.pem files containing the intermediate certificates.

oa .pem file containing the private key and password, a .pem file containing the public certificate, plus
additional .pen files containing the intermediate certificates.

Procedure
1. Log in to the Admin Portal.
2. Go to Policies & Configs > Configurations
3. Click Add New > Certificate Enrollment > Single File Identity.
4. Fill in the entries:lName: Enter brief text that identifies certificate enrollment setting.

lDescription: Enter additional text that clarifies the purpose of this certificate enrollment setting.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 239

Configuring SCEPl

Certificate 1: Click Browse to select the .p12 or .pfx file of the identity certificate, if you are uploading
only one file.

l

If you are uploading multiple files, select the file (.p12, .pfx, or .pem) that contains the private key.

l

Password 1: Enter the password for the certificate’s private key.

5. If you are uploading multiple files, click Add Certificate to add another file.
6. Fill in the entries:llCertificate 2: Click Browse to select the .pem file to upload to MobileIron Core. The certificate mustbe formatted as binary DER or ASCII PEM.
Password 2: The Password field is applicable only for the file that contains the private key.

7. Optionally, click Add Certificate to add another file.
8. Click Save.
After you save the single file identity certificate enrollment setting, you can view or change the certificate by editing
the setting.

Configuring SCEPThis section describes how to specify settings that allow the device to obtain certificates from a certificate
authority (CA) using Simple Certificate Enrollment Protocol (SCEP).
To specify the SCEP settings:
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment > SCEP.
2. Use the following guidelines to specify the settings:lName: Enter brief text that identifies this group of settings.

lDescription: Enter additional text that clarifies the purpose of this group.

lCentralized: MobileIron Core retrieves certificates on behalf of devices. Core also manages thecertificate lifetime and triggers renewals. See “SCEP proxy functions on page 242”.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.

lDecentralized: Devices retrieve their own certificates.
Use this feature if using the SCEP setting for mutual authentication. It is not supported for any otheruse cases with AndroidiOS and macOS devices. See Enabling mutual authentication for Apple andAndroid devices.

lStore keys on Core:
Specifies whether MobileIron Core stores the private key sent to each device. When storing key isenabled, private keys are encrypted and stored on the local Core.
If you select this option after devices have been provisioned, certificates will be re-provisioned for all

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 240

Configuring SCEP

impacted devices.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.
lProxy requests through Core:
When this option is enabled, Core acts as a reverse proxy between devices and the target certificate
authority. This option is only available when Decentralized is selected.

l

User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.

lDevice Certificate: Specifies that the certificate is bound to the given device.

l

URL: Enter the URL for the SCEP server.

l

CA-Identifier: (Optional) Enter the name of the profile for SCEP servers that support named-profiles.

l

Subject: Enter an X.509 name represented as a comma-separated array of OIDs and values.
Typically, the subject is set to the user’s fully qualified domain name. For example,
C=US,DC=com,DC=MobileIron,OU=InfoTech or
CN=www.mobileiron.com.
You can also customize the Subject by appending a variable to the OID. For example,
CN=www.mobileiron.com-$DEVICE_CLIENT_ID$.
For ease of configuration you can also use the $USER_DN$ variable to populate the Subject with theuser’s FQDN.

l

Subject Common Name Type: Select the CN type specified in the certificate template. If you enter
the $USER_DN$ variable in the Subject field, select None from the drop-down list.

l

Key Usage: Specify acceptable use of the key by signing.

lEncryption: Specify acceptable use of the key by encryption.

l

Key Type: Specify the key type.

l

Key Length: The values are 1024, 1536, 2048 (the default), 3072, and 4096.

l

CSR Signature Algorithm: The values are SHA1, SHA256, SHA384 (default), and SHA512.

l

Finger Print: The finger print of the CA issuing the root certificate.

llChallenge Type: Select None, Microsoft SCEP, or Manual to specify the type of challenge touse. The Challenge Type will depend on what the NDES server is configured to use.
Challenge URL: For a Microsoft SCEP challenge type, enter the URL of the trustpoint defined foryour Microsoft CA.

lUser Name: Enter the user name for the Microsoft SCEP CA.

l

Password: Enter the password for the Microsoft SCEP CA.

lSubject Alternative Names Type: Select NT Principal Name, RFC 822 Name, or None, based on
the attributes of the certificate template. You can enter four alternative name types.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 241

X.509 Codes

NOTE: If this SCEP setting is for authenticating the device to the Standalone Sentry using an
identity certificate: select NT Principal Name and select Distinguished Name for asecond Subject Alternative NamelSubject Alternative Names Value: Select the Subject Alternate Name Value from the drop-down listof supported variables. You can also enter custom variables in addition to and instead of the supported
variables.
NOTE: If this SCEP setting is for authenticating the device to the Standalone Sentry using an
identity certificate: enter $USER_UPN$ for the value corresponding to NT Principal
Name and enter $USER_DN$ for the value corresponding to Distinguished Name.

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
You cannot make changes to the saved SCEP settings. When you open a saved SCEP setting, the Save
button is disabled.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values
that you enter result in warnings, you can save the configuration after confirming thewarning messages. To see configuration errors, go to Services > Overview.

X.509 Codes
The Subject field uses an X.509 distinguished name. You can use one or more X.509 codes, separated bycommas. This table describes the valid X.509 codes:

TABLE 67. X.509 CODES
Code

Name

Type

Max Size

ExampleC

Country/Region

ASCII

2

C=US

DC

Domain Component

ASCII

255

DC=company, DC=com

S

State or Province

Unicode128

S=California

L

Locality

Unicode128

L=Mountain View

O

Organization

Unicode64

O=Company Name, Inc.

OU

Organizational Unit

Unicode64

OU=Support

CN

Common NameUnicode64

CN=www.company.com

NOTE: If the SCEP entry is not valid, then you will be prompted to correct it; partial and invalid entries
cannot be saved.

SCEP proxy functions
Choosing to enable SCEP proxy functions has the following benefits:
MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 242

Configuring Symantec Managed PKIl

A single certificate verifies Exchange ActiveSync, Wi-Fi, and VPN configurationsl

There is no need to expose a SCEP listener to the Internet.

l

MobileIron can detect and address revoked and expired certificates.

Configuring Symantec Managed PKI
Symantec Managed PKI support enables you to configure certificate-based authentication. Symantec Managed
PKI is a source for certificates that you can reference in a variety of configurations, such as for Exchange, VPN,
and AppConnect.

PrerequisiteslA valid Symantec Verisign Managed PKI account is required.

l(Optional) Get finger print from issuing CA for root certificate.

l

One or more client certificate and password from CA.

Procedure
To specify the Symantec Managed PKI settings:
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment > Symantec
Managed PKI.
2. Use the following guidelines to specify the settings:lName: Enter brief text that identifies this group of settings.

lDescription: Enter additional text that clarifies the purpose of this group.

lCentralized: MobileIron Core retrieves certificates on behalf of devices. Core also manages thecertificate lifetime and triggers renewals. See “Using a proxy on page 244”.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.

lDecentralized: Devices retrieve their own certificates.

lStore keys on Core: Specifies whether MobileIron Core stores the private key sent to each device.
When storing key is enabled, private keys are encrypted and stored on the local Core.
If you select this option after devices have been provisioned, certificates will be re-provisioned for all
impacted devices.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.

loProxy requests through Core:
When this option is enabled, Core acts as a reverse proxy between devices and the target certificate
authority. This option is only available when Decentralized is selected.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 243

Using a proxyl

User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.
NOTE: Select this option for certificates used for email on devices with multi-user sign-in.

l

URL Mode: Specifies the mode and the corresponding URL supplied by Symantec.

l

CA-Identifier: Required information supplied by Symantec.

l

Subject: See Supported variables for certificate enrollment for more information.

l

Subject Common Name Type: Select the CN type specified in the certificate template. If you enter
the $USER_DN$ variable in the Subject field, select None from the drop-down list.

l

Key Usage: Use these options to indicate which key usage to request from the CA.

l

Key Type: This is the Key Exchange algorithm: RSA or Elliptic Curve.

l

Key Size: The values are 1024, 1536, 2048 (the default), 3072, and 4096.

l

CSR Signature Algorithm: The values are SHA1, SHA256, SHA384 (the default), and SHA512.

l

Finger Print: The finger print of Symantec Managed PKI.

l

Certificate 1: Upload for the client authentication with the server.

lPassword 1: This password is optional.Best used when certificate and password are in separate files.

l

Subject Alternative Names table: Enter a type and value. At run-time these variables are resolved
into user values. (See Supported variables for certificate enrollment for more information.)
NOTE: The Required Fields and Optional Fields for the certificate are displayed based on
how the MDM (Web Service Client) profile was set up in the Symantec PKI manager.

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values
that you enter result in warnings, you can save the configuration after confirming thewarning messages. To see configuration errors, go to Services > Overview.

Using a proxy
Choosing to enable proxy functions has the following benefits:lA single certificate verifies Exchange ActiveSync, Wi-Fi, and VPN configurationsl

There is no need to expose a SCEP listener to the Internet.

l

MobileIron can detect and address revoked and expired certificates.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 244

Configuring Symantec Web Services Managed PKI

Configuring Symantec Web Services Managed PKI
Integration with Symantec Web Services Managed PKI version 8.x enables you to configure certificate-based
authentication. The following describes how to configure Symantec Web Managed PKI in MobileIron Core.
Before you beginl

Set up your account for Symantec Web Services Managed PKI with Symantec.

lCreate an MDM (Web Service Client) profile in the Symantec PKI manager that you will use for the
MobileIron integration.
SeatID
Be sure to include the Symantec SeatID as a required certificate profile field. In a Symantec Web Services
Managed PKI environment, Symantec uses the SeatID to track the number of seats for billing purposes.
To correctly track the number of seats, the SeatID value in the MobileIron Core SCEP settings must map
to the value you created for the SeatID in the Symantec PKI Manager. For example, if the user's email
address is used as the SeatID in Symantec PKI Manager, the Core SCEP settings should map the Coreemail address attribute to the Symantec SeatID.
Core associates each issued Symantec certificate to a SeatID in the Symantec PKI Manager. If the
SeatID does not exist, a new Symantec user account and SeatID is automatically created for the user at
the time the certificate is requested.

lGather the following items:oThe server address for the Symantec Web Services Managed PKI.
On MobileIron Core the default is set to pki-ws.symauth.com.

o

The Registration Authority (RA) certificate MobileIron Core will use to authenticate to the Symantec
CA.

Procedure
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment > Symantec
Web Managed PKI.
2. Use the following guidelines to specify the settings:
NOTE: The Required Fields and Optional Fields for the certificate are displayed based on how
the MDM (Web Service Client) profile was set up in the Symantec PKI manager.
lName: Enter brief text that identifies this group of settings.

lDescription: Enter additional text that clarifies the purpose of this group.

lStore keys on Core: Specifies whether MobileIron Core stores the private key sent to each device. If
you are using a Symantec profile that is set up to store keys on the Symantec server, you typically do
not select this option.
NOTE: If you select this option after devices have been provisioned, certificates will be reprovisioned for all impacted devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 245

Revoking the certificatel

User Certificate: Specifies that the certificate is distributed to multiple devices assigned to a single
user.
The certificate is revoked when the user is removed from Core.

l

Device Certificate: Specifies that the certificate is bound to the given device. Make sure theSymantec certificates are unique for each device.
The certificate is revoked when the device is retired from Core.

a. API URL: Enter the server address for the Symantec Web Services Managed PKI (received from
Symantec).
The default is set to pki-ws.symauth.com.
NOTE: Do not add https:// before the server name, and do not add path information after
the server name.
Only the hostname of the Symantec CA server should be provided.
l

l

l

l

Certificate 1: Navigate and select the RA certificate you received from Symantec. This is usuallya.p12 file. Enter the password for the certificate when prompted.
Password 1: (Optional if certificate and password are stored in the same file.) Enter the password forthe certificate.
Add Certificate: Click this link to add one or more certificates, as necessary.
Profile: This is the profile to be used for the integration. If you do not see an expected profile, then it
most likely contains multiple credentials, a configuration that MobileIron Core does not currently
support.

lProfile Description: This is pre-populated based on the profile you select.

lApplication Description: This is populated automatically based on the selected profile.

3. (Optional) Click Issue Test Certificate to verify the configuration by generating a test certificate to ensure
there are no errors. Although this step is optional, it is recommended. A real certificate is not generated.
4. Click Save.
NOTE: If values that you enter in fields result in errors, you cannot save the configuration. If values
that you enter result in warnings, you can save the configuration after confirming thewarning messages. To see configuration errors, go to Services > Overview.

Revoking the certificate
You can revoke a Symantec Web Services Managed PKI certificate.
Revoking a certificate adds the certificate to the CRL (Certificate Revocation List). The certificate is also removed
from the Symantec Web Services Managed PKI manager. When a device authenticates with MobileIron Core, thesystem first checks the CRL to verify that the certificate is not on the list. If the certificate is on the list,
authentication fails.
To revoke a certificate:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 246

Configuring a user-provided certificate enrollment setting

1. Navigate to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Click Actions > Revoke.

Configuring a user-provided certificate enrollment setting
One user-provided certificate enrollment setting for each purpose
Configure a user-provided certificate enrollment setting for every purpose for which users can upload a certificate(PKCS 12 file) in the user portal. For example, consider a case in which users have three different purposes forproviding certificates: S/MIME signing, S/MIME encryption, and authenticating to a backend server. In this case,
you create three user-provided certificate enrollment settings.
You provide a display name for each user-provided certificate enrollment setting. The display name you choose isimportant because the device user sees it in two places:
l

l

l

l

in the user portal when deciding what certificate to upload
In the user portal, the display name is called “configuration”. The user’s selection associates the uploaded
certificate with a user-provided certificate enrollment setting. The user can upload the same certificate, ordifferent certificates, for each display name.
in Mobile@Work for iOS, when Mobile@Work for iOS prompts the user for the private key password.
Mobile@Work prompts for the password if a password was not required when the user uploaded thecertificate to the user portal. Mobile@Work uses the display name to inform the user about which
certificate to provide the password for. For details, see The private key password on page 248.

Note The Following:
l

l

l

l

The PKCS 12 file must contain the certificate and one private key. MobileIron Core does not support
PKCS 12 files with more than one private key.
A web services MobileIron V2 API is also available for uploading user-provided certificates to Core andassociating the certificates with a user-provided certificate enrollment setting.
See the MobileIron V2 API Guide.
The V1 API that uploaded user certificates to MobileIron Core is no longer available. If you used the V1 API
to upload user certificates, Core will continue to use the certificates until either:o

the user uploads a replacement in the user portaloyou use the V2 API to upload a replacement
Note that the V1 API associated the user certificate with a certificate type: All, WIFI, VPN,SMIMESIGNING, SMIMEENCRYPTION, EMAIL or EXCHANGE. Although Core still supports using
these certificates and their associated type, the user portal does not display these certificates in theuser portal.

Core stores the certificate and private key

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 247

Configuring a user-provided certificate enrollment setting

When the user uploads a user-provided certificate in the user portal, the user uploads a PKCS 12 file. Core storesthe file, which includes the certificate and its private key. Core does not remove the PKCS 12 file after delivering itto the user’s device. Therefore, if the user registers another device, the PKCS 12 file is available to deliver to theadditional device.
The private key password
In each user-provided certificate enrollment setting, you specify whether the user is required to provide a password
for the certificate’s private key. When a password is required, users must provide a password when using the user
portal to upload a certificate associated with this certificate enrollment setting.
Important: Always require a password unless both of the following are true:ll

The devices that will use the user-provided certificate are iOS devices running Mobile@Work 9.0 for iOS
through the most recently released version as supported by MobileIron.
The apps that will use the certificate are AppConnect apps.

When you do not require a private key password when the user uploads a certificate, Mobile@Work for iOS and an
AppConnect for iOS app that uses the certificate behave as follows:
1. When the AppConnect app launches, control switches to Mobile@Work for iOS.
2. Mobile@Work prompts the device user for the private key password.
3. The device user enters the password.
NOTE: If the device user exits Mobile@Work without providing the password, when the
AppConnect app next launches, Mobile@Work unauthorizes the app, with the reason
that the app is missing credentials.
4. Control returns to the AppConnect app.
Whether you require a password depends on your security requirements. If a password is required, Core stores the
password along with the PKCS 12 file containing the certificate and private key. However, if your security
environment requires limiting the password’s storage to the device that uses the certificate, then do not require a
password.
When the private key of a user-provided certificate is deleted
The private key of a PKCS 12 file, and password if provided, can be deleted from the Core file system. Whether
you want the private key and password deleted from Core depends on your security requirements.
The following mechanisms are available to delete the private key and password:lA user can delete the private key and password using the user portal.

l

A web services API can delete the private key and password.

l

You can specify in the Admin Portal that Core deletes private keys and passwords older than somenumber of days.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 248

Configuring a user-provided certificate enrollment setting

IMPORTANT: When the private key and associated password is deleted, Core retains the publiccertificate and maintains an entry in its certificate table so it can track where thecertificate is used, when it expires and display information about it in the UI. Without theprivate key and associated password, Core is unable to use the identity certificate withany new certificate enrollments, AppConnect configuration and devices. Once theprivate key and associated password is deleted, the user-provided certificate must be
uploaded again before it can be used.
Because the certificate without the private key is still available on Core, you can view information about thecertificate, such as its expiration date. This information can help you manage devices still using the certificate.
Related topicslViewing, replacing, and deleting certificates in the user portal on page 370

l

MobileIron V2 API Guide

Specifying the settings for a user-provided certificate enrollment setting
To specify the settings for a user-provided certificate enrollment setting:
1. Go to Policies & Configs > Configurations and click Add New > Certificate Enrollment > UserProvided.
2. Use the following guidelines to specify the settings:lName: Enter brief text that identifies this setting.

lDescription: Enter additional text that clarifies the purpose of this setting.

llDisplay Name: Enter the name that will appear on the user portal where device users upload theircertificates. This name also appears in Mobile@Work if Mobile@Work prompts the device user for acertificate’s private key password.
Require Password: This option requires the user to provide a password for the certificate’s private
key when uploading a certificate associated with this certificate enrollment setting.

lImportant: Always require a password except as described in The private key password on page 248.

lDelete Private Keys After Days: Select the number of days after a user-provided certificate is
uploaded to MobileIron Core after which Core deletes the private key and, if provided, its password,from Core.
The default is None, which means Core does not delete the private key and its password.
The default is None, which means Core does not delete the private key and its password.

3. Click Save.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 249

13
Azure Services
This section addresses the different Azure services that MobileIron supports.
lAzure Services OverviewlRegister devices in AAD and MDMlJoin Azure and MobileIron for Windows 10

lWindows Information ProtectionlBusiness Store PortallWindows PIN management for PassPort For Work/Windows HellolWindows license management

Azure Services Overview
This chapter describes the Azure services that MobileIron supports. For all Azure services, you need to set up yoursystem both within MobileIron Core and using 3rd party tools and websites. This chapter describes theprerequisites for using any Azure service with MobileIron, as well as how to configure these services.

Standard prerequisites for all Azure services
MobileIron recommends you have met the following prerequisites before setting up any Azure service:l

A Premier license for Azure Active DirectorylAzure tenant for Azure Active DirectorylAzure user for Azure Active Directory.

Register devices in AAD and MDM
The documentation provided below, can be given to your employees with little or no modifications. Once the deviceuser completes the registration process, both the user and the device are registered and you can track compliance.
NOTE: These steps can change without notice. Contact Microsoft for the most up-to-date instructions.
The registration step to tracking compliance is for the device user to configure Azure Active Directory (AAD)
registration on the enterprise-owned device. Use the following scenarios to register the devices in AAD and MDM:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 250

OOBE sign up for AAD enrollmentl

OOBE sign up for AAD enrollment (first time set up)l

Post OOBE sign up for AAD enrollment (enterprise-owned not OOBE)lWorkplace sign up for AAD enrollment (employee-owned not OOBE)lTerms of Service Customization (customize the Terms of Service page)

OOBE sign up for AAD enrollment
When a device is registered for the first time, the user will answer a few questions about the device. The AAD
registration begins here.
1. Indicate who owns the device by making one of the following selections:
2. My organizationl

I own itl

Click Next.

3. Select Join Azure AD > Next.
4. Enter your enterprise user name and password.
5. Use the same credentials you use to log into your enterprise’s Office 365. Contact your administrator, if
you cannot sign in for any reason.
6. Click Sign In to connect to both Azure and the Core.
7. Read the MDM terms and conditions.
8. Click Accept to complete registration into Azure and MDM.
9. Microsoft requires pin registration for all AAD devices.
10. Enter a PIN and click OK.
11. In addition to the Set up a Pin screen, some users will be asked to verify that they are the correct user.
This verification screen does not appear for all users. The User and device is now registered and can beused both by Azure and MDM. Compliance can now be tracked.

Post OOBE sign up for AAD enrollment
Device users can follow this procedure for company-owned devices that are not OOBE devices.
1. Click Start > Settings > Accounts.
2. Click Access Work or School.
3. Click +Connect.
4. Enter your enterprise email address in the text box.
5. Click Next.
6. Enter your enterprise user name and password.
7. Use the same credentials you use to log into your enterprise’s Office 365. Contact your administrator, if
you cannot sign in for any reason.
8. Click Sign in to register your device and verify that it can be signed up for MDM service.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 251

Workplace sign up for AAD enrollment

Workplace sign up for AAD enrollment
Device users can follow this procedure for BYOD devices.
1. Click Start > Settings > Accounts.
2. Click Access Work or School.
3. Click +Connect.
4. Go to the Alternate actions section and click Join this device to Azure Active Directory.
5. Enter your enterprise user name and password.
6. Use the same credentials you use to log into your enterprise’s Office 365. Contact your administrator, if
you cannot sign in for any reason.
7. Click Sign in to register your device and verify that it can be signed up for MDM service.

Terms of Service Customization
Administrators can customize their MobileIron Terms of Service pages for users with new Azure Active Directory
registration.
To customize the Terms of Service page:
1. Log into the Admin Portal.
2. Click Settings > System Settings > Users & Devices > Registration.
3. Scroll to the End User Terms of Service section and click Add+.
4. Select a language.
5. Go to the Type field and select AAD Enrollment.
6. Customize the header text.
7. Add customized text in the Agreement Content box.
8. Click Save > Save.
Users with new AAD registration will see this new Terms of Service page.

Join Azure and MobileIron for Windows 10
This section describes how to set up Azure and MobileIron Core platforms to share data about device compliance.
Administrators use shared compliance information to set up rules for blocking access to applications (Office 365,
for example) until the device is in compliance.

Prerequisites for joining Azure and MobileIron
We recommend you have met the following prerequisites before starting this section:lStandard prerequisites for all Azure services

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 252

Join Azure and MobileIron work flow

Join Azure and MobileIron work flow
This section describes the overall work flow for joining Azure and MobileIron for Windows 10 devices:l

Set up Azure to join with MobileIronl

Set up MobileIron to join with AzurelManage device compliance

Set up Azure to join with MobileIron
The first step is to Set up Azure to join with MobileIron Core.
To set up MobileIron Core with Microsoft Azure Intune, see Azure Tenant.
NOTE: These steps can change without notice. Contact Microsoft for the most up-to-date instructions.

Add the MDM application
Follow this procedure to add the Mobile Device Management (MDM) application to Azure.
1. Log into the Microsoft Azure portal.
2. In the left panel, click Azure Active Directory.
3. Click Mobility (MDM and MAM).
4. Click + Add application.
5. Select the generic On-premises MDM application.
6. Enter a unique name that can easily be remembered to associate with MDM sign up and then click Add.
The app with the name you selected is added to a list of apps in the directory it was assigned.
Note the following information:l

Only one MDM vendor can be associated at a time.

l

If you add Intune, only Microsoft can remove the app manually.

ll

You can have multiple on-premise MDM apps at the same time, but make sure these apps' user
scopes do not overlap.
MobileIron_MDM is used only for cloud customers.

7. Complete the steps in Join Azure and MobileIron for Windows 10.

Configure the application
This procedure describes how administrators configure the settings required to connect to their instance ofMobileIron.
1. Open the MDM app you created.
2. On the Configure page, enter the URL of your MobileIron instance into the following fields:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 253

Configure the applicationl

MDM DISCOVERY URLl

MDM TERMS OF USE URL

3. Add /EnrollmentServer/Discovery.svc after .com in the MDM DISCOVERY URL field.
4. Add mifs/aad after .com in the MDM TERMS OF USE URL field.
5. In the MDM user scope field, select All to apply configuration to all users. Select Some if you want to a
specify a group (Additional fields will display.)
NOTE: Applying the configuration to None will negate using this app to any users in the directory
and will bypass using MobileIron Core for MDM management.

6. Click the On-premises MDM application settings link.
7. In the Overview tab, click Application ID URI and in the new page, click Edit to enter the URL of your
MobileIron instance.
8. In the left panel, click Authentication.
9. Add a new entry of redirect URIs, select the web type, enter the URL of your MobileIron instance for
redirect URIs, and then click Save.
10. Copy the Application (client) ID. You will enter this into the Azure Client ID field in MobileIron (see Set up
MobileIron to join with Azure).
11. In the left panel, click Certificates and Secrets.
12. To add a new key, click +New client secret.
13. Copy and save the new key. You will enter this into the Azure Key field in MobileIron.
Note the following:lThis key is also called a "client secret key" to the Application Client ID.

l

Select a 1- or 2-year activation period for the key.

l

The key is not visible until the configuration is changed.

l

The key is only visible after you save the configuration for the first time.

l

You can generate a new key, for any reason, using the same steps.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 254

Set up MobileIron to join with Azure

14. In the left pane, click API permissions. Note that under Permissions, the AAD Graph Read / Write device
permissions field is selected.
15. Click +Add permissions.
16. Select Azure Service Management.
17. In the Azure Service Management page, click Delegated permissions.
18. In the Permissions section, select the user_impersonation check box and then click Add permission.
19. Complete the steps in Set up MobileIron to join with Azure.

Set up MobileIron to join with Azure
The second step to join Azure with MobileIron is to set up MobileIron.
1. Log into the MobileIron Admin Portal.
2. Select Settings > System Settings > Windows > Advanced Menu.
3. Select Enable Microsoft Azure Menu.
NOTE: You do not need to turn on the Enabling Custom SyncML Menu option to work with Azure.
However, if it was already turned on, do not turn it off as it might be required for otherfeatures in MobileIron.
4. Click Save.
5. Click the Systems Settings tab.
6. In the left navigational pane, go to Microsoft Azure and expand the section. Alternately, find the Microsoft
Azure tile on the Systems Settings page.
7. Click Autopilot & Device Compliance for Windows. The Autopilot & Device Compliance for Windows
page opens.
8. Select the Enable Azure Device Compliance check box. New fields display below.
9. Enter the appropriate information for:l

Azure Domain ID - The name of your Azure tenant.

lAzure Client ID - the Client ID you noted from your Azure Configuration.

lAzure Key - the key you noted from your Azure Configuration.

10. Click Save.
You can edit the information at any time.
11. Provide your device users with the steps in Register devices in AAD and MDM.
12. Complete the steps in Manage device compliance.

Manage device compliance
Finally, now that the device is managed, MobileIron Core can begin to report compliance to Azure.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 255

Azure Compliance SettinglAdministrators can set up rules in MobileIron Core to determine if a device is out of compliance.

l

MobileIron can sends that information to Azure, when a device becomes is out of compliance.

l

If an administrator sets up rules in Azure, they are put in place when the device is out of compliance.

Azure Compliance Setting
The Trust Level, in Azure, indicates if a device is compliant or not.
lCompliant: the device is compliantlManaged: the device has fallen out of compliance

Windows Information Protection
As more enterprises take advantage of BYOD with Windows devices, the risk of accidental data leak through apps
and services (email, social media, the public cloud) outside of an enterprise’s control increases. Windows
Information Protection (WIP), previously known as Enterprise Data Protection (EDP), helps protect against thispotential data leakage without otherwise interfering with the user experience.
This feature is supported on Windows 10 devices.

Recommendations for using WIP
We recommend you have met the following in place before starting this section (however they are not required):llStandard prerequisites for all Azure services
A DRA certificate (contact your Microsoft sales and services associate for more information or go here:
https://docs.microsoft.com/en-us/windows/threat-protection/windows-information-protection/create-andverify-an-efs-dra-certificate)

Verify WIP profiles
You can view a device to see if the required profile settings to use WIP are correct. Currently, there is nocompliance based on these settings, however you do have the ability to verify that the device has the proper
profiles.
To verify WIP profiles:
1. Go to Device & Users> Devices.
2. Select the device.
3. Click the Policies tab.
4. Scroll to the WIP Policy2-3 section and expand, if necessary.
5. Review the WIP settings.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 256

WIP work flow

6. Verify that both Setting Value and Device Value are set to On.
These must match to be compliant.

WIP work flow
This section describes the overall work flow for setting up WIP:
1. Set up App Control rule
2. Creating a Windows Information Protection policy
3. Apply the profile to a label

Set up App Control rule
The App Control rule is a list of applications that can use and protect data with WIP. These apps will be a
combination of enlightened and un-enlightened applications.
Enlightened applications are those apps that have been written to use the functions Microsoft has defined for use
with WIP. These functions will help the application know the difference between:lbusiness datalpersonal data

Otherwise, the application treats all data as business data.

Setting up an App Control ruleThis procedure describes how to set up an App Control rule.
1. Select Apps > App Control> Add.
2. Select WIP as the Type and enter a name for the rule.
3. Enter the first application you want to be able to use WIP data, including the following fields:
l

App

l

App Identifier/Name (required)l

Device Platform (required)lComment

4. Click the green plus sign (+) to add additional applications, as necessary.
5. Click Save.
Click OK in the Success window.
6. Complete the steps in Creating a Windows Information Protection policy.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 257

Creating a Windows Information Protection policy

Creating a Windows Information Protection policy
To create a WIP policy:
1. Go to Policies & Configs > Policies.
2. Select Add New > Windows > Windows Information Protection.
3. Modify one or more of the fields, as necessary.
Refer to the Windows Information Protection Fields table for details.
4. Click Save > Apply to save the changes.
5. Click Save again to save the WIP policy.
6. Complete the steps in Apply the profile to a label
7. See also the Core Getting Started Guide for details.

New Windows Information Protection window
The following table summarizes fields and descriptions in the New Windows Information Protection window:

TABLE 68. WINDOWS INFORMATION PROTECTION FIELDS
FieldsDescription

Name

A name use to keep track of the profile in Core

Description

Describes the profile’s purpose (optional)

App Control Group

Lists applications protected by this policy, as defined in the appropriate App Control
rule. (See the Device Management Guide for Windows Devices for more information.)

Enforcement Level

Select one of the following enforcement modes:• Block: WIP looks for inappropriate data sharing practices and stops the employee
from completing the action. This can include sharing info across non-enterpriseprotected apps in addition to sharing enterprise data between other people anddevices outside of your enterprise.
• Override : WIP looks for inappropriate data sharing, warning employees if they dosomething deemed potentially unsafe. However, this management mode lets theemployee override the policy and share the data, logging the action to your audit log.
• MobileIron recommends that you start with Override while verifying with a small
group that you have the right apps on your protected apps list. After you're done,
you can select your final enforcement policy, either Override or Block.
• Silent : WIP runs silently, logging inappropriate data sharing, without blocking
anything that would've been prompted for employee interaction while in Override
mode. Unallowed actions, like apps inappropriately trying to access a network
resource or WIP-protected data, are still blocked.
• Off (not recommended) : WIP is turned off and doesn't help to protect or audit yourdata. After you turn off WIP, an attempt is made to decrypt any closed WIP-tagged
files on the locally attached drives.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 258

New Windows Information Protection window

TABLE 68. WINDOWS INFORMATION PROTECTION FIELDS (CONT.)
FieldsDescription

EnterpriseProtected Domain
Names

Enter your corporate identity.
Corporate identity is usually expressed as your primary Internet domain (miacme.com,
for example). It helps to identify and tag your corporate data from apps You havemarked as protected by WIP. For example, emails using miacme.com are identified as
being corporate and are restricted by your Windows Information Protection policies.
You can specify multiple domains owned by your enterprise by separating them withthe "|" character. For example, (miacme.com|newmiacme.com). With multiple
domains, the first one is designated as your corporate identity and all of the additional
ones as being owned by the first one. MobileIron strongly recommends that you include
all of your email address domains in this list.

Enterprise Network
Domain Names

Specify the DNS suffixes used in your environment.
All traffic to the fully-qualified domains appearing in this list will be protected.
This setting works with the IP ranges settings to detect whether a network endpoint isenterprise or personal on private networks.
If you have multiple resources, you must separate them using the "," delimiter. For
example "contoso.sharepoint.com,Fabrikam.com".

Enterprise Cloud
Resources

Specify the cloud resources you want to be treated as corporate and protected by WIP.
For each cloud resource, you can optionally specify a proxy server from yourEnterprise Internal Proxy Servers list to route traffic for this cloud resource. Be
aware that all traffic routed through your enterprise internal proxy servers is consideredenterprise.
If you have multiple resources, you must separate them using the "|" delimiter. If you
don't use proxy servers, you must also include the "," delimiter just before the "|". For
example: URL <,proxy>|URL <,proxy>.
Examples:• "With proxy: "contoso.sharepoint.com,contoso.internalproxy1.com|contoso.visualstudio.com,contoso.internalproxy2.com"• "Without proxy: "contoso.sharepoint.com|contoso.visualstudio.com"
There is a UI constraint of 64 chars.
In the Enterprise IP Range field, specify the addresses for a valid IPv4 value range
within your intranet.
These addresses, used with your enterprise network domain names, define yourcorporate network boundaries.
If you have multiple ranges, you must separate them using the "," delimiter
Example:3.4.0.1-3.4.255.254,10.0.0.1-10.255.255.254

Enterprise IP

Click this box if you want Windows to treat the IP ranges you specified in the network

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 259

New Windows Information Protection window

TABLE 68. WINDOWS INFORMATION PROTECTION FIELDS (CONT.)
FieldsDescription

Ranges Are
Authoritative

boundary definition as the complete list of IP ranges available on your network.

Data Recovery
Certificate

Paste your Base64-encoded DRA certificate (.CER) string into the Data Recovery
Certificate text box.

If you clear this box, Windows searches for additional IP ranges on any domain-joined
devices connected to your network (auto-detect).

After you create and deploy your WIP policy to your employees, Windows begins toencrypt your corporate data on the employees' local device drive. If the employees'
local encryption keys get lost or revoked, the encrypted data can become
unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an
included public key to encrypt the local data, while you maintain the private key that can
unencrypt the data.
Allow User
Decryption

Determines whether users can see the Personal option for files within File Explorer andthe Save As dialog box in Windows.
If selected, employees can choose whether a file is Work or Personal in File Explorer
and the Save As dialog box.
If not selected, only the Work option is available.
NOTE: If you pick this option, apps that use the Save As dialog box might
encrypt new files as corporate data unless a different file path is given
during the original file creation. After this happens, decryption of work
files becomes more difficult.
IMPORTANT: This option works only for devices using the Anniversary Edition of
Windows 10 (1607). This options has been deprecated by the OS in
all versions greater than the Anniversary Edition.

Revoke On
Unenroll

Determines whether to revoke a user's local encryption keys from a device when it isunenrolled from WIP. If the encryption keys are revoked, a user no longer has access toencrypted corporate data.
Uncheck this box to keep local encryption keys when migrating between MDM
solutions.

Show WIP Icons

Determines whether the Windows Information Protection icon overlay appears on
corporate files in the Save As and File Explore views.

Require Protection
Under Lock

This options applies only to Windows 10 Mobile. It determines whether to encrypt
enterprise data using a key that is protected by an employee's PIN code on a locked
device. Apps will not be able to read corporate data when the device is locked.

Neutral Resources

Specify your authentication redirection endpoints for your company.
These locations are considered enterprise or personal, based on the context of theconnection before the redirection.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 260

Apply the profile to a label

TABLE 68. WINDOWS INFORMATION PROTECTION FIELDS (CONT.)
FieldsDescription
If you have multiple resources, you must separate them using the "," delimiter.
Example: sts.contoso.com,sts.contoso2.com

Enterprise Proxy
Servers

Specify your externally-facing proxy server addresses, along with the port throughwhich traffic accesses the Internet.
This list must not include any servers listed in the Enterprise Internal Proxy Servers
list, because they are used for WIP-protected traffic.
This setting is also required if there's a chance you could are behind a proxy server onanother network. In this situation, if you don't have a proxy server pre-defined, you
might find that enterprise resources are unavailable to your client device, such as when
you are visiting another company and not on the guest network. To make sure this doe
not happen, the client device also needs to be able to reach the pre-defined proxy server
through the VPN network.
If you have multiple resources, you must separate them using the ";" delimiter.
Example: proxy.contoso.com:80;proxy2.contoso.com:443

Enterprise Proxy
Servers Are
Authoritative

Click this box if you want Windows to treat the proxy servers you specified in the
network boundary definition as the complete list of proxy servers available on yournetwork. If you clear this box, Windows will search for additional proxy servers in yourimmediate network (auto-detect).

Enterprise Internal
Proxy Servers

Specify the proxy servers your devices will go through to reach your cloud resources.
Using this server type indicates that the cloud resources you're connecting to areenterprise resources.
This list shouldn't include any servers listed in the Enterprise Proxy Servers list,
which are used for non-WIP-protected traffic.
If you have multiple resources, you must separate them using the ";" delimiter.
Example: contoso.internalproxy1.com;contoso.internalproxy2.com

Allow Azure RMS

Check this box if WIP is to be used in conjunction with Azure Rights Management
Service. Azure Rights Management (Azure RMS) can be used if company-wide
information protection is desired.

RMS TemplateID

Specify your Azure RMS TemplateID.

Apply the profile to a label
This section describes how to apply the WIP profile to a label.
1. Select Policies & Configs > Policy.
2. Select the WIP policy you want to apply to a label.
3. Select Actions > Apply to Label.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 261

Business Store Portal

4. Locate and select the label.
5. Click Apply.
NOTE: One note that we see with this profile is that once applied there can be cases where the profile is
not removed once un-enrolled in UEM. It is recommended to test with VMs and WIP at this time.

Business Store Portal
The Windows Business Store Portal (BSP) The Store for Business provides app purchases based onorganizational identity, flexible distribution options, and the ability to reclaim or re-use licenses. Organizations canalso use the Store for Business to create a private store for their employees that includes apps from the Store, as
well private Line-of-Business (LOB) apps.
BSP allows organizations to:lmake volume purchases of Windows applications

lcreate a private store for their employees (with Store apps and Line-of-Business (LOB) applications)lshut off the Microsoft Store on deviceslget applications from offline mode and silently install without relying on Microsoft Store to push
applications

NOTE: Refer to the MobileIron Apps@Work Guidefor more information about managing applications for
Windows devices.

Prerequisites for BSP
We recommend you have met the following prerequisites before starting this section:lStandard prerequisites for all Azure serviceslOne or more applications to add to Azure

BSP work flow
This section describes the overall work flow for setting up MobileIron and BSP to work together:l

Add a BSP app in Azurel

Add and activate the Azure App in BSPl

Add the Azure information into Corel

Deploying apps

Add a BSP app in Azure
The first step to using MobileIron with BSP is to create an Azure app under your tenant.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 262

BSP set up

1. Log into Microsoft Azure.
2. Go to the tenant to which you want to add the app.
3. Click NEW on the bottom of the window to open a wizard.
4. Click Add an application my organization is developing.
5. Enter a name for the app in the NAME field.
The name should be easy to remember, but personalized to your organization. You will use this name laterin this process.
6. Click WEB APPLICATION AND/OR WEB API then click the right arrow to continue.
7. Set up the following 2 URLs.
l

SIGN-ON URL: URL for your instance of Core.

l

APP ID URL: to the Core administrator Login instance.

8. Click the check mark to save the configuration.
9. Go to Azure Applications.
10. Select the app and click Configure.
11. Make note of the ID in the CLIENT ID field to use it in MobileIron later.
12. Select a key in the keys section.
MobileIron recommends using a 2-year activation period for the key. Remember to refresh this key before
activation period has gone by or access to the portal will stop. If you lose your key you can generate a newone
13. Save the changes on this page.
14. Make note key to enter into MobileIron later.
15. Click Add application.
16. Complete the steps in BSP set up.

BSP set up
The section describes how to set up BSP to allow access to the BSP from Azure.
1. Log into BSP (https://businessstore.microsoft.com).
2. Select Settings > Management Tools.
3. Click the Add a management tool link.
4. Enter the name of the app you added (in Add a BSP app in Azure ).
5. Click Save.
6. Select Settings > Offline licensing.
7. Click the Activate link for the app.
MobileIron integration is setup for use primarily with offline licensing. Online licensing requires

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 263

MobileIron Setup

administrators keep the Microsoft store open to users as online licensing cannot be distributed silently.
8. Complete the steps in MobileIron Setup.

MobileIron Setup
The section describes how to set up MobileIron to allow access to the BSP from Azure.
1. Log into the MobileIron Admin Portal.
2. Select Settings > System Settings > Windows > Business Store Portal.
3. Click Enable Business Store Portal.
4. Enter the following information you generated in the Add a BSP app in Azure :Tenant ID (enter into BSP Domain field)
Client ID (enter into BSP Client ID field)
Secret Key (enter into BSP Key field)
5. Select how often you want to sync to the BSP.
6. Click Save.
7. Complete the steps in Deploying applications.

Deploying applications
Refer to the MobileIron Apps@Work Guidefor details on how to:limport apps, edit, deploy, and apply them to the labels.

lsilently install offline in-house appsldistribute online apps

All BSP Apps will be shown with a BSP Version so that administrators can tell the difference between BSP andapps loaded through other means. The size of the app will be the largest package available to the administrator.
This may not be the same size as what is on the device.

Windows PIN management for PassPort For Work/Windows
Hello
Use this feature to set up PIN Management for PassPort For Work/Windows Hello, including rules to manage both
PINs and biometrics (iris, voice, fingerprints). You can also use it to create an identity change the AAD registration
flow for future devices to take advantage of PassPort For Work/Windows Hello.
Prerequisites for setting up a PassPort For Work/Windows Hello policy are:•••Configuring an Azure Active tenant.
Enabling Microsoft Azure Menu
Enabling PassPort For Work/Windows Hello with Microsoft Azure

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 264

Enabling Microsoft Azure Menu

Enabling Microsoft Azure Menu
Enabling the Microsoft Azure Menu is a required step before you can use PassPort For Work/Windows Hello in apolicy.
To enable WIP:
1. Select Settings > System Settings > Windows > Advanced Menu.
2. Select the Enable Microsoft Azure Menu check box.
3. Click Save.

Enabling PassPort For Work/Windows Hello with Microsoft Azure
Enabling PassPort For Work/Windows Hello with Microsoft Azure is a required step before you can use it in apolicy.
To enable pin management for PassPort For Work/Windows Hello:
1. Select Settings > System Settings > Windows > Microsoft Azure.
2. Select the Enable PassPort For Work/Windows Hello check box.
3. Click Save.

Creating a PassPort For Work/Windows Hello policy
Use this feature to set up options for PIN management. You can use only one type of rule per profile.
Procedure
To create a PassPort For Work/Windows Hello policy:
1. Select Policies & Configs> Policies.
2. Select Add New > Windows > PassPort For Work/Windows Hello.
3. Modify fields in the New Windows PassPort For Work/Windows Hello Policy window, as necessary.
Refer to the New Windows PassPort For Work/Windows Hello Policy window table for details.
4. Click Save.
5. Apply the policy to a label.

New Windows PassPort For Work/Windows Hello Policy window
The following table summarizes fields and descriptions in the New Windows Information Protection window:

TABLE 69. NEW WINDOWS PASSPORT FOR WORK/WINDOWS HELLO POLICY FIELDS
FieldsDescription

Name

Add the unique name of the policy.

Status

Options are Active or Inactive.

Priority

Set the priority based on other policies. Each policy has an assigned

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 265

New Windows PassPort For Work/Windows Hello Policy window

TABLE 69. NEW WINDOWS PASSPORT FOR WORK/WINDOWS HELLO POLICY FIELDS (CONT.)
FieldsDescription
hierarchy and Priority 1 taking precedence.

Description

Add a description of the policy

User PassPort For Work/Windows
Hello

Options are Enabled or Disabled

Required Trusted Platform Module

Options are Enabled or Disabled

Minimum PIN Length

Range is 4 - 127 chars. Default is 4. Cannot be less than 4.

Maximum PIN Length

Maximum value cannot be more than 127. Cannot be less than the Min
value.

Uppercase Letters in PIN

Values are:
0 - Allows the use of uppercase letters in PIN
1 - Requires the use of at least one uppercase letters in PIN
2 - Does not allow the use of uppercase letters in PIN (default)

Lowercase Letters in PIN

Values are:
0 - Allows the use of lowercase letters in PIN
1 - Requires the use of at least one lowercase letters in PIN
2 - Does not allow the use of lowercase letters in PIN (default)

Special Characters in PIN

Values are:
0 - Allows the use of special characters in PIN
1 - Requires the use of at least one special characters in PIN
2 - Does not allow the use of special characters in PIN (default)

Digits in PIN

Values are:
0 - Allows the use of digits in PIN
1 - Requires the use of at least one digits in PIN
2 - Does not allow the use of digits in PIN (default)

PIN History

Integer value that specifies the number of past PINs that can beassociated to a user account that can’t be reused. The largest number
you can configure for this policy setting is 50. The lowest number you
can configure for this policy setting is 0. If this policy is set to 0, thenstorage of previous PINs is not required. Default is 0.

PIN Expiration

Integer value specifies the period of time (in days) that a PIN can beused before the system requires the user to change it. The largest
number you can configure for this policy setting is 730. The lowest

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 266

Viewing status in device details

TABLE 69. NEW WINDOWS PASSPORT FOR WORK/WINDOWS HELLO POLICY FIELDS (CONT.)
FieldsDescription
number you can configure for this policy setting is 0. If this policy is
set to 0, then the user’s PIN will never expire. Default is 0.

Use Remote Passport

Options are Enabled or Disabled. Use this option to enable or disable
the use of remote Windows Hello for Business. Remote Windows
Hello for Business provides the ability for a portable, registered device
to be usable as a companion device for desktop authentication.
Remote Windows Hello for Business requires that the desktop be
Azure AD joined and that the companion device has a Windows Hellofor Business PIN. Default is Disabled.

Use Biomentrics

Options are Enabled or Disabled. Use this option to enable or disable
the of remote Windows Hello for Business. Remote Windows Hellofor Business provides the ability for a portable, registered device to beusable as a companion device for desktop authentication. RemoteWindows Hello for Business requires that the desktop be Azure AD
joined and that the companion device has a Windows Hello for
Business PIN. Default is Disabled.

Facial Features Use Enhanced AntiSpoofing

Options are Enabled or Disabled. Use this option to enable or disableenhanced anti-spoofing for facial feature recognition on devices which
support it.
If this policy is not configured, the user can choose whether they wantanti-spoofing on or off. If you set this policy to true, enhanced antispoofing is required on devices which support it. If you set this policy
to false, enhanced anti-spoofing is turned off and the user cannot turnit on.
This value can only be set if Use Biometrics is True. If False thisshould not be set. Default is Enabled.

Viewing status in device details
To see the policy status on a device:
1. Select Devices & Users > Devices.
2. Double-click the name of device.
3. Click the Policies tab.
If the policy was pushed to the selected device, it will be listed in the table.
The status (Applied/Partially Applied) is based on if the policy has be synced to the device. If there a discrepancy inthe policy the device will fall out of compliance the same as it would if passwords were out of compliance.

Windows license management
This features is for Windows 10 Desktop devices only.
MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 267

Upgrading Windows Licenses

Windows license management allows administrators to use Volume Licenses for BYOD for other devices to be
upgraded. You can now use your Volume OS key to upgrade any Windows 10 desktop, HoloLens, or IoT device
with a Pro or Enterprise SKU on the device.
Upgrade license paths:l

Pro --> EnterpriselAny desktop with a Pro license --> EnterpriselConsumer --> Enterprisel

For use with HoloLens and IoT devices

Upgrading Windows Licenses
To upgrade a Windows license:
1. Log into the Admin Portal.
2. Go to Policies & Configs > Configurations.
3. Select Add New > Windows Licensing (Windows 10 only).
l

In the Windows License dialog box, enter the following options:lName (required)lDescriptionlWindows Key (Required) - used for Windows 10 Desktop, HoloLens, and IoT devices.

4. Click Save.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 268

14
MobileIron Bridge
This section addresses components related to MobileIron Bridge.
NOTE: MobileIron Bridge is only used with Windows 10 Desktop devices.
l

MobileIron Bridge overview

lSetting up MobileIron BridgelEnabling BitLockerlManaging Windows device updateslWindows 10 Desktop device managementlRemovable storage device managementlWindows 10 Desktop customizationlBrowser Settings for Windows 10 DesktoplMobileIron logs overviewlRemoving unwanted applicationslUsing the GPO EditorlPrinter managementl

MobileIron Bridge reportinglUsing MobileIron Bridge advanced searchlManaging Win32 apps

MobileIron Bridge overview
MobileIron Core manages the modern partition of the Windows OS to secure Windows 10 Desktop devices using
the MDM protocol. MobileIron Bridge was developed, using the same MDM protocol, to manage theTraditional/Win32 half of the OS and secure legacy applications on Windows 10 Desktop devices.
By deploying the MobileIron Bridge application to Windows 10 Desktop devices, enterprises can now use the same
MDM protocol Core uses to send instructions to both partitions, use MDM API's and Group Policy Objects (GPOs)
delivered via scripts to the device to better manage and secure devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 269

Setting up MobileIron Bridge

FIGURE 10. MOBILEIRON BRIDGE ARCHITECTURE

Without MobileIron Bridge, Core supports modern apps, configurations, and policies, but not Non-MSI wrapped
Win32 apps. With MobileIron Bridge, Core also supports the following files:••••

PowerShell
Registry
Visual Basic scripts.EXE for Win32 application deployment

Some (but not all) of the actions you can take, using MobileIron Bridge with Core, are to modify the device in thefollowing areas:••

Registry: Reading, writing and updating registry values
Files: Verify, read and update the contents of a file

Setting up MobileIron Bridge
Setting up MobileIron Bridge includes the following steps:••••

Step 1: Creating the MobileIron Bridge certificate
Step 2: Enabling the MobileIron Bridge certificate
Step 3: Deploying the MobileIron Bridge app
Step 4: Uploading scripts

Creating the MobileIron Bridge certificate
This step happens automatically, with no actions taken by administrators. MobileIron Core creates a certificate
with each latest release or update to be used by MobileIron Bridge. This certificate is available to administrators toauthenticate and communicate with both devices and servers.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 270

Enabling the MobileIron Bridge certificate

FIGURE 11. MOBILEIRON BRIDGE SET UP

Core sends this certificate to all Windows 10 Desktop devices at the time the Core Server is created and theWindows 10 device is registered.

Enabling the MobileIron Bridge certificate
Before you can use MobileIron Bridge, you must select the authentication certificate.
Procedure
1. Log into the Admin Portal.
2. Go to Settings > System Settings > Windows > Certificate Authentication.
3. Click the box next to Enable certificate authentication for Windows 10 Bridge to assign your cert for
MobileIron Bridge.
You can also choose the same Certificate Enrollment with Apps@Work.
If you use certificates for both Apps@Work and MobileIron Bridge (by checking the Enable certificate
authentication for Windows 10 Apps@Work option), MobileIron Bridge uses the certificate in the device
store and Apps@Work uses the certificate in the user store.
4. Click Save.

Deploying the MobileIron Bridge app
Once the certificate is on the device you can deploy the MobileIron Bridge app to Windows 10 Desktop devices.
NOTE: Refer to the Apps@Work Guide for more information about managing applications for Windows
devices.
Procedure
1. Log into the Admin Portal.
2. Go to Apps > App Catalog.
3. Select the MobileIron Bridge app you want to install on the devices.
There could be one or more versions of the app. For details on deploying the MobileIron Bridge app, refer to thelatest MobileIron Core Apps@Work Guide.
4. Sort the list, if necessary, to find the MobileIron Bridge app.

FIGURE 12. FINDING MOBILEIRON BRIDGE APPS

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 271

Verifying MobileIron Bridge installation

5. Select Actions > Apply to Labels.
6. Select the appropriate label(s) and click Apply.
The app silently installs after devices sync with the label to which the MobileIron Bridge app is associated.

Verifying MobileIron Bridge installation
Once the app is deployed, administrators can view the device as a part of the application list by turning on the
Windows 10 Inventory for Win32 applications.
Procedure
1.
2.
3.
4.
5.
6.
7.
8.
9.

Log into the Admin Portal.
Go to Policy & Configs > Policies.
Select Default Privacy Policy and click the Edit button in the Policy Details pane.
Go to the Windows 10 Inventory section.
Click Win 32 Inventory > Enabled > Save.
Force a check-in or wait for the next sync period.
Go to Devices & Users > Devices.
Double-click a Windows 10 Desktop device.
Click the Apps tab to view the installed apps for the selected device.

Uploading scripts
There are two ways to manage actions in MobileIron Bridge:••

Uploading scripts using configurations
Pushing a single-use script to a device

Uploading scripts using configurations
After applying a label to a device with the MobileIron Bridge app installed, the script is delivered the next time thedevice syncs with Core and the MobileIron Bridge app executes the action defined by the script.
1.
2.
3.
4.
5.
6.

Log into the Admin Portal.
Go to Policies & Configs > Configurations.
Select Add New > Windows > MobileIron Bridge (Windows 10 Only) > Script.
Enter a name, upload an existing script, and click Save.
Select the configuration then click Actions > Apply to Label.
Select the appropriate label(s) and click Apply.
When working with MobileIron Bridge scripts make sure you have properly defined your labels by the types ofdevices (departments, geographically, etc.) you want to receive the actions created by the scripts.

Pushing a single-use script to a device
The other option for managing actions is by pushing a single-use MobileIron Bridge script directly to a Windows 10
Desktop device. This is often useful for managing a single device for troubleshooting purposes.
Procedure
1. Log into the Admin Portal.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 272

MobileIron Bridge script reversal

2.
3.
4.
5.

Go to Devices & Users > Devices.
Select a single device.
Select Actions > Windows Only > MobileIron Bridge (Windows 10 only).
Enter a name, upload an existing MobileIron Bridge Script, and click Execute.

MobileIron Bridge script reversal
This feature allows administrators to set up MobileIron Bridge action scripts (install scripts) as well as scripts toreverse those actions (uninstall scripts).
Not all actions have a corresponding undo action. Administrators need to be aware of these actions before
attempting to upload uninstall scripts. In addition, Core cannot run an undo script if a user un-enrolls their device.
To ensure that uninstall scripts can be activated, administrators need to restrict users from initiating MDM unenrollment.
Administrators must complete the following prerequisites to successfully reverse script actions:••

Disable MDM un-enrollment by changing the lockdown policy for Windows devices and disabling MDM unenrollment. See Disabling MDM un-enrollment section for details.
Disable the phone reset feature by disabling the reset phone feature in the lockdown policy.

NOTE: Although MobileIron Bridge is only available on Windows 10 Desktop devices, the disablingphone reset feature is still applicable to MobileIron Bridge script reversal actions.

Resetting Windows 10 devices
To make sure users cannot un-enroll a device from MDM before Core can issue the undo scripts, administrators
will want to reset the Windows 10 devices.
To disable the lockdown policy:
1.
2.
3.
4.
5.

Log into the Admin Portal.
Go to Policies & Configs > Policies.
Select the Default Lockdown Policy and then click Edit.
Scroll to the Windows Phone - Corporate Owned Devices Only section.
Select the Disable option for Reset Phone.

Disabling MDM un-enrollment
To disable the lockdown policy:
1.
2.
3.
4.
5.

Log into the Admin Portal.
Go to Policies & Configs > Policies.
Select Default Lockdown Policies > Edit.
Scroll to the Windows Phone - Corporate Owned Devices Only section.
Select the Disable option for MDM Un-enrollment.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 273

Configuring reversal scripts

Configuring reversal scripts
You can set up install and uninstall scripts at the same time. If you do not upload an uninstall script only the install
script is used.
To set up MobileIron Bridge scripts and reversal scripts:
1.
2.
3.
4.
5.
6.

Log into the Admin Portal.
Go to Policies & Configs > Configurations.
Select Add New > Windows > MobileIron Bridge (Windows 10 Only) > Scripts.
Add a name for the configuration.
Enter a description and the target folder (optional).
Browse and select the action script in the MobileIron Bridge Script field.
See Supported variables as script arguments for a list of arguments you can use.
7. Modify script arguments (optional).
8. Browse and select the reversal script in the MobileIron Bridge Uninstall Script field.
See Supported variables as script arguments for a list of arguments you can use.
9. Modify script arguments (optional).
10. Click Save.

Supported variables as script arguments
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

EMAIL
USERIDPASSWORDGOOGLE_AUTOGEN_PASSWORD
FIRST_NAME
LAST_NAMEDISPLAY_NAME
USER_DN
USER_UPNUSER_LOCALE
DEVICE_UUID
DEVICE_UUID_NO_DASHESDEVICE_UDID
DEVICE_IMSIDEVICE_IMEIDEVICE_SN
DEVICE_ID
DEVICE_MAC
DEVICE_CLIENT_ID
USER_CUSTOM1
USER_CUSTOM2
USER_CUSTOM3
USER_CUSTOM4
MI_APPSTORE_URL
REALM
DEVICE_PIVD_ACTIVATION_LINK
CN

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 274

Enabling BitLocker

•
•
•
•
•
•
•
•
•
•
•
•

EMAIL_DOMAINEMAIL_LOCALOU
SAM_ACCOUNT_NAME
ICCID
MODEL
PHONE_NUMBERCONFIG_UUIDTIMESTAMP_MSRANDOM_16
RANDOM_32
RANDOM_64

Enabling BitLocker
Using BitLocker allows MobileIron Core administrators to encrypt data on Windows 10 Desktop devices andprevent the ability to copy data from a removable drive (such as a USB stick) to a fixed device and vice versa.
Administrator create rules to enable BitLocker on Windows 10 Desktop devices to:
•
•
•
•
•

encrypt devices
enable USB sticks
enable removable drives
recover stored AD password
recover a password from either AD or Core

Before you begin
Enable MobileIron Bridge. See Setting up MobileIron Bridge for details.
Procedure
1.
2.
3.
4.
5.
6.
7.

Log into the Admin Portal.
Go to Policies & Configs > Policies.
Click the Default Security Policy link and then click Edit in the Policy Details panel.
In the Data Encryption section, click On for Data Encryption to enforce the device password option.
In the For Windows 10 Desktop section, click Bit Locker On to enable it.
Make your configuration settings, referring to the Enable BitLocker fields table for details.
Click Save.

The encryption process begins after restarting the device. Depending on the size of the drive, the device can takeanywhere from 45 minutes or longer to finish encrypting the device. This is a background process and does notinterfere with the users. When a device is not encrypted it is shown out of compliance with Core until the encryption
process is finished.

Bit Locker data encryption
The following table summarizes fields and descriptions for enabling Bit Locker:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 275

Managing Windows device updates

TABLE 70. ENABLE BITLOCKER FIELDS
FieldsDescription

Bit Locker

The options are On and Off. Bit Locker is applied only for Windows 10
desktop devices and only when MobileIron Bridge is enabled.

Read Only for unencrypted
removable drives

Click to encrypt removable drives (such as USB sticks) so the data is read
only and cannot be moved to another device.

Read Only for unencrypted
fixed drives

Click to encrypt fixed drives so the data is read only and cannot be moved toanother device.

Encryption TypeThe options are 128 bit and 256 bit.

Drive to encrypt

Select the OS drive you want to encrypt.

Recovery Options

You can recover a password and store it in Active Directory (AD), recover apassword and store in both AD and Core, or disable password recovery.

TPM Options

TPM is Trusted Platform Module (used for encryption) and when configured
requires the use of a password. The following options are for the users to set
up startup passwords:
A) If a user chooses the TPM option, then no additional startup password or
startup PIN is required. Only the default Windows password is required.
B) If a user chooses TPM + PIN option, then, in addition to the Windows
password, the user is required to enter a startup PIN. This startup pin isrequired to be entered before the device boots up and loads windows.
C) If a user chooses NO TPM, then in addition to the Windows password,
the user is required to enter a startup password. This startup password isrequired to be entered before the device boots up and loads windows.
NOTE: The startup PIN and password in B) and C) are in addition to
the Windows password which is required in all 3 cases.

Restart Interval

Use this option to determine what the interval is after this security policy isapplied before the device restarts.

Restart Message

Enter a message you want the user to see before the device restarts. If you
do not enter a custom message, Core sends a default message.

Managing Windows device updates
To better manage security patches, administrators can create compliance policies based on update status or time
periods. Devices that fall out of compliance are blocked from accessing specified services and applications suchas Office 365 or Tunnel. Compliance information can also be sent to AAD for integration with Office 365.
Device update management is based on one or more of the following update status:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 276

Setting hotfix optionslTime of the last hotfix datelLast hotfix IDlWindows 10 build# on the device

View the update information in the Device Details page for selected devices.
This section contains the following topics:lSetting hotfix optionslSetting up a compliance policy for device updates

NOTE: This feature requires MobileIron Bridge. See Setting up MobileIron Bridge for details.

Setting hotfix options
This procedure describes how to set the hotfix options to obtain hotfix information such as the version and date.
Procedure
1. Log into the Admin Portal.
2. Go to Policies & Configs > Configurations.
3. Click Add New > Windows > MobileIron Bridge.
4. Select Device Management to open the Device Management Settings page.
5. Enter a name for the configuration.
A description is optional.
6. Go to the hotfix section and click one or both of the Allow check boxes for the following options:lView Last Hotfix Date: to view the date of the most recent Windows hotfix update.

lView Last Hotfix ID: to view the ID of the most recent Windows hotfix update.

7. Click Save.
8. Select the newly added configuration in the Configurations table.
9. Click Actions > Apply to Label.
10. Select a label associated with devices to track updates for hotfixes.
11. Click Apply.
12. Go to Devices & Users > Devices.
13. Open the details page of a device associated with the new label.
14. Click the Device Details tab to track the hotfix updates in the following rows:lLast Hotfix IDlLast Hotfix Installed On (date)

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 277

Setting up a compliance policy for device updates

Setting up a compliance policy for device updates
This procedure describes how to set up device compliance based on hotfix and Windows 10 build information.
Procedure
1. Log into the Admin Portal.
2. Go to Policies & Configs > Policies.
3. Click Default Security Policy.
4. Scroll down to the Access Control > For Windows devices section.
5. Select one or more of the following options and provide the required information, where appropriate.
6. Click Save.
The default policy will be applied to all Windows 10 desktop devices and labels, by default, to which noother policy has been applied.

Windows 10 Desktop device management
Administrators can control OS information on managed Windows 10 Desktop devices by restricting user access tothe following areas on a device:lControl Panell

Task ManagerlFile ExplorerlRegistry Editor

NOTE: This feature requires MobileIron Bridge. See Setting up MobileIron Bridge for details.

Restricting access to device OS controls
Procedure
1. Log into the Admin Portal.
2. Go to Policies & Configs > Configurations.
3. Click Add New > Windows > MobileIron Bridge.
4. Select Device Management to open the Device Management Settings page.
5. Enter a name for the configuration.
A description is optional.
6. Click the check box for one or more of the following options:lTask ManagerlControl Panel

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 278

Removable storage device managementlFile ExplorerlRegistry Editor

7. Click Save.
8. Select the new configuration in the Configurations table.
9. Click Actions > Apply to Label > Windows.
This configurations will only apply to Windows 10 Desktop devices.
10. Click Apply.

Removable storage device management
Administrators can control access to any removable storage devices that can be plugged into a USB port by:lll

Removing read/writer access. This prevents any access and is the most restrictive configuration.
Removing write-only access. This allows limited access, but prevents unauthorized removal of data or
the ability to add viruses, etc. to the device.
Allowing complete access to limited devices. This lets administrators create a whitelist of devices,permitting users total access to only the removable storage device on the list.

Restricting access to removable storage devices
NOTE: This feature requires MobileIron Bridge. See Setting up MobileIron Bridge for details.
Procedure
1. Log into the Admin Portal.
2. Go to Policies & Configs > Configurations.
3. Click Add New > Windows > MobileIron Bridge.
4. Select Device Management to open the Device Management Settings page.
5. Enter a name for the configuration.
A description is optional.
6. Go to the USB section and click one or both of the following options:lRestrict Access to Removable Storage Devices: to restrict all access (no read/write).

lRestrict Write Access to Removable Storage Devices: to provide limited access (read-only).

7. Click Save.
8. Select the new configuration in the Configurations table.
9. Click Actions > Apply to Label > Windows.
This configurations will only apply to Windows 10 Desktop devices.
10. Click Apply.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 279

Creating a whitelist for removable storage devices

Creating a whitelist for removable storage devices
NOTE: This feature requires MobileIron Bridge. See Setting up MobileIron Bridge for details.
Before you begin
If you want to create a whitelist of permitted USB devices, complete the following steps first:
1. Attach the USB storage devices you want to allow to a personal computer.
2. Open Device Manager and click on the USB controller.
3. Look at the settings for each controller for device information.
4. Store the device information to use when creating your whitelist.
Procedure
1. Log into the Admin Portal.
2. Go to Policies & Configs > Configurations.
3. Click Add New > Windows > MobileIron Bridge.
4. Select Device Management to open the Device Management Settings page.
5. Enter a name for the configuration.
A description is optional.
6. Go to the USB section and click Add+.
7. Enter the device ID for one or more of the devices you want to add to the whitelist.
8. Click Save.
9. Select the new configuration in the Configurations table.
10. Click Actions > Apply to Label > Windows.
This configurations will only apply to Windows 10 Desktop devices.
11. Click Apply.

Windows 10 Desktop customization
Use Core to customize Windows 10 Desktop devices by adding:lShortcuts to the desktoplA screen saver imagel

A locking screen image

NOTE: Only Enterprise versions of Windows 10 can use the lock screen functionality.

Customizing desktops
NOTE: This feature requires MobileIron Bridge. See Setting up MobileIron Bridge for details.
MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 280

Customizing desktops

Procedure
1. Go to Policies & Configs > Configurations.
2. Click Add New > Windows > MobileIron Bridge > Desktop Settings.
3. Enter a Name for the configuration.
4. Select one of the following File Delivery options for desktop settings.
lFile Upload: upload settings files to Core.

lOverride URL: provide override URLs with the settings files to download.
Some fields on the page will change depending on what you select in this step.

5. Add a Desktop Background image using one of the following options.
lClick Browse in the Desktop Background section to locate and upload a background image.

lEnter the override URL in the Desktop Background section.
Background images can be .JPEG, .PNG, .TIFF, .JPG, or .BMP file types.

6. Add a Screensaver image using one of the following options.
lClick Browse in the Screensaver section to locate and upload a screensaver image.

lEnter the override URL in the Screensaver section.
Devices accept only the screen saver file type (.scr).

7. Check Password-protect Screensaver if you want to require use of a password to unlock screensavermode.
8. Select a Screensaver Timeout period (in minutes).
9. Add a Lock Screen file using one of the following options.
lClick Browse in the Lock Screen section to locate and upload a locked screen image.

lEnter the override URL in the Lock Screen section.
Lock screen images can be.JPEG, .PNG or .GIF file types.

10. Click Add+ to set up application shortcuts to add to device desktops, then fill out the table using thefollowing options.
a. Location: this will be desktop, taskbar or start menu.
b. Target: this will be an application.
For webclips specify the browser to be used. Each browser accepts different commands to create a
webclip.
c. Description: Specify the title below the shortcut.
d. Icon File: Specify the image for the icon file. This must be an .ICO file.
11. Click Save.
12. Select the new configuration in the Configurations table.
13. Click Actions > Apply to Label > Windows.
This configurations will only apply to Windows 10 Desktop devices.
14. Click Apply.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 281

Customized device desktop

Customized device desktop
The desktop, lock screen, and screen saver settings will take effect based on the associated configuration after thedevice is signed out and signed back in. For example, the desktop on the left is the default desktop for Windows 10
Desktop devices. The image on the right has been customized using Core’s Desktop Settings options. Shortcuts
do not need a restart to take affect.

FIGURE 13. DEFAULT BACKGROUND IMAGE VS. CUSTOMIZED BACKGROUND IMAGE

Browser Settings for Windows 10 Desktop
This feature gives administrators greater control over the three browsers most commonly used by Windows 10
desktop (Chrome, Internet Explorer, Firefox).

Using browser settings
NOTE: The device must be domain joined to respect the configuration for Chrome. See Setting up
MobileIron Bridge for details.
Procedure
1.
2.
3.
4.

Log into the Admin Portal.
Go to Policies & Configs > Configurations.
Click Add New > Windows > MobileIron Bridge > Browser Settings/Restrictions.
Complete the form.
Refer to Browser Settings /Restrictions fields for details.
Options vary depending on the browser you select.
5. Click Save.

Browser Settings/Restrictions window
NOTE: Chrome must be domain joined for the devices to respect the configuration.
MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 282

Browser Settings/Restrictions window

The following table summarizes fields and descriptions for MobileIron Bridge Browser Settings/Restrictions:

TABLE 71. BROWSER SETTINGS /RESTRICTIONS FIELDS
Item

Description

Default

Name

Add a name for this configuration (required).

N/A

Description

Add a description for this configuration (optional).

N/A

Browser types

Select one or more of the browsers (Chrome, Firefox, IE).

None

New Tab page
URL

Enabling this option specifies the URL that the browser opens when
adding a new tab page. If you do not set this option, no new tab page isprovided.

N/A

All browser
types

Select one or more options:• Allow Saving Passwords: enable this option to allow users to savepasswords to the password manager.
• Allow Outdated Plugins: enable this option to allow users to use
outdated plugins as normal plugins. If you disable it, users will not be
asked for permission to run them.
• Safe Browsing Mode: Safe Browsing shows a warning page whenusers navigate to sites that are flagged as potentially malicious.
Enabling this setting prevents users from proceeding anyway fromthe warning page to the malicious site.

Enabled for all
options

Chrome andFirefox Only

Select Allow Deleting Browser History to allow users to delete theirbrowser history and download history. Users cannot change this setting
when enabled.

EnabledChrome and IE
Only

Select Enable Printing to allow printing from a browser. If enabled,users cannot change this setting. If this option is not enabled, users
cannot print from their browser, however they can print from plug-ins thatbypass the browser.

EnabledChrome Only

Select one or more options:• Show Home Button: Select this option to enable this setting, so
the Home button is always shown. Disable it so the Home button isnever shown.
• Show the apps shortcut in the bookmark bar: Select this option
to show apps shortcut in the bookmark bar.
• Allow synchronization of data with Google: Select this option tolet users to synchronize in Google Chrome using Google-hosted
synchronization services.
• Continue running background apps when Google Chrome isclosed: Select this option to allow background apps in the current
browsing session to remain active, including any session cookies.
The background process displays an icon in the system tray and can

Enabled for all
options

Browser Settings

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 283

Browser Settings/Restrictions window

TABLE 71. BROWSER SETTINGS /RESTRICTIONS FIELDS (CONT.)
Item

Description

Default

always be closed from there.
Firefox Only

Enable Allow Install Extensions to allow a user to install the Firefox
extension. Selecting disable prevents the user from installing thisextension

EnabledIE Only

Select Allow Downloading Data from Websites to allow users to
download data from Websites.

EnabledUse this option to specify browser favorites folder and URLs. Click
Add+ to add each URL.

N/A

Use these options to control what information websites use. Select one
or more of the options, then click Add+ to add each URL.
• Block Cookies• Block Java Script• Block Plugins• Block Popups

N/A

Browser favorites
BrowserFavorite Folders
URL Control
Control all
Websites(Chrome andFirefox only)

URL Access Control
Specify
approved andblockedwebsites(Chrome only)

Use this option to control the access to websites. Format a URL pattern(according to https://www.chromium.org/administrators/url-blacklistfilter-format). Each access control is limited to 1000 entries.

Block

Click Add+, enter the URL, and select Block or Allow.

Extension blacklist
Specify blocked
extensions(Chrome and IE
only)

Use this option to set up blacklists that block extension

N/A

Click Add+, select a browser type, and enter the Chrome extension ID.

Extension sources
Specify
approved
extension
sources(Chrome only)

Use this option to specify approved extension sources. Each item is anextension-style match pattern. See
https://developer.chrome.com/extensions/match_patterns for details.

N/A

Click Add+, select a browser type, and enter the Chrome extension ID.

Extension forcelist

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 284

MobileIron logs overview

TABLE 71. BROWSER SETTINGS /RESTRICTIONS FIELDS (CONT.)
Item

Description

Default

Specifyextensions to
be force
installed onbrowser(Chrome only)

Use this option to specify extensions to be force installed on browsers.
Each item is a string that contains an extension Id and an update URL
separated by a semicolon (;).

N/A

Click Add+, then select an extension ID and extension update URL.

Allowed extension types
Allowedextension types(Chrome only)

Use these options to specify allowed extensions types. Select one ormore of the following extension type:• Chrome Extension ID/IE Add-on Class Identifier• Hosted App• Theme• Packaged App• User Script• Platform App

N/A

MobileIron logs overview
This feature allows you to pull MobileIron Bridge logs for individual devices for troubleshooting and diagnosing
applications. The logs are sent at the next device check-in. You can wait for the next scheduled sync or perform aforced device check-in to get the logs quickly.
This topic has the following procedures:lSending a request to the devicelViewing a MobileIron Bridge log

Sending a request to the device
This procedure describes how to pull logs from a device. Core sends a request to the device to pull MobileIron
Bridge log/s at the next device check-in.
Procedure
1. Log into the Admin Portal.
2. Go to Devices & Users > Devices and select a device.
3. Select Actions > Windows Only > MobileIron Bridge (Windows 10 only).
4. Select one of the following options:lSend Current Log: requests Core pull the most recent MobileIron log (up to 10 MB) on the device

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 285

Viewing a MobileIron Bridge loglSend All Logs: requests Core pull all MobileIron log (one zip file containing up to 11 log files) on thedevice5. Click the appropriate Send button then OK after the log request is sent to the device.

Viewing a MobileIron Bridge log
This procedure describes how to view a MobileIron Bridge log after a device has sent it to Core.
Procedure
1. Log into the Admin Portal.
2. Go to Logs > Devices.
3. Check MobileIron Bridge and select test comments.
4. Locate the device and click the View Output link to see:lCurrent Log: opening a new tab with the log content.

l

All Logs: automatically saving as “output.zip” file.

Removing unwanted applications
Administrators can remove unwanted applications (bloatware) that come on Windows 10 Desktop devices. There
are several applications that administrators might not want users to access that come packaged with the OS.
Rather than re-imaging a device with a smaller list of applications, MobileIron Core and MobileIron Bridge can help
remove those applications at device enrollment.
The process for removing unwanted applications is for administrators to configure settings and apply theconfiguration to a label. When devices, associated with that label, sync with Core, the bloatware is removed fromthe device(s) based on the configuration settings.
Procedure
1. Log into the Admin Portal.
2. Go to Devices & Users > Devices.
3. Double-click on a device that has bloatware on it.
4. Scroll to the Device UUID detail and copy the UUID.
Use the UUID, later in this procedure, to review the applications on a device.
5. Go to Policies & Configs > Configurations.
6. Click Add New > Windows > MobileIron (Windows 10 Only) > Bloatware Remover.
7. Enter the name of the configuration you will later apply to a label.
8. Enter the UUID in the Device UUID for getting the list of application field.
9. Click Get installed applications.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 286

Using the GPO Editor

Depending on how many applications are on the device, this can take a few minutes.
Applications on the device are listed in the left pane.
10. Use the left and right arrows to move applications between the Applications from device list and theApplications for delete list.
Applications will be removed from all devices associated with the configuration once applied to a label andthe devices sync to Core.
11. Define options for removing applications:lll

Run at log on: runs the configuration when a user logs onto their device.
Run every minute: checks the device at the designated interval and removes any bloatware that was
reinstalled.
Suppress force restart after uninstall: Does not restart the device after removing the bloatware.

12. Click Save.
13. Select the newly created bloatware removal configuration.
14. Select Actions > Apply to Label.
15. Select a label that is associated with Windows 10 Desktop devices containing bloatware you want toremove.
16. Click Apply.
Based on the configuration, the label is applied and the unwanted applications are removed and the checks
no longer apply.

Using the GPO Editor
Microsoft defines and releases more than 4000 Group Policy Objects (GPOs) to control Windows 10 Desktop
devices. The GPO Editor allows administrators to view and search for GPOs quickly and easily, based on
Microsoft's hierarchal groups and sub-groups. It also allows administrators to upload ADMX GPOs (custom forthird party applications) that run outside of the Windows 10 operating system.
The GPO Editor validates all Microsoft GPO selections, the values provided for policy options, and the ADMX files.
It also validates all custom ADMX GPO settings when the custom file specifies the key, with the exception of freeform text.
Note The Following:• For more information about Microsoft GPOs, go to the following page: https://technet.microsoft.com/enus/library/hh147307(v=ws.10).aspx. This page is controlled by a third party and can be removed, moved, or
modified at any time without notice. It is provided here only as a courtesy.
• Any GPO configurations created before 9.6.0.0 will be deleted upon upgrading to 9.6.0.0 through the mostrecently released version as supported by MobileIron. MobileIron recommends administrators save the settings
created in before 9.5.0.0 and create a new profile after upgrading to any 9.6.0.0 through the most recently
released version as supported by MobileIron.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 287

Adding a Windows 10 GPO

Adding a Windows 10 GPO
This procedure describes how to add GPOs that will modify the Windows Registry.
Procedure
1.
2.
3.
4.
5.
6.

Go to Policies & Configs > Configurations.
Click Add New > Windows > MobileIron (Windows 10 Only) > Windows GPO.
Enter the name of the GPO configuration in the Name field.
Click the arrow in the Add Description option if you want to add a description.
Click Add.
Expand the object tree to select a GPO or use the search field to find the GPO you want to add.
If you use the search feature, you can narrow the search scope by selecting the Machine (the default option) or
User options. You can switch between these options.
7. Select Enabled to turn on the setting or create a new setting in the Registry.
Some settings simply turn on the setting with no additional configurations. If a setting has a sub-setting,complete the wizard after clicking Enabled.
8. Click Save & Add another to add more GPOs (optional).
Repeat steps 7-9 until you are done adding GPOs.
9. Click Save & Close when you are done adding GPOs.
10. Apply the configuration to a label to deploy the configuration to devices.
a. Select the configuration.
b. Click Actions > Apply to Labels.
c. Select one or more labels.
d. Click Apply.
Core pushes the configuration to devices associated with the applied label(s) after the next sync with Core.

Adding an ADMXGPOThis procedure describes how to add ADMX GPOs to upload custom third party applications. Refer to ADMX filestructure for details on creating the required folder structure to zip the .admx files.
Procedure
1. Log into the Admin Portal.
2. Go to Policies & Configs > Configurations.
3. Click Add New > Windows > MobileIron (Windows 10 Only) > Windows GPO.
4. Enter the name of the GPO configuration in the Name field.
5. Click the arrow in the Add Description option if you want to add a description.
6. Click Add+.
7. Click Import ADMX+ next to the Search field to open the Import ADMX files window.
8. Click Import to locate and add the ADMX file.
9. Click Import again to import your ADMX file.
10. Click Save & Add another to add more GPOs (optional).
Repeat steps 7-10 until you are done adding GPOs.
11. Click Save & Close when you are done adding GPOs.
12. Apply the configuration to a label to deploy the configuration to devices.
a. Select the configuration.
b. Click Actions > Apply to Labels.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 288

ADMX file structurec. Select one or more labels.
d. Click Apply.
Core pushes the configuration to devices associated with the applied label(s) after the next sync with Core.

ADMX file structure
Create .admx zip files by zipping the folder containing the .admx file and the locale folders. Do not simply create is
by zipping the contents of the folder.
Use the following file structure under the .admx package’s location:|-- admx|-- windows|-- en-US|-- win_policy_1.adml|-- win_policy_2.adml|-- win_policy_1.admx|-- win_policy_2.admx|-- google|-- en-US|-- google_policy_1.adml|-- google_policy_2.adml|-- google_policy_1.admx|-- google_policy_2.admx

Disabling a GPO settingThis procedure describes how to disable a GPO setting to turn it off, but not to delete it.
NOTE: Some settings, once created, can never be deleted without a full device wipe.
Procedure
1.
2.
3.
4.
5.
6.

Log into the Admin Portal.
Go to Policies & Configs > Configurations.
Click Add New > Windows > MobileIron (Windows 10 Only) > Windows GPO.
Enter the name of the GPO configuration in the Name field.
Click Add.
Expand the object tree to select a GPO or use the search field to find the GPO you want to disable.
If you use the search feature, you can narrow the search scope by selecting the Machine or User options.
7. Select Disabled to turn off the setting.
8. Click Save & Close.

Printer management
MobileIron Core allows administrators to create printer profiles and add them to devices. This section includes thefollowing topics:•

Adding a shared printerMobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 289

Adding a shared printer•Adding a network printerAdding a shared printerA shared printer can only be set on domain joined devices. If you do not plan to domain join the device then a
network printer option must be used. When the printer profile is sent to the device, the printer must be active,
otherwise the device cannot discover it.
Procedure
1.
2.
3.
4.
5.
6.
7.
8.
9.

Log into the Admin Portal.
Go to Policies & Configs > Configurations.
Click Add New > Windows > MobileIron (Windows 10 Only) > Add Printer.
Select Shared Printer as the Printer type.
Enter the name of the printer configuration in the Name field.
Enter the IP address in the Print server field.
Enter the printer name in the Shared printer name field.
Click Save.
Apply the printer configuration to a label to deploy the app to devices.
a. Select the newly created shared printer configuration.
b. Click Actions > Apply to Labels.
c. Select one or more labels.
d. Click Apply.
Based on the settings, the next time the devices associated with that label sync with Core, they will beconnected to the configured printer.

Adding a network printerProcedure
1. Log into the Admin Portal.
2. Go to Policies & Configs > Configurations.
3. Click Add New > Windows > MobileIron (Windows 10 Only) > Add Printer.
4. Select Network-attached Printer as the Printer type.
5. Enter the name of the printer configuration in the Name field.
6. Enter the printer name in the Printer name field.
7. Enter the address of the network printer in the Printer port number field
8. Enter the name of the printer driver in the Printer driver name field
9. Click Save.
10. Apply the printer configuration to a label to deploy the app to devices.
a. Select the newly created network printer configuration.
b. Click Actions > Apply to Labels.
c. Select one or more labels.
d. Click Apply.
Based on the settings, the next time the devices associated with that label sync with Core, they will beconnected to the configured printer.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 290

MobileIron Bridge reporting

MobileIron Bridge reporting
This feature provides details in logs of MobileIron Bridge sent to and from applications, including the ability to report
if the scripts MobileIron Bridge initiates were successful or if they failed.
In addition, Core allows you to search logs using the following fields:
•
•
•

State
Object Name
Message

This section includes the following additional topics:••

Viewing MobileIron Bridge reports
Using MobileIron Bridge advanced searchViewing MobileIron Bridge reports
To view MobileIron Bridge reports:
1. Log into the Admin Portal.
2. Go to Logs > Audit Logs > Devices.
3. Scroll down and select MobileIron Bridge > Search.
Note the Success/Failed values in the State column.

Using MobileIron Bridge advanced search
To use advanced search options:
1. Log into the Admin Portal.
2. Go to Logs > Audit Logs > Devices.
3. Enter search filters for any of the following options:
l

State

l

ObjectNamel

Messagel

Message not containing

4. Click Search.

Managing Win32 apps
This sections includes the following topics:lViewing Win32 app informationl

Deploying legacy apps

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 291

Viewing Win32 app informationlRemoving legacy apps

Viewing Win32 app information
This feature provides information on Win32 applications uploaded for deployment with MobileIron Bridge for all
Win32 applications that report app data in a manifest file. The information available for these Win32 apps include:lDisplay VersionlDeveloperlDescription

Procedure
1. Log into the Admin Portal.
2. Go to Apps > App Catalog > Windows.
3. Click the name of a Win32 app.

Deploying legacy apps
Use the Add Application Wizard to add and deploy legacy applications to the list of available applications in the
App Catalog.
NOTE: Only .EXE applications that can be silently installed as an executable can be placed in anEnterprise application store for deployment. An example of a non-silently installed EXE is putty.
Putty is a client that would need to be pushed to the device as a file and not as an application towork on the device.
To add legacy applications:
1. Log into the Admin Portal.
2. Go to Apps > App Catalog.
3. Click Add+ to open the wizard.
4. Select the In-House button.
5. Select Browse to locate and select the application you wish to upload.
Core deploys applications with an .EXE extension using MobileIron Bridge.
6. Click Next and enter the following information for application deployment:lllOverride URL: Enter the URL where the application will reside, if you want to use a centralized server
distribution to store their applications.
Command Line Parameters: Specify the command line command for installing the EXE because not
all .EXE files use the same Command Line Command. Otherwise users will be prompted when an
application is being installed.
Exe Target Directory: This will let MobileIron Bridge know which directory to use to when extracting
the application for deployment. If nothing is specified MobileIron uses the system temp directory

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 292

Apply legacy apps to label(%TEMP%).
ll

Uninstall Command Line Parameters: Provide the uninstall command, if you want to use
MobileIron to uninstall an application.
Exe Uninstall File Location: Specify the location on the device where the uninstaller resides.

7. Click Finish to upload and save the configurations and return to the App Catalog page.

Apply legacy apps to label
MobileIron Bridge apps do not show up in Apps@Work and can only be installed by Core through label
management.
Procedure
1. Log into the Admin Portal.
2. Go to Apps > App Catalog.
3. Select one or more Win32 apps.
4. Select Actions > Apply to Labels.
5. Select the label you want to use to deploy the legacy apps.
6. Click Apply.
MobileIron Bridge silently installs the selected app onto the Windows 10 Desktop devices after the devices
sync with the label to which the Win32 app is associated.

Removing legacy apps
An app that was installed using MobileIron Bridge can only be removed from devices if the following fields were set
up:••

Command Line Instructions for application Uninstall
Application Location

For details, see Deploying legacy apps.
Procedure
1. Log into the Admin Portal.
2. Go to Apps > App Catalog.
3. Select the app you want to remove from the device.
4. Select Actions > Remove from Labels.
5. Select the name of the label and click Remove.
The user will no longer be able to see the application once it has been removed from the device.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 293

15Working with Events
This section addresses the components related to The Event Center.
l

About eventslManaging eventsl

Event settingslCustomizing Event Center messageslViewing and Exporting Events

About eventsThe Event Center enables MobileIron administrators to configure events to specific alerts that can be sent to users,
administrators, or both. Event types include:lInternational Roaming Eventl

SIM Changed EventlMemory Size Exceeded Eventl

System Eventl

Policy Violations Eventl

Device Status Event

An alert is a message sent via SMS or email. You can select a predefined message template, or create a custom
message to use for the alert.
For example, you can specify an SMS to be sent each time a user travels to a different country, informing the userthat different rates may apply.

Events pageUse the Logs > Event Settings page in Admin Portal to manage the events you are interested in and thecorresponding alerts you want to automate.

Required role
To edit settings on the Event Settings page, the administrator must have the Manage events role.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 294

Managing events

Managing events
The tasks that are common to all event types are:l

Creating an eventl

Editing an eventlDeleting an eventlEnsuring the alert is sent to the correct recipientsl

Applying the event to a labellSetting alert retries

Creating an event
Procedure
To create an event, in the Admin Portal:
1. Go to Logs > Event Settings.
2. Click Add New.
3. Select the type of event from the drop-down.
4. Complete the information for the selected event.
Each event type has settings specific to the event type. See Event settings for information on the settings.
5. Click Save.

Editing an event
Procedure
To edit an event, in the Admin Portal:
1. Go to Logs > Event Settings.
2. Select the event you want to edit.
3. Click Edit.
4. Make your changes.
5. Click Save.

Deleting an event
Procedure
To delete an event, in the Admin Portal:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 295

Ensuring the alert is sent to the correct recipients

1. Go to Logs > Event Settings.
2. Select the event you want to delete.
3. Click Delete.

Ensuring the alert is sent to the correct recipients
When you create an event, you designate recipients for the resulting alert. Each event type includes the alertconfiguration section shown in the following figure.

For each type of alert (i.e. SMS and email), you can select to send the alert to one of the following:
l

None

l

User onlyl

User + Adminl

Admin only

If you select one of the Admin options, a CC to Admins section is displayed in the dialog box. This section
displays a list of devices. Under the Available heading , select a device (or devices), that is associated with anemail address that you want to notify, other than the device user. Core will send a notification to the email address
associated with the device or devices that appear under the Selected heading.

FIGURE 14. CC TO ADMINSNOTE: Only users who have registered devices can appear in the Apply to Users list.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 296

Applying the event to a label

Applying the event to a label
To specify the devices to which the event should apply, you select one or more labels when you create the event.
The amount of time it takes to apply an event to a label depends on the number of devices identified by the label.
Therefore, it may take some time for the label name to display as selected for the event.

Setting alert retries
You can specify the number of times MobileIron attempts to send an SMS alert or registration email.
Procedure
1. Enter the number of retries for SMS and registration email.
Reminders are sent at 48-hour intervals until the number of reminders specified are sent, or the device isregistered.
For example, if you use the default for Number of Retries for Email (which is 2), an email is sent
immediately after registration. If the device is not registered within 48 hours, a second email is sent. No
other reminders are sent because you specified two reminders.
2. Click Save.

Setting MobileIron SMS, email, and push notifications
You can designate specific hours for the sending of SMS, email, and push notifications. The default notification
time is 0300 (3 a.m.), which can be disruptive.
Procedure
To override the default notification schedule:
1. From the Admin Portal, go to Settings > System Settings > General > Alert.
2. Select the Override Default Schedule SMS, Email, Push notification check box. The section
expands.
3. Enter the notification start time and end time, in UTC hours.
4. Select the days of the week when sending notifications are allowed.
5. Click Save.

Event settings
Each event type has specific settings that need to be configured when you create or edit the event. This section
describes the settings for each type.
l

International roaming event settingsl

SIM changed event settings

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 297

International roaming event settingslMemory size exceeded event settingsl

System event settingsl

System event field descriptionl

Policy violations event settingsl

Policy violations event field descriptionlDevice status event settings

International roaming event settings
This event type is not supported for Windows devices.

SIM changed event settings
This event type is not supported for Windows devices.

Memory size exceeded event settings
This event type is not supported for Windows devices.
This section address how to create a memory size exceeded event.
Procedure
1. Go to Logs > Event Settings.
2. Click Add New.
3. Select Memory Size Exceeded Event from the drop-down menu.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 298

Memory size exceeded event settings

4. Use the following guidelines to create a memory size exceeded event:
Field

Description

Name

Identifier for this event.

Description

Additional text to clarify the purpose of this notification.

Used Memory Size
Exceeds

Specifies the percentage of total memory that triggers the alert.

Generate Alert

Turns on/off the alert defined for this event.

Alert every

Specifies the time, in days, after which the alert count is reset.

Severity

Specifies the severity defined for the alert: Critical, Warning, andInformation.

Template

Specifies the template to populate the resulting alert. Click View todisplay the content of the current template.
Select an alternate template from the drop-down or click Create to create
a new template.
See Customizing Event Center messages for information on creating a
new template.

Send SMS

Specifies whether to send an alert in a text message, and whether to send
it to the user, the admin, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.

Send EmailSpecifies whether to send an alert in an email, and whether to send it tothe user, the admin, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.

Send through Push
Notification

Specifies whether to send a message, and whether to send it to the user,
the admin, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.
The length of the message is limited to 255 characters.

Apply to Labels

Associate this event with the selected labels. See the “Using labels toestablish groups” section in the Core MobileIron Getting Started Guide formore information.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 299

System event settings

Field

Description

Search UsersEnter the user ID to find devices to which you want to apply this event.

Apply to Users

Associate this group of settings with the selected users.

CC to Admins

If you selected “Admin only” or “User + Admin”, then the CC to Admins
section appears. Use this section to specify administrative users whoshould receive the alert.

5. Click Save.
NOTE: Memory exceeded events are sent only once per week when the configured memory limit isreached. If more than one memory size exceeded event applies to a device, only the last one
you edited and saved is triggered.

System event settings
A system event applies a compliance action when a component of a MobileIron implementation is not working.
System alerts are intended for relevant administrators.
Procedure
1. In the Admin Portal, go to Logs > Event Settings.
2. Click Add New.
3. Select System Event from the drop down menu.
4. Use the guidelines in System event field description to complete the form:
5. Click Save.

System event field description
TABLE 72. SYSTEM EVENT FIELD DESCRIPTIONS
Field

Description

Name

Identifier for this event.

Description

Additional text to clarify the purpose of this notification.

Sentry (standalone and integrated) is
unreachable

Applies a compliance action if MobileIron Core is unable to contact
the MobileIron Sentry.

MobileIron gateway is unreachable

Select this option to send an alert if Core cannot connect to the
MobileIron gateway.

LDAP server is unreachable

Select this option to send an alert if Core cannot connect to any of theconfigured LDAP servers.

DNS server is unreachable

Select this option to send an alert if Core cannot connect to one of theconfigured DNS servers.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 300

System event field description

TABLE 72. SYSTEM EVENT FIELD DESCRIPTIONS (CONT.)
Field

Description

Mail server is unreachable

Select this option to send an alert if Core cannot connect to theconfigured SMTP server.

NTP server is unreachable

Select this option to send an alert if Core connect to the configured
NTP server.

Certificate Expired or Certificate Error

Select this option to send an alert for certificate expiration.
An alert is sent 30 days before expiration and on the expiration date.
Certificates supported include Admin Portal and device certificates.

Provisioning Profile Expired

This feature is not supported for Windows devices.

SMTP Relay server is unreachable

Applies a compliance action if the configured SMTP relay (used for
SMS archive) does not respond to a ping or SMTP ping.

SMTP Relay server error

Applies a compliance action if the configured SMTP relay (used for
SMS archive) returns an error. The alert includes available details toenable troubleshooting.

System storage threshold has beenreachedApplies a compliance action if the system storage threshold has beenreached.
Refer to MobileIron Core System Manager Guide for information on
setting this threshold or manually purging the data.

Connector state events

Applies a compliance action if the health of the Connector changes.
MobileIron defines a healthy connector as one that connects to theserver at expected intervals and syncs successfully with the LDAP
server. An alert is generated if a Connector changes from healthy tounhealthy, or from unhealthy to healthy.

Connector requires upgrade

Applies a compliance action if the automated upgrade of theConnector fails. This alert prompts you to manually upgrade theConnector.

Connector can not connect to LDAP
server

Applies a compliance action if a configured LDAP server is no longer
reachable.

Connector is unreachable

Applies a compliance action if the MobileIron server does not receive
the expected response to the scheduled probe of the Connector.
This alert generally indicates network problems.

Application update failed

Alerts the administrator that the Apps@Work or Bridge update forWindows failed. For more information, administrators can the server
logs.

Mobile Threat Definition Update

Alerts administrators when a new version of the mobile threat
definition is available. The notification includes any impacts to theexisting MTD Local Action policies if threats were removed from the

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 301

System event field description

TABLE 72. SYSTEM EVENT FIELD DESCRIPTIONS (CONT.)
Field

Description
latest update.

Generate Alert

Turns on/off the alert defined for this event.

Maximum Alerts

Specifies whether there is a limit on the number of alerts generated fora given event. If you select Limited, then you can specify the numberof alerts to allow. By default, compliance is checked every 24 hours.
See Managing Compliance and Creating an event for more
information.

Alert Every

Specifies the time, in days, after which the alert count is reset.

Severity

Specifies the severity defined for the alert. Select Critical, Warning,or Information.

Template

Specifies the template to populate the resulting alert. Click View todisplay the content of the current template.
Select an alternate template from the drop-down or click Create tocreate a new template. See Customizing Event Center messages for
information on creating a new template.

Send SMS

Specifies whether to send an alert in a text message, and whether tosend it to the user, the administrator, or both. Specify users in the
Apply to Users section or by selecting a label in the Apply to
Labels section. If you select “Admin only” or “User + Admin”, then the
CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.

Send EmailSpecifies whether to send an alert in an email, and whether to send it
to the user, the administrator, or both. Specify users in the Apply toUsers section or by selecting a label in the Apply to Labels section.
If you select “Admin only” or “User + Admin”, then the CC to Admins
section appears. Use this section to specify administrative users whoshould receive the alert.

Send through Push Notification

Specifies whether to send a message, and whether to send it to theuser, administrator, or both.
Specify users in the Apply to Users section or by selecting a label in
the Apply to Labels section. If you select “Admin only” or “User +Admin”, then the CC to Admins section appears. Use this section to
specify administrative users who should receive the alert.
The length of the message is limited to 255 characters.

Apply to Labels

Send the alert to users in the selected labels. See the “Using labels toestablish groups” section in the Core MobileIron Getting Started Guide
for more information.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 302

Policy violations event settings

TABLE 72. SYSTEM EVENT FIELD DESCRIPTIONS (CONT.)
Field

Description
NOTE: In most cases, if you do select a label, it should not be alabel with broad coverage. System event alerts areusually not appropriate for device users.

Search UsersEnter the user ID to find users to which you want to send the alert.

Apply to Users

Send the alert to the selected users.

Policy violations event settings
For Windows devices, only out of contact and out of policy violations are supported. Alerts can be sent by email
only.
Procedure
1. In the Admin Portal, go to Logs > Event Settings.
2. Click Add New.
3. Select Policy Violation Event from the drop- down menu. The New Policy Violations Event dialog box
opens.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 303

Policy violations event field description

4. Follow the guidelines in Policy violations event field description to complete the form.
5. Click Save.
NOTE: Apply only one Policy Violations event to each device. If more than one policy violations event
applies to a device, only the last one you edited and saved is triggered. Therefore, do not create
a separate policy violations event for each type of security policy violation.
In that one Policy Violations event, select all of the security policy settings that you want to trigger the event. Use
the template variable $DEFAULT_POLICY_VIOLATION_MESSAGE in your message template to specify the
security policy violation that triggered the event.

Policy violations event field description
The following table describes fields for configuring a policy violation event.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 304

Policy violations event field description

TABLE 73. POLICY VIOLATION EVENT FIELD DESCRIPTION
Field

Description

Name

Identifier for this event.

Description

Additional text to clarify the purpose of this notification.

Connectivity
Out-of-contact with Server for X
number of days

Select this option to send an alert when a device has been out of contact
for the number of days specified in the Security policy assigned to it.

Out-of-policy for X number of days

Select this option to send an alert when a policy has been out of date forthe number of days specified in the Security policy assigned to it.

Device Settings
Passcode is not compliant

Applies a compliance action if a device is detected having a passcodethat does not meet the requirements specified in the associated security
policy.

App Control
Disallowed app foundApplies a compliance action if an app that is specified as Disallowed isinstalled on a device.
Apps are specified as Required, Allowed, or Disallowed under Apps >App Control.

App found that is not in Allowed
Apps list

Applies a compliance action if an app that does not appear on the list ofallowed apps has been detected on a device.
Apps are specified as Required, Allowed, or Disallowed under Apps >App Control.

Required app not foundApplies a compliance action if an app that is specified as Required is notinstalled on a device.
Apps are specified as Required, Allowed, or Disallowed under Apps >App Control.

Data Protection/Encryption - iOS - Android
Data Protection/Encryption isdisabled.

Security - Windows
OS Build is less than the required
OS build

Select this option to apply a compliance action if the device build is lessthan the OS build defined in the Security policy.

Last Hotfix is less than therequired hotfix

Select this option to apply a compliance action if the device OS build isless than the hotfix build defined in the Security policy.

Last Hotfix installation date is out

Select this option to apply a compliance action if the device OS has not

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 305

Policy violations event field description

TABLE 73. POLICY VIOLATION EVENT FIELD DESCRIPTION (CONT.)
Field

Descriptionof datebeen updated in the time interval defined in the Security policy.

iOS
Disallowed iOS model foundSelect this option to apply a compliance action when a restricted iOS
model is registered.

Disallowed iOS version foundSelect this option to apply a compliance action when a restricted iOS
version is registered.

Compromised iOS device

Select this option to apply a compliance action when a compromised iOS
is registered or connects to the server. That is, an iOS device has been
compromised by circumventing the operator and usage restrictions
imposed by the operator and manufacturer.

iOS Configuration not compliant

Applies a compliance action if an iOS device does not have the expected
security policy or app settings. This state may indicate that a setting waschanged or was not applied successfully.

Restored Device connected toserver

Applies a compliance action if a previously wiped device has been
restored and attempts to connect through the MobileIron deployment.

MobileIron iOS App Multitasking
disabled by user

Applies a compliance action if the device user disables multitasking for
the MobileIron iOS app. Disabling multitasking increases the likelihoodthat a compromised device will go undetected for a significant period oftime.

Device MDM deactivated (iOS 5
and later)

Applies a compliance action when the MDM profile on a managed iOS 5
device is removed.

macOS
Disallowed macOS version foundApplies a compliance action if Core finds a registered device running aprohibited version of macOS.

Device MDM deactivated

Applies a compliance action if Core detects that MDM (Mobile Device
Management) has been deactivated on a registered macOS device.

FileVault encryption disabled

Applies a compliance action if Core detects a registered macOS device
with disabled FileVault encryption.

Android
Disallowed Android OS version
foundApplies a compliance action if an Android device having a disallowed OS
version is detected. You can specify disallowed versions in the security
policy.

Compromised Android device
detected

Applies a compliance action if a modified Android device is detected. Thatis, an Android device has been compromised by circumventing theoperator and usage restrictions imposed by the operator andMobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 306

Policy violations event field description

TABLE 73. POLICY VIOLATION EVENT FIELD DESCRIPTION (CONT.)
Field

Description
manufacturer.

Device administrator not activatedfor DM client or agent

Generate an alert when a managed Android device is found to have nodevice administrator privilege activated for Mobile@Work or the Samsung
DM Agent.

Actions
Generate Alert

Turns on/off the alert defined for this event.

Maximum Alerts

Specifies whether there is a limit on the number of alerts generated for agiven event. If you select Limited, then you can specify the number ofalerts to allow.

Alert Every

Specifies the time, in days, after which the alert count is reset.

Severity

Specifies the severity you define for this alert. Select Critical, Warning,or Information.

Template

Specifies the template to populate the resulting alert. Click View todisplay the content of the current template. Select an alternate templatefrom the drop down or click Create to create a new template.
See Customizing Event Center messages on page 311 for information on
creating a new template.

Send SMS

Specifies whether to send an alert in a text message, and whether to send
it to the user, the administrator, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.

Send EmailSpecifies whether to send an alert in an email, and whether to send it tothe user, the administrator, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.

Send through Push Notification

Specifies whether to send a message, and whether to send it to the user,
the administrator, or both.
Specify users in the Apply to Users section or by selecting a label in the
Apply to Labels section. If you select “Admin only” or “User + Admin”,
then the CC to Admins section appears. Use this section to specify
administrative users who should receive the alert.
The length of the message is limited to 255 characters.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 307

Device status event settings

TABLE 73. POLICY VIOLATION EVENT FIELD DESCRIPTION (CONT.)
Field

Description

Apply to Labels

Send the alert to users in the selected labels. See the “Using labels toestablish groups” section in the Core MobileIron Getting Started Guide formore information.

Search UsersEnter the user ID to find users to which you want to send the alert.

Apply to Users

Send the alert to the selected users.

CC to Admins

If you selected “Admin only” or “User + Admin”, then the CC to Admins
section appears. Use this section to specify administrative users whoshould receive the alert.

Device status event settings
The device status event applies only to Android and iOS devices. The following describes the steps to create adevice status event in the Admin Portal.
Procedure
1. Go to Logs > Event Settings.
2. Click Add New.
3. Select Device Status Event from the drop-down menu. The New Status Event dialog box opens.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 308

Device status event settings

4. Use the following guidelines to complete the form:
Field

Description

Name

Identifier for this event.

Description

Additional text to clarify the purpose of this notification.

Triggers when

Specifies the conditions on the device that will trigger an alert:• Device status is changed (Android and iOS)
• Android device reports policy/config errors• Android device reports policy/config warnings• Work schedule policy applied (Android and iOS)

Actions
Severity

Specifies the severity you define for this alert. Select Critical,
Warning, or Information.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 309

Device status event settings

Field

Description

Template

Specifies the template to populate the resulting alert. Click View todisplay the content of the current template. Select an alternate
template from the drop-down or click Create to create a new
template.
See Customizing Event Center messages for information on
creating a new template.

Send SMS

Specifies whether to send an alert in a text message, and whether
to send it to the user, the administrator, or both.
Specify users in the Apply to Users section or by selecting a label
in the Apply to Labels section. If you select “Admin only” or “User+ Admin”, then the CC to Admins section appears. Use thissection to specify administrative users who should receive thealert.

Send EmailSpecifies whether to send an alert in an email, and whether to send
it to the user, the administrator, or both.
Specify users in the Apply to Users section or by selecting a label
in the Apply to Labels section. If you select “Admin only” or “User+ Admin”, then the CC to Admins section appears. Use thissection to specify administrative users who should receive thealert.

Send through Push Notification

Specifies whether to send a message, and whether to send it tothe user, the administrator, or both.
Specify users in the Apply to Users section or by selecting a label
in the Apply to Labels section. If you select “Admin only” or “User+ Admin”, then the CC to Admins section appears. Use thissection to specify administrative users who should receive thealert.
The length of the message is limited to 255 characters.

Apply to Labels

Send the alert to users in the selected labels. See the “Using labels
to establish groups” section in the Core MobileIron Getting Started
Guide for more information.

Search UsersEnter the user ID to find users to which you want to send the alert.

Apply to Users

Send the alert to the selected users.

CC to Admins

If you selected “Admin only” or “User + Admin”, then the CC to
Admins section appears. Use this section to specify
administrative users who should receive the alert.

5. Click Save.
NOTE: If more than one device status event applies to a device, only the last one you edited and saved
is triggered.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 310

Customizing Event Center messages

Customizing Event Center messages
The MobileIron Event Center sends emails, SMSes, and push notification messages based on triggering events.
When you configure events, you can use the default message template or create a new one. Event Center
templates enable you to specify content and basic formatting using HTML markup.

Displaying Event Center templates
To display Event Center templates:
1. In the Admin Portal, go to Settings > Templates.

2. Select Event Center Templates.
This list includes the default template for each Event Center type. Default templates are not editable.
3. Click the View link for the message template you want to view.

Adding custom Event Center messages
To add a custom Event Center message:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 311

Adding custom Event Center messages

1. Either click the Create button in the event dialog or select the event type from Settings > Templates >Event Center Templates > Add New.
The following figure shows the event dialog.

2. The following figure shows the Event Center Templates menu.

The dialog for the corresponding event type opens.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 312

Using variables in Event Center messages

Event Center messages are displayed with the HTML markup that provides the basic formatting for thecontent.
3. In the Name field, enter a name for the template.
The name must be unique for events of the same type.
4. In the Edit Template for field, select the language this template will be used for.
Note that only those languages that have been enabled for the system will be displayed in this list.
5. Make changes to the displayed messages.
6. Click Save.

Using variables in Event Center messages
Supported and required variables for Event Center messages vary by the type of message. The following tablesummarizes these variables. You can also click the Variables Supported link to display this information. Note
that, unlike variables used for registration variables, Event Center variables do not end with $.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 313

Using variables in Event Center messages

TABLE 74. VARIABLES IN EVENT CENTER MESSAGES
Template Type

Required Variables

International Roaming$CURRENT_COUNTRY$HOME_COUNTRY$PHONE_NUMBER$SEVERITY$USER_NAME

Threshold Reached$PHONE_NUMBER$SEVERITY$THRESHOLD_ON$THRESHOLD_TYPE$THRESHOLD_UNIT$THRESHOLD_VALUE$USED_VALUE$USER_NAME

SIM Changed$CURRENT_PHONE_NUMBER$NEW_PHONE_NUMBER$SEVERITY$USER_NAME

Memory Size Exceeded$FREE_MEMORY_SIZE$MEMORY_SIZE_LIMIT$PHONE_NUMBER$SEVERITY$TOTAL_MEMORY_SIZE$USER_NAME

System Event$DEFAULT_SYSTEM_MESSAGE$SERVER_IP$SERVER_NAME$SEVERITY

Policy Violation$DEFAULT_POLICY_VIOLATION_MESSAGE$PHONE_NUMBER$SEVERITY$USER_NAME

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 314

Variable descriptions

Variable descriptions
The following table describes the variables used in Event Center messages.

TABLE 75. VARIABLE DESCRIPTIONS
Variable

Description$CURRENT_COUNTRY

The country in which the device is currently located.

$CURRENT_PHONE_NUMBER

The phone number currently associated with the device in
MobileIron Core, but not matching the phone number currently
used by the device.

$DEFAULT_POLICY_VIOLATION_MESSAGE

The hard-coded message associated with the policy violationthat triggered the alert.
NOTE: Due to the length limits of SMS, the text might betruncated.

$DEFAULT_SYSTEM_MESSAGE

The third-party system message or error that triggered thealert.

$FREE_MEMORY_SIZE

The amount of free memory currently available on the device.

$HOME_COUNTRY

The home country of the device.

$MEMORY_SIZE_LIMIT

The threshold set for the device memory.

$NEW_PHONE_NUMBER

The phone number replacing the $CURRENT_PHONE_
NUMBER$ as a result of a SIM change.

$PHONE_NUMBER

The phone number used by the device.

$SERVER_IP

The IP address of the server triggering a system event alert.

$SERVER_NAME

The hostname of the server triggering the system event alert.

$SEVERITY

The defined severity of the system event, i.e., Information,
Warning, or Critical.

$THRESHOLD_ON

The total used for calculations, i.e., International Roaming or
Total Usage.

$THRESHOLD_TYPE

The type of usage measured, i.e., SMS, Data, or Voice.

$THRESHOLD_UNIT

The unit associated with the type of usage, i.e., minutes,
messages, or MB.

$THRESHOLD_VALUE

The defined threshold value for this event, e.g., 1000 (voice
minutes).

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 315

Specifying which template to use

TABLE 75. VARIABLE DESCRIPTIONS (CONT.)
Variable

Description$TOTAL_MEMORY_SIZE

The total memory reported by the device.

$USED_VALUE

The amount of memory currently used on the device.

$USER_NAME

The display name of the user associated with the device.

Specifying which template to use
When you create or edit an event, you specify which template to use for resulting alerts. To select a template:
1. Create or edit an event.
2. Select a template from the drop-down or click the Create button to create a new template.

Filtering Event Center messages
In the Event Center Templates page, you can filter messages by event type. Just select the preferred event typefrom the Event Type drop-down.

Editing Event Center messages
You can edit your custom Event Center templates. However, default Event Center templates are not editable.
To edit a custom Event Center template:
1. In Admin Portal, go to Settings > Templates > Event Center Templates.

2. Click the edit icon for the custom template you want to edit.
3. Make your changes.
4. Click Save.

Deleting Event Center messages
You can delete any of the Event Center messages you have created:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 316

Viewing and Exporting Events

1. In Admin Portal, go to Settings > Templates > Event Center Templates.
2. Select the items you want to delete.
3. Click Delete.

Viewing and Exporting Events
Use the Events screen to track the events that have triggered alerts. To display the Events screen, go to Logs >Events.

Marking as Read or Unread
To enable tracking of which events have been noted and/or addressed by an administrator, you can mark an event
as Read. Likewise, you can switch this flag back to Unread.
To set the Read/Unread flag:
1. Select one or more events.
2. Select Read or Unread or from the Actions menu.

Filtering events
You can display the events using the following filters:

TABLE 76. FILTERING EVENTSFilterDescription

Read/Unread

Select Read or Unread from the Show drop-down list. To resume displaying all
events, select All.

All

Select All to resume displaying all events.

LabelsSelect the preferred label from the Labels drop-down to filter based on the label
specified in the event.

User

Enter a user ID and click the search icon to filter based on the user IDs specified in
the event.

Start Date/End Date

Select dates in the Start Date and End Date fields to filter events by date range.

Event Type

Select an event type from the Type drop-down to filter by event type.

Event Status

Select an event status from the status drop-down to filter based on the event’s
lifecycle state.

Event lifecycle and status
Events go through the following lifecycle:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 317

Exporting event history

Created -> Dispatch Pending -> Dispatching -> Dispatched
The following two failure states may also occur:ll

Dispatch Failed: The process of generating the alert failed. This is usually the result of an SMTP problem.
Check the SMTP configuration in System Manager, as well as the health of your SMTP server.
Expired: Another event occurred that makes the alert obsolete, resulting in expiration before dispatch.

Exporting event history
To export a CSV file containing the currently displayed events on the Logs > Events page, click the Export
button.

Adding a note
You can add a note to one or more events to help track the work that has been done in response. Each event canhold one note; adding another note replaces the existing note. To add a note:
1. Select one or more events.
2. Click Actions > Add Note.

3. Enter the text of the note.
4. Click Add.
5. Press F5 to refresh the screen and confirm that the note displays in the Note field for the selected events.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 318

16Troubleshooting MobileIron Core and devices
This section addresses troubleshooting various aspects of Core and devices.
About Core logs
Audit log information
Best practices: label management
Device events
ActiveSync Device information
MDM events
Certificate events
App Tunnel events
Audit Logs use cases
Viewing Errors
Certificate Management
Service Diagnostic tests

About Core logs
As you oversee management and security of users, data and devices, you will need information about the actions
and events that occur in your MobileIron Core instance. MobileIron Core logs many actions that can impact yourCore instance, and provides the Audit Logs page for you to sort and view the logged information.
The following pages of logs, found in the Admin Portal under Logs, enable you to easily navigate through the
MobileIron log entries to find the information you need.
l

Audit Logs: for MobileIron device management entrieslCertificate Management: for certificate-related entries

Note The Following:llLogs are stored in the MobileIron Core file system, not in the MobileIron Core database. Therefore, the sizeof the logs does not impact Core performance.
Core will show up to 1 million audit log records.

Audit logs
Using log entries, the Admin Portal tracks status and operations for each managed device. You can use log entries
to confirm that actions were completed and to investigate problems.
The Audit Logs page includes panels that:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 319

Searching the information in the audit logsllenable you to filter through all events that Core has logged since the last time the logs were purgedshows either the events recorded since the logs were last purged, or the events matching the criteria you
specified in the Filters panel

FIGURE 15. AUDIT LOGS

Searching the information in the audit logs
Procedure
To search the information that Core logs:
1. In Admin Portal, go to Logs.
Core displays the Audit Logs page, which initially lists the events logged since the last time the logs were
purged.
2. In the Filters panel, click on the number of events in a category to display only that category’s events.
For example, click the 72 next to App.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 320

Setting event time criteria in audit logs.
3. Alternatively, click to expand one of the information types that you want to view (for example, App).
4. Check the items within that category that you want to view (for example, Add App and Install App).
5. Repeat Step 3 and Step 4 for each category that you want to include in this search.
6. (Optional) To search for events involving a particular administrator, or actions that contain a specific wordor phrase in the details, use the Search by Performed (On|By)/Details box in the Filters panel as follows:lenter the search string in the text box.

lfor example, to find events involving Mobile@Work, enter the text Mobile@Work.

7. (Optional) To limit the time frame of the actions, use the Action Date box (see Setting event time criteria in
audit logs on page 321)
8. Click Search.
The Audit Logs page shows all events matching your search criteria and time period. If you do not specify atime period, the default used is the period between the time you run the search and when the log data waslast purged.
9. To reset all search criteria, click Reset.

Setting event time criteria in audit logs
When you are working with audit logs, the default time frame for the events displayed is the time between thecurrent time and the last time the logs were purged (for information about setting the log retention time, see

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 321

Setting event time criteria in audit logs

Specifying how long log information is saved). For example, if the logs were purged two weeks ago, the Audit Logs
display all the events matching any criteria you set that occurred from two weeks ago to the current moment.
You can change the time frame of events you view in the Filters panel. You can select by time or date.
To specify a time frame for events you view from the audit logs:
1. In Admin Portal, go to Logs.
2. In the Filters panel, click the drop-down arrow in Action Date.

3. Select one of the times listed or Others.
Selecting a time displays the events matching criteria you set, if any, for the time period from the last time
the logs were purged until the time you specify.
Any events that occurred between the specified time period and the current moment are not displayed. For
example, if you select 1 hour ago, no events that happened within the last hour are displayed.
4. If you select Others:llusing the left column of time choices in Filters, you can specify an exact date, hour or minute (or any
combination of these criteria) as one end of the time frame and use the date of the last audit log purge
as the other end of the time frame
using the left and right columns of time choices in Filters, you can specify both the beginning and endof the time range.

Use the following table to help you set the time range for your search.

Note The Following:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 322

Setting event time criteria in audit logsllWhen you set only one end of the time frame, the date or time you specify must be later than the last date
the log data was purged. If the last log purge was May 13th, for example, May 12th would not be a valid
date for selecting events.
When you set both ends of the time frame, ensure that the time or date specified in the left column occurs
before the time or date specified in the right column. For example, if you specify 1 hour ago in the left
column and 1 day ago in the right column, Core will display a message asking you to reset your time
criteria because 1 hour ago happens after 1 day ago.

TABLE 77. TIME CRITERIA SELECTION EXAMPLESTime criteria
selected

Value selected

ResultIn the left column,
select both:• Others• Select date

Click May 12th in thedisplayed calendar

Displays all events matching your criteria that occurredfrom the last audit log data purge until May 12th.

In the left column,
select both:• Others• Select hour

Select 2AM from thelist of hours

Displays all events matching your criteria that occurredfrom the last audit log data purge until 2AM of the currentday.

In the left column,
select both:• Others• Select minuteSelect 15 from the listof minutes

Displays all events matching your criteria that occurredfrom the last audit log data purge until the 15th minute of
the current hour.

In the left column,
select:• Others• Select dateIn the left column:• Select April 10thfrom the calendar

Displays all events matching your criteria that occurred
between April 10th and 24 hours ago.

In the right column,
select:• a time interval from
Select time
In the left column,
select:• Others• Select hour

In the right column:• Select 1 day ago

In the left column:• Select 2AM

Displays all events matching your criteria for the time
period that started at 2AM the morning of the current day
and ended an hour ago.

In the right column:• Select 1 hour ago
In the right column,
select:• a time interval from
Select time

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 323

Viewing audit log information

Viewing audit log information
The Audit Logs page displays the information that MobileIron Core records for your Core instance. You specify
what information is displayed on this page when you use the controls in the Filters panel of the page. See
Searching the information in the audit logs for details.
To view the information that Core logs:
1. In Admin Portal, go to Logs.
Core displays the Audit Logs page. The information panel displays:
Action (for example, Admin Portal sign-in)lState (for example, Success)lPerformed By (for example, myadmin)lAction DatelCompleted AtlPerformed On (for example, Admin Portal)l

Details

2. (Optional) Enter a number in Page to specify what page to view.
3. (Optional) Select a number from per page to specify how many records are displayed on a page.
4. (Optional) Click Export to CSV to export the records that match the current search criteria.

Specifying how long log information is saved
You specify how long log data is retained on your server. Determining how long to retain data is a balance between
having data you need and having the available server resources to run your Core. The default value is 90 days.
To set how long log information is kept:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 324

Audit log information

1. In System Manager, go to Settings > Data Purge.
2. In Audit Logs Purge Configuration, select the number of days Core retains log information.
3. Click Apply.

Audit log information
Several categories of information are available for you to view and audit. The category list, displayed on the left
side of the Audit Logs page, includes:lDevicel

ActiveSync Device

l

MDM

l

Certificatel

App Tunnel

l

App

l

PolicylCompliance ActionlConfigurationl

DEP (Device Enrollment)

l

Admin

l

User

l

LDAP

l

Other

l

Label

l

Sentryl

AfWl

Custom AttributeslCompliance Policyl

E-FOTAl

Migrationl

MTD (MobileIron Threat Defense)l

Access Integrationl

Derived Credential Providerl

Zebra FOTA

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 325

Best practices: label management

Best practices: label management
If Notes for Audit Logs is enabled, whenever a change is made to a label, a text box displays for the administrator
to provide a reason for the change.

Example text to enter would be a change ticket order number. This information then displays in the Audit logs, inthe Details column as "Reason."This affects the following label-related activities:l

Add/Edit/Delete/Save Label (Both filter and manual)l

In Devices & Users > Devices > Advanced Search > Save to Labell

Add/Edit/Remove Label to devices

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 326

Device eventsl

Add/Edit/Remove Label to configurationsl

Add/Edit/Remove Label to policiesl

Add/Edit/Remove Label to appsl

Add/Edit/Remove Label to iBooks

The Notes for Audit Logs feature is also applicable to any administrator-made changes to iOS andmacOS restrictions.
To enable this feature, see "Setup tasks" in Getting Started with MobileIron Core.

Device events
Device events record device-related actions taken by an administrator in the Admin Portal.
To monitor device actions, select one or more of the logged device actions in the Filters panel:lAllow App Tunnel: Manually allow app tunnels from the selected device.

l

Apply Label: Associate an item with a label.

l

Apply Multiple Labels to One Device: Associate an item with multiple labels.

lBlock App Tunnel: Manually disallow app tunnels from the selected device.

l

Cancel Wipe: Cancels pending "Wipe" command if it was not yet delivered to the device. Applies to allmodes.

l

Change Language: Change the language associated with a device.

lChange Ownership: Toggle device ownership between Employee and Company.

l

Check Available OS Update:l

Check Compliance: Check device against compliance criteria.

lDelete Retired Device: Remove entry for a device that is not longer managed.

lDevice Location:lDisable:lDisable Activation Lock: Turn off the activation lock feature for the selected iOS device.

lDisable Data Roaming: Turn off the ability to use data when the device is roaming.

lDisable due to out of compliance:lDisable Kiosk: Exit kiosk mode on the designated Android device.

lDisable KNOX Container: Turn off the Samsung KNOX container feature for the selected device.

lDisable Personal Hotspot: Prevent the device user from using the personal hotspot feature.

lDisable Voice Roaming: Turn off the ability to make voice calls when the device is roaming.

l

Download Available OS Update:lEnable:MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 327

Device eventslEnable Activation Lock: Turn on the activation lock feature for the selected iOS device.

lEnable Data Roaming: Turn on the ability to use data while roaming for the selected iOS device.

lEnable Kiosk: Start kiosk mode on the designated Android device.

lEnable KNOX Container: Turn on the Samsung KNOX container feature for the selected device.

lEnable MDM Lost Mode: Enable lost mode for the selected iOS device.

lEnable Personal Hotspot: Allow the device user to use the personal hotspot feature.

lEnable Voice Roaming: Turn on the ability to make voice calls when the device is roaming.

lFound: Designate the selected lost device as found.

lInstall Downloaded OS Update:lInstall Help@Work: Install the MobileIron Help@Work app.

l

Locate: Retrieve the last known location for the selected device.

l

Lock: Force the selected device to require a passcode for user access.

l

Lost: Designate the selected device as lost.

lMobileIron Bridge: Create a configuration for the MobileIron Bridge application for Windows 10
Management.

lPush Profile: Prompt a manual distribution of profiles to the selected device.

lRe-provision Device: Restart the provisioning process for the selected device.

l

Reboot: Reboot the selected Windows device.

lRegister Device: Start the registration process for the selected device.

lRemote Control: Establish a remote control session (Help@Work) on the selected Android device.

lRemote Display: Establish a remote view session (Help@Work) on the selected iOS device.

lRemove Device Attribute: Remove an attribute from a device.

lRemove Label: Remove the association between the specified label and the selected item.

lRemove Multiple labels from one device: Remove the association between the specified labels and theselected item.

lRequest Derived Credential: Device user request in user portal for a derived credential.

lRequest Unlock AppConnect Container (Android only): Initiate unlock AppConnect container.

lRequest Unlock Device: Initiate unlock device.

lRequest Unlock Passcode: Initiate unlock passcode.

l

Resend Provision Message: No longer supported.

lReset AppConnect Passcode: Device user request in user portal to reset the AppConnect passcode.

lReset Password:lRestart iOS Device: Restart iOS device.

l

Reset PIN: Generate a new registration PIN for the selected Windows device.

lRetire: End management of the selected device.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 328

ActiveSync Device informationlSend Activation Lock Bypass Code: Send the bypass code to the selected iOS device.

l

Send Alert: Send compliance alert to the selected device.

l

Send APNS message: Launch a MobileIron client and authenticate against MobileIron Core.

l

Send Message: Send SMS message to the selected device.

l

Set Device Attribute: Set an attribute to a device.

l

Shutdown iOS Device: Shutdown iOS device.

l

Sign In: Launch a MobileIron client and authenticate against MobileIron Core.

lSign Out: End session between the MobileIron client and MobileIron Core.

l

l

l

Substitution Variable Change: Change a configuration due to a change in the value of a substitution
variable.
Unlock AppConnect Container (Android only): Begin unlock device and AppConnect container.
Unlock Device and AppConnect Container: (Android only): Begin unlock device and AppConnect
container.

l

Unlock Device Only: Clear the passcode for the selected device.

l

Update Device Comment: Change the Comment field in the record for the selected device.

l

Update OS Software: Update iOS software.

lWakeup: Force the device client to check in.

llWindows License: Alert administrators to upgrade the SKU of Windows 10 desktop devices. Options canbe Windows 10 Pro to Enterprise or Windows 10 Education to Enterprise.
Wipe: Return the device to factory default settings.

NOTE: Events beginning with Request, such as Request Unlock Device, are logged when an
administrator clicks the corresponding command in the Admin Portal. The corresponding event
without the word Request, such as Unlock Device, is logged when Core actually sends therequest to the device. Core sometimes delays sending requests to regulate Core performance.

ActiveSync Device information
These events do not apply to Mac devices.
To monitor ActiveSync device actions, select one or more of the logged ActiveSync device actions in the Filters
panellActiveSync Device Comment: Add or change the comment associated with an ActiveSync device entry.

l

Add Correlation:lAllow Device: Allow a blocked ActiveSync device to access the ActiveSync server.

lAssign ActiveSync Policy: Apply an ActiveSync policy to the selected device.

l

Block Device: Prevent the selected device from accessing the ActiveSync server.

l

Link To MI Device: Associate an ActiveSync device with a device registered with MobileIron Core.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 329

MDM eventslRemove: End the association between the MobileIron Core device and the ActiveSync device record.

lRemove Correlation:l

Revert ActiveSync Policy: Restore the Default ActiveSync Policy to the selected device.

MDM events
MDM events indicate when a device takes an action due to a MobileIron Core request. These events pertain only to
iOS and Mac devices unless otherwise noted.
To monitor these actions, select one or more of the logged MDM actions in the Filters panel.
l

Apply Redemption Code: Apply Redemption Code: Use a Apple License code.

l

Clear Passcode: Clear Passcode: Reset device passcode.

lDevice Lock: Set screen lock on device.

lInstall Encrypted Sub-Profile:lInstall Managed Application: Install a managed app.

l

Install MDM Profile: Install the MDM profile on the device.

lInstall Provisioning Profile: Install the provisioning profile for a managed app.

l

Lock Device (Android): Lock an Android device.

lProfile Change: Change the profile on an iOS or Android device.

lRemove Encrypted Sub-Profile:lRemove Managed Application: Uninstall a managed app.

lRemove MDM Profile: Remove the MDM profile from the device.

lRemove Provisioning Profile: Remove the provisioning profile for a managed app.

l

Settings: Modify device settings.

lUnlock Device (Android): Unlock an Android device and the AppConnect container on the device.

l

Unlock Device Only (Android): Unlock an Android device.

l

Wipe Device (called Erase Device in the MDM Activity tab): Restore the iOS device to factory defaults.

lWipe Device (Android): Restore the Android device to factory defaults.

Certificate events
To monitor actions involving certificates, select one or more of the logged certificate actions in the Filters panel.
ll

Apply User Provided Certificate: Use a certificate already provided by the user and sent to MobileIron
Core.
Create Device Certificate: Issue a device certificate.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 330

App Tunnel eventslCreate User Certificate: Issue a user certificate.

lDelete User Provided Certificate: Destroy certificate provided by the user via the self-service portal.

l

Device Certificate Expired: Warn on a device certificate that is no longer valid due to expiration.

l

Device Certificate Renewal: Re-enrolls a device certificate.

lReuse Device Certificate: Use an existing device certificate.

lReuse User Certificate: Use an existing user certificate.

l

Revoke Device Certificate: Reclaim a device certificate.

l

Revoke User Certificate: Reclaim a user certificate.

lUpload User Provided Certificate: Send certificate provided by the user via the self-service portal.

l

User Certificate Expired: Warn on a user certificate that is no longer valid due to expiration.

lUser Certificate Renewal: Re-enroll a user certificate.

NOTE: The contents of the Logs > Certificate Management shows information about certificates, suchas their expiration dates. It allows you to take actions, such as re-enroll, remove, and revoke on
the certificates.

App Tunnel events
To monitor actions involving app tunnels, select one or more of the logged app tunnel actions in the Filters panel.
lAllow App Tunnel: Permit the specified app tunnel.

l

App Tunnel Comment: Add a comment on the selected app tunnel.

l

Block App Tunnel: Do not allow the specified app tunnel.

lRemove App Tunnel: Delete the selected app tunnel configuration.

App information
To monitor actions involving apps, select one or more of the logged app actions in the Filters panel.
l

Add App: Add an app to the app catalog.

l

Add App Control Rule: Add an app control rule.

l

Add App Dependency:l

Add App Resource: Add screenshots or icons for an app.

l

Apply Label to App: Associate a label with an app.

lDelete App Control Rule: Remove an app control rule.

l

Edit App Control Rule: Change one or more attributes of an app control rule.

lInstall App: Send installation request for the selected app.

lManage VPP Labels: Specify labels and account for Apple License app distribution.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 331

Policy informationlModify App: Edit app catalog entry.

lRemove App: Delete entry from the app catalog.

lRemove Label From App: End the association between an app and a label.

l

Uninstall App: Remove the app from the device based on managed app criteria.

Policy information
To monitor actions involving policies, select one or more of the logged policy actions in the Filters panel.
lActivate Policy: Set flag to make the selected policy active.

l

Add Policy: Create a new policy.

lApply Label to Policy: Associate a policy and a label.

l

Deactivate Policy: Clear flag to make the selected policy inactive.

lDelete Policy: Delete a policy.

lExport Policy: Export a policy from MobileIron Core.

l

Import Policy: Import a policy into MobileIron Core.

lModify Policy: Change an attribute of an existing policy.

lModify Policy Priorities:lModify Policy Priority: Change the priority for an existing policy.

lRemove Label From Policy: End the association between a policy and a label.

Compliance Action events
To monitor compliance actions, select one or more of the logged compliance actions in the Filters panell

Add Compliance Action: Create a set of actions to be taken on devices that violate policies.

lDelete Compliance Action: Remove a set of actions to be taken on devices that violate policies.

llModify Compliance Action: Make changes to a set of actions to be taken on devices that violate
policies.
Modify Compliance Check Preferences: Make changes to compliance preferences.

Configuration eventsl

Add Configuration: Create a new configuration.

lApply Label To Configuration: Associate a configuration with a label.

l

Export Configuration: Export a configuration from MobileIron Core.

l

Import Configuration: Import a configuration to MobileIron Core.

lModify Configuration: Change the settings in a configuration.

lRemove Configuration: Delete a configuration.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 332

Admin eventslRemove Label From Configuration: End the association between a configuration and a label.

lRemove Labels From Configuration: End the association between a configuration and multiple labels.

Admin eventsl

Add Space: Define a new delegated administration space.

lAdmin Portal Sign In: Start an Admin Portal session.

lAdmin Portal Sign Out: End an Admin Portal session.

lAssign Space Admin: Specify an administrator for a space.

lChange Space Priority: Set a different priority for a space.

lDelete Space Admin: Remove space admin access from the user.

lModify Space: Make changes to rules that define a space.

lRemove Admin From Space: Remove the admin user from the space.

lRemove Space: Delete all rules that define a space and reallocate its devices.

lUpdate Device Space: Recalculate space rules to determine device membership.

lUser Locked Out: Prevent administrator from further attempts at signing in after limit on authentication
failures is exceeded.

User eventsl

Add User: Define a new MobileIron Core user.

lDelete User: Remove a MobileIron Core user.

l

Link to LDAP User: Associate a local MobileIron Core user with an LDAP user.

lModify User: Make changes to a user’s attributes.

lModify User Role: Make changes to the roles assigned to a user.

lRe-sync with LDAP: Synchronize LDAP data.

lRemove User Attribute: Remove an attribute from a user.

l

Renew Google Apps password: Manually regenerate a user’s Google Apps password.

lRequire Password Change: Force a local user to change their MobileIron Core password.

lSend Invitation: Invite a user to register with MobileIron Core.

l

Set User Attribute: Set an attribute for a user.

lUser Portal Sign In: Start User Portal session.

lUser Portal Sign Out: End User Portal session.

LDAP eventsl

Add LDAP: Integrate an LDAP server with MobileIron Core.

lDelete Admin LDAP Entity: Delete an Admin LDAP entity that has no roles.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 333

Other eventslDelete LDAP: End the integration between an LDAP server and MobileIron Core.

lDelete LDAP Entity: Delete a user LDAP entity that has no roles.

lModify LDAP: Make changes to the record for an integrated LDAP server.

lModify LDAP Preferences: Make changes to the preferences for integrated LDAP servers.

lUpload LDAP Certificate: Add an LDAP certificate to MobileIron Core.

Other eventslApplication Started: Start Core services.

l

Application Stopped: Stop Core services.

lComplete feature usage collection: Complete the current run of feature usage collection.

l

Feature usage collection error: Encountered error during collection.

l

Feature usage collection scheduling error: Encountered scheduling error during collection.

lInitiate feature usage collection: Start feature usage collection.

lPurge feature usage data: Purge collected feature usage information.

lPreference Config Changes: Make changes to the settings under Settings > System Settings in the
Admin Portal.

lRetrieve feature usage data: Start collecting feature usage data.

lRetrieve feature usage data file list: Start retrieval of the usage data file list.

Label eventsl

Add Label: Define a new label for MobileIron Core.

lDelete Label: Remove a label from MobileIron Core.

lModify Label: Make changes to a label.

l

Save As Label: Copy a label to a new label.

Sentry eventsl

Add Integrated Sentry: Establish a relationship between MobileIron Core and an Integrated Sentry.

l

Add Standalone Sentry: Establish a relationship between MobileIron Core and a Standalone Sentry.

lDelete Integrated Sentry: End the relationship between MobileIron Core and an Integrated Sentry.

lDelete Standalone Sentry: End the relationship between MobileIron Core and a Standalone Sentry.

lDisable Integrated Sentry: Suspend the interaction between MobileIron Core and an Integrated Sentry.

lDisable Standalone Sentry: Suspend the interaction between MobileIron Core and a Standalone Sentry.

l

Edit Integrated Sentry: Make changes to the settings for an Integrated Sentry.

l

Edit Standalone Sentry: Make changes to the settings for a Standalone Sentry.

lEnable Integrated Sentry: Start the interaction between MobileIron Core and an Integrated Sentry.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 334

Custom attributes eventslEnable Standalone Sentry: Start the interaction between MobileIron Core and a Standalone Sentry.

lManage Certificate: Upload a certificate for Standalone Sentry.

lModify Sentry Preferences: Make changes to the settings under Services > Sentry.

lRegenerate Key: Generate a new control key for attachment encryption.

lRegenerate Attachment Encryption Control Key:lResync Integrated Sentry With Exchange: Force Integrated Sentry to synchronize mailbox data with
the Exchange server.

Custom attributes eventsl

Add Custom Attribute: Create a new customer attribute definition.

lModify Custom Attribute: Modify a customer attribute definition.

Compliance policy eventsl

Add Compliance Policy Group: Add a new compliance policy group.

l

Add Compliance Policy Rule: Add a new compliance policy rule.

l

Apply Label to Compliance Policy Group: Apply one or more labels to a compliance policy group.

lModify Compliance Policy Group: Modify a compliance policy group.

lModify Compliance Policy Rule: Modify a compliance policy rule.

lRemove Compliance Policy Group: Delete a compliance policy group.

lRemove Compliance Policy Rule: Delete a compliance policy rule.

lRemove Label From Compliance Policy Group: Delete one or more labels from a compliance policy
group.

Audit Logs use cases
A wealth of information is available to you in the Audit Logs. Querying the events allows you to monitor your
MobileIron system and resolve problems. You can run queries for one type of event, several types of events, or as
many as you like. All you need to do is check the events you want to track, and then specify a time frame. The
default time frame is the time between the last time the logs were purged and the current time.
For example:lll

Use the certificate events to troubleshoot certificate issues. For example, query for certificates that have
expired or have been revoked.
Use the MDM events to troubleshoot MDM activity on devices. For example, query whether an MDM
profile was removed, or whether a managed app was installed.
Use the AppTunnel events to determine whether an administrator manually blocked or allowed AppTunnel
on a device.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 335

Personal information is wiped from devicesll

Use the device events to determine activity taken on devices, such as unlocking the device, or deleting
retired devices.
Use the app events to determine whether an administrator has changed the app control rules in MobileIron
Core. A change to app control rules can result in Core taking, or not taking, compliance actions such as
blocking email on devices.

This section presents several scenarios and how you can use the audit logs to resolve the problems they present.

Personal information is wiped from devices
Suppose several of your users report that the personal information on their phones was wiped. How can you figureout how this happened? Using the audit logs, you can check the wipe actions recorded in the logs, and discover:l

who issued the Wipe commandslwhen they occurredlhow many users are impacted

To resolve this problem:
1. In the Admin Portal, select Logs.
2. Select Audit Logs.
3. Click Reset at the bottom of the Filters panel to ensure that the previous search values are cleared.
4. In the Filters panel, specify a time interval that you suspect the device wipe(s) happened.
5. Open the Device events list.

6. Select Wipe.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 336

Users are prompted for email passwords when not necessary

7. Click Search.
8. View the results of the search to determine:lwhen the devices were wipedlhow many devices were wipedlwhich admin user issued the wipe commands

Users are prompted for email passwords when not necessary
Suppose you set up your Exchange policy to not require your users to provide a password when they log in toemail, but your users are still prompted for a password each time they access email.
To check for any changes to the Exchange policy that could cause this problem:
1. In the Admin Portal, select Logs.
2. Select Audit Logs.
3. Click Reset at the bottom of the Filters panel to ensure that the previous search values are cleared.
4. In the Filters panel, specify a time interval that you suspect changes to the Exchange policy happened.
5. Open the Configuration events list.

6. Select Modify Configuration.
7. Click Search.
8. View the results of the search to determine:lwhat changes were made recently to the Exchange policylwhich admin user made the changes

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 337

Users are prompted to create passwords

Users are prompted to create passwords
Suppose your users are prompted to create device passwords when that is not how you set up your MobileIron
Core. You can use the audit logs to discover if this requirement is set and when this change occurred.
To check for changes to mandatory passwords:
1. In the Admin Portal, select Logs.
2. Select Audit Logs.
3. Click Reset at the bottom of the Filters panel to ensure that the previous search values are cleared.
4. In the Filters panel, specify a time interval that you suspect changes to the security policy happened.
5. Open the Policy events list.

6. Select Modify Policy.
7. Click Search.
8. View the results of the search to determine:lwhat changes, if any, were made recently to the Security policylwhich admin user made the changes

Devices have lost their managed apps
If your users report missing managed apps, the cause is usually deleted labels.
NOTE: For Android devices 11 through the latest version as supported by MobileIron, the administrator
does not have the ability to manage app installs on the personal side.
To determine whether labels were deleted from your MobileIron Core:
1. In the Admin Portal, select Logs.
2. Select Audit Logs.
3. Click Reset at the bottom of the Filters panel to ensure that the previous search values are cleared.
4. In the Filters panel, specify a time interval that you suspect the labels were deleted.
5. Open the Label events list.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 338

Viewing Errors

6. Select Delete Label.
7. Click Search.
8. View the results of the search to determine:lwhat labels, if any, were deleted recentlylwhich admin user made the changes

Viewing Errors
Errors result in the display of a View Error link in the Error column. Error details are not available for Windows
devices.

Certificate Management
The Logs > Certificate Management tab displays certificate-related log entries. You can:lview certificate log entrieslsearch certificate log entrieslremove selected certificates from the log

lrevoke selected certificates from the loglre-enroll selected certificates from the log

NOTE: Actions on certificates are logged in Logs > Audit Logsin the Certificate category.

How to search for certificate entries
When viewing the Certificate Management page, you can search for entries based on:lexpiration date

l

user

l

setting

Procedure
To search the Certificate Management page:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 339

How to search for certificate entries

1. In the Admin Portal, go to Logs > Certificate Management.
2. Specify one or more of the criteria in the following steps to describe the certificates you want to display.
3. (Optional) To specify a time range within which the certificates expired:ll

In the Expiration Date Range field, click the calendar next to the field, and then click on a date. Thisdate is the earliest day the certificates you are searching for expired.
In the To field click the calendar next to the field, and then click on a date. This date is the latest day
the certificates you are searching for expired.
NOTE: An error message displays if you select a day in the Expiration Date Range field earlier
than the day specified in the To field. For example you receive an error message ifyou:l

An error message displays if you select a day in the Expiration Date Range field earlier than the day
specified in the To field. For example you receive an error message if you:lselect November 13th in the Expired Date Range field (earliest time a certificate expired).

lselect October 15th in the To field (latest time a certificate expired).
NOTE: The search can return fewer than all the certificates that expired during the specified
time period if you specify other criteria in Step 4.

4. (Optional) In Search by User/Setting Name, enter a username or a setting name.
Certificate
Enrollment

Displays the name of the Certificate Enrollment setting.

Setting

Displays the configuration using the Certificate Enrollment.
The configuration displays only for a non-cached Certificate Enrollment.
Configuration names are not available for certificates created in VSP Version
6.0 or earlier.
For a cached Certificate Enrollment certificate, you will always see - in the
Setting Name, regardless of whether it was created prior to version 7.0 or
created in version 7.0.

5. Click Search.
Search results are displayed in a table with the following columns:
Item

Description

User

The user name of the device user identified by the identity certificate.

Phone Number

The phone number associated with the device user identified by the identity
certificate.

Email

The email address associated with the device user identified by the identity
certificate.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 340

How to remove a certificate

Item

Description

Certificate Enrollment
Name

The name of the certificate enrollment (such as SCEP, Local, Entrust) used
to issue the identity certificate.

Setting Name

The name of the setting that uses the certificate enrollment, such as an
Exchange or Web@Work setting.

Cert Type

Indicates whether the certificate is a user-provided certificate enrollment.
Otherwise, this field is left blank.

Expiration Date

The date by which the identity certificate will no longer be valid.

Content

Click the View link to see the contents of the identity certificate itself.

How to remove a certificate
This action removes the certificate from device, but does not remove the SCEP setting.
To remove a certificate:
1. Go to Logs > Certificate Management.
2. Select the certificate that you want to remove.
3. Click Actions > Remove.

How to revoke a certificate
You can revoke certificates created using a Local Certificate Authority, OpenTrust, Entrust API Version 9, andSymantec Web Service PKI. Revoking a certificate adds the certificate to the CRL (Certificate Revocation List).
When a device authenticates with MobileIron Core, the system first checks the CRL to verify that the certificate is
not on the list. If the certificate is on the list, authentication fails.
To revoke a certificate:
1. Go to Logs > Certificate Management.
2. Select the certificate that you want to revoke.
3. Click Actions > Revoke.
The certificate will be added immediately to the CRL so the next time the device attempts to authenticate,authentication will fail.

How to re-enroll a SCEP certificate
To renew a certificate:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 341

Service Diagnostic tests

1. Go to Logs & Events > Certificate Management.
2. Select the certificate that you want to revoke.
3. Click Actions > Re-enroll.

Service Diagnostic tests
The Service Diagnostic screen (Services > Overview) in the Admin Portal provides a health check for several
services. The diagnostic tests determine whether your Core instance can connect to these services. An error
indicates that you cannot reach the service.
The services checked are:

TABLE 78. SERVICE DIAGNOSTIC TESTS DESCRIPTIONS
Service

Test

AFW

Checks to see if:• Authentication server https://accounts.google.com/o/oauth2/token is reachable.
• API server https://www.googleapis.com/androidenterprise/v1/enterprises isreachable.

APNS

Checks to see if:• MDM-APNS service is reachable.
• ENTERPRISE-APNS - No Enterprise APNS certificate configured.
• MDM-APNS - feedback service (tccentos122.auto.mobileiron.com:2196) is notreachable.

APPCONFIG_COMMUNITY_REPO

Checks to see if the AppConfig Community Repository server is reachable:

APP_GATEWAY

Checks to see if App Gateway server is reachable:

https://d2e3kgnhdeg083.cloudfront.net/com.example.OneTouchConfiguration/current/
appconfig.xml

https://gwtest.mobileiron.com/gateway/gatewayServices/status.html
BYPASS

Checks the connection between your Core instance and the Apple activation lockbypass server

CERTIFICATEENROLLMENT

Checks to see if:• Certificate Enrollment : System - iOS Enrollment SCEP is reachable.
• Certificate Enrollment : System - iOS Enterprise AppStore SCEP is reachable.
• Certificate Enrollment : System - Windows Phone Enrollment SCEP is reachable.

CONFIGURATIONS

Tests the connection to the Certificate Enrollment server from your Core instance.

CONNECTOR

Two tests are run:
• One test checks whether Enterprise Connector is enabled (Services > Connector)• If Enterprise Connector is enabled, the other test sends an HTTP Post request from

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 342

Running Service Diagnostic tests

TABLE 78. SERVICE DIAGNOSTIC TESTS DESCRIPTIONS (CONT.)
ServiceTestyour Core instance to each Connector configured, checking whether the Connector
can communicate with your Core instance

DEP

Sends a sample GET request to test the connection between your Core instance andthe MDM server using Device Enrollment.

FCM

Checks whether Google Firebase Cloud Messaging (FCM) is reachable from your Coreinstance.

HEALTH_ATTESTATION_SERVICE

Checks if the Health Attestation Service serveris reachable.

LDAP

Two tests are run:• Checks LDAP from Core to verify the communication channel• For each Connector configured, checks the communication channel for the pathfrom the LDAP server to Core, then Core to Connector, and finally from Connector
to the LDAP server

MAPQUEST

Checks if the MapQuest Service server is reachable:

https://has.spserv.microsoft.com/HealthAttestation/ValidateHealthCertificate/v1

https://api.mqcdn.com/sdk/mapquest-js/v1.0.0/mapquest.js
PROXY

No proxy is configured.

SENTRY

Checks the connection between your Core instance and the Sentry used (either
integrated standalone). As part of this test, the connection between ActiveSync serverand Sentry is checked also.

SENTRY_WITH_
ACTIVESYNC

No Integrated Sentry server(s) configured.

SERVICES

Checks whether the IP addresses reserved for FCM are reachable.

VPP

Sends a GET request to verify the connection between Core and the Apple License
server.

No Standalone Sentry server(s) configured.

Running Service Diagnostic tests
To run the Service Diagnostic tests:
1. Go to Services > Overview.
2. To test one or all of the services:l

Click Verify All to test the listed serviceslClick Verify next to a specific service to test that service

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 343

17Language Support
This section addresses the language settings for MobileIron client apps (Mobile@Work.)lTranslated versions of MobileIron client appslSelecting languages for MobileIron Core messageslSetting the system default languagelChanging language selection from the Admin Portal

Translated versions of MobileIron client apps
MobileIron client apps (Mobile@Work or Apps@Work on Windows) are localized to a number of languages. A
device’s locale setting (or selected language) determines the language that the MobileIron client app appears in on
the device. If the device’s locale is not supported, the app appears in English (United States) by default.
Once the device communicates a language change to MobileIron Core, MobileIron Core sends messages to thedevice in the selected language, assuming the language is supported and selected in Core’s Settings > System
Settings > General > Language.
Please refer to the Core release notes for each release to see which languages and locales are supported.

Selecting languages for MobileIron Core messages
You can enable or disable languages for the messages sent from MobileIron Core to devices. For example, if you
have only Japanese-speaking users, you might want to remove the other message templates from the Admin
Portal.
To enable or disable languages:
1. Log into the System Manager.
2. Go to Settings > System Settings > General > Language.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 344

Setting the system default language

3. Move the languages you want to support from Disabled Languages to Enabled Languages.
4. Click Save.

Setting the system default language
The System Default Language setting under Settings > System Settings > General > Language determines
what language to use if the locale of the device cannot be determined, or the corresponding language is notsupported. It also determines the default language for the self-support user portal (SSP) pages. The languages
available for this setting are derived from the languages in the Enabled Languages list.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 345

Changing language selection from the Admin Portal

FIGURE 16. SETTING THE SYSTEM DEFAULT LANGUAGE FOR MOBILEIRON CORE.

Changing language selection from the Admin Portal
Administrators can manually change the language selection for devices that do not report their locale. In this case,language selection applies only to the messages sent from MobileIron Core (e.g., Event Center alerts). If thedevice later reports a different locale, then MobileIron Core honors the reported locale.
To change the language selection for a specific device:
1. In the Admin Portal, go to Devices & Users > Devices.
2. Select the check box next to the device.
3. Click Actions > Change Language.
The Change Language dialog appears.
4. From the Set Language drop-down, select the preferred language.
5. Click Change Language.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 346

18
Self-service User Portal
This section addresses device registration and its related components.
lDevice management with the user portallAssigning user portal device management roleslRequiring user portal password changelConfiguring help desk contact informationl

User portal information for your users

User portal overview
The MobileIron Core Mobile@Work self-service user portal (SSP) is a platform whereby device users can manage
their own devices. This section addresses the settings an administrator can create and maintain a self-service user
portal.
l

Benefits of the user portallImpacts of using the user portallUser portal authentication optionslAbout registering devices in the user portallAbout changing device ownership in the user portall

Associating a certificate with a user-provided certificate enrollment setting

The user portal allows your users to:lAccess MobileIron device management actions such as wipe and locklView their device audit/history logslView details of their registered deviceslRegister devices, including QR code and SMS/email optionslReset the user PINlReset a PIN passwordlChange device ownership from company-owned to user-owned or the reverselUpload, as well as view, replace, and delete user-provided certificates
These certificates are used, for example, for S/MIME or for authenticating to internal servers.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 347

Benefits of the user portal

One of your decisions when you distribute MobileIron Core management is whether or not to enable your users tomanage one or more device actions such as locking or unlocking a device. Your users access the actions you
assign them through the user portal.
To enable users to manage their devices, you assign them roles to perform any or all of the following actions:lWipe their devicelLock their devicelLocate their devicelRetire their devicelRegister their devicelChange device ownershiplReset PIN Password (for Windows 8.1 Phone and Windows Mobile 10 devices)

The Device Registration role replaces the MyPhone@Work Registration role. The MyPhone@Work
Registration role is removed. The old user portal, MyPhone@Work, was available only through Core 8.0.1.

Benefits of the user portal
Giving users the ability to perform device management tasks:lDistributes mobile device managementl

Gives your users more control of their deviceslAdds efficiency to device registration by saving administrators’ time as well as wait time that device users
might experience

Impacts of using the user portal
When you enable users to manage their own devices, you need to:lDefine which users have access to which device management actionslProvide your users with the information they need to use the user portallConsider how changing device ownership from company-owned to employee-owned or vice-versa may
impact:o

The policies and configurations that are applied to the device.

o

The apps that are available through Apps@Work.

oiBooks that are available on the device.
Devices are impacted when they check-in with MobileIron depending on the labels to which companyowned or employee-owned devices are applied.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 348

User portal authentication options

User portal authentication options
You can allow device users to authenticate to the user portal with:l

A user name and password
These are the credentials a device user uses to register a device with MobileIron Core.

l

An identity certificate from a smart card
This authentication method is supported only on desktop computers. It is not supported with:o

Mobile devicesoFirefox

You can allow one or both of these authentication mechanisms. You make your selection in the MobileIron Core
System Manager. For information about how to configure the user portal authentication options, see “Advanced:
Portal authentication” in the MobileIron Core System Manager Guide.

About registering devices in the user portal
To allow device users to register devices in the user portal, you must assign those users the Device Registrationrole in the Admin Portal in Devices & Users > Users.

Configuring the Per-User Device limit
You can configure a global per-user device limit, and optionally, custom device limits for specific LDAP Groups.
Users will be limited to register only the number of devices specified in Settings > System Settings > Users& Devices > Registration > Per-User Device Limit.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 349

Registration PIN

Procedure
To configure standard device limits and LDAP group-specific device limits, follow these steps:
1. In the first drop-down menu, select a default per-user device limit of 1-50, or none.
2. If you would like to create different per-user device limits for selected LDAP groups, click Add+. The Add
LDAP Group Specific Device Limit menu opens.
3. From the Select LDAP Server drop-down menu, select the LDAP server that contains the LDAP group you
want to include.
4. From the Select LDAP Group drop-down menu, select the Group to include.
5. From the Select Device Limit Per User drop-down menu, select the per-user device limit for that LDAP group.
6. Click Add to save your changes.
7. The LDAP group you selected appears in the LDAP group specific device limit table, where you can copy, edit,
or delete it.

Registration PIN
Users who can register devices can also request and receive device registration PINs. To allow users to request aregistration PIN, PIN-based registration must be selected in Settings > System Settings > Users & Devices >Device Registration. Any option that includes Registration PIN will enable device users to obtain a PIN in theuser portal.
Note the following about registration PIN:l

Even though a PIN is generated, device users will not be prompted to enter a PIN if the device platform
does not require PIN for registration.

About changing device ownership in the user portal
To allow device users to change device ownership through the user portal, you must assign those users the
Change Device Ownership role in the Admin Portal in Devices & Users > Users.
Users cannot assign ownership of a device during device registration in the user portal. Device ownership is
automatically set to company-owned. Once users have registered their devices through the user portal, they canchange the ownership of the device from company-owned to user-owned or the reverse.

Associating a certificate with a user-provided certificate enrollment setting
When the user uploads a certificate, the user chooses a configuration to associate with the certificate. The
configuration refers to a user-provided certificate enrollment setting that you configured. When you configure auser-provided certificate enrollment setting, you specify a display name. The user portal presents the display namein its list of configurations for the user to choose.
For example, you might create a user-provided certificate enrollment setting for S/MIME signing, another for
S/MIME encryption, and another for server authentication. Each setting has a display name:MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 350

About uploading certificates in the user portall

S/MIME signingl

S/MIME encryptionlAuthentication

When the user uploads a certificate, they see these display names as configurations, and they choose the one forthe certificate. The user can upload the same certificate or different certificates for each configuration.
If you have not created at least one user-provided certificate enrollment setting, the user portal disables the option
for the user to upload a certificate.
See also:lCertificate Enrollment settings on page 227.

About uploading certificates in the user portal
On a desktop computer, device users can upload their own certificates in the user portal. They can use thesecertificates for different purposes, such as:l

S/MIME signingl

S/MIME encryptionlAuthenticating to servers, such as internal servers that support apps.

From Core release 10.8.0.0 through the latest release supported by MobileIron, users can upload files with multiple
aliases and friendly names.
NOTE: This capability is available in the user portal on desktop computers, but not on mobile devices.

Device management with the user portal
This section addresses the settings your users need to use the user portal.
l

Logging in to the user portal with user name and passwordlLogging in to the user portal on a desktop computer with a certificatelWhat users see after they loginlUploading certificates in the user portal on a desktop computerlViewing, replacing, and deleting certificates in the user portallWhen a user-provided certificate is deleted

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 351

Assigning user portal device management roles

Assigning user portal device management roles
The MobileIron Core user portal provides several device management options for your users. You give themaccess to these management tasks by assigning them roles in the Admin Portal.
Procedure
1. In Admin Portal, go to Devices & Users.
2. Select the users receiving device management privileges.
3. From Actions, select Assign Roles.
4. Check User Portal.
5. Check one or more roles to assign the corresponding management actions to the selected users.
6. User roles include:lWipe DevicelLock DevicelUnlock Device (See following Note)l

Locate DevicelRetire DevicelRegister DevicelChange Device OwnershiplReset PINlReset Secure Apps Passcodel

Use Google Device Account (for Android enterprise devices only)lEnable Auth Only Role

Note The Following:l

The unlock feature works with Managed Device with Work Profile (COPE) mode (Android versions 810.) Upon upgrade to Android 11, administrators do not have the ability to unlock the device.

l

Unlock devices does not work for Work Profile devices starting from Android 7 and higher.

7. Click Save.

Customizing the self-service user portal
The self-service user portal can easily be customized to reflect your company branding, messaging, and layout.
The following elements can be customized:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 352

Customizing the self-service user portallCompany namelCompany logolLogin page messagel

Background colorlCascading stylesheet (CSS)

Procedure
1. From the Admin portal, navigate to Settings > System Settings > General > Self-Service Portal. The
Self-Service Portal page opens.

2. Company Name: Enter a customized company name.
3. Company Logo: Upload a customized company logo. Images can be JPG or PNG format, and must notexceed 250 by 50 pixels.
4. Login Page Message: Modify or replace the existing message that displays on the Self-Service Portal's
log in page, up to 1,000 characters.
5. Background color:a. Check Enable customized background color and either:lType in a HEX color value, orlOpen the Background color menu.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 353

Customizing the self-service user portal

b. Select or enter a value for the background color.
NOTE: Based on your choice of background color, Core will automatically determine thehighest-contrast text color (black or white) for that color.
c. Click OK to exit the menu.
6. CSS: By default, your message is formatted using the default cascading style sheet (CSS) supplied by
MobileIron. You can import and edit a custom CSS file, modify the default CSS file, or leave the default.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 354

MobileIron user portal default stylesheet

Options are:l

Import a CSS file: Click to browse to a valid CSS file on your local drive. Select the file and click
Open. The CSS file opens in the edit window. You will be asked to confirm the change.
NOTE: Invalid CSS files will not be imported, and an error message will display.

l

Reset: Click to reset the style sheet to the default values. You will be asked to confirm the reset.

lPreview: Click to see a preview of your message as users will see it.

l

Download: Downloads a copy of the default CSS file to your browser's Download folder for you tokeep and modify. Alternately, you can copy and paste the default CSS file into the CSS text window.
See

7. When all of your changes are made, click Save (at the top of the page) to keep your options. A confirmation
message displays.
8. Verify the new custom portal page on Core by substituting your Core hostname and SSP user name:https://<hostname>/mifs/<user>

MobileIron user portal default stylesheet
You can copy-and-paste the following default stylesheet into the CSS text window and modify it for your needs.
.backgroundColor {background:#33ccff!important;}.foregroundColor > p,label,div,.user-accessibility-color * {color: #000066!important;}.white-bg,.light-gray {background:#33ccff!important;}.pbl,.big-font,.x-form-display-field-default {MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 355

MobileIron user portal default stylesheet

color: #000066!important;}.x-menu-default,.x-menu-body-default,.link-menu-item-blue span{
Background:#e6f9ff!important;}.btn-new-color,.x-btn-accessblue-medium {background:#000066!important}.link-menu-item-blue span {line-height: 16px;
font-size: 14px;
font-family: Helvetica,Arial,sans-serif;
margin-left: 5px;
color: #2d70b5;}.x-menu-item-text-default {
font: normal 11px helvetica,arial,sans-serif;
line-height: 21px;
padding-top: 1px;
color: #222;
cursor: pointer;}.x-btn-inner-accesswhite-medium {
font: normal 12px/24px arial,verdana,sans-serif;
color: #2d70b5;
padding: 0 10px;
max-width: 100%;}.x-btn-inner {display: inline-block;vertical-align: middle;
overflow: hidden;
text-overflow: ellipsis;}.x-autocontainer-innerCt {display: table-cell;height: 100%;
vertical-align: top;}
.x-autocontainer-outerCt {display: table;}.x-grid-empty {padding: 10px;
color: gray;background-color: white;
font: normal 12px helvetica,arial,sans-serif;}.x-grid-header-ct {background-color: #edf0f2;}.x-grid-header-ct {border: 1px solid #d0d0d0;
border-bottom-color: #a0a7ad;
background-color: #a0a7ad;}.x-column-header-inner {padding: 8px 8px 6px 8px;}
.x-leaf-column-header {height: 100%;}.x-column-header-inner {white-space: nowrap;
position: relative;
overflow: hidden;

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 356

Configuring an end user Terms of Service agreement}.x-column-header-text {background-repeat: no-repeat;
display: block;overflow: hidden;
text-overflow: ellipsis;
white-space: nowrap;}.x-grid-item-container {min-height: 1px;
position: relative;}.x-panel-default {border-color: #d0d0d0;
padding: 0;}

Configuring an end user Terms of Service agreement
Device users must sign a Terms of Service (ToS) agreement to use Mobile@Work. You can create custom ToS
agreements to align with your user languages and countries. Each time a user accepts an agreement, an email isgenerated to the configured email address for that agreement.
Procedure
1. From the Admin portal, navigate to Settings >System Settings > Users & Devices > Registration
page > End User Terms of Service.
2. Click Add+. The Add End User Terms of Service agreement window opens.

3. In the Language drop-down, select the language for the agreement.
4. In the Country / Region drop-down, select the primary country or region.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 357

Requiring user portal password change

5. In the Type drop-down, select the type of agreement:a. System - Select for iOS, macOS and Android devices.
b. AAD enrollment - Select for Windows devices.
6. In the Agreement Content text box, enter your agreement text. The text field permits basic formatting.
7. In the EMail ID field, enter an email address to receive confirmation emails when the users accept theagreement.
8. Click Save. Your new agreement appears in the End User Terms of Service table.

Requiring user portal password change
You can require local users to change their user portal password the next time the device checks in with MobileIron
Core. This feature is not available for LDAP users.
To require a local user to change their user portal password:
1. In Admin Portal, go to Devices & Users.
2. Click Users.
3. Select one or more local users you want to change their user portal passwords the next time they check inwith Core.
4. Click Actions.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 358

Limiting devices per user by LDAP group membership

5. Select Require Password Change.
Core prompts you to confirm the requirement.
6. Click Yes to require the selected users to create a new password at the next check in.

Limiting devices per user by LDAP group membership
You can limit the number of allowed devices per user, using LDAP group membership as the conditional limiter.
You can:lSelect a global device limit of 0-50 devices per userl

Add LDAP user groups to the LDAP group-specific device limit tablel

Edit LDAP user groupslDelete LDAP user groups from the device limit tablel

Set the device limit precedence setting: you can choose whether the standard device limit takes
precedence over LDAP membership-specific device limits, or LDAP group-specific device limits takeprecedence over the standard device limit (for all applicable users)
For example, you could set a global device limit of four devices, but restrict members of specific LDAP
groups to one or two devices.

Before you begin
You must have previously configured an LDAP server to support LDAP groups before you can set per-user device
limits.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 359

Limiting devices per user by LDAP group membership

Procedure
1. From the Admin Portal, go to Settings > System Settings > Users & Devices > Registration page
2. In the Per-User Device Limit section, enter the following information:

3. Per-User Device Limit (1-50, or none): Set the default number of devices each user can register with
Core. This is the "standard" device limit, that by default takes precedence over LDAP membershipspecific device limits.You can change this priority by selecting a device limit precedence setting (step 5).
4. LDAP group specific device limit: This setting allows you to create LDAP group-specific device limits
that vary from the default device limit you set as the per-user device limit.
a. From below the LDAP group table, click Add+. The Add LDAP Group Specific Device Limit dialog
opens.

b. Select a configurable LDAP server from the Select LDAP Server drop-down.
c. Select a group from the LDAP Group drop-down.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 360

Editing or Deleting an LDAP group-specific device limit

d. Select the device limit (1-50) from the Select device limit field.
e. Click Add.
5. Select a device limit precedence setting:a. Standard device limit takes precedence over LDAP membership-specific device limit for all applicableusers.
b. LDAP group-specific device limit takes precedence over standard device limit for all applicable users.

Editing or Deleting an LDAP group-specific device limit
You can modify or delete your LDAP group-specific device limits from the LDAP group-specific device limit table.
Procedure
1. Locate the LDAP group that you want to edit or delete in the LDAP group-specific device limit table.

2. Click Edit to re-open the Add LDAP Group Specific Device Limit dialog.
3. Click Delete to delete the LDAP group-specific device limit.

Configuring help desk contact information
MobileIron Core administrators with Manage settings and services permission can configure the help desk
contact information to display in the self-service user portal.
Procedure
1. In the MobileIron Core Admin Portal, go to Settings > General > Helpdesk.
2. Enter the following information:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 361

User portal information for your users

Item

Description

Name

Enter a name for the configuration.

Description

Enter a brief description for the configuration.
Maximum characters allowed is 100.

Contact(s)Enter one or more phone numbers. Valid number strings include:l

Up to 24 digits for numbers beginning with the + symbol.

l

Up to 22 digits for numbers without the + symbol.

If you are entering multiple phone numbers, enter a comma-separated list.
Email(s)Enter one or more email addresses.
If you are entering multiple email addresses, enter a comma-separated list.

NOTE: Either a phone number or an email address is required.
Related topics
Viewing the help desk contact information.

User portal information for your users
This section presents the information that your users need to use the user portal.
The user portal displays:l

Icons for each device management action the user is allowed to perform.

lUser and device information, including:odevice type (iPod touch, 4th gen in the example)ostatus (Active, for example)olast check-in (example, 2 hours ago)ophone numberoOS and version (to 3 digits, iOS 7.1.1, for example)ocarrier (for example, AT&T)

o

IMEI value, if applicableomanufacturerodate the device was registered with MobileIronl

Accounts settings and certificates uploaded by the device user.

l

Helpdesk contact information configured by the MobileIron Core administrator.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 362

Logging in to the user portal with user name and password

FIGURE 17. USER PORTAL SHOWING USER'S DEVICE INFORMATION

Logging in to the user portal with user name and password
Device users can log in to the user portal to register and manage their devices.
Procedure
1. Go to https://<MobileIron server>, where <MobileIron server> is the address of your MobileIron server.
Contact your administrator if you do not have this address.
2. If you are not logged in, provide your user name and password, when prompted, and then select Sign In
with Password.
The user portal displays on your device. You can:lclick the icon for one of the available device management actions available to you.

lview your device information.

Logging in to the user portal on a desktop computer with a certificate
If set up by the MobileIron Core administrator, device users can log in to the user portal on a desktop computer
using an identity certificate on a smart card.
Procedure
1. Attach your smart card reader with your smart card to a USB port on the desktop computer.
If your computer has a built-in smart card reader, insert your smart card.
2. Go to https://<MobileIron server>, where <MobileIron server> is the address of your MobileIron server.
Contact your administrator if you do not have this address.
3. If you are not logged in, select Sign In with Certificate.
A prompt appears to select your certificate
4. Select the certificate from the smart card.
5. If prompted, enter the password of the private key of the identity certificate on your smart card.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 363

What users see after they login

The user portal displays. You can:l

Select the icon for one of the available device management actions available to you.

l

View your device information.

What users see after they login
Depending on the user portal role enabled, device users may have a different view of the user portal.

Welcome menu
The Welcome menu is in the top-right of the user portal. From this menu, you can perform the following actions:llView Activity - See a list of all device activity. See Viewing device history logs from the self-service user
portal.
Helpdesk - Configure the help desk contact information to display in the user portal. See Configuring help
desk contact information.

lSettings - View user portal settings.

lSign Out - Sign out of the self-service user portal.

If Register Device role is enabled
If the Register Device role is enabled, device users will be able to send an invitation from the user portal to register
their device.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 364

If Register Device role is enabled

FIGURE 18. SEND INVITATION TO REGISTER

After the invitation is sent, the device status is seen as Pending.

FIGURE 19. REGISTRATION PENDING FOR DEVICE

Device users can complete the registration on their mobile device at https://<Core_Server_FQDN>/go.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 365

Registration instructions

FIGURE 20. COMPLETE DEVICE REGISTRATION

After registration is completed on the mobile device, the status for the device is changed to Active.

FIGURE 21. ACTIVE DEVICE STATUS

Registration instructions
For Windows devices, users can follow the instructions provided in the user portal and in the email sent to thedevice user to register the device with MobileIron Core.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 366

If PIN-based registration is enabled

If PIN-based registration is enabled
If PIN-based registration is enabled, device users will see Request Registration PIN. Clicking on Request
Registration PIN allows device users to send an invitation for registration as well as generate a PIN.

FIGURE 22. REGISTRATION WITH PIN

Device users can complete the registration on their mobile device at https://<Core_Server_FQDN>/go. They will
have to enter the PIN if prompted.

If QR-code registration is enabled
If Quick Response (QR) code-based registration is enabled, device users will see Generate QR Code. Clicking on
Generate QR Code allows device users to complete the device registration process.
When users log into the Self-service portal (SSP) home page, they can click one of two registration buttons:lSend Invitation – Receive registration information by SMS message and email.

lGenerate QR Code – Scan to be redirected to the appropriate registration page.

Users scan the QR code and are redirected to a browser to enter their pin or password:

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 367

If Change Device Ownership role is enabledl

iOS users: Once authenticated, iReg profile installation starts, completing device registration.

lAndroid users: Once authenticated, the user is redirected to Google Play to download the registration app.
Users open the app to complete device registration.

FIGURE 23. REGISTRATION WITH QR CODE

If Change Device Ownership role is enabled
If the Change Device Ownership role is enabled, device users will see the option to change the device
ownership.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 368

Uploading certificates in the user portal on a desktop computer

FIGURE 24. CHANGE DEVICE OWNERSHIP OPTION

Clicking on Change Ownership allows the user to change the device ownership.

FIGURE 25. CHANGE DEVICE OWNERSHIP SETTINGS

Uploading certificates in the user portal on a desktop computer
Device users can upload a certificate in the user portal on a desktop computer (available only if at least one userprovided certificate enrollment setting has been created).

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 369

Viewing, replacing, and deleting certificates in the user portal

Procedure
1. Go to https://<Core_Server_FQDN>/user.
2. Click on the device user’s name in the top right corner.
3. Click on Settings in the drop down menu.

FIGURE 26. USER PROVIDED CERTIFICATE MANAGEMENT

4. Click Upload New Certificate.
5. In the Configuration field, select a value from the drop-down list that corresponds with how you want to
use the certificate.
NOTE: If you select a configuration for which you have already uploaded a certificate, thepreviously uploaded certificate will be replaced.
6. Click Browse next to the User-Provided Certificate File field.
7. Select a PKCS 12 file to upload. You can use an alias or "friendly name" for the files.
8. If a Password field displays, enter the password of the certificate’s private key.

Viewing, replacing, and deleting certificates in the user portal
Device users can view, replace, or delete certificates in the user portal.
Procedure
1. Go to https://<Core_Server_FQDN>/user.
2. Click on the device user’s name in the top right corner.
3. Click on Settings in the drop down menu.
The User-Provided Certificate Management page appears.
4. To view information about an uploaded certificate, click the “i” next to the certificate.
5. To replace a certificate, click the edit icon next to the certificate.
6. To delete a certificate, click the delete icon next to the certificate.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 370

When a user-provided certificate is deleted

When a user-provided certificate is deleted
The user can delete the private key from the PKCS 12 file, and password if provided, from the Core file systemusing the user portal. A web services API is also available to delete them. Whether you want the private key andpassword deleted from Core depends on your security requirements.
WARNING: This action means that the certificate and private key in the PKCS 12 file (and password if
provided) are still available and usable on existing devices that already had received themfrom Core. Because the private key was deleted from the Core file system, the certificate is
not available to newly registered devices or to re-provisioned devices.
Because the certificate without the private key is still available on Core, you can view information about thecertificate, such as its expiration date. This information can help you manage devices still using the certificate.

Viewing the help desk contact information
If the help desk contact information is configured in the MobileIron Admin Portal, device users can view the contact
information in the self-service user portal.
For information about configuring the help desk contact information see, Configuring help desk contact information
Procedure
1. Go to https://<Core_Server_FQDN>/user.
2. Click on the device user’s name in the top right corner.
3. Click Helpdesk in the drop down menu.
The Helpdesk page appears.

FIGURE 27. HELPDESK CONTACT INFORMATION

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 371

Viewing device history logs from the self-service user portal

Viewing device history logs from the self-service user portal
Mobile@Work users can access their audit/device history logs from the self-service user portal. From the user
portal Welcome drop-down menu, select View Activity. The device activity page opens, displaying search tools
and a scrolling table of log entries. Users can access this page from their laptop and mobile devices.
Procedure
1. From the user portal Welcome drop-down menu, select View Activity.

FIGURE 28. SELECT VIEW ACTIVITY FROM THE WELCOME MENU

2. The Device Activity page opens, displaying search tools and a scrolling table of log entries.

FIGURE 29. USER DEVICE LOGS FROM SELF-SERVICE USER PORTAL

Users can access this page from their laptop and mobile devices.

MobileIron Core 11.0.0.0 Device Management Guide for Windows Devices| 372